2026-09-12 · view entry permalink →
CVE-2026-42016 + CVE-2026-42018, JFrog Artifactory: chaining two previously-patched token flaws turns an unauthenticated request into full administrative control in two API calls, confirmed exploited since mid-August
JFrog disclosed the two flaws separately and weeks apart, labeling each only "High" without a numeric score; the CNA's own submitted CVSS 3.1 base scores (8.1 for CVE-2026-42016 and 7.5 for CVE-2026-42018) are recorded in the MITRE CVE record for each (MITRE CVE Record, CVE-2026-42016; MITRE CVE Record, CVE-2026-42018). CVE-2026-42016 (CWE-863 Incorrect Authorization), disclosed 27 July 2026, is a privilege-escalation bug in Artifactory's token handling: the platform validates a token's signature and issuer but never checks whether the token's scope matches what it is being used for, so a low-privileged token can be exchanged for one carrying administrative authority (JFrog, 2026-07-27). CVE-2026-42018 (CWE-287 Improper Authentication), disclosed 12–13 August 2026, is narrower but supplies the missing first step: Artifactory returns an internal anonymous-user token to a caller who never authenticated, even when anonymous access is disabled (JFrog, 2026-08-13). Neither flaw alone grants administrative control; Wiz Research states plainly that the anonymous token from CVE-2026-42018 and the scope-validation gap in CVE-2026-42016 "together... can turn an unauthenticated request into an admin-scoped token in two steps" (Wiz Research, 2026-09-10).
Kill chain, as Wiz reconstructed it from real intrusions (initial access, T1190). An unauthenticated POST /access/api/v1/aws/token/ (the trailing slash matters; the bare path without it returns 401) returns HTTP 200 with a JWT scoped to Artifactory's internal anonymous identity, exploiting CVE-2026-42018. The operator then exchanges that JWT for a new one via POST /access/api/v1/tokens, which returns HTTP 200 carrying admin authority despite the request originating from the anonymous identity, exploiting CVE-2026-42016's missing scope check (T1550.001, forging elevated authority onto an application access token). The escalated token still shows token:anonymous as its actor in logs, which is itself a detection anomaly: no legitimate administrative action originates from the anonymous identity. Wiz observed actors reach a created administrator account in under five minutes from the first request in some cases. CISA added both CVEs to its Known Exploited Vulnerabilities catalog on 2026-09-11 (CISA KEV, catalogue version 2026.09.11).
Post-exploitation observed across the chained cases. Operators create persistent administrator accounts via PUT /api/security/users/<username> or /access/api/ui/users/<username> (T1136.001); deploy malicious Groovy plugins through Artifactory's own extensible plugin framework to gain arbitrary code execution (T1505, abusing a legitimate server extension mechanism for persistence); and run ad-hoc shell commands through the plugin-execution endpoint (GET/POST /api/plugins/execute/<plugin>), used for reconnaissance and file enumeration (T1059). Across multiple cases Wiz observed a custom Rust-based backdoor with command-and-control capability dropped to disk as a further persistence layer.
Wiz's own patching-velocity data is the second half of the defender-relevant finding: at first disclosure, 67% of organizations running Artifactory had at least one instance vulnerable to CVE-2026-42016, and a similar 69% for CVE-2026-42018; six weeks after CVE-2026-42016's disclosure, 59% remained vulnerable, and CVE-2026-42018 fell only from 69% to 62% over four weeks, versus the separately-disclosed CVE-2026-82329 (a default-configuration join-key bypass, disclosed 28 August 2026), which dropped from 67% to 49% within two weeks of its own disclosure. Wiz attributes the gap to CVE-2026-82329's critical-severity label likely driving faster security-team attention, while these two high-severity CVEs went unpatched at far higher rates for far longer; precisely the CVSS-driven prioritization trap that let this chain stay open long enough to be found under active exploitation.
Wiz Research has identified active, in-the-wild exploitation of three critical and high-severity vulnerabilities affecting JFrog Artifactory: CVE-2026-42016, CVE-2026-42018, and CVE-2026-82329. Attackers are chaining these vulnerabilities to bypass authentication, escalate privileges, and gain administrative control over vulnerable Artifactory instances.
Between August 15 and September 8, 2026, we observed multiple actors chain CVE-2026-42018 and CVE-2026-42016 against self-hosted Artifactory instances. Across multiple cases we observed a custom Rust backdoor with C2 capabilities being dropped. Wiz Research is not aware of any prior public reporting of in-the-wild exploitation involving those two CVEs.
JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature/issuer and not the token's scope.
Builds on: 2026-09-01/jfrog-artifactory-cve-2026-82329-default-config-admin-bypass