CISA added CVE-2026-42016 to the Known Exploited Vulnerabilities catalog on 2026-09-11, confirming in-the-wild exploitation of a privilege escalation flaw in self-hosted JFrog Artifactory.
What Is It
CVE-2026-42016 is an incorrect authorization vulnerability (CWE-863) in JFrog Artifactory. The flaw stems from a token validation check that verifies the token's signature and issuer but not the token's scope. An attacker holding a validly signed token can therefore use it outside its intended scope, resulting in privilege escalation.
NVD assigns a primary CVSS 3.1 base score of 8.8 (HIGH), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The vendor-supplied secondary score is 8.1 (HIGH) with the same exploitability profile but no availability impact. Both agree the attack is network-reachable, low-complexity, requires only low privileges, and needs no user interaction.
Why It Matters
CISA's SSVC assessment marks exploitation as active with total technical impact, though it rates the vulnerability as not automatable. The KEV entry lists known ransomware campaign use as "Unknown."
Artifactory is a binary and artifact repository that commonly sits at the center of software build and release pipelines. Low-privilege access plus scope-blind token validation means an authenticated user or a leaked narrow-scope token can be leveraged into broader control over stored artifacts; high confidentiality and integrity impact per both CVSS assessments.
What's Vulnerable
JFrog Artifactory (Self Hosted), all versions before 7.133.11. The affected CPE is cpe:2.3:a:jfrog:artifactory:*:*:*:*:*:-:*:* with versionEndExcluding 7.133.11.
Patch Status
Fixed in Artifactory 7.133.11 and later.
CISA's required action: apply mitigations in accordance with vendor instructions, ensuring compliance with BOD 26-04 "Prioritizing Security Updates Based on Risk." For cloud services, follow applicable BOD 26-04 guidance, or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure. Due date: 2026-09-25. The KEV entry flags forensic triage as not required ("No"), so CISA's Forensics Triage Requirements do not apply to this entry.