CVE-2026-42016: JFrog Artifactory Incorrect Authorization Added to CISA KEV
CISA added CVE-2026-42016, an incorrect authorization flaw in JFrog Artifactory (self-hosted) before 7.133.11, to the KEV catalog on 2026-09-11. Federal due date: 2026-09-25 — patch or mitigate now.
CVE-2026-42016: JFrog Artifactory Incorrect Authorization Added to CISA KEV
TL;DR
CISA added CVE-2026-42016, an incorrect authorization flaw in JFrog Artifactory (self-hosted) versions before 7.133.11, to the Known Exploited Vulnerabilities catalog on 2026-09-11. The federal remediation due date is 2026-09-25. If you run self-hosted Artifactory, inventory instances today, apply the vendor's fix or mitigations, and verify that token scope — not just signature and issuer — is enforced.
What is this vulnerability?
- CVE ID: CVE-2026-42016
- Vendor / product: JFrog / Artifactory (self-hosted)
- Vulnerability name: JFrog Artifactory Incorrect Authorization Vulnerability
- Weakness: CWE-863 (Incorrect Authorization)
- Affected versions: Self-hosted Artifactory before 7.133.11
- Impact: Privilege escalation. The authorization check validates the token's signature and issuer but does not validate the token's scope, allowing a token to be used beyond its intended permissions.
- CISA KEV status: Yes — added 2026-09-11
- CISA due date: 2026-09-25
- Known ransomware use: Unknown per CISA
- CVSS: 8.1 (HIGH) from JFrog; 8.8 (HIGH) from NVD — both vectors are network-accessible with low attack complexity and low privileges required
- EPSS: 0.00886 (percentile ~0.576)
KEV vs CVSS vs EPSS
| Signal | What it measures | How to use it for this CVE |
|---|---|---|
| CISA KEV | Confirmed exploitation in the wild; carries a binding federal due date | Treat as your top priority. Due 2026-09-25 for federal agencies and a strong signal for all defenders to accelerate patching. |
| CVSS | Theoretical severity of the flaw (8.1 JFrog / 8.8 NVD, HIGH) | Confirms this is a serious network-reachable privilege escalation. Use it to justify emergency change windows. |
| EPSS | Modeled probability of exploitation in the next 30 days (0.00886, ~57.6th percentile) | Low relative score, but KEV membership overrides EPSS for prioritization — exploitation is already confirmed. |
Step-by-step remediation
- Inventory. Identify all self-hosted JFrog Artifactory deployments and record their exact versions. Include instances in build pipelines, air-gapped environments, and any internet-facing or partner-exposed endpoints.
- Patch or mitigate. Upgrade self-hosted Artifactory to 7.133.11 or later, following JFrog's security advisories and release notes. If an immediate upgrade is not possible, apply the mitigations in the vendor's instructions and follow CISA's BOD 26-04 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Verify. After upgrading, confirm the new version is running and that authorization decisions enforce token scope, not just signature and issuer. Review access logs for anomalous token use, unexpected privilege changes, or access from unfamiliar sources.
- Triage exposure. Evaluate each asset's internet exposure and apply CISA's Forensics Triage Requirements where applicable. Escalate any evidence of token misuse to incident response.
- Close the ticket. Document the version, patch date, verification evidence, and exposure assessment. Confirm compliance with BOD 26-04 patching guidelines and retain records for audit.
FAQ
Is CVE-2026-42016 in CISA KEV? Yes. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-09-11.
What is the CISA due date? 2026-09-25. Federal civilian agencies must remediate by that date under BOD 26-04; other organizations should treat it as an urgent deadline.
Is this vulnerability internet-facing? The CVSS vectors are network-accessible (AV:N), and Artifactory is often reachable from build systems, developer networks, and sometimes the public internet. Evaluate each asset's exposure individually and prioritize any externally reachable instance.
Is there a ransomware tie? CISA lists known ransomware use as unknown for this CVE. Absence of a confirmed ransomware link does not reduce urgency — KEV membership means exploitation has been observed.
What exactly is the flaw? The authorization check validates the token's signature and issuer but not the token's scope, enabling privilege escalation. Affected self-hosted versions are those before 7.133.11.
What is the CVSS score? JFrog rates it 8.1 (HIGH) and NVD rates it 8.8 (HIGH). Both are network-accessible with low attack complexity and low privileges required.