CVE-2026-42016: listed in the CISA KEV catalog

CVE-2026-42016 · CVSS 8.1 HIGH · EPSS 9% · KEV 2026-09-11 · patch available

JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope.

Is CVE-2026-42016 exploited?

• Listed in the CISA KEV catalog on 2026-09-11.
• Federal remediation due 2026-09-25.
• Past that date by 34 days.
• EPSS puts exploitation in the next 30 days at 9%.
• Public exploit code: none found in monitored sources.

Which products and versions are affected?

• jfrog · artifactory · >= 0, < 7.133.11

Is there a patch?

Yes. Update to one of these or later:

From jfrog's CVE record · jfrog advisory

What PlainSec published about CVE-2026-42016

• Wiz finds Artifactory admin takeover in the wild (2026-09-17)
• Artifactory chaining gave attackers admin backdoors (2026-09-09)
• Artifactory fix set grows, but the breach path is still unclear (2026-07-28)

Primary sources

• NVD record
• CISA KEV catalog
• jfrog advisory

KEV and EPSS are re-checked daily. Record last updated 2026-09-24.