high

CVE-2026-42016

JFrog Artifactory (self-hosted) privilege escalation - access tokens are validated on signature and issuer but never on SCOPE (CISA KEV, exploited in the wild)

Severity: high
Affected product: JFrog Artifactory
Affected versions: JFrog Artifactory < 7.133.11
Fixed in: JFrog Artifactory 7.133.11
Detection basis: Component version range
Shipped rule: JFrog Artifactory: JFrog Artifactory (self-hosted) privilege escalation - access tokens are validated on signature and issuer but never on SCOPE (CISA KEV, exploited in the wild)
Added to NewScan: 2026-09-14
Detected by: NewScan — free, self-hosted

How NewScan reports it

COMPONENT VERSION RANGE

NewScan fingerprints JFrog Artifactory from its response and reports this CVE when the detected version falls inside the affected range below.

References

NVD — CVE-2026-42016 ↗
CVE Record ↗

Scan for this yourself — local, in-band scanning is free.

Get NewScan (FREE) →

Review the measured benchmark, then use the verified remediation process.