HIGHVulnerability
Verified
Global

CISA KEV: JFrog Artifactory — JFrog Artifactory Incorrect Authorization Vulnerability

·Source: CISA KEV

Updated:

Executive Summary

JFrog Artifactory contains an incorrect authorization vulnerability that allows leads to privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope.

Analysis

JFrog Artifactory contains an incorrect authorization vulnerability that allows leads to privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope. Added to CISA Known Exploited Vulnerabilities catalog on 2026-09-11. Remediation due: 2026-09-25.

Indicators of Compromise (1)

CVE (1)
CVE-2026-42016
NVDMITRE CVE
Source Attribution

Originally published by CISA KEV on Sep 11, 2026. Verified by: CISA.

Related Threats

MEDIUMVulnerabilityNEW

China-Linked Hackers Impersonate AI Experts to Target US Policy Insiders

TA419 posed as AI policymakers and economists to phish US AI policy experts' Microsoft 365 accounts

Infosecurity Magazine
MEDIUMVulnerabilityNEW

Kiteworks patches max severity code injection vulnerability

Secure file-sharing software company Kiteworks has released security updates to address 126 vulnerabilities, including a max-severity flaw affecting its Email Protection Gateway (EPG) security solution. [...]

BleepingComputer
MEDIUMVulnerabilityNEW

CloudSyncD MacOS Backdoor Hides Behind Fake Zoom Installer

CloudSyncD uses a fake Zoom installer to phish Mac passwords and launch a two-stage backdoor

Infosecurity Magazine