Developer Toolchain and DevSecOps Infrastructure Under Siege

Three entries this cycle target the software supply chain directly — the repositories, artifact managers, and source control systems that sit at the center of modern software delivery pipelines.

JFrog Artifactory appears twice: CVE-2026-42016 and CVE-2026-42018, both added September 11 with a September 25 deadline, offering a slightly longer runway but warranting no complacency given active exploitation. CVE-2026-42016 is an incorrect authorization flaw where token validation checks the signature and issuer but fails to enforce token scope — meaning a legitimately issued, narrowly scoped token can be weaponized for privilege escalation to broader artifact access. CVE-2026-42018 compounds this: when anonymous access is configured as disabled, Artifactory can nevertheless return an internal anonymous-user token to an unauthenticated caller, effectively nullifying the access control policy. Together, these vulnerabilities mean that an adversary needs no valid credentials to begin escalating privileges within your artifact repository. For organizations using Artifactory as part of CI/CD pipelines, the blast radius extends to package signing keys, build secrets, and dependency integrity. Audit all active tokens immediately, revoke any of unknown provenance, and verify that anonymous access is genuinely disabled at the application layer — not merely assumed to be based on configuration intent.

The GitLab path traversal (CVE-2026-85706, noted above) reinforces this theme. When source control and artifact management are simultaneously under active exploitation, the integrity of the entire build pipeline must be questioned. Teams should perform artifact provenance checks and verify the integrity of any packages built or published during the relevant exposure windows.

Internet-Facing Email Infrastructure: Critical Priority Before Week's End

Cisco Secure Email Gateway (CVE-2026-76461) was added September 14 with a September 17 deadline — three days from today. This SQL injection vulnerability in Cisco AsyncOS is particularly alarming because it is exploitable by an unauthenticated remote attacker and yields root-level command execution on the underlying operating system. Email gateways are definitionally internet-facing, process sensitive communications, and frequently hold credentials for downstream mail infrastructure. A root shell on an SEG provides an attacker with a persistent, high-trust network vantage point. Organizations must apply Cisco's patch before the deadline without exception. If patching cannot be completed by September 17, the system must be isolated or taken offline per BOD 26-04 guidance — operating an unpatched, internet-facing device with an unauthenticated RCE vulnerability after the federal deadline constitutes a compliance failure with potential reporting obligations. Review mail flow logs for anomalous relay behavior and unexpected process execution from the SEG host going back at least 30 days.

Analyst Note

This cycle's KEV additions are unusually dense with authentication bypass and privilege escalation pairs — MikroTik, JFrog, and ConnectWise each contribute vulnerabilities that chain naturally. Defenders should evaluate these not as isolated patch tickets but as compound attack paths. Prioritization should reflect internet exposure, supply-chain position, and whether the affected system holds credentials or secrets that grant lateral movement opportunity.

Sources: CISA KEV Catalog · CISA BOD 26-04 · Cisco Security Advisory — AsyncOS SEG · JFrog Security Advisories · ConnectWise Security Bulletins · GitLab Security Releases · MikroTik Security Advisories · Fortinet PSIRT Advisories