Attackers Chain JFrog Artifactory Flaws to Seize Admin Control

Attackers chained two Artifactory flaws to seize admin control of self-hosted JFrog Artifactory servers and plant backdoors, according to Wiz. Between 15 August and 8 September 2026, they exploited CVE-2026-42018, which exposes an internal anonymous-user token to unauthenticated callers even when anonymous access is disabled, followed by CVE-2026-42016, which lets a low-privilege token be swapped for an administrator-scoped token.

The pattern involved an unauthenticated request to a token endpoint that returned the internal anonymous token, then exchange at Artifactory’s token-creation endpoint for an administrator-token. Admin actions performed with this token appeared in logs as token:anonymous, and in several cases attackers progressed to create real administrator accounts in under five minutes. The chain targeted a narrow set of builds; closing either flaw on a given server would curb the attack.

A separate vulnerability, CVE-2026-82329, was exploited independently in late August/early September and is a critical authentication bypass that can grant admin privileges on affected systems, affecting six release branches up to 7.161. Public exploitation spiked, with Fastly recording around 406,000 exploitation attempts on 2 September.

Patching guidance from JFrog covers the fixed builds for each branch (7.133.11 for CVE-42016, and 7.146.8/7.111.20 etc. for CVE-42018), while Fastly warns that tokens minted before patching remain usable and that rotating the join key and revoking tokens is prudent. Wiz and CISA note that attackers often implanted persistent admin accounts, installed Groovy plugins for code execution, and used backdoors and C2 channels.

To check, look for anonymous or low-privilege accounts performing admin-like actions or plugin listings; audit and rotate keys, tokens, and administrator accounts.