An unauthenticated request to a JFrog Artifactory server, one that ends in nothing more exotic than a trailing slash, comes back carrying a valid token. A second request trades that token for one with administrator authority. In some of the cases Wiz Research documented, under five minutes passed between that first request and a brand new administrator account on the server.
Wiz says it has confirmed active, in-the-wild exploitation of three Artifactory vulnerabilities across multiple environments, with attackers chaining them to bypass authentication, escalate privileges and take administrative control. That matters more than the average admin bug. Artifactory is where organisations keep their build artifacts, along with the credentials and integrations that feed them, so control of it is control of what ships into production.
Two bugs that only matter together
Neither of the first two flaws grants administrative control on its own. CVE-2026-42018 is an improper-authentication issue that can make Artifactory hand an internal anonymous-user token to an unauthenticated requester, even when anonymous access is switched off. CVE-2026-42016 is a privilege-escalation flaw: Artifactory validates a token's signature and issuer but does not properly enforce the scope it was issued with. Chained, the two turn an unauthenticated request into an admin-scoped token in two steps, and Wiz observed exactly that against self-hosted instances between 15 August and 8 September.
The third flaw needs no chaining at all. CVE-2026-82329 carries a CVSS score of 9.8 and is an authentication bypass affecting Artifactory in its default configuration: one unauthenticated request to the cluster registry join endpoint returns an admin-scoped token in the response body. Wiz saw several distinct actors exploiting it between 1 and 8 September, straddling the day CISA put a three-day federal patching deadline on it.
Exposure is wide and remediation has been slow. Wiz's data indicates that 67% of organizations running JFrog Artifactory had at least one vulnerable instance when CVE-2026-42016 was first published on 27 July, with similar levels for the other two at their publication dates. Six weeks on, 59% of organisations remain vulnerable to CVE-2026-42016, and CVE-2026-42018 has only declined from 69% to 62% over four weeks.
A Rust backdoor lands in /dev/shm
Because the payoff is an administrator account, what follows varies by operator, and Wiz stresses that no single actor ran every step. Across compromised instances it saw persistent administrator accounts created through the user API, malicious Groovy plugins installed through Artifactory's own plugin framework to gain code execution on the server, and shell commands run through the plugin execution endpoint. A dropper pulled a binary over plain HTTP into a world-writable directory such as /dev/shm or /tmp and opened a channel to a command-and-control server, and in several cases that payload was a custom Rust backdoor. Others exfiltrated the system configuration, minted long-lived tokens, stole the cluster join key, enumerated users and repositories, or attached their own SSH keys to accounts they had just created.
Upgrade, then go read your access logs
Fixed releases exist on every supported branch: 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38 and 7.161.20 or later, with CVE-2026-42016 addressed in 7.133.11. Because exploitation works remotely and without authentication under the default configuration, internet-reachable instances come first, and network access should be restricted to trusted users and systems wherever possible.
Detection is largely behavioural. Wiz's highest-confidence signal for the token-exposure flaw is a 401 on the bare token path followed by a 200 on a variant of it, from the same client, inside a short window: that is an operator confirming which path works, not something a normal client produces. For the scope flaw, watch for the internal anonymous identity minting tokens, enumerating users or touching the plugins API, remembering that an escalated token keeps the anonymous username. For the authentication bypass, correlate a successful response from the registry join endpoint with the administrator creation and configuration reads that follow.
Selected indicators, defanged:
- 93[.]104[.]155[.]133, actor IP exploiting CVE-2026-42018 and CVE-2026-42016, seen 28 August to 7 September
- hxxp://log[.]gitclone[.]org:45678/smtp and hxxp://3[.]88[.]162[.]79:36789/smtp, payload downloads
- 513a907b69edffc3cb77a494da395178d21ef9bd, SHA1 of a /tmp/.z payload, and 64[.]207[.]232[.]6:8443 as a command-and-control address
- Attacker-created accounts named 0xTerror or matching Nxploited_, labadmin_ and svc_, plus plausible-looking ones such as jfrog-distribution, jfrog-insight, repo-service and ldap_admin
If a self-hosted Artifactory instance faced the internet at any point in the last month, this is an incident to rule out rather than a patch to schedule.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.