Skip to content

48 results for “NTIA”

ListGrid
What you seeeverything
RecentOldestAddedA–Z
All types736Articles251Write-ups205Papers117Repos56Advisories48
Threads34Talks14Tools7Videos2Courses1Other1
🚨 Advisories“NTIA”Clear all
blog.railway.comadvisory🛡️ Security

Railway Security Disclosure

Railway's security disclosure of 21 October 2026 says an unauthorized third party may have accessed encrypted customer environment variables and decrypted some of them. Railway links it to a series of attacks on platform companies aimed at compromising AI inference providers, and has asked upstream providers to revoke keys. It tells all users to roll every environment variable, API key and registry credential, and it paused all deployments. The notice gives no technical details of the intrusion.

Railway
Railway security incident October 2026

Threat Intel, DevSecOps· Added 22 Oct 2026, published 21 Oct 2026

unit42.paloaltonetworks.comadvisory🛡️ Security

Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (Updated Oct 20)

Unit 42 threat brief on active exploitation of CVE-2026-0257, a PAN-OS GlobalProtect authentication bypass added to CISA KEV on May 13, 2026. It lists IP addresses, host IDs and PoC-derived client values to hunt in GlobalProtect logs. The October 2026 updates cover Qilin and Inc ransomware operators, MFA bypass, pivots to vCenter and ESXi with offline VMDK credential dumping, and management interface exposure on ports 4443 and 3879.

PAN-OSGlobalProtectVPN+3
CVE-2026-0257CVE-2023-27532Spikey Scorpius+10

Threat Intel, Blue Team & Detection, Identity & Access· Added 21 Oct 2026, published 20 Oct 2026

x.comadvisory🛡️ Security

Microsoft Threat Intelligence (@MsftSecIntel) on X

ConnectWise Cloud Backup (formerly SkyKick Backup, AppId 506e08f9-6e9a-4da4-942b-a099a03644ae) had its multitenant OAuth app compromised, per Microsoft Threat Intelligence. On 15 October 2026 the actor authenticated broadly as the service principal from 144.172.64[.]128, likely using customer-granted permissions such as Directory.ReadWrite.All, then ran Graph API reconnaissance and tried to add credentials to the service principal as a backdoor. The post lists IOCs, Defender alerts and hunting advice.

OAuthMicrosoft Entra IDMicrosoft Defender+1
ConnectWise Cloud BackupSkyKickDirectory.ReadWrite.All+2

Threat Intel, Identity & Access, Supply Chain, Blue Team & Detection· Added 20 Oct 2026, published 17 Oct 2026

watchtowr.comadvisory🛡️ Security

Frequently Asked Questions About the BeyondTrust Remote Support Arbitrary File Upload (CVE-2026-102764)

CVE-2026-102764 is an arbitrary file upload in BeyondTrust Remote Support (formerly Bomgar) caused by internal appliance components not validating message origin. Mandiant found it exploited as a zero-day in late August 2026. BeyondTrust disclosed it on 15 October 2026 and CISA added it to KEV on 16 October 2026. The FAQ covers the web shell, root escalation, credential theft, persistence, patching and compromise checks.

BeyondTrust Remote Support
CVE-2026-102764CISA KEVMandiant+4

AppSec, Threat Intel· Added 30 Oct 2026, published 16 Oct 2026

x.comadvisory🛡️ Security

Dark Web Intelligence (@DailyDarkWeb) on X

Summary of SAP's October 13, 2026 Security Patch Day (16 new notes, 4 GitHub advisories). It leads with CVE-2026-89111, a CVSS 10.0 OAuth2 SSRF in SAP Cloud SDK for Python before 0.45.2, where an attacker-controlled tenant_subdomain redirects token requests and exfiltrates client credentials. It also lists three other critical flaws: broken access control in NetWeaver Visual Composer, code injection in S/4HANA substitution/validation rules, and a missing authorization check in the Manufacturing Integration and Intelligence (XMII) Configuration Service. It notes that none are in CISA KEV and SAP reports no in-the-wild exploitation.

