CVE-2026-42016
published 2026-07-27CVE-2026-42016: JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token…
PriorityP187high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
KEVITWEXPLOIT
CISA Known Exploited Vulnerabilitydue 2026-09-25
Exploited in the wild
EPSS
8.64%
95.1th percentile
JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| jfrog | artifactory | < 7.133.11 | 7.133.11 |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vulncheck8.8HIGH
cisa8.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
JFrog Artifactory up to 7.133.10 privileges management
vuldb·2026-09-11·CVSS 8.8
CVE-2026-42016 [HIGH] JFrog Artifactory up to 7.133.10 privileges management
A vulnerability identified as critical has been detected in JFrog Artifactory up to 7.133.10. Impacted is an unknown function. Performing a manipulation results in improper privilege management.
This vulnerability was named CVE-2026-42016. The attack may be initiated remotely. In addition, an exploit is available.
You should upgrade the affected component.
GHSA
JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope.
ghsa_unreviewed·2026-07-27
CVE-2026-42016 [HIGH] CWE-863 JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope.
JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope.
VulnCheck
JFrog Artifactory Improper Authentication
vulncheck·2026·CVSS 7.5
CVE-2026-42018 [HIGH] JFrog Artifactory Improper Authentication
JFrog Artifactory Improper Authentication
JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.
Affected: JFrog Artifactory
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://www.wiz.io/blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201
VulnCheck
JFrog Artifactory Incorrect Authorization
vulncheck·2026·CVSS 8.8
CVE-2026-42016 [HIGH] JFrog Artifactory Incorrect Authorization
JFrog Artifactory Incorrect Authorization
JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope.
Affected: JFrog Artifactory
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://www.wiz.io/blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201
CISA
JFrog Artifactory Incorrect Authorization Vulnerability
cisa·2026-09-11·CVSS 8.8
CVE-2026-42016 [HIGH] CWE-863 JFrog Artifactory Incorrect Authorization Vulnerability
Vulnerability: JFrog Artifactory Incorrect Authorization Vulnerability
Affected: JFrog Artifactory
JFrog Artifactory contains an incorrect authorization vulnerability that allows leads to privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope.
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guide
No detection rules found.
Nuclei
JFrog Artifactory - Anonymous Token Disclosure via Trailing Slash Auth Bypass
nuclei·CVSS 7.5
CVE-2026-42018 [HIGH] JFrog Artifactory - Anonymous Token Disclosure via Trailing Slash Auth Bypass
JFrog Artifactory - Anonymous Token Disclosure via Trailing Slash Auth Bypass
JFrog Artifactory contains an information disclosure caused by returning an internal anonymous-user token to unauthenticated callers when anonymous access is disabled, letting unauthenticated attackers access sensitive resources. The exploit requires anonymous access to be disabled.
Template:
id: CVE-2026-42018
info:
name: JFrog Artifactory - Anonymous Token Disclosure via Trailing Slash Auth Bypass
author: theamanrawat
severity: high
description: |
JFrog Artifactory contains an information disclosure caused by returning an internal anonymous-user token to unauthenticated callers when anonymous access is disabled, letting unauthenticated attackers access sensitive resources. The exploit requires anonymous acc
Hackernews
⚡ Weekly Recap: Rogue AI Agents, WeChat Worm, PaperCut Attacks, AI Espionage, and Rootkits
blogs_hackernews·2026-09-14
CVE-2026-85046 ⚡ Weekly Recap: Rogue AI Agents, WeChat Worm, PaperCut Attacks, AI Espionage, and Rootkits
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: Rogue AI Agents, WeChat Worm, PaperCut Attacks, AI Espionage, and Rootkits
AI keeps showing up in the wrong places. Attackers are using it to speed up exploits, test defenses, and automate more of the job. Some models are also crossing lines on their own. That is not a great combination.
The rest of the week is more familiar: old bugs still working, fresh exploit chains, exposed systems, weak defaults, and simple paths that should have been harder to abuse. A few of these stories are clever. Most are just easy.
Here’s what mattered this week.
## ⚡ Threat of the Week
OpenAI Agents Behind May 2026 Attack o
Hackernews
CISA Adds 5 Actively Exploited Artifactory, ScreenConnect, and RouterOS Flaws to KEV
blogs_hackernews·2026-09-12·CVSS 8.8
CVE-2026-42016 [HIGH] CISA Adds 5 Actively Exploited Artifactory, ScreenConnect, and RouterOS Flaws to KEV
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## CISA Adds 5 Actively Exploited Artifactory, ScreenConnect, and RouterOS Flaws to KEV
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added five security flaws impacting JFrog Artifactory, ConnectWise ScreenConnect , and MikroTik RouterOS to its Known Exploited Vulnerabilities ( KEV ) catalog, following reports of active exploitation in the wild.
Details of the vulnerabilities are as follows -
CVE-2026-42016 (CVSS score: 8.1) - An incorrect authorization vulnerability in JFrog Artifactory that could lead to privilege escalation due to a validation check of the token signature/issuer and not the token's s
Hackernews
Attackers Chain JFrog Artifactory Flaws to Gain Admin Control and Plant Backdoors
blogs_hackernews·2026-09-11·CVSS 8.8
CVE-2026-42018 [HIGH] Attackers Chain JFrog Artifactory Flaws to Gain Admin Control and Plant Backdoors
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Attackers Chain JFrog Artifactory Flaws to Gain Admin Control and Plant Backdoors
Attackers have chained two flaws in JFrog Artifactory , the repository that software build pipelines pull from, to take administrator control of self-hosted servers and plant backdoors, cloud security company Wiz said in a report.
Wiz saw the attacks between August 15 and September 8. JFrog had fixed both flaws before then, so only servers that had not been updated were open to them.
Neither flaw gives administrator control on its own.
CVE-2026-42018 makes Artifactory hand an internal anonymous-user token to a caller who has not logged in, ev
Wiz
Artifactory Under Attack: In-the-Wild Exploitation of CVE-2026-42016, CVE-2026-42018 & CVE-2026-82329
blogs_wiz·2026-09-10·CVSS 8.8
CVE-2026-42016 [HIGH] Artifactory Under Attack: In-the-Wild Exploitation of CVE-2026-42016, CVE-2026-42018 & CVE-2026-82329
Wiz Research has identified active, in-the-wild exploitation of three critical and high-severity vulnerabilities affecting JFrog Artifactory: CVE-2026-42016, CVE-2026-42018, and CVE-2026-82329. Attackers are chaining these vulnerabilities to bypass authentication, escalate privileges, and gain administrative control over vulnerable Artifactory instances. Observed post-exploitation activity includes the creation of persistent administrator accounts, the deployment of malicious Groovy plugins for code execution, and the installation of Rust-based backdoors to establish persistence. This blogpost provides an analysis of the exploitation patterns observed, the impact on affected organizations, and actionable guidance for security teams to detect and remediate these threats.
We will continue to
https://docs.jfrog.com/releases/docs/artifactory-self-managed-releaseshttps://docs.jfrog.com/releases/docs/jfrog-security-advisorieshttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42016https://www.wiz.io/blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201
2026-07-27
Published
2026-09-11
Added to CISA KEV
Exploited in the wild