CVE-2026-42016: JFrog Artifactory

JFrog Artifactory contains an incorrect authorization vulnerability that leads to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope.

Vendor: JFrog
Product: Artifactory
Vulnerability: JFrog Artifactory Incorrect Authorization Vulnerability
Date added: Sep 11, 2026
CISA due date (U.S. federal agencies): Sep 25, 2026
Known ransomware campaign use: Unknown
Weakness (CWE): CWE-863

References

NVD — CVE-2026-42016
docs.jfrog.com
docs.jfrog.com
www.cisa.gov
www.cisa.gov
nvd.nist.gov

This site summarizes CISA's catalog for information only. It is not security advice — follow your vendor's guidance and official advisories.

Last updated: Oct 4, 2026 17:31 UTC · Catalog version 2026.10.02