SECURITY analysts have reported in-the-wild exploitation of three vulnerabilities in self-hosted JFrog Artifactory: CVE-2026-82329, rated 9.8 (critical), CVE-2026-42016, rated 8.1, and CVE-2026-42018, rated 7.5. The flaws can be chained to bypass authentication and obtain administrative control, potentially exposing proprietary artefacts, credentials and software build pipelines. Wiz Research and CISA are cited as confirming active exploitation, while public proof-of-concept exploit details are reportedly available.
One attack path abuses CVE-2026-42018 to obtain an internal anonymous-user token from an unauthenticated request, even when anonymous access is disabled, then exploits CVE-2026-42016 to bypass scope enforcement and exchange it for an administrator-scoped token. Separately, CVE-2026-82329 reportedly allows unauthenticated remote attackers to request administrative tokens through specific registry endpoints.
Observed post-compromise activity includes creating administrator backdoor accounts, uploading malicious Groovy plugins to run shell commands, and installing Rust-based backdoors for command-and-control. Administrators should upgrade to fixed releases, including 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38 or 7.161.20, as applicable. They should also review audit logs for suspicious token-minting requests and consider restricting Artifactory access to internal network perimeters.