SAP Cloud SDK for PythonSAP NetWeaverSAP S/4HANA+3
CVE-2026-89111CVE-2026-89110CVE-2026-89107+5

AppSec, Identity & Access· Added 15 Oct 2026, published 13 Oct 2026

x.comadvisory🛡️ Security

♫Why♥Not♪ (@Python_s_) on X

Alert thread on CVE-2026-35029 (CVSS v4.0 8.7) in LiteLLM Proxy, versions before 1.83.0. A low-privilege authenticated user can bypass admin authorization on /config/update, change runtime settings, read server files, take over admin credentials and run Python through remotely loaded modules (S3/GCS-hosted). Check Point Research published a full execution chain on October 13 after the April 2026 disclosure. The post lists hunting pointers (non-admin POSTs to /config/update, env-var changes, unexpected pass-through endpoints, cloud module loading) and advises upgrading to 1.83.9 or later and rotating credentials.

LiteLLMPythonCVSS
CVE-2026-35029Check Point ResearchCWE-306

AI Security, AppSec· Published and added 13 Oct 2026

watchtowr.comadvisory🛡️ Security

Frequently Asked Questions About the Ivanti Connect Secure Authentication Bypass by Spoofing (CVE-2026-104935)

CVE-2026-104935 is an authentication bypass by spoofing in Ivanti Connect Secure. A remote attacker can forge identity signals and run arbitrary commands without credentials. CISA added it to the KEV catalog on 13 October 2026. The FAQ lists affected branches by ISA hardware (25.1.1.1, 25.1.2.2, 22.8.X), fixed versions (25.1.1.2, 25.1.3.0/25.1.3.1, 22.8R2.5), no workaround and no reliable IOCs.

Ivanti Connect SecureVPN
CVE-2026-104935CISA KEVCISA+1

Threat Intel, Blue Team & Detection· Added 30 Oct 2026, published 13 Oct 2026

x.comadvisory🛡️ Security

♫Why♥Not♪ (@Python_s_) on X

Alert on CVE-2026-106610, a critical (CVSS 9.8) incorrect privilege assignment flaw in the miniOrange OTP Verification WordPress plugin, versions 5.5.7 and earlier. Unauthenticated remote attackers can gain elevated permissions, potentially administrator, with no user interaction. Fixed in 5.5.8; no in-the-wild exploitation or public PoC verified. It advises auditing unexpected admin accounts and role changes, and warns that Patchstack's mitigation blocks legitimate requests too.

WordPressCVSS
CVE-2026-106610PatchstackminiOrange OTP Verification+1

AppSec, Identity & Access· Published and added 11 Oct 2026

cisa.govadvisory🛡️ Security

CISA AA26-281A: Chinese Government-linked Actors Combine Automated and Hands-on Hacking Tools to Steal Data

Joint FBI/CISA/NSA and allied-agency advisory on China-linked actors enabled by Integrity Technology Group (overlapping with Flax Typhoon, Ethereal Panda, Red Juliett). It details their TTPs: open-source scanners and the MicroScan exploit-script app, an XSS credential-harvesting payload dropping live700_v1.exe, EBurst password spraying against Exchange/O365, SoftEther VPN persistence, DCSync via DC.exe, and email theft via the Curlc4.txt PHP bot and the office-cli utility. It also provides IOCs, MITRE ATT&CK mappings, CVEs, incident response steps, and mitigations.

SoftEtherMicrosoft 365Active Directory+3
Integrity Technology GroupFlax TyphoonEthereal Panda+13

Threat Intel, Blue Team & Detection· Added 9 Oct 2026

x.comadvisory🛡️ Security

♫Why♥Not♪ (@Python_s_) on X

Alert summarizing Socket Threat Research's disclosure that a malicious version of the Tensorlake npm SDK (an AI-agent infrastructure package) was published with a preinstall hook delivering Shai-Hulud/ChainDrop credential-stealing malware. The payload targets GitHub, npm, AWS, Kubernetes and Vault credentials, persists via a gh-token-monitor mechanism, and spreads through compromised publishing accounts. It lists IOCs (lib/setup.mjs, lib/Math_Symbol.js) and warns to remove the persistence before revoking stolen GitHub tokens, since revocation triggers a destructive routine. Socket detected the release about 11 minutes after publication.

npmTensorlakeSocket+3
Shai-HuludChainDropgh-token-monitor+2

Supply Chain, Threat Intel· Added 11 Oct 2026, published 9 Oct 2026

endorlabs.comadvisory🛡️ Security

Tensorlake npm package compromised by Shai-Hulud in latest software supply chain attack | Blog | Endor Labs

