Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-42016 |
| Alert Source | CISA KEV - Active Exploitation |
| CVE Publication Year | 2026 |
| Date Published | 2026-09-11 |
| Vendor | JFrog |
| Product | Artifactory |
| CVSS Score | 8.1 (high) |
| EPSS Score | 0.9% (percentile: 58%) |
| CISA KEV | Yes - confirmed active exploitation |
| Ransomware | Not confirmed |
| Remediation Deadline | 2026-09-25 |
Vulnerability Description
Source: CISA KEV
JFrog Artifactory contains an incorrect authorization vulnerability that leads to privilege escalation.
The cause is stated precisely: validation checks the token’s signature and issuer but not its scope. The token is therefore judged authentic — correctly so — and then accepted for operations it was never entitled to perform. Authentication works; authorization fails.
That distinction has practical consequences for risk assessment. An attacker does not need to forge a token or steal administrator credentials — it is enough to hold a legitimate token with a narrow scope. In CI/CD pipelines such tokens are handed out widely: to individual jobs, repositories and build pipelines, and they are often stored with less care than administrative credentials.
The entry appears in the CISA KEV catalog as actively exploited, and the assigned remediation deadline of 2026-09-25 has passed.
Required Actions
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 (“Prioritizing Security Updates Based on Risk”) guidance and CISA’s “Forensics Triage Requirements”. For cloud services, follow the applicable BOD 26-04 guidance; if mitigations are unavailable, discontinue use of the product.
Evaluating each asset’s internet exposure and adhering to BOD 26-04 patching guidelines remain the organisation’s responsibility.
Who Is Affected?
This vulnerability affects organisations running JFrog Artifactory.
When planning your response, account for how many narrow-scope tokens circulate in your CI/CD pipelines and where they are stored — they define the real attack surface. After patching, consider rotating tokens if you cannot be confident none has leaked. Note as well the second vulnerability from the same period, CVE-2026-42018, concerning anonymous token issuance in the same product.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
