Security1 publisher2 min readPublished
Two Artifactory flaws turned an anonymous JWT into admin in under five minutes
Wiz observed multiple actors chaining CVE-2026-42018 and CVE-2026-42016 against self-hosted JFrog Artifactory between August 15 and September 8, creating admin accounts, loading Groovy plugins and dropping a Rust backdoor.
The Watch · Security desk
What happened
- Wiz confirmed exploitation of self-hosted JFrog Artifactory across multiple environments, including a chain that combines CVE-2026-42018 with CVE-2026-42016 to reach administrator privileges.
- Multiple threat actors worked that chain between August 15 and September 8, 2026, obtaining a JWT for the internal anonymous user and exchanging it for an admin-scoped token.
- Once admin, the attackers generated long-lived access tokens, installed malicious Groovy plugins to execute arbitrary commands, and deployed a Rust-based backdoor for persistence.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- decision Five minutes from exploitation to a created administrator account leaves no room to schedule this into the next maintenance window, so the choice is an out-of-band upgrade or accepting that a reachable instance may already have a rogue admin.
- exposure Stolen cluster join keys and configuration data put the other nodes in the cluster and the systems that authenticate to it within reach of an actor who no longer needs either vulnerability.
- cost The upgrade is quick; the work is auditing 24 days of token creation, plugin activity and account changes, then rotating whatever the attacker read.
- precedent More than one crew working the same repository-server chain inside a month sets the expectation that internal build infrastructure gets scanned on the same cadence as edge appliances.
Disabling anonymous access does not close this. CVE-2026-42018 hands over a JWT belonging to Artifactory's internal anonymous user whether or not anonymous access is enabled, at low privilege [3]. CVE-2026-42016 is a token validation failure, and it lets that low-privilege token be exchanged for an admin-scoped one [4]. Wiz measured under five minutes from exploitation to a created administrator account in some cases [6].
The upgrade removes the vulnerabilities but not the access already taken. The actors created admin accounts and generated long-lived access tokens before installing malicious Groovy plugins to run arbitrary commands [7]. An account minted on August 20 survives the patch, and so does its token. Wiz's post-upgrade list for internet-exposed instances is unexpected token creation, rogue administrator accounts, suspicious plugin activity and enumeration requests, plus restricting access to trusted systems [14]. Indicators of compromise are published [15].
"Between August 15 and September 8, 2026, we observed multiple actors chain CVE-2026-42018 and CVE-2026-42016 against self-hosted Artifactory instances," Wiz wrote [8]. The window is 24 days [17]. More than one crew worked it [5], so the chain is not sitting with a single operator.
On scope, Wiz gives a range: between 49% and 62% of reachable Artifactory instances are vulnerable to at least one of the three flaws [11]. Thirteen points of spread [19]. The low end still puts about half of everything reachable in range. Six fixed release lines are listed, the lowest 7.111.21 and the highest 7.161.20 [13][18].
CVE-2026-82329 sits outside the chain. It is a critical authentication bypass, and watchTowr observed it exploited earlier this month to mint administrator tokens directly [12].
"Across multiple cases, we observed a custom Rust backdoor with C2 capabilities being dropped," Wiz wrote [9].
No artifact tampering has been reported. What Wiz describes after admin is payloads written to /dev/shm, /tmp and /var/tmp, uploaded webshells, theft of Artifactory configuration data and cluster join keys, enumeration of repositories, tokens and users, and SSH keys added to the newly created accounts [10]. The published record stops there [20]. Cluster join keys and long-lived tokens are what a follow-on operation would use against the rest of the cluster and the systems that trust it, and Wiz reports both taken [10].
BleepingComputer said it contacted JFrog to confirm the reported activity and had received no response as of publication [16].
What to watch
- A JFrog statement or advisory confirming in-the-wild exploitation and naming any branches missing from the six fixed release lines.
- A reported case where a stolen cluster join key was used against a second node, or where stored artifacts were modified.
- Public exploit code or a packaged module for the CVE-2026-42018 to CVE-2026-42016 chain, which would widen the actor set again.