CVE-2026-42018 and CVE-2026-42016 were chained by attackers to obtain administrator control of self‑hosted JFrog Artifactory instances, cloud security company Wiz reported.
How CVE-2026-42018 and CVE-2026-42016 were chained
Wiz observed attackers between August 15 and September 8 exploiting two distinct flaws in Artifactory in sequence. Neither vulnerability grants administrator rights by itself. CVE-2026-42018 causes Artifactory to hand an internal anonymous‑user token to an unauthenticated caller, even when anonymous access is turned off. CVE-2026-42016 then lets that low‑privilege token be exchanged for one with administrator scope because Artifactory checks a token’s signature and issuer but not the actions the token is allowed to perform.
In every case Wiz saw, the attacker made an unauthenticated request to a token endpoint, received a token for the internal anonymous user, and then exchanged it at Artifactory’s token‑creation endpoint for an administrator‑scoped token. The administrator token retained the anonymous username; administrator actions appear in logs as token:anonymous rather than under a named account. In some instances the chain from first request to a new administrator account completed in under five minutes.
The chain affects a narrower set of releases than either flaw alone: a server must be vulnerable to both CVEs for the chain to succeed, and closing either one breaks it. In JFrog’s published ranges, CVE-2026-42016 ends at 7.133.11, leaving the 7.146 and 7.161 branches outside that range.
What attackers did after gaining administrator control
Wiz reported a range of post‑compromise activity across the servers it investigated. Attackers created administrator accounts and left them in place. They installed malicious Groovy plugins through Artifactory’s plugin framework, which granted code execution on the server. Some used the plugin execution endpoint to run shell commands to explore file systems and list files.
Wiz also observed a dropper that fetched a binary over HTTP, wrote it to a world‑writable directory such as /tmp, and opened a command‑and‑control channel. A custom Rust backdoor with command‑and‑control features was dropped in multiple cases. Wiz emphasized that no single actor performed every step it observed; activity was varied across compromised servers.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleCVE-2026-82329: a separate critical bypass and mass scanning
Wiz’s report also documents a third, separate flaw: CVE-2026-82329, a critical authentication bypass rated 9.8 on the CVSS scale. It targets Artifactory’s default configuration and requires no chaining; an unauthenticated attacker with network access can obtain administrator privileges on six release branches up to 7.161. That is why a server on a newer branch may still have been affected.
The Hacker News reported on September 1 that attackers had begun creating administrator tokens through that flaw days after JFrog disclosed it. CISA added CVE-2026-82329 to its catalog of known exploited vulnerabilities on September 2 and set a September 5 deadline for federal agencies. Fastly said a public exploit appeared on September 1, followed by scanning, and counted about 406,000 exploitation attempts across its platform on September 2; these are attempts seen in traffic, not confirmed compromises.
On servers taken via CVE-2026-82329, Wiz saw attackers read system configuration and, in several cases, take the cluster join key—the shared secret Artifactory nodes use to register with one another.
Patching, workarounds, and what updates do not undo
JFrog had shipped fixes for the two chained flaws before Wiz observed the attacks, so only servers that had not been updated were vulnerable. JFrog shipped the CVE-2026-42018 fix on the 7.146 branch on April 28 and on the 7.133 branch on August 12 — three days before the attacks Wiz observed began. JFrog lists 7.133.11 as the fixed version for CVE-2026-42016 and does not publish a separate per‑branch fix in that advisory. JFrog says cloud instances need no action; self‑hosted Artifactory should be upgraded to the fixed build for the release branch, per JFrog’s security advisories.
For CVE-2026-82329, JFrog publishes a workaround for organizations that cannot upgrade quickly: generate a random value and add it as an extra join key in system.yaml so only your own keys are accepted when a service registers. There is no interim mitigation listed for the two‑flaw chain in the advisories and reports consulted by Wiz.
Crucially, updates do not undo attacker activity. Administrator accounts the attackers created remain after an update. A patch does not revoke tokens already minted, nor does an upgrade change a join key an attacker has already taken. Fastly advises treating any exposed server as compromised, rotating the platform join key, revoking access tokens issued since August 28, and reviewing administrator accounts, repositories, and configuration changes.
What this means for technologists, procurement leaders, and federal agencies
- Technologists and security teams: upgrade self‑hosted Artifactory to the fixed build for your branch, search logs for token:anonymous performing privileged actions, look for low‑privilege accounts creating tokens or reading/writing plugins, and hunt for unfamiliar administrator accounts — many of those Wiz found used names such as 0xTerror, svc_* and labadmin_* with random characters, or names designed to blend in like jfrog-distribution and repo-service.
- Procurement and enterprise leaders: confirm which release branches your vendors and suppliers run and whether they have applied the specific fixed builds JFrog lists; note that JFrog lists a single fixed version for CVE-2026-42016 and that question has been raised publicly to JFrog and Wiz about which builds fully close it.
- Federal agencies and regulated organizations: CISA added CVE-2026-82329 to its known exploited list on September 2 and set a September 5 deadline, and Fastly’s analysis shows mass scanning days after a public exploit appeared. Treat exposed servers as compromised and follow recommendations to rotate join keys and revoke tokens.
The immediate lesson is simple and stark: closing either link in the two‑CVE chain stops the attack, but a separate critical bypass (CVE-2026-82329) can produce administrator control by itself. Organizations running self‑hosted Artifactory must verify their branch, apply the fixed builds JFrog publishes, and assume that any previously minted tokens or stolen join keys may already be in an attacker’s hands.
