Skip to content
OriginalSign in

CISA KEV alertCyberSIXT

CISA Warns of Actively Exploited JFrog Artifactory Flaw

Part of the CVE-2026-42016 story · since 11 Sep

Quiet for 6 weekslast report 14 Sep8 articles5 outlets
11 Sep · SecurityOnline first5 Oct13 OctNowThis article3rd of 8
  • Fri 11 Sep, 01:30 UTC. SecurityOnline, first report. JFrog Artifactory Flaws Exploited to Seize Admin Control. Cites a CVE in CISA KEV.
  • Fri 11 Sep, 07:48 UTC. The Hacker News, its first report on the story. Attackers Chain JFrog Artifactory Flaws to Seize Admin Control. Cites a CVE in CISA KEV.
  • Fri 11 Sep, 20:32 UTC. CISA, its first report on the story. CISA Warns of Actively Exploited JFrog Artifactory Flaw. Cites a CVE in CISA KEV. This article, 3rd of 8.
  • Sat 12 Sep, 17:53 UTC. The Hacker News. CISA Flags Artifactory, ScreenConnect and RouterOS Attacks. Cites a CVE in CISA KEV.
  • Sun 13 Sep, 15:00 UTC. Security Affairs, its first report on the story. Security Weekly Roundup Covers Cisco, Chrome and Windows Attacks. Cites a CVE in CISA KEV.
  • Sun 13 Sep, 18:30 UTC. Security Affairs. Security Affairs Tracks Malware, Ransomware and Active Exploits. Cites a CVE in CISA KEV.
  • Mon 14 Sep, 09:36 UTC. SecurityWeek, its first report on the story. Hackers Exploit JFrog Artifactory Bugs to Install Persistent Backdoors. Cites a CVE in CISA KEV.
  • Mon 14 Sep, 15:26 UTC. Security Affairs. CISA Flags Artifactory, ScreenConnect and GitLab Flaws as Exploited. Cites a CVE in CISA KEV.

CISA has added CVE-2026-42016 to its Known Exploited Vulnerabilities (KEV) catalogue. The vulnerability affects JFrog Artifactory and is an incorrect authorisation flaw that can enable privilege escalation when the product validates a token’s signature and issuer but not its scope.

The flaw allows an attacker to bypass intended authorisation controls. The available data does not specify the attack vector or required access conditions. CVE-2026-42016 has a CVSS score of 8.1 and is rated High. Patch status is unknown, although JFrog has published security advisory and release information.

Active exploitation has been confirmed, as indicated by the KEV listing. The supplied data does not confirm use in ransomware campaigns. CISA set 25 September 2026 as the remediation deadline.

CISA requires organisations to apply mitigations in accordance with vendor instructions and BOD 26-04 guidance, including its Forensics Triage Requirements. Organisations should follow applicable BOD 26-04 guidance for cloud services or discontinue use if mitigations are unavailable. FCEB agencies are directly affected; all organisations should review their Artifactory exposure, including internet-facing assets, and apply the required remediation.

See the NVD entry and CISA KEV catalogue for full details.

How the story developed

All 8 articles
Quiet for 6 weekslast report 14 Sep8 articles5 outlets

8 articles from 5 outlets since 11 Sep. Quiet since 14 Sep. This was the 3rd report, 19 hours after the first.

Now11 Sep12131415First reportSecurityOnline · 11 Sep, 01:30This article3rd of 8 · day 0
  • Fri 11 Sep, 01:30 UTC. SecurityOnline, first report. JFrog Artifactory Flaws Exploited to Seize Admin Control. Cites a CVE in CISA KEV.
  • Fri 11 Sep, 07:48 UTC. The Hacker News, its first report on the story. Attackers Chain JFrog Artifactory Flaws to Seize Admin Control. Cites a CVE in CISA KEV.
  • Fri 11 Sep, 20:32 UTC. CISA, its first report on the story. CISA Warns of Actively Exploited JFrog Artifactory Flaw. Cites a CVE in CISA KEV. This article, 3rd of 8.
  • Sat 12 Sep, 17:53 UTC. The Hacker News. CISA Flags Artifactory, ScreenConnect and RouterOS Attacks. Cites a CVE in CISA KEV.
  • Sun 13 Sep, 15:00 UTC. Security Affairs, its first report on the story. Security Weekly Roundup Covers Cisco, Chrome and Windows Attacks. Cites a CVE in CISA KEV.
  • Sun 13 Sep, 18:30 UTC. Security Affairs. Security Affairs Tracks Malware, Ransomware and Active Exploits. Cites a CVE in CISA KEV.
  • Mon 14 Sep, 09:36 UTC. SecurityWeek, its first report on the story. Hackers Exploit JFrog Artifactory Bugs to Install Persistent Backdoors. Cites a CVE in CISA KEV.
  • Mon 14 Sep, 15:26 UTC. Security Affairs. CISA Flags Artifactory, ScreenConnect and GitLab Flaws as Exploited. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 8 articles as a list
  1. Fri 11 SepDay 03
    1. JFrog Artifactory Flaws Exploited to Seize Admin Control01:30 · SecurityOnline · First report · Exploited CVE · Known exploited CVE
    2. Attackers Chain JFrog Artifactory Flaws to Seize Admin Control07:48 · The Hacker News · Known exploited CVE
    3. CISA Warns of Actively Exploited JFrog Artifactory Flaw20:32 · CISA · official · CISA alert · Known exploited CVE · This article, 3rd of 8
  2. Sat 12 SepDay 11
    1. CISA Flags Artifactory, ScreenConnect and RouterOS Attacks17:53 · The Hacker News · Known exploited CVE
  3. Sun 13 SepDay 22
    1. Security Weekly Roundup Covers Cisco, Chrome and Windows Attacks15:00 · Security Affairs · Known exploited CVE
    2. Security Affairs Tracks Malware, Ransomware and Active Exploits18:30 · Security Affairs · Known exploited CVE
  4. Mon 14 SepDay 32
    1. Hackers Exploit JFrog Artifactory Bugs to Install Persistent Backdoors09:36 · SecurityWeek · Known exploited CVE
    2. CISA Flags Artifactory, ScreenConnect and GitLab Flaws as Exploited15:26 · Security Affairs · Known exploited CVE

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in