JFrog Artifactory Incorrect Authorization Vulnerability
JFrog Artifactory validates token signature and issuer but not scope, creating a privilege escalation path. CVSS 8.1 (high), CISA KEV deadline September 25, 2026.
- Vendor
- JFrog
- Product
- Artifactory
- CVSS
- 8.1
- EPSS (exploit probability)
- 8.6%
- Status
- kev
- CISA patch-by (BOD 22-01)
- Published
Is CVE-2026-42016 being exploited?
Yes. CISA added CVE-2026-42016 to its Known Exploited Vulnerabilities catalog on . CISA only lists a CVE when it has reliable evidence of exploitation in the wild.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 8.6% (scored October 14, 2026).
- CISA KEV[ LISTED ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-05. Full cross-catalog view: /kev-comparison
CVE-2026-42016 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
What to do
US federal civilian agencies must remediate by (14 days after listing) under BOD 22-01. Everyone else: that deadline is a sensible upper bound, not a target. Vendor guidance and the NVD record are linked under Source above.
JFrog Artifactory validates a token’s signature and issuer but not its scope. An attacker who obtains a valid token, including one returned by the related anonymous-token flaw CVE-2026-42018, can present it with an elevated scope and gain unauthorized privileges.
CISA added CVE-2026-42016 to its Known Exploited Vulnerabilities catalog on September 11, 2026. Federal agencies must remediate by September 25, 2026. The JFrog advisory and NVD entry have version and patch details. Both Artifactory CVEs are being actively chained in ongoing attacks against self-managed Artifactory instances. The federal deadline is not the useful planning horizon for anyone running Artifactory on the open internet.
Other JFrog Artifactory CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-42018 JFrog Artifactory Improper Authentication Vulnerabilitywrite-up | [ HIGH ] | 7.5 | 10.0% | |
| CVE-2026-82329 JFrog Artifactory Default Authentication Weakness Grants Admin Accesswrite-up | [ CRITICAL ] | 9.8 | 14.4% | |
| CVE-2026-66384 JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability | [ MEDIUM ] | 5.3 | 0.7% |
