CISA Adds Critical JFrog Artifactory Flaws to KEV Amid Active Supply Chain Exploitation Chains

The Cybersecurity and Infrastructure Security Agency (CISA) has formally added two security vulnerabilities impacting JFrog Artifactory—CVE-2026-42016 and CVE-2026-42018—to its Known Exploited Vulnerabilities (KEV) catalog following active weaponization in the wild. Attackers have been observed chaining these authorization and improper authentication flaws alongside CVE-2026-82329 to bypass access controls, escalate to administrative privileges, and deploy persistent backdoors across targeted self-hosted instances. Artifact repositories and registries serve as the crown jewels of modern engineering environments, functioning as the central distribution hub for proprietary binaries, third-party packages, and container images. When attackers gain unauthenticated or unauthorized control of Artifactory, the downstream consequences compromise the entire software supply chain. Threat actors can poison built artifacts, exfiltrate intellectual property, or use repository administrative access as a staging ground to pivot into production cloud workloads and enterprise CI/CD automation. This development aligns with an aggressive broader shift in threat actor methodology: moving away from attacking hardened production perimeters and instead targeting internal software delivery pipelines. As organizations adopt DevSecOps tooling and automated build workflows, developer platforms often maintain high privileges and broad network reach while receiving less stringent perimeter auditing. Chaining multiple mid-to-high severity flaws—such as token validation failures and anonymous user token leakage—demonstrates that adversaries do not rely solely on single zero-day remote code execution bugs, but rather compose logic flaws across authentication surfaces to achieve complete system takeover. For security practitioners, patching self-hosted Artifactory instances must take immediate priority ahead of the federal mandate deadlines. Security teams should audit active repository tokens, verify that anonymous access configurations do not inadvertently leak credentials, and inspect server access logs for anomalous admin creation or unrecognized outbound network connections. Additionally, organizations should place artifact management consoles behind zero-trust network access (ZTNA) or private enterprise overlays rather than exposing administrative endpoints directly to internal or public networks.