JFrog Artifactory Flaws Exploited to Seize Admin Control

Security researchers have observed active, in-the-wild exploitation of three JFrog Artifactory vulnerabilities that together can bypass authentication and grant full administrative control. The flaws—CVE-2026-82329, CVE-2026-42018, and CVE-2026-42016—pose a severe risk to self-hosted Artifactory deployments, enabling unauthorised access to cloud artefacts, credentials and build pipelines.

Public notices place these as highly critical with CVSSv3 scores up to 9.8, and researchers report ongoing exploitation confirmed by Wiz Research and CISA.

Attackers employ two main paths to gain admin rights. In one path, they chain CVE-42018 (an improper-authentication flaw that can leak an anonymous-user token when anonymous access is disabled) with CVE-42016 (a scope-validation weakness that allows an admin-scoped token to be minted from a low-privilege token within minutes). In a second path, CVE-82329 is exploited directly to request administrative tokens via specific registry endpoints, without authentication.

Once administrators’ privileges are obtained, threat actors deploy persistent access mechanisms such as backdoor administrator accounts, malicious Groovy plugins for remote command execution, and Rust-based backdoors for covert command-and-control.

Evidence cited includes affected release branches and post-exploitation findings, with Wiz Research and CISA confirming active exploitation. Vendors have issued remediated releases across supported trains, and organisations are advised to upgrade to 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, or 7.161.20. Security teams should audit logs for suspicious token minting and enforce tight network access controls to mitigate unauthenticated access. The article is dated 11 September 2026.