JFrog Artifactory (Self-Hosted) versions before 7.133.11 fail to validate a token's scope, checking only the token's signature and issuer, which constitutes an incorrect authorization flaw (CWE-863). A remote, authenticated user with low privileges can obtain or present a token whose scope is never verified, bypassing authorization checks and escalating to higher privileges. Successful attackers gain administrative control of the Artifactory instance; in observed attacks this flaw has been chained with CVE-2026-42018 and CVE-2026-82329 to bypass authentication, take admin control, and deploy backdoor malware. Only self-hosted Artifactory deployments are within the stated affected scope. Exploitation is confirmed in the wild and the vulnerability was added to CISA's KEV catalog on 2026-09-11, although no public proof-of-concept code is known.
What to do: Upgrade self-hosted Artifactory to version 7.133.11 or later immediately, in line with vendor instructions and CISA KEV/BOD 26-04 timelines. Audit issued tokens and logs for tokens carrying elevated scope granted to low-privilege users, and look for signs of compromise such as unexpected admin accounts or persistence, given reported backdoor deployments. Also patch CVE-2026-42018 and CVE-2026-82329, which attackers are chaining with this flaw.
Affected
JFrog Artifactory (Self-Hosted)
All versions before 7.133.11
Estimated exposure
largetens of thousands of self-hosted instances (subset internet-exposed) — Artifactory is one of the most widely deployed binary repository managers among enterprise development teams, but the affected scope is limited to self-hosted installations, of which only a portion are internet-exposed, supporting an…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope.
CISA Known Exploited Vulnerability
Affected
JFrog Artifactory
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Attackers chained JFrog Artifactory flaws CVE-2026-42018 and CVE-2026-42016 for admin control, planting Rust backdoors; CVE-2026-82329 also mass-exploited.
Wiz observed attackers chaining CVE-2026-42018 (anonymous-token leak) and CVE-2026-42016 (token escalation) in self-hosted JFrog Artifactory between August 15 and September 8, gaining admin control, creating admin accounts, and installing malicious Groovy plugins and a custom Rust backdoor. Separately, critical authentication bypass CVE-2026-82329 (CVSS 9.8) was mass-exploited starting September 1, drawing ~406,000 exploitation attempts on September 2 per Fastly. CISA added CVE-2026-82329 to KEV on September 2 with a September 5 federal deadline. Patching does not revoke minted tokens or rotate stolen join keys; admins must review accounts and rotate credentials.
Wiz Research confirms in-the-wild exploitation of three JFrog Artifactory vulnerabilities, chained to gain administrative control, deploy Groovy plugins, and install Rust backdoors.
Wiz Research identified active exploitation of CVE-2026-42016, CVE-2026-42018, and CVE-2026-82329 in JFrog Artifactory between August 15 and September 8, 2026. Attackers chain the anonymous-token exposure (CVE-2026-42018) with the token scope-validation flaw (CVE-2026-42016) to obtain admin-scoped tokens, while CVE-2026-82329 allows unauthenticated administrative access in default configurations. Observed post-exploitation includes persistent administrator accounts created in under five minutes, malicious Groovy plugin deployment, ad-hoc command execution, Rust-based C2 backdoors dropped to writable paths, and webshell uploads. Wiz measured that 59-62% of organizations running Artifactory remained vulnerable to the chained CVEs weeks after disclosure, and the vulnerabilities were already included in CISA KEV.
Wiz Research observes multiple attackers exploiting three JFrog Artifactory flaws, including default-configuration authentication bypass CVE-2026-82329, to gain admin access and deploy backdoors.
Attackers chain CVE-2026-42018 and CVE-2026-42016 to exchange anonymous JWTs for administrator-scoped tokens, or exploit CVE-2026-82329 directly via the registry join endpoint to obtain admin privileges under default configuration. Post-exploitation observed by Wiz includes persistent admin users created within five minutes, malicious Groovy plugins for command execution, and Rust-based backdoors dropped to /tmp, /var/tmp, and /dev/shm with C2 communications. Compromise exposes software artifacts, repository credentials, CI/CD integrations, and cluster secrets, creating supply chain risks. Fixed releases include 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, and 7.161.20.
CISA added four actively exploited GitLab, JFrog Artifactory, and ConnectWise ScreenConnect flaws to the KEV catalog with imminent deadlines.
CISA added CVE-2026-42016 and CVE-2026-42018 (JFrog Artifactory), CVE-2026-84869 (ConnectWise ScreenConnect), and CVE-2026-85706 (GitLab, CVSS 10.0) to its KEV catalog. Artifactory flaws are being chained with CVE-2026-82329 in attacks observed August 15 to September 8, taking over self-hosted servers, creating persistent administrator accounts, and installing backdoors. ScreenConnect CVE-2026-84869 allows unauthorized file transfer and execution during remote sessions, linked by Huntress to malicious VBScript deliveries, and is fixed in version 26.6.5. GitLab's repository commits API path traversal exposes SSH keys, database credentials, deploy tokens, and CI/CD variables, with watchTowr already observing in-the-wild probes. Federal agencies must patch GitLab and ScreenConnect flaws by September 14, 2026, and Artifactory flaws by September 25, 2026.
