CVE-2026-42016 + CVE-2026-42018, JFrog Artifactory: chaining two previously-patched token flaws turns an unauthenticated request into full administrative control in two API calls, confirmed exploited since mid-August
Two JFrog Artifactory bugs patched weeks ago are confirmed chained into full admin takeover
Defender actions
- Upgrade every self-hosted JFrog Artifactory instance to a build that closes both CVEs: 7.133.11 or later for CVE-2026-42016, which JFrog names as its only fixed build, and the CVE-2026-42018 fix for the branch, where Wiz's corrected builds (7.133.29, 7.146.38, 7.161.20) sit above JFrog's table. Wiz's 7.111.21, 7.117.28 and 7.125.20 are below 7.133.11, so instances on those branches remain vulnerable to CVE-2026-42016 and must move to 7.133.11 or later.
- On any Artifactory instance that was internet-reachable and unpatched since 15 August 2026, search access logs for an unauthenticated POST to /access/api/v1/aws/token/ followed by a POST to /access/api/v1/tokens from the same client (in some cases Wiz saw an admin account created within five minutes of the first request); on a hit with both answered HTTP 200, treat the instance as compromised and reset the Access token signing key and certificate before relying on the upgrade.
Analysis
JFrog disclosed the two flaws separately and weeks apart, on 2026-07-27 and 2026-08-12; its advisory page labels each only "High" (JFrog, 2026-07-27), while its own CVE records as numbering authority score them CVSS 3.1 8.1 (CVE-2026-42016) and 7.5 (CVE-2026-42018) (ENISA EU Vulnerability Database, 2026-07-27; ENISA EU Vulnerability Database, 2026-08-12). CVE-2026-42016 (CWE-863 Incorrect Authorization), disclosed 27 July 2026, is a privilege-escalation bug in Artifactory's token handling: the platform validates a token's signature and issuer but not the token's scope (JFrog, 2026-07-27). Wiz describes the consequence: a low-privileged token can be escalated to admin scope (Wiz Research, 2026-09-10). CVE-2026-42018 (CWE-287 Improper Authentication), disclosed 12–13 August 2026, is narrower but supplies the missing first step: Artifactory returns an internal anonymous-user token to a caller who never authenticated, even when anonymous access is disabled (JFrog, 2026-08-13). Neither flaw alone grants administrative control. Of the anonymous token from CVE-2026-42018 and the scope-validation gap in CVE-2026-42016, Wiz Research writes: "Together, the two can turn an unauthenticated request into an admin-scoped token in two steps" (Wiz Research, 2026-09-10).
Kill chain, as Wiz reconstructed it from real intrusions (initial access, T1190). An unauthenticated POST /access/api/v1/aws/token/ (with the trailing slash, since the bare path returns 401) returns HTTP 200 with a JWT scoped to Artifactory's internal anonymous identity, exploiting CVE-2026-42018 (Wiz Research, 2026-09-10). The operator then exchanges that JWT for a new one via POST /access/api/v1/tokens, which returns HTTP 200 carrying admin authority despite the request originating from the anonymous identity, exploiting CVE-2026-42016's missing scope check (T1550.001, forging elevated authority onto an application access token) (Wiz Research, 2026-09-10). The escalated token still shows token:anonymous as its actor in logs, and Wiz treats the internal anonymous identity, or any low-privilege identity, minting tokens, enumerating users or touching plugins as the anomaly to hunt (Wiz Research, 2026-09-10). Wiz observed actors reach a created administrator account in under five minutes from the first request in some cases (Wiz Research, 2026-09-10). CISA added both CVEs to its Known Exploited Vulnerabilities catalog on 2026-09-11 (CISA KEV, catalogue version 2026.09.11).
Post-exploitation observed across the chained cases. Operators create persistent administrator accounts via PUT /api/security/users/<username> or /access/api/ui/users/<username> (T1136.001); deploy malicious Groovy plugins through Artifactory's own extensible plugin framework to gain arbitrary code execution (T1505, abusing a legitimate server extension mechanism for persistence); and run ad-hoc shell commands through the plugin-execution endpoint (GET/POST /api/plugins/execute/<plugin>), used for reconnaissance and file enumeration (T1059) (Wiz Research, 2026-09-10). Across multiple cases Wiz observed a custom Rust-based backdoor with command-and-control capability dropped to disk as a further persistence layer (Wiz Research, 2026-09-10).
Wiz's own patching-velocity data is the second half of the defender-relevant finding: at first disclosure, 67% of organizations running Artifactory had at least one instance vulnerable to CVE-2026-42016, and a similar 69% for CVE-2026-42018; six weeks after CVE-2026-42016's disclosure, 59% remained vulnerable, and CVE-2026-42018 fell only from 69% to 62% over four weeks. The separately disclosed CVE-2026-82329 (an authentication bypass under default configuration, disclosed 28 August 2026) dropped from 67% to 49% within two weeks of its own disclosure (Wiz Research, 2026-09-10). Wiz attributes that faster remediation to CVE-2026-82329's critical severity rating, which likely drove more urgent attention from security teams (Wiz Research, 2026-09-10). The two high-rated flaws in this chain stayed unpatched for longer, and the exploitation Wiz reports began inside that window.
