Loading story…
JFrog disclosed CVE-2026-42016, a high-severity privilege-escalation vulnerability in Artifactory Self-Hosted caused by incorrect authorization validation of user tokens. The flaw affects versions before 7.133.11 and stems from token checks that validate the signature and issuer but do not verify the token scope, allowing an authenticated user with low privileges to gain elevated access. The issue is tracked as CWE-863 and carries a CVSS v3.1 vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, indicating high confidentiality and integrity impact with no direct availability impact.
JFrog’s self-managed release documentation lists 7.133.11 as the fixed version for affected deployments, and organizations running on-premises Artifactory are expected to prioritize upgrades. Because exploitation requires only valid low-privilege access and no user interaction, the vulnerability raises the risk of unauthorized access to repositories, artifacts, and administrative functions in environments that have not yet patched.
Get the actors, campaigns, and ATT&CK mapping behind it.
1 event from the most recent confirmed update back to the earliest known activity.
A new vulnerability, CVE-2026-42016, was recorded on July 27, 2026 for JFrog Artifactory Self Hosted. The flaw affects versions before 7.133.11 and allows privilege escalation because token validation checks the signature and issuer but not the token scope.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
JFrog disclosed **CVE-2026-66014**, a high-severity vulnerability in **Artifactory** caused by improper authentication in internal request processing. The flaw, classified as **`CWE-287`**, can allow an authenticated attacker with low privileges to bypass intended authorization boundaries and escalate privileges under specific conditions. The issue carries a **CVSS v3.1 score of 8.8** with vector **`AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`**, indicating high potential impact on confidentiality, integrity, and availability. Multiple Artifactory version ranges are affected, and JFrog has published release and security advisory information identifying remediated versions outside those ranges. The CVE record credits **Amy Burnett of OpenAI** with reporting the issue, and organizations running Artifactory are being directed to review JFrog’s advisory and upgrade guidance to prevent privilege escalation through the vulnerable internal request handling path.
Jul 29, 2026
JFrog disclosed **CVE-2026-66015**, a high-severity authorization flaw in the JFrog Platform that can let an authenticated user escalate privileges and obtain temporary platform administrator access under certain admin-provisioned account conditions. The issue is classified as **CWE-269: Improper Privilege Management** and carries a **CVSS v3.1 score of 7.2**. The vulnerability affects **JFrog Artifactory** versions `7.146.0` through before `7.146.34` and `7.161.0` through before `7.161.15`, according to the CVE record and JFrog's security advisories. Organizations running affected releases should review JFrog's advisory guidance and prioritize upgrades to fixed versions to prevent authenticated privilege escalation within the platform.
Jul 29, 2026
Attackers are actively exploiting **CVE-2026-82329**, a critical authentication-bypass vulnerability in JFrog Artifactory, to mint administrative access tokens on exposed vulnerable instances. Under the default configuration, the flaw allows an unauthenticated network attacker to obtain administrative privileges and affects multiple Artifactory release branches. JFrog released fixes on August 28; its cloud-hosted instances were already patched, but self-hosted customers must upgrade to a fixed Artifactory release immediately. WatchTowr reported exploitation within days of disclosure. The vulnerability was not yet listed in CISA's Known Exploited Vulnerabilities catalog, and is distinct from the previously patched Artifactory flaws connected to the OpenAI-Hugging Face testing-environment escape incident.
Sep 4, 2026