CVE coverage

CVE-2026-42016

CVSS 8.1 Actively exploited (KEV) no coverage

JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope.

Detection rules

No detection found — yet

None of Sigma, Elastic, Splunk ESCU, YARA, Microsoft Sentinel, Snort, or Suricata currently has a rule referencing CVE-2026-42016.

This CVE is on CISA's Known Exploited Vulnerabilities list. It is being exploited in the wild with no public detection rule — worth writing one.