Skip to content

Wiz "Artifactory Under Attack": in-the-wild exploitation chains in JFrog Artifactory (CVE-2026-42016 / CVE-2026-42018 / CVE-2026-82329)

Tags

Summary

On September 10, 2026, Wiz Threat Research published "Artifactory Under Attack: In-the-Wild Exploitation of CVE-2026-42016, CVE-2026-42018 & CVE-2026-82329" (updated September 11, 3 PM UTC with corrected HTTP method for CVE-2026-82329 and corrected impacted/fixed versions for CVE-2026-42018). Wiz confirms active, in-the-wild exploitation of three JFrog Artifactory flaws that attackers chain to bypass authentication, escalate privileges, and take administrative control of self-hosted instances. CISA added CVE-2026-42016 and CVE-2026-42018 to the KEV catalog on September 11, 2026 (BOD 26-04; due 2026-09-25; ransomware use unknown; no actor named); CVE-2026-82329 has been in KEV since September 2, 2026. This is the third exploited flaw in ~30 days against the same product family and the first confirmed IWT exploitation of the two 2026 "new" CVEs.

The chain is a two-step token escalation against self-hosted Artifactory, followed by admin-scoped post-exploitation:

CVE Class CWE Fixed in Published
CVE-2026-42018 Improper authentication — returns the internal anonymous-user token to an unauthenticated caller even when anonymous access is disabled CWE-287 Artifactory 7.111.20; 7.117.28; 7.125.20; 7.133.29; 7.146.9 (per JFrog advisory, corrected in the Sep 11 change log) Aug 12, 2026
CVE-2026-42016 Incorrect authorization / token-scope validation flaw — a valid low-privilege token can be used to perform unauthorized, elevated actions CWE-863 Artifactory 7.133.11 Jul 27, 2026
CVE-2026-82329 Critical authentication bypass to administrative access under default configuration CWE-288 (KEV lists improper auth) 7.111.22; 7.117.28; 7.125.20; 7.133.29; 7.146.37; 7.161.20 Aug 28, 2026

Neither of the two new flaws grants admin on its own: CVE-2026-42018 exposes a token for the internal anonymous user, and CVE-2026-42016 lets that low-privileged token be escalated to admin scope. Together they turn an unauthenticated request into an admin-scoped token in two steps.

The observed exploitation chain

Wiz observed multiple actors, August 15 – September 8, 2026, running the same shape against self-hosted Artifactory:

  1. POST /access/api/v1/aws/token/ with a trailing slash → 200 returning a JWT for the internal anonymous user (exploits CVE-2026-42018).
  2. POST /access/api/v1/tokens → 200 returning an admin-scoped token, still carrying the anonymous username (exploits the CVE-2026-42016 scope-validation flaw).
  3. PUT /api/security/users/<username> (or /access/api/ui/users/<username>) → 201, with the actor field showing token:anonymous, creates a persistent administrator account.

In some cases the actor moved from the first request to a created admin account in under five minutes. Because the escalated token retains the anonymous identity, subsequent requests are attributed to token:anonymous — an unusually strong, durable log tell.

Post-exploitation observed

Once admin access is granted, post-exploitation varies, but Wiz recorded a consistent set of durable artifacts: - Creation of persistent administrator accounts (the token:anonymous user above). - Deployment of malicious Groovy plugins for code execution inside the Artifactory JVM/plugin host. - Installation of Rust-based backdoors with C2 capabilities for persistence (Wiz was not aware of prior public reporting of these two CVEs being used IWT; the Rust backdoor is the novel payload).

Exposure and patching velocity (Wiz telemetry)

  • 67% of organizations running Artifactory had at least one vulnerable instance when CVE-2026-42016 was first published (Jul 27); 69% at CVE-2026-42018 publication (Aug 12); 67% at CVE-2026-82329 publication (Aug 28).
  • Patching was slow for the lower-severity flaws: six weeks after the first disclosure, 59% remained vulnerable to CVE-2026-42016; CVE-2026-42018 declined only from 69% to 62% over four weeks.
  • CVE-2026-82329 remediated faster (67% → 49% within two weeks), likely driven by its critical severity rating.

Why this matters

  • Artifact repositories are Tier-1 security assets, not dev tooling: admin control of Artifactory exposes every artifact, credential, and integration it manages.
  • The token:anonymous actor is the durable detection primitive — it separates this specific chain from legitimate admin activity and is visible in Artifactory's own request logs.
  • Patch-alone is not enough if a persistent admin account or Groovy plugin has already been dropped: hunt for token:anonymous actors, unknown admin accounts, and unexpected Groovy plugin deployments before and after remediation.

Detection (hunt)

  • Artifactory request/access logs: any request with actor = token:anonymous that performs privileged operations (PUT /api/security/users/*, /access/api/ui/users/*, token exchange) — treat as confirmed compromise.
  • Unauthenticated POST /access/api/v1/aws/token/ with a trailing slash returning 200 (the CVE-2026-42018 trigger).
  • POST /access/api/v1/tokens returning an admin-scoped token that retains the anonymous subject.
  • New admin-level user accounts created outside the normal IAM/SSO flow, especially with an anonymous-derived username.
  • Malicious Groovy plugins in the Artifactory plugin directory / JVM plugin host that do not map to a known, maintained build.
  • Outbound Rust backdoor C2 beaconing from the Artifactory host; correlate with new, unexplained binaries on the host.
  • ScreenConnect-style lateral movement is not in scope here, but treat the Artifactory host as a pivot into build/CI pipelines once admin is compromised.

Remediation

  1. Upgrade self-hosted Artifactory to the fixed versions above (minimum 7.133.11 for CVE-2026-42016; per the corrected JFrog advisory for the other two — see the Sep 11 change log). Cloud-hosted Artifactory is already patched.
  2. Hunt and remove any persistent admin account created by token:anonymous (audit /api/security/users and /access/api/ui/users for anomalous entries).
  3. Remove malicious Groovy plugins and any Rust backdoor artifacts; treat the host as compromised if the chain was observed.
  4. Rotate credentials stored in or managed by Artifactory (repository tokens, API keys, build/CI integration secrets, SSO/OAuth client secrets).
  5. Restrict anonymous access and enforce token-scope validation in any upstream IdP that issues Artifactory tokens; audit for tokens that can be exchanged beyond their intended scope.
  6. Monitor BOD 26-04 due date 2026-09-25 for the two new KEV entries (CVE-2026-42016 / CVE-2026-42018) and the existing CVE-2026-82329.

Sources