CVE-2026-42016KEV · OVERDUECWE-863broken-access-control

JFrog Artifactory Incorrect Authorization Vulnerability

High · published July 28, 2026

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 8.1. It is confirmed in active exploitation. It sits in the 95.1th percentile for exploit probability.

28
days past CISA
deadline
CVSS v3.1
8.1
EPSS
9%
Percentile
95.1
In the wild
Confirmed
What it is

JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.08643 · 95.1th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-07-28T00:16Z
KEV added
2026-09-11 · due 2026-09-25
Affected products (1)
ProductVersionsFixed in
jfrog/artifactory< 7.133.117.133.11
References (4)
https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases · [email protected]https://docs.jfrog.com/releases/docs/jfrog-security-advisories · [email protected]https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42016 · 134c704f-9b21-4f2e-91b3-4a467353bcc0https://www.wiz.io/blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 27 JUL 19:20Z
    Incorrect authorization validation of user token in JFrog Artifactory allows Privilege Escalation
    cvelistv5