JFrog Artifactory Incorrect Authorization Vulnerability

HIGH 8.8EXPLOITED (CISA KEV)CVE-2026-42016 · Published 27/07/2026 · updated 24/10/2026

JFrog Artifactory Incorrect Authorization Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 11/09/2026. Patch affected systems as an emergency.

Package	Affected versions	Patched versions
artifactory jfrog	`< 7.133.11`	`7.133.11`

Description

JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope.

References

docs.jfrog.com/releases/docs/artifactory-self-managed-releases · Release Notes
docs.jfrog.com/releases/docs/jfrog-security-advisories · Vendor Advisory
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
wiz.io/blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201 · Third Party Advisory
CISA KEV · CVE-2026-42016

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free