Security1 publisher2 min readPublished
Attackers turn an unauthenticated Artifactory request into an admin token in two steps
Wiz Research found two high-severity JFrog Artifactory flaws being chained into admin tokens in the wild, while patch data shows organisations moved fastest on a third bug rated critical. The chained pair is the least patched of the three.
The Watch · Security desk
What happened
- Wiz Research confirmed active in-the-wild exploitation of three JFrog Artifactory vulnerabilities, CVE-2026-42016, CVE-2026-42018 and CVE-2026-82329, chained to bypass authentication and gain administrative control.
- Between August 15 and September 8, 2026, multiple actors chained CVE-2026-42018 and CVE-2026-42016 against self-hosted Artifactory instances.
- Post-exploitation activity included persistent administrator accounts, malicious Groovy plugins used for code execution, and Rust-based backdoors installed for persistence.
- The only prior public sign that either chained flaw was being exploited was their inclusion in CISA's KEV catalogue, according to Wiz Research.
- Exploitation of all three vulnerabilities has been confirmed across multiple environments, not a single victim estate.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- exposure Organisations that worked their queue by severity rating closed the critical bypass and left the two flaws under active chaining in place, and that chain needs no credentials to start.
- decision Anyone running self-hosted Artifactory has to decide whether a KEV listing on two high-severity CVEs outranks a critical rating on a third when ordering the change.
- capability Admin on Artifactory yields the credentials and integrations it manages, and a Groovy plugin puts attacker code inside the build path.
- constraint The accounts and backdoors were placed to persist, so an upgrade closes the entry without telling an operator whether the instance was already taken.
Neither chained flaw gives admin on its own [16]. CVE-2026-42018 hands back a token for Artifactory's internal anonymous user to a caller who never authenticated, and it does that even where anonymous access has been switched off [3]. CVE-2026-42016 is the scope failure: Artifactory checks a token's signature and issuer but does not enforce the scope it was issued with, so that anonymous token can be used for actions above its privilege [4]. In every case Wiz observed, the first request was an unauthenticated POST to /access/api/v1/aws/token/ with a trailing slash, and it came back HTTP 200 with a JWT for the internal anonymous user [17].
The third CVE needs no chain. CVE-2026-82329 is an authentication bypass present in Artifactory's default configuration, and Wiz describes an unauthenticated attacker with network access obtaining administrative privileges over the deployment and over the artifacts, credentials and integrations it manages [5].
The patch data is where triage went wrong. CVE-2026-42016 was published on July 27 with 67% of organisations running Artifactory holding at least one vulnerable instance [6]; six weeks later 59% were still vulnerable [9], a decline of about 1.3 points a week [1]. CVE-2026-42018 went from 69% at its August 12 publication [7] to 62% four weeks on [10], about 1.75 points a week [2]. The critical one moved differently: 67% at publication on August 28 [8] to 49% within two weeks [11], 9 points a week [3], roughly five times the weekly pace of the two actually being chained [4]. Wiz wrote that the faster remediation was "likely due to its critical severity rating driving more urgent attention from security teams" [12].
Exploitation of the pair began on August 15, three days after CVE-2026-42018 was published [5], and the observed activity runs 25 days [6]. CVE-2026-82329 was published on August 28, inside that window [7].
Wiz attributes the chaining to multiple actors [13], and a custom Rust backdoor with command-and-control turned up across multiple cases [14]. Indicator lists built around one crew will miss the others. Wiz says its post carries detection as well as remediation guidance and will be updated as new information becomes available [18].
What to watch
- Whether Wiz attributes the custom Rust backdoor with C2 to a named actor or crew.
- Whether in-the-wild chaining of CVE-2026-82329 with the other two CVEs is reported, rather than the standalone default-config bypass.
- Whether the 62% and 59% exposure figures for the chained pair move now that exploitation is public.