artifactory: Incorrect Authorization (CVE-2026-42016)

What is affected, what to do

JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope.

The vulnerability is being actively exploited; treat it as a priority. Update JFrog Artifactory to version 7.133.11. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• JFrog Artifactory lt *..7.133.11

Fixed in

• JFrog Artifactory 7.133.11

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Patch now: Upgrade every self-hosted JFrog Artifactory instance to 7.133.11 or later. In HA clusters, upgrade every node, not just the primary. Confirm the running version via GET /artifactory/api/system/version.
   • Cut exposure: If Artifactory is reachable from the internet or partner networks (typically router port 8082, legacy port 8081, or a reverse proxy on 443), restrict access to known CI runners, VPN ranges and admin jump hosts until patched.
   • Revoke and reissue tokens: Inventory all scoped access tokens, identity tokens and API keys, including read-only, project, pipeline and third-party integration tokens. Revoke long-lived tokens and any token of unknown origin. The flaw checks only signature and issuer, not scope, so any valid token is effectively a potential admin credential.
   • Start a compromise assessment: Review admin users, groups, permission targets, repository configuration and system configuration for unauthorised changes since the earliest possible exposure. Prioritise newly created admin accounts and admin tokens.
   • Verify supply-chain integrity: Compare artefacts uploaded or overwritten after any suspicious privilege change against CI build provenance and checksums. Quarantine affected releases until their integrity is confirmed.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: Allow access only from defined build networks, developer VLANs via VPN and admin networks. At the reverse proxy, restrict the admin surface (/artifactory/api/security/*, /artifactory/api/system/*, /access/api/v1/*) to admin jump hosts.
   • WAF / reverse-proxy rule: Permit write methods (POST/PUT/DELETE/PATCH) on /access/api/v1/tokens, /artifactory/api/security/users, /artifactory/api/v2/security/permissions and /artifactory/api/system/configuration only from admin source IPs. Return 403 to everything else and log the event.
   • IAM / least privilege: Sharply shorten token lifetimes, allow refresh only for dedicated service accounts, and keep the number of admins to a minimum. For CI pipelines, prefer short-lived OIDC-based tokens over static secrets where your platform supports it.
   • Configuration hardening: Disable anonymous access unless it is genuinely required. Remove unused integrations and federation links. Check whether tokens from other JPD instances are trusted (Circle of Trust) and minimise those trust relationships until patched.
   • Signed artefacts: Allow downstream deployments only with verified signatures (e.g. Cosign/GPG verification in the pipeline). This limits blast radius if Artifactory itself is compromised.
3. 03

   Runbook step 3

   Detection rules

   • Access audit log (access-security-audit.log): Alert on token creation, user creation and group or permission changes initiated by non-admin subjects or service accounts. SPL sketch: index=artifactory source=*access-security-audit.log (action=*CREATE* OR action=*UPDATE*) (entity=*token* OR entity=*user* OR entity=*group*) NOT user IN (admin_allowlist)
   • Request log (artifactory-request.log / access-request.log): Look for successful (2xx) calls to privileged endpoints by tokens whose subject normally only reads or deploys. KQL sketch: ArtifactoryRequest | where Url has_any ("/api/security/","/api/system/configuration","/access/api/v1/tokens") and StatusCode between (200 .. 299) and User !in (AdminList)
   • Service-account baseline deviation: Flag CI tokens that suddenly hit admin APIs, create or delete repositories, or appear from a new source IP or ASN. Implement as a Sigma rule with logsource: product: artifactory and selection: user|startswith: 'svc-' + uri|contains: '/api/security/'.
   • Artefact tampering: Watch for overwrites of existing release versions (PUT to an already-existing path), bulk downloads (exfiltration of proprietary code), or uploads from outside CI source IPs. On the network side, use Zeek/Suricata to spot unusually large outbound transfers from the Artifactory host.
   • Persistence: Watch for new admin tokens with very long or unlimited expiry, new users with the admin flag, or new webhooks and replication targets pointing to external URLs.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope.

Source: BSI WID Portal

Vendors and products

• JFrog JFrog Artifactory

Weakness classes (CWE)

• CWE-863Incorrect Authorization

  Class

  The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

  Entry at MITRE CWE-863

References & sources

• docs.jfrog.comreleases/docs/jfrog-security-advisoriesVendor advisory, Vendor advisory
• docs.jfrog.comreleases/docs/artifactory-self-managed-releasesVendor advisory, Release notes
• wiz.ioblog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2…Third-party advisory, Third-party advisory
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42016government-resource, US government resource
• pwn.watchpwn.watch: JFrog Artifactory: JFrog Artifactory Incorrect Authorization Vulnerabilitypwn-watch
• NVD (NIST)NVD: CVE-2026-42016pwn-watch
• NVD (NIST)NVD: CVE-2026-42018pwn-watch
• cisa.govCISA Known Exploited Vulnerabilities Catalogpwn-watch

Changes to this CVE

Who changed this CVE and when: NVD (analysis, affected products, CVSS), the CVE publisher (CNA) and additional providers such as CISA (ADP).

1. 12.09.2026Record modifiedCISA ADP

   CISA assessment (SSVC): exploitation: active, automatable: no

   Show the original change

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   SSVC assessment	changed	{"id":"CVE-2026-42016","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"no"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-09-11T18:50:46.942762Z"}	{"id":"CVE-2026-42016","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"no"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-09-11T00:00:00+00:00"}

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

2. 11.09.2026NVD analysis modifiedNVD

   New references:

   • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42016
   • https://www.wiz.io/blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201
   Show 2 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Reference type	added	—	CISA-ADP: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42016 Types: US Government Resource
   Reference type	added	—	CISA-ADP: https://www.wiz.io/blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201 Types: Third Party Advisory

   Source identifier: nvd@nist.gov

3. 11.09.2026Record modifiedCISA ADP

   CISA assessment (SSVC): exploitation: active, automatable: no

   New references:

   • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42016
   • https://www.wiz.io/blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201
   Show 3 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Reference	added	—	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42016
   Reference	added	—	https://www.wiz.io/blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201
   SSVC assessment	changed	{"id":"CVE-2026-42016","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-09-11T10:15:28.944933Z"}	{"id":"CVE-2026-42016","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"no"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-09-11T18:50:46.942762Z"}

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

4. 11.09.2026CISA KEV entry updated9119a7d8…

   4 individual changes: Date Added, Due Date, Required Action, Vulnerability Name

   Show 4 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Date Added	added	—	2026-09-11
   Due Date	added	—	2026-09-11
   Required Action	added	—	2026-09-11
   Vulnerability Name	added	—	2026-09-11

   Source identifier: 9119a7d8-5eab-497f-8521-727c672e3725

5. 11.09.2026Record modifiedjfrog.com

   New references:

   • https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases
   • https://docs.jfrog.com/releases/docs/jfrog-security-advisories
   Show 6 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Reference	added	—	https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases
   Reference	added	—	https://docs.jfrog.com/releases/docs/jfrog-security-advisories
   Reference	removed	https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases	—
   Reference	removed	https://docs.jfrog.com/releases/docs/jfrog-security-advisories	—
   Reference type	removed	https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases Types: Release Notes	—
   Reference type	removed	https://docs.jfrog.com/releases/docs/jfrog-security-advisories Types: Vendor Advisory	—

   Source identifier: reefs@jfrog.com

One NVD translation into another language is hidden.

Linked advisories

• CISA Adds 5 Actively Exploited Artifactory, ScreenConnect, and RouterOS Flaws to KEVThe Hacker News12.09.2026