added to CISA Known Exploited catalog
JFrog Artifactory can let a lower-privileged user gain higher permissions. That could expose or change information the account should not reach.
- Severity
- HighCVSS 3.1 · 8.1
- Fix
- Fixed in 7.133.11
- Affected versions
- before 7.133.11
- Weakness
- CWE-863Incorrect Authorization
- Exploit likelihood
- 0.27% in 30 daysEPSS, higher than 18% of known flaws
- Affects
- Artifactory
- Exploited
- Yes, in the wildListed by CISA
- CISA SSVC
- Active exploitationAutomatable: no · Technical impact: total
- EU ID
- EUVD-2026-49566ENISA vulnerability database
- Added to CISA list
- Sep 11, 2026
- Federal fix deadline
- Sep 25, 2026
How it works
- Artifactory checks a user token's signature and issuer, but not its permission scope.
- A remote user with low privileges can use this validation gap to gain higher privileges.
- The record does not describe the exact request or token details.
What to do
Check the installed JFrog Artifactory Self Hosted version and compare it with 7.133.11. versions older than 7.133.11 are within the affected range.
Update JFrog Artifactory Self Hosted to version 7.133.11 or later.
Technical details
CVE-2026-42016 is an authorization flaw in JFrog Artifactory. The token validation checks its signature and issuer, but omits its scope, enabling privilege escalation for a user with low privileges.
Severity breakdown
- Attack vector Network Requires network access to the vulnerable service
- Attack complexity Low Low complexity under the assessed conditions
- Privileges required Low Attacker needs a basic user account
- User interaction None No victim action needed
- Scope Unchanged Impact stays within the same security authority
- Confidentiality impact High Sensitive data can be exposed with serious impact
- Integrity impact High Protected data can be changed with serious impact
- Availability impact None No availability impact
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Open in FIRST.org calculatorReferences
- nvd.nist.gov · CVE-2026-42016 us government resource vdb entry
- cve.org · CVERecord vdb entry
- cvefeed.io · CVE-2026-42016 third party advisory vdb entry
- tenable.com · CVE-2026-42016 third party advisory vdb entry
- cveawg.mitre.org · CVE-2026-42016
- docs.jfrog.com · jfrog-security-advisories (docs) vendor-advisory
- docs.jfrog.com · artifactory-self-managed-releases (docs) vendor-advisory
- cybersecuritynews.com · jfrog-artifactory-vulnerabilities-actively-exploited Cyber Security News
- gbhackers.com · hackers-exploit-jfrog-artifactory-flaws GBHackers
- otx.alienvault.com · 6aa3a8516fc630e89143079a AlienVault OTX
- cisa.gov · known-exploited-vulnerabilities-catalog
- wiz.io · artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201