Your build pipeline’s artifact brain is under active attack. Attackers have been chaining JFrog Artifactory flaws to go from no login to administrator in minutes — then planting Groovy plugins and a custom Rust backdoor.
If self-hosted Artifactory was reachable and unpatched through early September, patching alone does not revoke the tokens or admin accounts they already minted.
What happened
Wiz Research reported in-the-wild exploitation between August 15 and September 8, 2026. Two flaws were chained:
Don’t Miss the Policy Changes That Affect Security Decisions
Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
- CVE-2026-42018 — even with anonymous access disabled, an unauthenticated caller can obtain an internal anonymous-user token from a token endpoint.
- CVE-2026-42016 — that low-privilege token can be exchanged for an administrator-scoped token because Artifactory validated signature/issuer but not what the token was allowed to request.
In observed cases, attackers moved from the first request to a new admin account in under five minutes. Logs often show powerful actions as token:anonymous. A third critical auth bypass, CVE-2026-82329 (CVSS 9.8), was exploited separately against newer branches and can grant admin alone.
CISA added CVE-2026-42016 and CVE-2026-42018 to KEV on September 11, 2026 (federal due September 25). CVE-2026-82329 was already on KEV with an earlier due date.
Why it matters
Artifactory sits in the path of every binary your pipelines trust. Admin on that box means malicious packages, poisoned plugins, stolen join keys, and a foothold that survives the next developer push.
Supply-chain impact is the blast radius — not just one server’s uptime.
What to do first
- Upgrade self-hosted Artifactory to the fixed build for your release train (see JFrog advisories). Cloud instances: confirm vendor posture; do not assume “someone else patched.”
- For CVE-2026-82329 if you cannot upgrade immediately: add an extra random join key in
system.yamlper JFrog’s workaround so only your keys register. - Audit admin users — Wiz saw PoC names (
0xTerror,svc_/labadmin_*) and lookalikes (jfrog-distribution,repo-service). Delete strangers. - Revoke access tokens minted since at least late August; rotate the cluster join key if it could have leaked.
- Hunt malicious Groovy plugins, unexpected plugin-execution shell, and droppers writing binaries under world-writable paths such as
/tmp.
Details
- CVEs: CVE-2026-42018 (anon token leak), CVE-2026-42016 (token scope escalation), CVE-2026-82329 (standalone admin auth bypass, CVSS 9.8)
- Product: Self-hosted JFrog Artifactory (multiple 7.x trains)
- KEV: 42016/42018 added 2026-09-11 (due 2026-09-25); 82329 earlier (due 2026-09-05)
- Example fixed builds: branch-dependent — e.g. 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, 7.161.20 for 82329; confirm your train in JFrog’s matrix
- Post-exploit: admin accounts, Groovy plugins, Rust C2 backdoor, join-key theft
Hunt / verify
- Search access logs for unauthenticated
POST /access/api/v1/aws/token/(trailing slash) followed byPOST /access/api/v1/tokens. - Flag admin actions attributed to
token:anonymousor low-privilege identities creating tokens/plugins. - Inventory plugins and recently modified repositories; rotate secrets that lived in Artifactory config.
Sources
- Wiz: Artifactory under attack — CVE-2026-42016 / 42018 / 82329
- The Hacker News: Attackers chain JFrog Artifactory flaws (Sep 11, 2026)
- CISA: three KEV additions including Artifactory (Sep 11, 2026)
- Kodem: Artifactory IOCs and first-hour runbook
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
