Wiz Research has confirmed active exploitation of three vulnerabilities in JFrog Artifactory, the artifact repository at the heart of many CI/CD pipelines. Between August 15 and September 8, 2026, multiple actors chained two of them to go from an anonymous request to an administrator account, sometimes in under five minutes. A third, critical flaw hands out an admin token directly. Once inside, attackers installed malicious Groovy plugins, dropped a Rust backdoor and stole signing keys. All of that stays in place after the upgrade.
- Three exploited CVEs: CVE-2026-42018 and CVE-2026-42016, chained together, plus CVE-2026-82329 (CVSS 9.8), a standalone authentication bypass.
- Self-hosted instances are affected. JFrog says Cloud instances have already been fixed.
- Post-compromise activity: persistent admin accounts, malicious Groovy plugins, a Rust backdoor with command and control, and theft of configuration, credentials and signing keys.
- Six weeks after disclosure, Wiz estimates that 59% of organizations running Artifactory were still vulnerable to CVE-2026-42016.
- Wiz advises treating any exposed, vulnerable instance as compromised: upgrading is not enough.
Three flaws, two paths to admin
| CVE | Weakness | Severity | JFrog advisory | Added to KEV |
|---|---|---|---|---|
| CVE-2026-42018 | Improper authentication: internal anonymous-user token returned to an unauthenticated caller, even with anonymous access disabled | High (CVSS 7.5) | August 12, 2026 | September 11, 2026 |
| CVE-2026-42016 | Incorrect authorization: token signature and issuer are checked, but not its scope | High (CVSS 8.1) | July 27, 2026 | September 11, 2026 |
| CVE-2026-82329 | Authentication bypass in the default configuration, leading to admin access | Critical (CVSS 9.8) | August 28, 2026 | September 2, 2026 |
Path 1: from anonymous token to admin token
Wiz describes a chain of three unauthenticated HTTP requests:
- A POST to /access/api/v1/aws/token/ (with the trailing slash) returns a JWT for the internal anonymous user (CVE-2026-42018).
- A POST to /access/api/v1/tokens with that JWT returns an admin-scoped token that still carries the anonymous username (CVE-2026-42016).
- A PUT to /api/security/users/<name> or /access/api/ui/users/<name> creates a persistent admin.
In the logs, follow-on actions appear under the actor token:anonymous.
Path 2: abusing cluster join
CVE-2026-82329 is more direct: a POST to /access/api/v1/registry/join returns an admin token. According to published analyses, on a default install an empty join key is still treated as valid and has a predictable signing secret, so an attacker can forge a join JWT. JFrog’s interim mitigation is to set a random additionalJoinKeys value under shared › security in system.yaml and restart the Access service. According to press reports, watchTowr saw this flaw exploited from September 1, just days after the fix.
What attackers do once inside
Wiz stresses that the activity it observed does not come from a single actor. Recurring behaviors include:
- Persistent admin accounts with test-style names (labadmin_…, svc_…) or legitimate-looking ones (jfrog-distribution, repo-service, backup-service, ldap_admin…), sometimes with an attacker SSH key attached.
- Long-lived tokens created through /access/api/v1/tokens.
- Data theft: system configuration, the cluster join key, and enumeration of users, repositories and tokens.
- Second-stage payloads downloaded to /dev/shm, /tmp or /var/tmp, including a Rust backdoor with command-and-control capabilities, and occasionally web shells uploaded into repositories.
Groovy plugins that survive the patch
Wiz’s September 17 update details the malicious Groovy plugins dropped into $JFROG_HOME/var/etc/artifactory/plugins/. They run unsandboxed with the service account’s privileges, reload on restart and survive patching. Wiz groups them into three tiers:
| Tier | Plugins | Capabilities |
|---|---|---|
| 1 — Disposable shells | rce.groovy, cmd.groovy, jwtToken.groovy, uploadFile.groovy | Command execution. Some are open to the anonymous user and keep working after patching |
| 2 — Credential harvesting | JFrogImage.groovy | Exports configuration (LDAP, Crowd, mail, proxies, remote repositories, with decrypted credentials), the user and token database, and Access signing keys. Output is returned through an HTTP 500 error to evade detections |
| 3 — Resident implants | metrics.groovy, httpSession.groovy | In-memory servlet filter, blocking of competing actors, Access private key read, network tunnel, request*.log truncation and self-deletion |
Why it matters
Artifactory sits at the center of the software supply chain: it stores and distributes build and deployment artifacts. An attacker with admin rights can change what your pipelines consume. With the Access private key, they can keep forging tokens until the certificate is reset.
