Attackers lifted the cluster join key out of self-hosted Artifactory

The join key is the shared secret Artifactory nodes use to register with one another ^[10]. Artifactory is what build pipelines pull from, so whoever holds administrator on that server decides what every downstream build consumes ^[25]. Upgrading the binary closes the request path that leaked it. The secret itself stays the same. On servers taken through the critical bypass, Wiz saw attackers read the system configuration and, in several cases, take that key ^[21].

The revocation date is the line to check against your own logs. JFrog's remediation is upgrade to the fixed build for your branch, then rotate the join key and revoke tokens issued since August 28 ^[11]. Wiz's observation window opens on August 15 ^[2]. That leaves 13 days of observed activity sitting before the cutoff the fix list gives you ^[22].

Username is the wrong key for scoping this. The administrator-scope token keeps the anonymous username it inherited, so every privileged action taken with it lands in the logs as token:anonymous ^[7]. A hunt for a rogue admin account finds nothing, because the attacker never had one until they created it ^[8]. The sequence is the artifact: an unauthenticated request to a token endpoint returning a token for the internal anonymous user, then that token presented to the token-creation endpoint and exchanged for administrator scope ^[6].

Which advisory applies depends on your branch. CVE-2026-42016's published fixed range ends at 7.133.11, which leaves the 7.146 and 7.161 branches outside it entirely ^[15]. JFrog shipped the CVE-2026-42018 fix on the 7.146 branch on April 28 and on the 7.133 branch on August 12, three days before Wiz saw the attacks start ^[16]. Closing either flaw breaks the chain, so the chain reaches fewer servers than either bug alone ^[14]. The wider exposure is CVE-2026-82329, an authentication bypass rated 9.8 that targets the default configuration, needs no partner flaw, and spans six release branches up to 7.161 ^[17]. The fix list carries six builds, one per branch ^[24].

Fastly counted roughly 406,000 exploitation attempts across its platform on September 2, its busiest day. The report is explicit that those are attempts observed in traffic, not confirmed compromises ^[19]. For that figure to say anything about your estate, your instance would have to be internet-facing and reachable by the scanners that generated it, which is the population JFrog's advisory singles out ^[12]. A public exploit appeared on September 1 and scanning followed immediately ^[18]. CISA added the CVE to its known exploited vulnerabilities catalog on September 2 and set a September 5 deadline for federal agencies, three days ^[20][23].

Wiz also noted that no single actor performed every step it observed, and read that as more than one crew working the same exposure ^[13].