Attackers chain JFrog Artifactory flaws CVE-2026-42018 and CVE-2026-42016 to gain admin tokens and deploy a Rust backdoor on self-hosted servers.
Wiz observed multiple threat actors chaining CVE-2026-42018 and CVE-2026-42016 against self-hosted JFrog Artifactory instances between August 15 and September 8, 2026, in some cases obtaining admin access in under five minutes. The critical authentication bypass CVE-2026-82329 was also exploited this month to mint administrator tokens. Attackers installed malicious Groovy plugins, dropped a Rust backdoor with C2 capabilities, uploaded webshells, stole configuration data and cluster join keys, and added SSH keys to new accounts. Wiz estimates 49-62% of internet-reachable Artifactory instances are vulnerable to at least one of the three flaws, and patched releases from 7.111.21 through 7.161.20 are available.
Multiple attackers are exploiting three JFrog Artifactory CVEs, including critical auth-bypass CVE-2026-82329, to gain admin access and install backdoors.
Wiz confirmed in-the-wild exploitation of all three JFrog Artifactory vulnerabilities: CVE-2026-42018 (high, improper authentication token leak), CVE-2026-42016 (high, privilege escalation), and CVE-2026-82329 (critical, unauthenticated authentication bypass). Starting August 15, attackers chained the first two bugs against self-hosted instances to gain admin access and dropped a custom Rust backdoor for C2; from September 1-8 several attackers exploited CVE-2026-82329. Post-exploitation included persistent admin accounts, Groovy plugins for remote code execution, web shells, token minting, key theft, and reconnaissance. Patching velocity has been slow, with 49-62% of organizations still vulnerable to individual bugs weeks after fixes were released.
Wiz observed active exploitation of three JFrog Artifactory flaws used to mint admin tokens, deploy malicious plugins, and install Rust backdoors on self-hosted servers.
JFrog Artifactory flaws CVE-2026-42016, CVE-2026-42018, and CVE-2026-82329 are being actively exploited against self-hosted instances, enabling token exposure, token scope abuse, and a critical default-configuration authentication bypass. Wiz observed attackers chaining CVE-2026-42018 and CVE-2026-42016 from August 15 to September 8, 2026, creating persistent administrator accounts in under five minutes, deploying malicious Groovy plugins, and installing Rust-based backdoors. At disclosure, 67-69 percent of Wiz-monitored organizations ran vulnerable instances; fixed releases include 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, and 7.161.20 or later depending on branch.
CISA added five actively exploited JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS flaws to its KEV catalog.
CISA added five actively exploited vulnerabilities to the KEV catalog: CVE-2026-42016 and CVE-2026-42018 in JFrog Artifactory, CVE-2026-84869 in ConnectWise ScreenConnect (CVSS 9.9), and CVE-2026-67277 and CVE-2026-86060 in MikroTik RouterOS. The Artifactory bugs are chained with CVE-2026-82329 to gain administrative control, deploy malicious Groovy plugins, and install Rust-based backdoors. CERT Polska dubbed the RouterOS chain 'MikroTrick'; FCEB agencies must patch between September 13 and 25, 2026.
CISA added three actively exploited vulnerabilities — two JFrog Artifactory and one ConnectWise ScreenConnect — to its KEV Catalog.
CISA added CVE-2026-42016 (JFrog Artifactory incorrect authorization), CVE-2026-42018 (JFrog Artifactory improper authentication), and CVE-2026-84869 (ConnectWise ScreenConnect improper privilege management and missing authorization) to the Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. BOD 26-04 requires Federal Civilian Executive Branch agencies to prioritize rapid remediation of such high-risk vulnerabilities on publicly exposed assets and to check for prior compromise. CISA urges all organizations to adopt risk-based vulnerability management and prioritize KEV remediation.
Wiz reports multiple actors chaining three JFrog Artifactory auth flaws to gain admin and deploy backdoors; CISA added all three CVEs to KEV.
Wz reports threat actors exploiting CVE-2026-42018, CVE-2026-42016, and CVE-2026-82329 in self-hosted JFrog Artifactory instances to bypass authentication and gain administrative privileges. Between August 15 and September 8, 2026, multiple actors chained CVE-2026-42018 and CVE-2026-42016 to mint anonymous-user tokens, escalate privileges, create persistent admin accounts, install malicious plugins for code execution, and drop second-stage payloads. From early September, CVE-2026-82329 was exploited for configuration exfiltration, cluster key theft, token minting, and SSH key attachment to attacker-created accounts. CISA added all three CVEs to its KEV catalog, giving federal agencies two weeks under BOD 26-04 to patch to versions 7.161.20, 7.146.38, 7.133.29, 7.125.20, 7.117.28, or 7.111.21.
Weekly Security Affairs newsletter aggregates top stories including Cisco FMC exploitation, Qilin ransomware, Chrome zero-days, and Berlin leak.
Pierluigi Paganini's Security Affairs newsletter Round 594 (International Edition) rounds up the week's security headlines. Topics include attackers exploiting a critical Cisco FMC flaw to deploy Qilin ransomware, SonicWall mass exploitation linked to a UK council attack, multiple CISA KEV additions, Chrome zero-days used by four nation-state actors, a $320 million Liquid Network theft, and a Berlin ransomware data leak. It also covers AI security items such as agent sandbox failures and distillation campaigns by Chinese AI firms.