Slow patching makes things worse. According to Wiz, 67% of organizations running Artifactory had at least one instance vulnerable to CVE-2026-42016 at publication, and 59% still did six weeks after disclosure. For CVE-2026-82329, the share fell from 67% to 49% in two weeks.
Fixed versions
Upgrade to 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38 or 7.161.20 (or later), depending on your branch. These are the versions recommended by Wiz and by JFrog’s CVE-2026-82329 advisory.
MITRE ATT&CK view
Wiz does not provide an ATT&CK mapping. The table below is an indicative Defensy reading of the behaviors described.
| Technique | Observed behavior |
|---|---|
| T1190 — Exploit Public-Facing Application | Exploitation of the three CVEs on exposed instances |
| T1136 — Create Account | Persistent admin accounts created |
| T1098 — Account Manipulation | Attacker SSH keys attached to created accounts |
| T1505 — Server Software Component | Persistent malicious Groovy plugins |
| T1505.003 — Web Shell | Web shells uploaded into repositories |
| T1105 — Ingress Tool Transfer | Payloads downloaded to /tmp, /dev/shm and /var/tmp |
| T1552.001 — Credentials In Files | Configuration export with decrypted credentials and signing keys |
| T1070 — Indicator Removal | request*.log truncation and plugin self-deletion |
| T1090 — Proxy | Network tunnel provided by httpSession.groovy |
Recommendations
- ImmediateUpgrade and restrict access
Apply the fixed version for your branch, starting with internet-facing instances, and restrict Artifactory to trusted networks and systems. If you cannot upgrade right away, apply JFrog’s additionalJoinKeys mitigation.
- ImmediateAssume compromise and hunt
If the instance was exposed while vulnerable, review admin accounts, tokens, attached SSH keys and the plugins folder. A broken plugin API on an otherwise normal server may point to the metrics implant.
- ImmediateRotate keys and credentials
Reset the Access token signing certificate, because an upgrade does not revoke a stolen private.key. Also rotate the cluster join key and every credential stored in Artifactory (LDAP, proxies, remote repositories, database).
- Short termDeploy detections on Artifactory logs
Alert on a 401 on /access/api/v1/aws/token/ followed by a 200 on a variant from the same client, on calls to /access/api/v1/tokens by anonymous or low-privileged identities, and on a successful /registry/join correlated with user creation or a configuration read. Watch for empty or truncated log files.
- Short termCheck artifact integrity
Review artifacts published or modified during the exposure window, and repositories where unexpected files were uploaded.
- Medium termTreat the artifact repository as a critical asset
Send its logs to the SOC, keep admin accounts to a minimum and include Artifactory in your penetration tests and software supply chain reviews.
This campaign shows that a patch does not end an incident: accounts, plugins and stolen keys survive the upgrade. An Artifactory instance that was exposed during the exploitation window should be handled as a security incident, not just a patching task.
Our SOC, Detection & Response team can run this compromise assessment and support remediation. If you see suspicious activity, report the incident right away. With IGIDER Strike, you keep an up-to-date view of your exposed assets and their exploitable vulnerabilities.
- Artifactory Under Attack: In-the-Wild Exploitation of CVE-2026-42016, CVE-2026-42018 & CVE-2026-82329Wiz Research — S. Dorfman, S. Johnstone, Z. Kaplan, K. Giacchino — September 10, 2026, updated September 17, 2026
- JFrog Security AdvisoriesJFrog
- CISA KEV Flags Exploited Artifactory, ScreenConnect and RouterOS VulnerabilitiesHexnode — September 16, 2026
- Artifactory flaws chained in attacks deploying backdoor malwareBleepingComputer — September 11, 2026
- CVE-2026-82329: Critical JFrog Artifactory Authentication Bypass Exploited in the WildSOC Prime — September 2026
- Attackers chain JFrog Artifactory flaws (original article)The Hacker News — September 2026
- MITRE ATT&CK® — Enterprise MatrixMITRE Corporation