Endor Labs documents the compromise of tensorlake@0.5.144, the official npm TypeScript SDK for Tensorlake, which shipped a Shai-Hulud worm payload via a poisoned preinstall hook (node lib/setup.mjs) after the project's main branch was altered and pushed through a legitimate, provenance-signed GitHub Actions release pipeline. The malware harvests npm, GitHub, SSH, cloud (AWS/GCP/Azure), Kubernetes/Docker and Vault credentials, uses an EtherHiding Ethereum wallet as a durable dead-drop to fetch its rotating C2 domain, and republishes itself into other packages the victim controls. The writeup includes affected package versions, file hashes, C2 indicators, and concrete remediation guidance (pin to 0.5.143, rotate credentials, disable install scripts).

npmGitHub ActionsNode.js+3
Shai-HuludEtherHiding

Supply Chain, Threat Intel· Published and added 8 Oct 2026

orca.securityadvisory🛡️ Security

Critical Atlassian Path Traversal Exposes Sensitive Files Across 8 Products

Orca Security details CVE-2026-21589 (CVSS 9.3), a critical unauthenticated path traversal flaw affecting all versions of eight Atlassian Data Center and Server products: Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, and Fisheye. Insufficient path validation lets remote attackers read arbitrary files within the web application root without authentication, and in Crowd SSO deployments this can expose plaintext credentials usable to create administrative accounts and take over the entire Atlassian ecosystem. The advisory lists fixed versions for each product and recommends WAF rules and log review for organizations unable to patch immediately.

JiraConfluenceBitbucket+3
CVE-2026-21589path traversal

AppSec, Identity & Access· Published and added 7 Oct 2026

github.comadvisory🧠 AI

MCP TypeScript SDK v2.2.0

Release notes for v2.2.0 of the official Model Context Protocol TypeScript SDK. Upgrade notes: machine-to-machine OAuth providers (ClientCredentialsProvider, PrivateKeyJwtProvider, StaticPrivateKeyJwtProvider, CrossAppAccessProvider) should now be given expectedIssuer, and fetchToken() throws AuthorizationServerMismatchError when client information is bound to a different authorization server. listTools/listPrompts/listResources/listResourceTemplates now follow nextCursor automatically, capped by listMaxPages. Fixes include CommonJS type-checking of the DPoP jose types, unhandled rejections in Client.listen(), createMcpHandler stack overflow and subscriptions/listen handling, .localhost loopback for OAuth token endpoints, and v1-to-v2 codemod comment preservation.

Model Context ProtocolTypeScriptOAuth+1

mcp· Added 1 Oct 2026

orca.securityadvisory🛡️ Security

Critical Citrix NetScaler Zero-Days Under Active Exploitation

Analysis of two CVSS 9.5 Citrix NetScaler ADC/Gateway zero-days, CVE-2026-88771 (unauthenticated RCE through improper input validation in the management interface, affecting default deployments) and CVE-2026-88772 (memory overflow in DTLS, enabled by default on VPN virtual servers). It lists six more high-severity flaws patched in advisory CTX697096, the affected and fixed versions, and the CISA KEV listing with a federal deadline of 2026-09-30. It advises checking for compromise before patching, since patching can destroy forensic evidence, and gives response steps: isolate, revoke credentials, rebuild firmware, rotate keys and certificates.

Citrix NetScalerVPN
CVE-2026-88771CVE-2026-88772CVE-2026-88773+7

Cloud & Infra, Threat Intel· Published and added 29 Sep 2026

rapid7.comadvisory🛡️ Security

Zero-Day Exploitation of Citrix NetScaler ADC and Gateway: CVE-2026-88771 and CVE-2026-88772

Rapid7 details active zero-day exploitation of two critical Citrix NetScaler ADC/Gateway RCE vulnerabilities (CVE-2026-88771, CVE-2026-88772, both CVSSv4 9.5), both added to CISA KEV on disclosure day, plus a later SAML denial-of-service zero-day (CVE-2026-88779). The post includes Rapid7 MDR's observed exploitation of CVE-2026-88771 in the wild — a command-injection payload that exfiltrates /flash/nsconfig (containing ns.conf admin credentials, SSL private keys, SSH host keys) via the publicly-served /vpn/ path, and a webshell (SHA256 hash provided) found on a compromised appliance — along with vendor patch versions and detection guidance.

