An active exploitation of three JFrog Artifactory vulnerabilities that attackers are using to bypass authentication, elevate privileges, and take administrative control of exposed servers.
The flaws, tracked as CVE-2026-42016, CVE-2026-42018, and CVE-2026-82329, affect multiple Artifactory release branches and create a serious supply-chain security risk.
Attackers have already targeted self-hosted Artifactory deployments, creating persistent administrator accounts, deploying malicious Groovy plugins, executing shell commands, and installing Rust-based backdoors.
Since Artifactory commonly stores software packages, credentials, repository metadata, and CI/CD integrations, a successful compromise could give attackers a route into broader development and cloud environments.
CVE-2026-42018 is an authentication flaw that can expose an internal anonymous-user token to an unauthenticated remote requester, even when anonymous access is disabled. The token may provide access to resources available to Artifactory’s internal anonymous identity.
CVE-2026-42016 is a token scope-validation weakness. Artifactory validates a token’s signature and issuer but may fail to enforce its authorized scope correctly. An attacker can abuse a valid low-privilege token to request elevated permissions.
JFrog Artifactory Vulnerabilities Actively Exploited
Wiz observed attackers chaining CVE-2026-42018 and CVE-2026-42016 between August 15 and September 8, 2026. The activity began with a POST request to /access/api/v1/aws/token/, including a trailing slash, which returned an anonymous JWT token.
The attackers then sent the token to /access/api/v1/tokens to generate an administrator-scoped token. Subsequent actions appeared in logs as token: anonymous, despite possessing administrative authority.
In several cases, attackers created a persistent administrator account in less than five minutes using endpoints such as /api/security/users/.
They also installed malicious Groovy plugins through Artifactory’s native plugin framework, allowing arbitrary server-side command execution.
Payload droppers downloaded binaries into writable locations including /tmp, /dev/shm, and /var/tmp, then established command-and-control communications.
The third flaw, CVE-2026-82329, is a critical authentication bypass affecting Artifactory installations using the default configuration. An unauthenticated attacker can send a POST request to /access/api/v1/registry/join and potentially receive an administrator-scoped token.
Wiz observed exploitation from September 1 through September 8, followed by configuration theft, user and repository enumeration, token creation, and theft of cluster join keys.
Threat actors also created accounts named jfrog-distribution, jfrog-insight, repo-service, backup-service, ldap_admin, and 0xterror. These accounts can blend into normal service identities and provide long-term access after the initial vulnerability is patched.
Cloud exposure remains significant. Wiz found that 67 percent of organizations running Artifactory had at least one vulnerable instance when CVE-2026-42016 was disclosed on July 27.
JFrog Artifactory Exploitation IOCs:
| Type | IOCs |
|---|---|
| IP / C2 | 93.104.155[.]133, 146.19.216[.]120, 185.190.58[.]172, 45.61.176[.]88, 137.184.111[.]69, 64.207.232[.]6:8443 |
| Payload URLs | hxxp://log.gitclone[.]org:45678/smtp, hxxp://3.88.162[.]79:36789/smtp |
| File / Hash | /tmp/.z — 513a907b69edffc3cb77a494da395178d21ef9bd |
| Account | 0xterror, svc_[a-zA-Z0-9]{8}, Nxploited_[a-zA-Z0-9]{3} |
For CVE-2026-42018, 69 percent were vulnerable at disclosure, while CVE-2026-82329 affected 67 percent of organizations when published on August 28. Remediation for the critical authentication bypass was faster, but 49 percent of organizations remained exposed two weeks later.
Organizations should immediately identify all Artifactory instances, prioritize internet-facing deployments, and upgrade to fixed releases. Fixed versions include 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, and 7.161.20 or later, depending on the affected vulnerability and release branch.
Security teams should hunt for successful requests to /access/api/v1/aws/token/, /access/api/v1/tokens, and /access/api/v1/registry/join.
They should also investigate unexpected privileged activity by anonymous or low-privilege identities, newly created administrator accounts, plugin deployments, token minting, configuration exports, and unusual outbound connections from Artifactory servers.
Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.
The post JFrog Artifactory Vulnerabilities Actively Exploited in the Wild to Gain Administrative Control appeared first on Cyber Security News.