KEV Lag Tracker → CVE-2026-42016. Data verified against the official CISA KEV catalog and the National Vulnerability Database.

CISA added CVE-2026-42016 (JFrog Artifactory) to the Known Exploited Vulnerabilities catalog on September 11, 2026. It was publicly known for 46 days before CISA confirmed active exploitation. A KEV listing is CISA’s official confirmation that a vulnerability is being exploited in the wild.

The Record

CVECVE-2026-42016
Vendor / productJFrog Artifactory
VulnerabilityJFrog Artifactory Incorrect Authorization Vulnerability
CVSS base score8.1
EPSS probability the day before the KEV listing0.27% (18.4% percentile)
NVD publication dateJuly 27, 2026
Added to CISA KEVSeptember 11, 2026
Lag (public → KEV listing)46 days
Federal patch deadlineSeptember 25, 2026
Known ransomware useNo

Measured against the 1723 entries in our tracker with verified publication dates, CVE-2026-42016 was flagged faster than 65% of them.

What CISA Reported

CISA describes the flaw as follows: “JFrog Artifactory contains an incorrect authorization vulnerability that allows leads to privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope.”

Federal Patch Deadline

Under Binding Operational Directive rules, U.S. federal agencies must remediate CVE-2026-42016 by September 25, 2026 — a 14-day remediation window from the KEV listing date. Private organizations are not bound by that deadline; CISA treats it as the benchmark for how urgently a confirmed-exploited flaw should be patched.

What EPSS Forecast Before the Confirmation

The EPSS forecast (FIRST’s daily estimate of the probability a CVE will be exploited within 30 days) put CVE-2026-42016 at 0.27% on the day before CISA confirmed active exploitation — the 18.4% percentile of all scored CVEs that day. That places it outside the top 10% of EPSS risk on the eve of confirmation — a patch queue ordered by EPSS alone would have left it for later.

EPSS for CVE-2026-42016Value
Probability the day before the KEV listing0.27%
Percentile the day before the KEV listing18.4%
Probability today (September 25, 2026)8.64%
Percentile today94.9%

Today’s figure is not evidence that the forecast worked: EPSS reacts to the KEV listing itself, so the score for any confirmed-exploited CVE tends to rise after CISA acts. Only the eve-of-listing number was available to a defender making the call. Across every KEV entry we track, we measured how often that number was high — see the EPSS accuracy analysis.

How This Compares

We do not yet track enough JFrog entries to publish a vendor median (the threshold is five with verified publication dates), so the reference here is the catalog as a whole:

Across all tracked KEV entriesValue
Entries with verified publication dates1723
Median lag (disclosure → KEV listing)246 days
Exploited within 7 days of disclosure24%
Tied to known ransomware campaigns19%

Other Recent JFrog KEV Additions

CVEProductAdded to KEVLag (days)Ransomware
CVE-2026-42018ArtifactorySeptember 11, 202630No
CVE-2026-82329ArtifactorySeptember 2, 20265No
CVE-2026-66384ArtifactoryAugust 27, 202615No

Frequently Asked Questions

What is CVE-2026-42016?

CVE-2026-42016 is a vulnerability in JFrog Artifactory (JFrog Artifactory Incorrect Authorization Vulnerability) that CISA added to its Known Exploited Vulnerabilities catalog on September 11, 2026. A KEV listing is CISA’s official confirmation that the flaw is being exploited in the wild.

How long was CVE-2026-42016 public before CISA confirmed exploitation?

46 calendar days, measured from its NVD publication date to the date CISA added it to the KEV catalog.

What is the federal patch deadline for CVE-2026-42016?

U.S. federal agencies must remediate CVE-2026-42016 by September 25, 2026, a 14-day window from the KEV listing date. Private organizations are not bound by that deadline, but CISA treats it as the benchmark for how urgently a confirmed-exploited flaw should be patched.

Is CVE-2026-42016 used in ransomware campaigns?

CISA has not flagged CVE-2026-42016 as known to be used in ransomware campaigns. That field reflects confirmed campaign use, not the absence of risk.

What was the EPSS score for CVE-2026-42016 before it was confirmed as exploited?

0.27% — the probability EPSS assigned on the day before CISA added CVE-2026-42016 to the KEV catalog, placing it in the 18.4% percentile of all scored CVEs that day. That is outside the top 10% of EPSS risk. Its score today is higher in most cases because EPSS reacts to the KEV listing itself, so only the eve-of-listing figure reflects what a defender could have acted on.

Is a 46-day lag typical?

The median across all 1723 KEV entries we track with verified publication dates is 246 days, so CVE-2026-42016 is below the catalog median.

Related Coverage

Primary Sources

How We Track This

This page is generated from our CISA KEV Lag Tracker, which syncs the official CISA KEV catalog daily and records the date each CVE is added. For every entry we retrieve the original NVD publication date and compute the lag in calendar days. No date or figure on this page is estimated or taken from a third-party source — they come directly from CISA and NVD records. Free to cite with attribution to CVEDaily (CC BY 4.0).