ai-security
Your model registry runs on the same software CISA just flagged as under attack
CISA added five actively exploited flaws in JFrog Artifactory, ConnectWise ScreenConnect and MikroTik RouterOS to its known-exploited list this month. Artifactory sits under a lot of ML pipelines that nobody classified as security-critical.
On 12 September, CISA added five actively exploited vulnerabilities affecting JFrog Artifactory, ConnectWise ScreenConnect and MikroTik RouterOS to its Known Exploited Vulnerabilities catalogue, according to The Hacker News. One of them, an incorrect-authorization flaw in Artifactory tracked as CVE-2026-42016, carries a CVSS score of 8.1.
Why Artifactory is on this list at all
Artifactory is best known as a generic package repository, and most security teams that inventory it think of it as developer infrastructure: a place where Java or npm packages get cached. In machine learning pipelines it plays a second, less-tracked role, as the artifact store for trained model weights, container images and training data snapshots. Teams already running Artifactory for software builds extend it to cover ML artifacts rather than standing up a separate model registry. That second role rarely appears in the same risk register as the first.
The blind spot this creates
A vulnerability in a package repository gets triaged by whoever owns software supply-chain security. A model registry compromise gets triaged, if it is triaged at all, by whoever owns ML infrastructure. When the same Artifactory instance is both, an actively exploited authorization bug can sit unpatched past the point where the software security team closed the ticket. Nobody on the ML side knew the same instance was in scope, and nobody on the software side knew it held model weights worth stealing or poisoning.
A CVE gets patched by whoever is watching the CVE feed. A shared artifact store has two teams who each assume the other is watching.
What changes this week
Confirm, this week, whether any Artifactory instance in your environment stores model artifacts alongside software packages, and check its patch level against CVE-2026-42016 specifically rather than assuming a general infrastructure patch cycle already covered it. If ML and platform security report through different chains, add a standing item to both teams' vulnerability review: any shared artifact store gets triaged by both, not by whichever team's naming convention the CVE happened to match.
Sources
Written by the Devence Lab research team.