Artifactory auth bypasses are now on the exploited list
September 15, 2026. From issue 6 of The Compliance Brief, one story for teams that commission penetration tests.
Issue 6 of The Compliance Brief went to subscribers on September 15, 2026. One of its 5 stories bears on exploited vulnerabilities and security testing, and they are below in short form. The full issue, with every take in full, is on traztech.ca.
Free weekly email
Get the next issue on Tuesday
One email a week: what changed in security and compliance, and what it means for teams that commission penetration tests.
Free. One email every Tuesday from Jacob Masse, and nothing else: signing up here does not add you to any other sequence. One click unsubscribes.
Source: CISA
CISA added three vulnerabilities to its Known Exploited Vulnerabilities catalogue on September 11. Two affect JFrog Artifactory, covering incorrect authorization and improper authentication, and one affects ConnectWise ScreenConnect for improper privilege management and missing authorization.
Our take, in short
Artifactory sits between your developers and your customers, so an authorization flaw there is a path to shipping someone else's code under your name. If you self-host it, this is a same-day job rather than a next-sprint job.
Read the full take on traztech.ca
Related on GetPentest
- How to get a penetration test funded
- How to vet a security or compliance firm
- How to write a penetration test scope
- Retest and remediation verification
Also in issue 6
Outside exploited vulnerabilities and security testing, but in the same email:
- Revolut gave customer data to someone posing as a government agency
- Trezor's supplier breach keeps growing, and it was never Trezor's system
- Passkey enrolment is the new phishing target
- Delaware amends its privacy and breach notification laws
Older: issue 4 All issues on GetPentest Newer: issue 7
Free weekly email
Get it every Tuesday
The next issue goes out Tuesday morning. Read it in your inbox instead of finding it here a week later.
Free. One email every Tuesday from Jacob Masse, and nothing else: signing up here does not add you to any other sequence. One click unsubscribes.