Developer Toolchain Under Siege: JFrog Artifactory and GitLab

The software supply chain remains a primary attack surface, with three KEV entries this cycle directly targeting the artifact and repository management layer that underpins modern CI/CD pipelines.

CVE-2026-42016 and CVE-2026-42018 both affect JFrog Artifactory and carry a September 25 deadline — the furthest out in this batch, but urgency should not be underestimated given active exploitation. CVE-2026-42016 is an authorization flaw that enables privilege escalation because the platform validates a token's signature and issuer but fails to enforce token scope. An attacker with a low-privilege token can therefore impersonate higher-privilege roles. CVE-2026-42018 compounds this: even when anonymous access is explicitly disabled, a logic error causes Artifactory to return an internal anonymous-user token to unauthenticated callers, effectively defeating the access control entirely. Together, these two vulnerabilities can form a two-stage attack chain — obtaining the anonymous token, then leveraging scope validation failures to escalate. DevOps teams should immediately audit Artifactory token issuance policies, revoke and rotate all service tokens, and validate that anonymous access settings are reflected at the API layer, not just in the UI. Confirm that Artifactory is not directly internet-exposed before the September 25 deadline.

GitLab's CVE-2026-85706, addressed above for its immediate deadline, also belongs to this supply-chain conversation. Any organization running both GitLab and Artifactory in the same pipeline faces compounded exposure — attackers who exfiltrate repository secrets through GitLab can immediately leverage those credentials against an unpatched Artifactory instance.

Authorization Failures Across the Enterprise Edge: Cisco ISE, Acronis Backup, and Google Pixel

The remaining three vulnerabilities, all added September 16 with a September 19 deadline, represent the enterprise edge and endpoint layer.

CVE-2026-76460 (Cisco Identity Services Engine) is arguably the most systemically dangerous entry in this cycle. An unauthenticated remote attacker can bypass the ISE web-based management interface entirely through incorrect privileged API usage. Since ISE is the policy enforcement and network access control backbone for many federal and enterprise environments, a successful compromise could allow an attacker to alter network segmentation policy, whitelist rogue devices, or exfiltrate identity data. Restrict ISE management access to out-of-band networks immediately and apply patches before the September 19 deadline.

CVE-2026-87886 (Acronis Backup) targets the plugin for cPanel/WHM and Plesk — shared hosting and managed service environments where Acronis is widespread. Incorrect default permissions enable local privilege escalation, making this a compelling post-exploitation step following any initial access to a managed hosting node. Hosting providers and MSPs should treat this as urgent even absent a direct internet-facing attack vector.

CVE-2026-58704 (Google Pixel) rounds out the batch with a cellular modem improper authorization flaw enabling privilege escalation. Federal employees and contractors using Pixel devices for government communications should apply the September patch update before the September 19 deadline. Organizations subject to CISA's Forensics Triage Requirements should also ensure Pixel endpoints are enrolled in MDM with verified patch compliance tracking.

Operational Takeaways

Across all eight CVEs, the throughline is authorization logic failure — broken scope checks, missing authentication enforcement, incorrect permission defaults. Patching closes the door, but teams should also conduct credential rotation audits, validate that management interfaces are not internet-exposed, and review anomalous access logs in affected products for evidence of pre-patch exploitation activity consistent with BOD 26-04 forensic triage obligations.

Sources: CISA KEV Catalog · CISA BOD 26-04 · Cisco Security Advisories · JFrog Security Center · ConnectWise Security Advisories · GitLab Security Releases · Google Pixel Security Bulletins · Acronis Security Advisories