Citrix NetScalerCVSS
CVE-2026-88771CVE-2026-88772CVE-2026-88779+3

Threat Intel, AppSec· Added 7 Oct 2026, published 28 Sep 2026

github.comadvisory🛡️ Security

Kong Konnect MCP server: stored prompt injection via analytics data leads to credential/data exfiltration (CVE-2026-13341)

GitHub Security Advisory (CVE-2026-13341) for Kong's mcp-konnect MCP server describes a stored prompt injection vulnerability where a remote attacker crafts malicious request metadata (e.g. User-Agent) that gets stored in Konnect analytics and later returned unsanitized to an AI assistant via MCP tools, potentially causing the agent to exfiltrate sensitive data (plugin configs, secrets, internal hostnames) to an attacker-controlled URL if the client can make outbound fetches. A related path manipulation flaw in control plane/group identifiers allowed requesting unintended Konnect API endpoints with the user's token. The v1.0.0 patch neutralizes untrusted analytics fields, validates identifiers as UUIDs, encodes path segments, and disables raw plugin config output by default.

Model Context Protocol
CVE-2026-13341GHSA-7767-3m3w-2p44path traversal+2

AI Security· Added 26 Sep 2026

nvd.nist.govadvisory🛡️ Security

CVE-2026-75130: Context7 through 2

CVE-2026-75130 describes a prompt injection flaw in Context7 (through v2.1.2), an MCP server that serves library documentation to AI coding agents. The vulnerability lies in the Custom AI Instructions feature, which fails to sanitize content before injecting it into agent context; attackers can poison these instructions so that a routine documentation lookup triggers the agent to exfiltrate credentials from environment files and delete files on the victim's machine. Researchers at Noma Security and VulnCheck published independent technical breakdowns of the attack chain.

Model Context ProtocolContext7
CVE-2026-75130

AI Security· Added 26 Sep 2026

nvd.nist.govadvisory🛡️ Security

CVE-2026-65056: mcp-webresearch 0

CVE-2026-65056 describes a server-side request forgery in the mcp-webresearch MCP server (npm package @mzxrai/mcp-webresearch, v0.1.7), scoring CVSS 4.0 8.3 HIGH. The visit_page tool only validates URL protocol and does not filter private, loopback, link-local, or cloud metadata IP ranges, so an attacker who controls the LLM-supplied URL argument (e.g. via prompt injection) can steer the server's Playwright browser to internal endpoints like cloud instance metadata services and exfiltrate sensitive internal content, including credentials, back into the model context.

Model Context ProtocolPlaywrightnpm
CVE-2026-65056CWE-918SSRF

AI Security, AppSec· Added 26 Sep 2026

nvd.nist.govadvisory🛡️ Security

CVE-2026-49291: mcp-memory-service is a semantic memory layer for AI applications

CVE-2026-49291 affects mcp-memory-service prior to version 10.65.3: its HTTP MCP JSON-RPC endpoint at /mcp only enforced OAuth 'read' scope before dispatching tools/call requests, so a client holding only read access could invoke mutating tools like store_memory and delete_memory even though the equivalent REST endpoints correctly required 'write' scope. The flaw is a classic missing-authorization bug (CWE-862) surfacing specifically in an MCP tool-dispatch layer, scored CVSS 3.1 8.1 (High) with confidentiality unaffected but integrity and availability impacted. Fixed in 10.65.3.

Model Context ProtocolOAuth
CVE-2026-49291CWE-862

AppSec, Identity & Access· Added 26 Sep 2026

nvd.nist.govadvisory🛡️ Security

CVE-2026-18655: Improper restriction of intended endpoints in the RabbitMQ broker connection tools of the Amazon MQ MCP Server (awslabs

CVE-2026-18655 describes an improper endpoint restriction flaw (CWE-923) in the RabbitMQ broker connection tools of awslabs.amazon-mq-mcp-server versions before 2.0.24. A remote unauthenticated attacker can use prompt injection introduced into the MCP client context to redirect the broker hostname to an attacker-controlled endpoint, causing Amazon MQ for RabbitMQ credentials or OAuth access tokens to be sent there; CVSS 4.0 base score 7.1 (High). Fixed in version 2.0.24, referenced via an AWS security bulletin and a GitHub security advisory (GHSA-xwj6-8x5h-hjp6).