Contradiction: JFrog's CVE-2026-42018 table names 7.111.20, 7.117.27, 7.125.19, 7.133.28 and 7.146.8 as the patched builds, while its affected ranges on the last four branches end at those same builds (for example 7.117.0 to 7.117.27) (JFrog, 2026-08-13). Wiz corrected its fixed versions for this CVE on 2026-09-11 and lists 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38 and 7.161.20 (Wiz Research, 2026-09-10). Take the higher build. For CVE-2026-42016 JFrog names 7.133.11 as the only fixed build, so Wiz's 7.111.21, 7.117.28 and 7.125.20 remain inside JFrog's affected range for that flaw (JFrog, 2026-07-27).
Triage: the highest-confidence signal is behavioral rather than a single request: a 401 on the bare token path (/access/api/v1/aws/token without the trailing slash) followed by a 200 on a variant of it, such as the trailing-slash form, from the same client in a short window. That is an operator confirming the vulnerable variant before relying on it, and a normal client does not produce it (Wiz Research, 2026-09-10). Correlate any resulting anonymous-identity token activity against later user-creation, plugin-execution or credential-enumeration calls.
Cited evidence
Wiz Research has identified active, in-the-wild exploitation of three critical and high-severity vulnerabilities affecting JFrog Artifactory: CVE-2026-42016, CVE-2026-42018, and CVE-2026-82329. Attackers are chaining these vulnerabilities to bypass authentication, escalate privileges, and gain administrative control over vulnerable Artifactory instances.
Between August 15 and September 8, 2026, we observed multiple actors chain CVE-2026-42018 and CVE-2026-42016 against self-hosted Artifactory instances. Across multiple cases we observed a custom Rust backdoor with C2 capabilities being dropped. Wiz Research is not aware of any prior public reporting of in-the-wild exploitation involving those two CVEs.
JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature/issuer and not the token's scope.
In some instances, actors moved from the first request to a created admin account in under five minutes.
Updates3
Take the higher fixed build for CVE-2026-42018. JFrog's table names 7.111.20, 7.117.27, 7.125.19, 7.133.28 and 7.146.8 as the patched builds, while its affected ranges on the last four branches end at those same builds (JFrog, 2026-08-13). Wiz corrected its fixed versions on 2026-09-11 to 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38 and 7.161.20 (Wiz Research, 2026-09-10). CVE-2026-42016 is fixed only from 7.133.11, so an instance on the 7.111, 7.117 or 7.125 branch needs 7.133.11 or later to close CVE-2026-42016, on a build that also carries that branch's CVE-2026-42018 fix (JFrog, 2026-07-27). An instance that shows exploitation needs its Access token signing key and certificate reset as well as an upgrade, because a stolen key keeps forging valid tokens after patching (Wiz Research, 2026-09-10). JFrog's advisory page rates both flaws High and gives no numeric score (JFrog, 2026-07-27); the CVSS 3.1 scores of 8.1 and 7.5 come from JFrog's own CVE records as numbering authority (ENISA EU Vulnerability Database, 2026-07-27; ENISA EU Vulnerability Database, 2026-08-12). A log hit counts as successful exploitation when both requests returned HTTP 200, as in every case Wiz observed (Wiz Research, 2026-09-10).
Wiz Research's sentence reads: "Together, the two can turn an unauthenticated request into an admin-scoped token in two steps" (Wiz Research, 2026-09-10); the earlier quotation here shortened it with an ellipsis.
JFrog's own CVE records, as numbering authority, score CVE-2026-42016 at CVSS 3.1 8.1 and CVE-2026-42018 at 7.5 (ENISA EU Vulnerability Database, 2026-07-27; ENISA EU Vulnerability Database, 2026-08-12); its advisory page shows only the High label (JFrog, 2026-07-27). Wiz gives no interval between the two token requests: its only timing is that "In some instances, actors moved from the first request to a created admin account in under five minutes" (Wiz Research, 2026-09-10), so a log search should not require the second request within minutes of the first.
Sources7
Revision history
- Published 2026-09-12T0409Z-intel
- Correction 2026-09-30T0639Z-audit
The 8.1 and 7.5 scores came from the MITRE CVE records, and the cited advisory pages do not carry them. They are removed from the text and the structured data, and the severity sentence now cites JFrog's advisory page, which rates both flaws High. The fixed-build guidance now requires 7.133.11 or later for CVE-2026-42016, which JFrog names as its only fixed build, and states the conflict between JFrog's CVE-2026-42018 table and Wiz's corrected, higher builds. The scope-escalation consequence is attributed to Wiz, the compromise check adds Wiz's signing-key reset and in-memory implant caveat, the triage line names the bare token path correctly, the kill-chain, post-exploitation and patch-velocity paragraphs now cite Wiz, and the sourcing note keeps provenance only. The log-search guidance now counts a hit as successful exploitation only when both requests returned HTTP 200, and the takeaway no longer says one fix leaves the chain intact.
Changed: sources cves body sourcing_note immediate_action actions
- Correction 2026-10-11T1307Z-audit
A Wiz Research quotation was not verbatim (an ellipsis replaced part of the sentence); it now quotes Wiz's sentence as written. The compromise-check action is trimmed to the task itself.
Changed: actions body
- Improvement 2026-10-21T0800Z-audit
JFrog's own CVSS 3.1 scores from its CVE records, 8.1 for CVE-2026-42016 and 7.5 for CVE-2026-42018, are restored with ENISA's EU Vulnerability Database as the citation; the advisory page itself shows only the High label. The log-search guidance no longer says the two token requests come within minutes of each other, since Wiz gives only an under-five-minutes time to a created admin account in some cases. The headline drops "dormant", BSI's advisory is described as recording an exploit rather than KEV status, and EPSS is refreshed to FIRST's 2026-10-20 scores.
Changed: actions body cves evidence headline immediate_action sources sourcing_note summary title
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.