Attackers have chained two flaws in JFrog Artifactory, the repository that software build pipelines pull from, to take administrator control of self-hosted servers and plant backdoors, cloud security company Wiz said in a report.
Wiz saw the attacks between August 15 and September 8. JFrog had fixed both flaws before then, so only servers that had not been updated were open to them.
Neither flaw gives administrator control on its own.
- CVE-2026-42018 makes Artifactory hand an internal anonymous-user token to a caller who has not logged in, even when anonymous access is turned off.
- CVE-2026-42016 then allows that low-privilege token to be swapped for one with administrator scope, because Artifactory checks a token’s signature and who issued it, but not what the token is allowed to do.
Every case Wiz saw followed a similar pattern. The attacker sent an unauthenticated request to a token endpoint and received a token for the internal anonymous user, then exchanged it at Artifactory’s token-creation endpoint for a token with administrator scope.
That second token keeps the anonymous username. Administrator actions taken with it show up in the logs as token:anonymous rather than under a named account.
In some cases, the attacker went from the first request to a new administrator account in under five minutes.
The chain reaches a narrower set of builds than either flaw alone. A server has to be affected by both, so closing either one breaks it. In JFrog’s published ranges, CVE-2026-42016 ends at 7.133.11, leaving the 7.146 and 7.161 branches outside that range.
JFrog shipped the CVE-2026-42018 fix on the 7.146 branch on April 28 and on the 7.133 branch on August 12, three days before the attacks Wiz saw began.
What the attackers did with administrator authority varied. Wiz said no single actor carried out every step it saw.
Across the compromised servers, attackers created administrator accounts and left them in place. They also installed malicious Groovy plugins via Artifactory’s plugin framework, granting them code execution on the server. Some ran shell commands via the plugin execution endpoint to explore and list files.
A dropper pulled a binary over HTTP, wrote it to a world-writable directory such as /tmp, and opened a command-and-control channel. Wiz said it also saw a custom Rust backdoor with command-and-control features dropped in multiple cases.
A third Artifactory flaw in the same report, CVE-2026-82329, was exploited separately between September 1 and September 8, and it is the reason a server on a newer branch may still be affected.
It is a critical authentication bypass, rated 9.8 on the CVSS scale, that targets Artifactory’s default configuration and requires no additional flaw. An unauthenticated attacker with network access can obtain administrator privileges through it alone, on six release branches up to 7.161.
The Hacker News reported on September 1 that attackers had begun creating administrator tokens for themselves through that flaw days after JFrog disclosed it. CISA added it to its catalog of known exploited vulnerabilities on September 2 and set a September 5 deadline for federal agencies.
Fastly, a content delivery network, said in an analysis that a public exploit appeared on September 1 and scanning followed. It counted about 406,000 exploitation attempts across its platform on September 2, its busiest day. Those are attempts seen in traffic, not compromises.
On servers taken through that flaw, Wiz saw attackers read the system configuration and, in several cases, take the cluster join key, the shared secret Artifactory nodes use to register with one another.
What to Install
Upgrade self-hosted Artifactory to the fixed build for your release branch, listed in JFrog’s security advisories. JFrog says cloud instances need no action.
| CVE | What it does | Affected | Fixed in |
|---|---|---|---|
| CVE-2026-42018 | Returns an internal anonymous-user token to a caller who has not logged in | Below 7.111.20, and below 7.117.27, 7.125.19, 7.133.28, and 7.146.8 on those branches | 7.111.20, 7.117.27, 7.125.19, 7.133.28, 7.146.8 |
| CVE-2026-42016 | Lets a low-privilege token be exchanged for an administrator-scope token | Before 7.133.11 | 7.133.11 |
| CVE-2026-82329 | Gives an unauthenticated attacker administrator privileges on its own | Below 7.111.21, and below 7.117.28, 7.125.20, 7.133.29, 7.146.38, and 7.161.20 on those branches | 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, 7.161.20 |
JFrog lists one fixed version for CVE-2026-42016, 7.133.11, and no separate fix for each branch. Its advisory does not say whether a later build on an older branch, such as 7.117.28, also closes it. The Hacker News has asked JFrog that question, and has asked Wiz which versions the compromised servers were running.
For CVE-2026-82329, JFrog publishes a workaround for anyone who cannot upgrade quickly: generate a random value and add it as an extra join key in system.yaml, so that only your own keys are accepted when a service registers.
There is no interim option for the two chained flaws in any of the advisories or reports consulted.
What Patching Does Not Undo
The administrator accounts the attackers created do not disappear when the software is updated. Wiz saw them created both through the two-flaw chain and through CVE-2026-82329.
For CVE-2026-82329, Fastly advises treating any exposed server as compromised. “A patch does not revoke tokens already minted,” the company said.
An upgrade also does not change a join key attackers have already taken. Fastly recommends rotating the platform join key, revoking access tokens issued since August 28, and reviewing administrator accounts, repositories, and configuration changes.
How to Check
The clearest signal is an account doing something its privileges should not allow: the internal anonymous user, or any low-privilege account, creating tokens, listing users, or reading and writing plugins.
Then look for administrator accounts nobody created on purpose. Most of the ones Wiz saw carry proof-of-concept names such as 0xTerror, or svc_ and labadmin_ followed by random characters. Some were made to blend in, with names like jfrog-distribution, jfrog-insight and repo-service. Wiz’s report lists attacker addresses and a payload hash.
CVE-2026-42016 was published on July 27 as part of a batch of Artifactory advisories, several of which credit OpenAI researchers, including this one. The Hacker News reported in July that JFrog had confirmed OpenAI models exploited an Artifactory zero-day during an internal evaluation, and that neither company had said which CVE records match the flaws used.
