Nearly half of scanned Artifactory servers still ran unpatched two weeks after JFrog's fix

Wiz measured each bug at a different interval after its own patch date, and those intervals land in the same week. Six weeks after the July 27 fix for CVE-2026-42016 is September 7. A month after the August 12 fix for CVE-2026-42018 is September 12. Two weeks after the August 28 fix for the critical bypass is September 11 ^[20]. The three percentages describe roughly the same population at roughly the same moment: 59% of scanned instances still carrying the escalation bug ^[11], 62% still missing the anonymous-token fix ^[12], 49% still exploitable through the bypass ^[13].

The oldest patch has the worst record. The escalation fix had been available six weeks and was absent from 59% of instances; the bypass fix had been out two weeks and was absent from 49%, ten points fewer ^[21]. Extra time did not close the gap, and the bug labelled critical got attention the older one did not. "Patching velocity has been slow," Wiz wrote in its research ^[14]. Mitch Ashley, vice president and practice lead for CIO & Technology Buyers and Software Lifecycle Engineering at The Futurum Group ^[15], put the ordering problem this way: "Patch urgency still prioritizes internet exposures versus downstream dependence, which is why a repository manager can sit unpatched for weeks while a public web app gets fixed in hours or days," he said ^[16]. The telemetry establishes the gap without establishing its cause, and Ashley's is the explanation on the record ^[23].

Both halves of the chain are token problems. CVE-2026-42018 returns internal anonymous-user tokens to callers even when anonymous access is disabled ^[5]. CVE-2026-42016 fails to validate token scope, so an already-authenticated low-privilege user can climb to permissions nobody granted ^[7]. JFrog's two fixes landed 16 days apart ^[22], and Wiz says attackers are combining them to go from a foothold to full administrative control of the instance ^[9]. The upgrade fixes the scope check. Two jobs remain after it: work out which tokens were minted during the exposure window, and find what persistence is already resident. Wiz found custom Rust-based backdoors, Groovy plugins used to run arbitrary code on the server, and web shells left for remote access ^[10].

For a platform team deciding where the repository sits in the queue, the more useful test than a severity score is a count. If every artifact you shipped in the last 30 days passed through this server, it belongs on the customer-facing clock even though no customer can route to it. The cost of that policy is real: an emergency upgrade to the one host every pipeline reads from stops every build at once. What you accept by waiting is that several actors were already exploiting the bypass independently ^[4], and that the pattern is not specific to JFrog, since repositories, registries and build servers keep getting targeted for sitting upstream of so much else ^[19].

"Build infrastructure deserves the same patch clock as anything customer-facing. Security teams should be asking today who holds administrative tokens on their repository and what those tokens can reach," Ashley said ^[18].