Incorrect authorization validation of user token in JFrog Artifactory allows Privilege Escalation

cisa required action Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

1. 2026-07-27 Published
2. 2026-09-11 CISA SSVC: exploitation active
3. 2026-09-11 Added to CISA KEV
4. 2026-09-25 CISA patch deadline

Added

59 d ago (2026-09-11)

Patch by

2026-09-25 (45 d ago)

Ransomware

Not known

Required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Vendor, product

JFrog, Artifactory

CISA name

JFrog Artifactory Incorrect Authorization Vulnerability

Exploitation

Active, exploited in the wild

Automatable

no

Technical impact

total

Assessed

59 d ago (2026-09-11)

8.64% chance of exploitation in the next 30 days, higher than 95% of all scored CVEs (FIRST EPSS, 2026-11-08).

• jfrog artifactory

Weakness

• CWE-863 Incorrect Authorization

• docs.jfrog.com /releases/docs/jfrog-security-advisories

  vendor-advisory

• docs.jfrog.com /releases/docs/artifactory-self-managed-releases

  vendor-advisory, release-notes

• wiz.io /blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201

  third-party-advisory

• cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42016

  government-resource, us-government-resource

• CVE List CVE-2026-42016
• NVD CVE-2026-42016

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.