More JFrog Artifactory bugs under attack, and all 3 have patches
Multiple attackers are exploiting three JFrog Artifactory CVEs, including critical auth-bypass CVE-2026-82329, to gain admin access and install backdoors.
Wiz confirmed in-the-wild exploitation of all three JFrog Artifactory vulnerabilities: CVE-2026-42018 (high, improper authentication token leak), CVE-2026-42016 (high, privilege escalation), and CVE-2026-82329 (critical, unauthenticated authentication bypass). Starting August 15, attackers chained the first two bugs against self-hosted instances to gain admin access and dropped a custom Rust backdoor for C2; from September 1-8 several attackers exploited CVE-2026-82329. Post-exploitation included persistent admin accounts, Groovy plugins for remote code execution, web shells, token minting, key theft, and reconnaissance. Patching velocity has been slow, with 49-62% of organizations still vulnerable to individual bugs weeks after fixes were released.
- CVE-2026-82329: critical unauthenticated auth bypass; CVE-2026-42018: token leak; CVE-2026-42016: privilege escalation.
- Attackers chained CVE-2026-42018 and CVE-2026-42016 for admin access, dropping a custom Rust backdoor for C2.
- Post-exploitation included Groovy plugin RCE, web shells, token minting, key theft, and SSH key attachment.
- 49-62% of organizations remained vulnerable weeks after patches; Wiz urges immediate upgrades of internet-facing instances.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1136.001 Create Account: Local AccountT1505.003 Web ShellT1059.004 Unix ShellT1552.004 Private Keys
- Products
- Artifactory
- Organizations
- JFrogWizwatchTowrOpenAIHugging Face
- AI models
- OpenAI models
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-42016 | Token Scope Validation Flaw Enables Privilege Escalation in JFrog Artifactory | 8.8 | 9% | KEV | KEV |
| CVE-2026-42018 | Improper Authentication in JFrog Artifactory Exposes Internal Anonymous Tokens | 7.5 | 10% | KEV | KEV |
| CVE-2026-82329 | Improper Authentication in JFrog Artifactory Allows Unauthenticated Admin Access | 9.8 | 14% | KEVPoC ×2 | KEV |
From the original article
3 min read at theregister.comIf you're waiting for a sign to upgrade to a fixed version: this is it
By Jessica Lyons · theregister.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.