JFrog Artifactory Improper Authentication Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 11/09/2026. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| artifactory | ≥ 7.117.0, < 7.117.27≥ 7.125.0, < 7.125.19≥ 7.133.0, < 7.133.28≥ 7.146.0, < 7.146.8< 7.111.20 | 7.117.277.125.197.133.287.146.87.111.20 |
JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free