CVE-2026-42016: JFrog Artifactory Incorrect Authorization Added to CISA KEV
CISA added CVE-2026-42016, an incorrect authorization flaw in self-hosted JFrog Artifactory before 7.133.11, to the KEV catalog on 2026-09-11. The federal due date is 2026-09-25 — patch or mitigate now.
CVE-2026-42016: JFrog Artifactory Incorrect Authorization Added to CISA KEV
TL;DR
CISA added CVE-2026-42016, an incorrect authorization flaw in JFrog Artifactory (self-hosted) versions before 7.133.11, to the Known Exploited Vulnerabilities catalog on 2026-09-11. The federal remediation due date is 2026-09-25. The flaw is a privilege escalation: the authorization check validates the token's signature and issuer but does not validate the token's scope, so a token can be used beyond its intended permissions. If you run self-hosted Artifactory, inventory instances today, apply the vendor's fix or mitigations, and verify that token scope — not just signature and issuer — is enforced.
What this is
CVE-2026-42016 is an incorrect authorization vulnerability in JFrog Artifactory (self-hosted), tracked as CWE-863. Affected versions are self-hosted Artifactory before 7.133.11. The impact is privilege escalation: the authorization check validates the token's signature and issuer but does not validate the token's scope, allowing a token to be used beyond its intended permissions.
JFrog rates the CVSS at 8.1 (HIGH); NVD rates it 8.8 (HIGH). Both vectors are network-accessible with low attack complexity and low privileges required. EPSS is 0.00886 (percentile ~0.576). CISA lists known ransomware use as unknown.
Why it matters
CISA added this CVE to the KEV catalog on 2026-09-11, which means exploitation has been confirmed in the wild and carries a binding federal due date of 2026-09-25 under BOD 26-04. For federal civilian agencies that date is mandatory; for everyone else it is a strong signal to accelerate patching.
The CVSS vectors are network-accessible (AV:N), and Artifactory is often reachable from build systems, developer networks, and sometimes the public internet. Because the flaw is a privilege escalation driven by unenforced token scope, a token that should be limited can be used beyond its intended permissions — which makes anomalous token use the thing to hunt for.
EPSS is low in relative terms, but KEV membership overrides EPSS for prioritization: exploitation is already confirmed.
How it works
The authorization check validates the token's signature and issuer but does not validate the token's scope. That gap allows a token to be used beyond its intended permissions, producing privilege escalation. Affected self-hosted versions are those before 7.133.11.
Detection and response
Hypothesis: a token issued with a narrow scope is being accepted for actions outside that scope on a self-hosted Artifactory instance running a version before 7.133.11.
Evidence that confirms or rejects it: the instance's exact version (before 7.133.11 is affected), whether the asset is internet-facing or reachable from build systems and developer networks, and access-log entries showing anomalous token use, unexpected privilege changes, or access from unfamiliar sources. After upgrading, confirm the new version is running and that authorization decisions enforce token scope, not just signature and issuer. Escalate any evidence of token misuse to incident response.
What to do
- Inventory. Identify all self-hosted JFrog Artifactory deployments and record their exact versions. Include instances in build pipelines, air-gapped environments, and any internet-facing or partner-exposed endpoints.
- Patch or mitigate. Upgrade self-hosted Artifactory to 7.133.11 or later, following JFrog's security advisories and release notes. If an immediate upgrade is not possible, apply the mitigations in the vendor's instructions and follow CISA's BOD 26-04 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Verify. After upgrading, confirm the new version is running and that authorization decisions enforce token scope, not just signature and issuer. Review access logs for anomalous token use, unexpected privilege changes, or access from unfamiliar sources.
- Triage exposure. Evaluate each asset's internet exposure and apply CISA's Forensics Triage Requirements where applicable. Escalate any evidence of token misuse to incident response.
- Close the ticket. Document the version, patch date, verification evidence, and exposure assessment. Confirm compliance with BOD 26-04 patching guidelines and retain records for audit.
FAQ
Is CVE-2026-42016 in CISA KEV? Yes. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-09-11.
What is the CISA due date? 2026-09-25. Federal civilian agencies must remediate by that date under BOD 26-04; other organizations should treat it as an urgent deadline.
Is this vulnerability internet-facing? The CVSS vectors are network-accessible (AV:N), and Artifactory is often reachable from build systems, developer networks, and sometimes the public internet. Evaluate each asset's exposure individually and prioritize any externally reachable instance.
Is there a ransomware tie? CISA lists known ransomware use as unknown for this CVE. Absence of a confirmed ransomware link does not reduce urgency — KEV membership means exploitation has been observed.
What exactly is the flaw? The authorization check validates the token's signature and issuer but not the token's scope, enabling privilege escalation. Affected self-hosted versions are those before 7.133.11.
What is the CVSS score? JFrog rates it 8.1 (HIGH) and NVD rates it 8.8 (HIGH). Both are network-accessible with low attack complexity and low privileges required.