Model Context ProtocolAWSAWS Bedrock+1
CVE-2026-18655CWE-923GHSA-xwj6-8x5h-hjp6

AI Security, Cloud & Infra· Added 26 Sep 2026

github.comadvisory🛡️ Security

"Allowed HTTP Request Domains" Restriction Bypass via AI Agents MCP Connector

n8n's AI Agents module did not enforce the "Allowed HTTP Request Domains" restriction on credentials. A member-level user with use-only access to a shared credential could point an MCP tool at an attacker-controlled URL and run the agent, so the credential secret was sent to an external server. It only affects instances with the agents module enabled via N8N_ENABLED_MODULES and a domain-restricted credential shared with a member. It is fixed in 2.28.1 and 2.27.4, and the advisory rates it High (CVSS v4 7.1).

n8nModel Context ProtocolCVSS
GHSA-h44j-f5r5-ph73credential exfiltrationauthorization bypass

AppSec, AI Security, Identity & Access· Added 26 Sep 2026

github.comadvisory🛡️ Security

DNS TOCTOU race condition causes SSRF protection bypass (`/admin/gateways/test`)

GHSA-9hgc-g3w5-67cm details a DNS TOCTOU race in IBM mcp-context-forge's /admin/gateways/test endpoint: validate_gateway_test_url() resolves and vets a hostname against private/cloud-metadata IP ranges, but the actual request is made with httpx (via ResilientHttpClient), which independently re-resolves DNS at connection time with no IP pinning. An attacker with gateways.read permission can exploit DNS rebinding (short-TTL record flipping from a public IP to 169.254.169.254) to bypass SSRF protections and reach cloud instance metadata, exfiltrating IAM credentials where IMDSv1 is enabled. The advisory notes the codebase already acknowledges the gap in two comments and a tracked TODO (ICACF-15), and recommends pinning the validated IP into the connection.

Model Context ProtocolPythoncURL
SSRFGHSA-9hgc-g3w5-67cmGHSA-m8rv-5m6m-32ff+3

AppSec· Added 26 Sep 2026

github.comadvisory🛡️ Security

CVE-2026-21852 - GitHub Advisory Database

GitHub advisory GHSA-jh7p-qr78-84p7 for Claude Code: a malicious repository could ship a project settings file setting ANTHROPIC_BASE_URL to an attacker-controlled endpoint. Claude Code made API requests during project load before the trust prompt was shown, leaking data including the user's Anthropic API key. Fixed in auto-updated versions; manual updaters should upgrade. It is CVSS v4 scored, with network attack vector and passive user interaction, and mapped to a credential-transmission weakness (insecure transmission/storage of credentials).

Claude CodeAnthropicCVSS+1
GHSA-jh7p-qr78-84p7ANTHROPIC_BASE_URLworkspace trust prompt bypass

AI Security, AppSec· Added 26 Sep 2026

ccb.belgium.beadvisory🛡️ Security

Warning: Vulnerability in Starlette framework and related frameworks like FastAPI exposes millions of servers to authentication bypass, Patch Immediately! | CCB Belgium

Belgian CCB advisory on CVE-2026-48710 ("BadHost", CVSS 6.5), an authentication bypass in Starlette versions before 1.0.1. The Host header was not validated when request.url was rebuilt, so request.url.path could differ from the routed path. Middleware and endpoints that enforce access control on request.url could therefore be bypassed. The flaw affects FastAPI, LiteLLM, vLLM, MCP servers and other Python LLM infrastructure, and may expose stored third-party credentials. The advisory recommends upgrading to 1.0.1 or later and increasing monitoring, and links to the badhost.org scanner and to the GitHub, OSTIF, X41 D-Sec and Ars Technica write-ups.

StarletteFastAPILiteLLM+3
CVE-2026-48710BadHostCCB+3

AppSec, AI Security· Added 26 Sep 2026

aws.amazon.comadvisory🛡️ Security

CVE-2026-87912 and CVE-2026-87913: Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server

AWS bulletin 2026-105-AWS discloses CVE-2026-87912 and CVE-2026-87913: the AWS Security Agent plugin (aws-agents-for-devsecops, <1.1.0) and its MCP server (<0.2.0) write scan output to a predictably-named S3 bucket (security-agent-scans-<account-id>-<region>) without verifying bucket ownership. An attacker who pre-registers that bucket name in their own account can obtain the victim's private source archive, including embedded credentials and infrastructure state. AWS recommends upgrading to 0.2.0 and manually verifying/pre-creating the scan bucket to prevent squatting.

AWSAWS Security AgentModel Context Protocol
CVE-2026-87912CVE-2026-87913

Cloud & Infra, AI Security· Added 26 Sep 2026

orca.securityadvisory🛡️ Security

WordPress “Comment2Shell” XSS-to-RCE Chain Lets Unauthenticated Attackers Compromise Servers via Malicious Comments

CVE-2026-93485 (CVSS 7.1) is a stored XSS-to-RCE chain in WordPress Core's wpautop() function (wp-includes/formatting.php), where a mismatch between comment sanitization at save time and HTML reformatting at display time lets an unauthenticated attacker inject live event handlers via a crafted comment. When a logged-in administrator views the page, the script executes and installs a malicious plugin containing a web shell, achieving full RCE. It affects WordPress Core 4.7 through 7.1.0 (essentially all installs, including block themes since Twenty Twenty-Two), and is fixed in 7.1.1 with backports down to 4.7.36; no public PoC or in-the-wild exploitation was reported at disclosure time.

