Two Artifactory flaws turned an anonymous JWT into admin in under five minutes
Wiz observed multiple actors chaining CVE-2026-42018 and CVE-2026-42016 against self-hosted JFrog Artifactory between August 15 and September 8, creating admin accounts, loading Groovy plugins and dropping a Rust backdoor.
The Watch · Security desk
What happened
- Wiz confirmed exploitation of self-hosted JFrog Artifactory across multiple environments, including a chain that combines CVE-2026-42018 with CVE-2026-42016 to reach administrator privileges.
- Multiple threat actors worked that chain between August 15 and September 8, 2026, obtaining a JWT for the internal anonymous user and exchanging it for an admin-scoped token.
- Once admin, the attackers generated long-lived access tokens, installed malicious Groovy plugins to execute arbitrary commands, and deployed a Rust-based backdoor for persistence.
Why it matters
- Who has to decide decision Five minutes from exploitation to a created administrator account leaves no room to schedule this into the next maintenance window, so the choice is an out-of-band upgrade or accepting that a reachable instance may already have a rogue admin.
- Who's exposed exposure Stolen cluster join keys and configuration data put the other nodes in the cluster and the systems that authenticate to it within reach of an actor who no longer needs either vulnerability.
- What it costs cost The upgrade is quick; the work is auditing 24 days of token creation, plugin activity and account changes, then rotating whatever the attacker read.
- What it sets up precedent More than one crew working the same repository-server chain inside a month sets the expectation that internal build infrastructure gets scanned on the same cadence as edge appliances.
Next story · Build · Sep 30
Attackers chain three JFrog Artifactory flaws to mint their own admin tokensConfirmed2 publishers
Disabling anonymous access does not close this. CVE-2026-42018 hands over a JWT belonging to Artifactory's internal anonymous user whether or not anonymous access is enabled, at low privilege [3]. CVE-2026-42016 is a token validation failure, and it lets that low-privilege token be exchanged for an admin-scoped one [4]. Wiz measured under five minutes from exploitation to a created administrator account in some cases [10].
The upgrade removes the vulnerabilities but not the access already taken. The actors created admin accounts and generated long-lived access tokens before installing malicious Groovy plugins to run arbitrary commands [6]. An account minted on August 20 survives the patch, and so does its token. Wiz's post-upgrade list for internet-exposed instances is unexpected token creation, rogue administrator accounts, suspicious plugin activity and enumeration requests, plus restricting access to trusted systems [12]. Indicators of compromise are published [13].
"Between August 15 and September 8, 2026, we observed multiple actors chain CVE-2026-42018 and CVE-2026-42016 against self-hosted Artifactory instances," Wiz wrote [7]. The window is 24 days [16]. More than one crew worked it [5], so the chain is not sitting with a single operator.
On scope, Wiz gives a range: between 49% and 62% of reachable Artifactory instances are vulnerable to at least one of the three flaws [18]. Thirteen points of spread [19]. The low end still puts about half of everything reachable in range. Six fixed release lines are listed, the lowest 7.111.21 and the highest 7.161.20 [11][15].
CVE-2026-82329 sits outside the chain. It is a critical authentication bypass, and watchTowr observed it exploited earlier this month to mint administrator tokens directly [9].
"Across multiple cases, we observed a custom Rust backdoor with C2 capabilities being dropped," Wiz wrote [8].
No artifact tampering has been reported. What Wiz describes after admin is payloads written to /dev/shm, /tmp and /var/tmp, uploaded webshells, theft of Artifactory configuration data and cluster join keys, enumeration of repositories, tokens and users, and SSH keys added to the newly created accounts [17]. The published record stops there [20]. Cluster join keys and long-lived tokens are what a follow-on operation would use against the rest of the cluster and the systems that trust it, and Wiz reports both taken [17].
BleepingComputer said it contacted JFrog to confirm the reported activity and had received no response as of publication [14].
