45
60
60
Artifactory Under Attack: In-the-Wild Exploitation of CVE-2026-42016, CVE-2026-42018 & CVE-2026-82329
Wiz Research confirms in-the-wild exploitation of three JFrog Artifactory vulnerabilities, chained to gain administrative control, deploy Groovy plugins, and install Rust backdoors.
Wiz Research identified active exploitation of CVE-2026-42016, CVE-2026-42018, and CVE-2026-82329 in JFrog Artifactory between August 15 and September 8, 2026. Attackers chain the anonymous-token exposure (CVE-2026-42018) with the token scope-validation flaw (CVE-2026-42016) to obtain admin-scoped tokens, while CVE-2026-82329 allows unauthenticated administrative access in default configurations. Observed post-exploitation includes persistent administrator accounts created in under five minutes, malicious Groovy plugin deployment, ad-hoc command execution, Rust-based C2 backdoors dropped to writable paths, and webshell uploads. Wiz measured that 59-62% of organizations running Artifactory remained vulnerable to the chained CVEs weeks after disclosure, and the vulnerabilities were already included in CISA KEV.
85
60
45
60
60
60
60
60
Attackers Chain JFrog Artifactory Flaws to Gain Admin Control and Plant Backdoors
Attackers chained JFrog Artifactory flaws CVE-2026-42018 and CVE-2026-42016 for admin control, planting Rust backdoors; CVE-2026-82329 also mass-exploited.
Wiz observed attackers chaining CVE-2026-42018 (anonymous-token leak) and CVE-2026-42016 (token escalation) in self-hosted JFrog Artifactory between August 15 and September 8, gaining admin control, creating admin accounts, and installing malicious Groovy plugins and a custom Rust backdoor. Separately, critical authentication bypass CVE-2026-82329 (CVSS 9.8) was mass-exploited starting September 1, drawing ~406,000 exploitation attempts on September 2 per Fastly. CISA added CVE-2026-82329 to KEV on September 2 with a September 5 federal deadline. Patching does not revoke minted tokens or rotate stolen join keys; admins must review accounts and rotate credentials.
92
60
60
Hackers Exploit JFrog Artifactory Flaws to Bypass Authentication and Gain Admin Access
Wiz Research observes multiple attackers exploiting three JFrog Artifactory flaws, including default-configuration authentication bypass CVE-2026-82329, to gain admin access and deploy backdoors.
Attackers chain CVE-2026-42018 and CVE-2026-42016 to exchange anonymous JWTs for administrator-scoped tokens, or exploit CVE-2026-82329 directly via the registry join endpoint to obtain admin privileges under default configuration. Post-exploitation observed by Wiz includes persistent admin users created within five minutes, malicious Groovy plugins for command execution, and Rust-based backdoors dropped to /tmp, /var/tmp, and /dev/shm with C2 communications. Compromise exposes software artifacts, repository credentials, CI/CD integrations, and cluster secrets, creating supply chain risks. Fixed releases include 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, and 7.161.20.
84
JFrog Artifactory Vulnerabilities Actively Exploited in the Wild to Gain Administrative Control
Wiz observed active exploitation of three JFrog Artifactory flaws used to mint admin tokens, deploy malicious plugins, and install Rust backdoors on self-hosted servers.
JFrog Artifactory flaws CVE-2026-42016, CVE-2026-42018, and CVE-2026-82329 are being actively exploited against self-hosted instances, enabling token exposure, token scope abuse, and a critical default-configuration authentication bypass. Wiz observed attackers chaining CVE-2026-42018 and CVE-2026-42016 from August 15 to September 8, 2026, creating persistent administrator accounts in under five minutes, deploying malicious Groovy plugins, and installing Rust-based backdoors. At disclosure, 67-69 percent of Wiz-monitored organizations ran vulnerable instances; fixed releases include 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, and 7.161.20 or later depending on branch.
79
60
60
60
Critical Gitea Flaw Let Unauthenticated Attackers Read Server Files via Org
60
60
50
60
60
60
45
60
45
60
60
Artifactory flaws chained in attacks deploying backdoor malware
Attackers chain JFrog Artifactory flaws CVE-2026-42018 and CVE-2026-42016 to gain admin tokens and deploy a Rust backdoor on self-hosted servers.
Wiz observed multiple threat actors chaining CVE-2026-42018 and CVE-2026-42016 against self-hosted JFrog Artifactory instances between August 15 and September 8, 2026, in some cases obtaining admin access in under five minutes. The critical authentication bypass CVE-2026-82329 was also exploited this month to mint administrator tokens. Attackers installed malicious Groovy plugins, dropped a Rust backdoor with C2 capabilities, uploaded webshells, stole configuration data and cluster join keys, and added SSH keys to new accounts. Wiz estimates 49-62% of internet-reachable Artifactory instances are vulnerable to at least one of the three flaws, and patched releases from 7.111.21 through 7.161.20 are available.
82
60
60
60
Google fixes a new Chrome zero
60
60
Google fixes the third actively exploited Chrome 0
60
Google addresses two new Chrome zero
60
45
60