WordPressPHP
CVE-2026-93485

AppSec· Published and added 22 Sep 2026

orca.securityadvisory🛡️ Security

Breaking: GitLab Critical Path Traversal Flaw Exploited in the Wild — Patch Immediately

Details CVE-2026-85706 (CVSS 10.0), an unauthenticated arbitrary file read in GitLab CE/EE's repository commits API exploitable via a crafted file.path parameter in a single POST request, requiring only that one public project exist on the instance. It also covers CVE-2026-87719 (CVSS 9.9), an authenticated insecure deserialization bug in GitLab EE's GraphQL subscription serializer reachable via Duo Chat access that leaks stored Elasticsearch/OpenSearch credentials. Both affect GitLab versions through 19.3.1; CVE-2026-85706 is under active internet-wide scanning per WatchTowr Labs and is in CISA's KEV catalog with a federal patch deadline, with fixes in GitLab 19.1.8/19.2.6/19.3.2.

GitLabCVSSElasticsearch+1
CVE-2026-85706CVE-2026-87719CISA KEV+2

AppSec, Threat Intel· Published and added 14 Sep 2026

rapid7.comadvisory🛡️ Security

CVE-2026-85706: Critical GitLab Path Traversal Exploited in the Wild

GitLab patched CVE-2026-85706, a critical (CVSS 10.0) path traversal flaw (CWE-22) in the repository commits API that lets an unauthenticated attacker read arbitrary files from self-managed GitLab CE/EE instances; CISA added it to the KEV catalog on September 11, 2026 due to active exploitation, with a remediation deadline of September 14. The same patch release fixes CVE-2026-87719, a critical insecure deserialization bug (CWE-502) letting an authenticated Duo Chat user exfiltrate Advanced Search configs and credentials via a crafted GraphQL subscription argument, plus 17 other vulnerabilities. Rapid7 recommends emergency patching and post-patch compromise checks given confirmed in-the-wild exploitation.

GitLabCVSSGraphQL+1
CVE-2026-85706CVE-2026-87719CWE-22+1

AppSec, Threat Intel· Added 7 Oct 2026, published 14 Sep 2026

horizon3.aiadvisory🛡️ Security

CVE-2026-85706: GitLab CE/EE Repository Commits API Path Traversal

CVE-2026-85706 is a CVSS 10.0 critical path traversal vulnerability in GitLab CE/EE's repository commits API, caused by improper path confinement combined with missing authentication enforcement. It allows unauthenticated, remote attackers to read arbitrary files from the GitLab server — potentially exposing credentials, secrets, tokens, SSH keys, and database credentials. Affects versions 18.7 through 19.1.7, 19.2.0-19.2.5, and 19.3.0-19.3.1; fixed in 19.1.8, 19.2.6, and 19.3.2.

GitLabCVSS
CVE-2026-85706path traversal

AppSec· Added 17 Sep 2026, published 11 Sep 2026

wiz.ioadvisory🛡️ Security

Artifactory Under Attack: In-the-Wild Exploitation of CVE-2026-42016, CVE-2026-42018 & CVE-2026-82329

Wiz Research documents active in-the-wild exploitation of three JFrog Artifactory vulnerabilities: CVE-2026-42018 (exposes an internal anonymous-user JWT via POST /access/api/v1/aws/token/), CVE-2026-42016 (token scope validation flaw allowing that JWT to be escalated to admin via POST /access/api/v1/tokens), and CVE-2026-82329 (unauthenticated admin access via POST /access/api/v1/registry/join, added to CISA KEV). Attackers chained the first two to create persistent admin accounts, deploy malicious Groovy plugins for RCE, and drop Rust-based C2 backdoors, while CVE-2026-82329 was exploited independently for configuration exfiltration, cluster join-key theft, and credential/SSH-key persistence. The post includes exact request sequences, detection signatures, affected/fixed version ranges, and remediation guidance.

JFrog ArtifactoryRust
CVE-2026-42016CVE-2026-42018CVE-2026-82329+1

AppSec, Threat Intel, Blue Team & Detection· Published and added 10 Sep 2026

Showing 30 of 48

Show more