What to watch
- A JFrog statement or advisory confirming in-the-wild exploitation and naming any branches missing from the six fixed release lines.
- A reported case where a stolen cluster join key was used against a second node, or where stored artifacts were modified.
- Public exploit code or a packaged module for the CVE-2026-42018 to CVE-2026-42016 chain, which would widen the actor set again.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence68
- Adoption35
- Hype gap+10
- Incentives35
- Confidence70
Perspective Coverage
4 publishers- Builder
- Builder 34%
- Operator
- Operator 61%
- Investor
- Investor 5%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Threat actors are exploiting critical and high-severity vulnerabilities in JFrog Artifactory to bypass authentication, gain administrative privileges, and deploy a Rust backdoor on vulnerable self-hosted servers.
- [2]
A report from cloud security company Wiz confirmed exploitation across multiple environments, including an exploit chain combining CVE-2026-42018 and CVE-2026-42016.
- [3]
According to Wiz, attackers exploit CVE-2026-42018 to obtain a JSON Web Token belonging to an internal Artifactory anonymous user, even when anonymous access is disabled, with low privileges.
- [4]
Attackers then raise permissions to admin level by exploiting CVE-2026-42016, which is caused by insufficient token validation.
- [5]
Between August 15 and September 8, 2026, multiple threat actors exploited the two vulnerabilities to obtain a JWT for the internal anonymous user and then exchange it for an admin-scoped token.
- [6]
After creating admin accounts and generating long-lived access tokens, the attackers installed malicious Groovy plugins to execute arbitrary commands and established persistence by deploying a Rust-based backdoor.
- [7]
"Between August 15 and September 8, 2026, we observed multiple actors chain CVE-2026-42018 and CVE-2026-42016 against self-hosted Artifactory instances," Wiz says.
- [8]
"Across multiple cases, we observed a custom Rust backdoor with C2 capabilities being dropped," Wiz says.
- [9]
The third vulnerability, CVE-2026-82329, is a critical authentication bypass that offensive security company watchTowr observed being exploited earlier this month to mint administrator tokens.
- [10]
Wiz researchers note that in some cases the attacker took less than five minutes to create an administrator account.
- [11]
System administrators are recommended to upgrade immediately to Artifactory 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38 or 7.161.20, or later.
- [12]
After upgrading, Wiz recommends investigating internet-exposed instances for unexpected token creation, rogue administrator accounts, suspicious plugin activity and enumeration requests, and restricting access to trusted systems only.
- [13]
Wiz has listed indicators of compromise associated with the observed attacks to help defenders detect them.
- [14]
BleepingComputer contacted JFrog to confirm the reported activity but had not received a response as of publication.
- [15]
The recommended upgrade covers six separate Artifactory release lines.
- [16]
The observed exploitation window spans 24 days.
- [17]
In the next stage the threat actor downloaded additional payloads into /dev/shm, /tmp, and /var/tmp, uploaded webshells, stole Artifactory configuration data and cluster join keys, enumerated repositories, tokens, and users, and added their SSH keys to newly created accounts.
- [18]
Wiz warns that between 49% and 62% of reachable Artifactory instances are vulnerable to at least one of the three flaws.
- [19]
Wiz's vulnerable-share estimate has a spread of 13 percentage points.
- [20]
The observed post-exploitation activity as reported does not include modification of stored artifacts or packages.
Sources
4 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comArtifactory flaws chained in attacks deploying backdoor malware
1 article · September 11, 2026
- securityweek.comThree JFrog Artifactory Flaws Exploited for Backdoor Deployment
1 article · September 14, 2026
- thehackernews.comAttackers Chain JFrog Artifactory Flaws to Gain Admin Control and Plant Backdoors
2 articles · September 11, 2026
- wiz.ioArtifactory Under Attack: In-the-Wild Exploitation of CVE-2026-42016, CVE-2026-42018 & CVE-2026-82329
1 article · September 10, 2026