CVE-2026-42016: JFrog Artifactory token scope bypass enables privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityCVSS 8.8 with network reachability and confirmed KEV listing including in-the-wild exploitation reports, though EPSS is modest and no ransomware use is documented.

What it is

JFrog Artifactory (Self Hosted) before 7.133.11 validates a token's signature and issuer but not its scope, so a token can be used for actions beyond what it was issued for. This is an incorrect authorization flaw that lets a low-privileged authenticated user escalate privileges within the instance.

Impact

An attacker with a valid low-privileged token gains unauthorized access to resources and actions outside the token's intended scope, with high impact to confidentiality, integrity and availability.

Attack surface

Reachable over the network via the Artifactory API or web interface using a token; the CVSS vector indicates low privileges are required and no user interaction. No unauthenticated path is described.

Exploitation

Listed in CISA KEV with a 2026-09-25 remediation due date, and a third-party advisory reference describes in-the-wild exploitation; EPSS 30-day probability is 0.00886 (57th percentile), so mass scanning is not indicated but targeted abuse is.

What to do

• Upgrade self-hosted Artifactory to 7.133.11 or later per the vendor release notes and security advisories.
• If immediate patching is not possible, restrict network access to the Artifactory instance and follow CISA BOD 26-04 guidance, including discontinuing use if no mitigation exists.
• Audit and rotate access tokens, revoking any tokens whose scope exceeds what the holder needs.
• Enforce least privilege on accounts and tokens that can reach the Artifactory API.
• Track the CISA KEV due date of 2026-09-25 and confirm remediation across all exposed instances.

Detection

• Review Artifactory audit and access logs for token-authenticated requests performing actions outside the token's expected scope or privilege level.
• Alert on privilege changes, permission grants, or administrative actions performed by low-privileged or service accounts.
• Monitor for anomalous API calls from tokens shortly after issuance or from unusual source addresses.
• Correlate Artifactory authentication events with downstream repository or configuration changes for signs of escalation.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.