CVE-2026-42016 + CVE-2026-42018, JFrog Artifactory: chaining two previously-patched token flaws turns an unauthenticated request into full administrative control in two API calls, confirmed exploited since mid-August

JFrog disclosed the two flaws separately and weeks apart, labeling each only "High" without a numeric score; the CNA's own submitted CVSS 3.1 base scores (8.1 for CVE-2026-42016 and 7.5 for CVE-2026-42018) are recorded in the MITRE CVE record for each (MITRE CVE Record, CVE-2026-42016; MITRE CVE Record, CVE-2026-42018). CVE-2026-42016 (CWE-863 Incorrect Authorization), disclosed 27 July 2026, is a privilege-escalation bug in Artifactory's token handling: the platform validates a token's signature and issuer but never checks whether the token's scope matches what it is being used for, so a low-privileged token can be exchanged for one carrying administrative authority (JFrog, 2026-07-27). CVE-2026-42018 (CWE-287 Improper Authentication), disclosed 12–13 August 2026, is narrower but supplies the missing first step: Artifactory returns an internal anonymous-user token to a caller who never authenticated, even when anonymous access is disabled (JFrog, 2026-08-13). Neither flaw alone grants administrative control; Wiz Research states plainly that the anonymous token from CVE-2026-42018 and the scope-validation gap in CVE-2026-42016 "together... can turn an unauthenticated request into an admin-scoped token in two steps" (Wiz Research, 2026-09-10).

Kill chain, as Wiz reconstructed it from real intrusions (initial access, T1190). An unauthenticated POST /access/api/v1/aws/token/ (the trailing slash matters; the bare path without it returns 401) returns HTTP 200 with a JWT scoped to Artifactory's internal anonymous identity, exploiting CVE-2026-42018. The operator then exchanges that JWT for a new one via POST /access/api/v1/tokens, which returns HTTP 200 carrying admin authority despite the request originating from the anonymous identity, exploiting CVE-2026-42016's missing scope check (T1550.001, forging elevated authority onto an application access token). The escalated token still shows token:anonymous as its actor in logs, which is itself a detection anomaly: no legitimate administrative action originates from the anonymous identity. Wiz observed actors reach a created administrator account in under five minutes from the first request in some cases. CISA added both CVEs to its Known Exploited Vulnerabilities catalog on 2026-09-11 (CISA KEV, catalogue version 2026.09.11).

Post-exploitation observed across the chained cases. Operators create persistent administrator accounts via PUT /api/security/users/<username> or /access/api/ui/users/<username> (T1136.001); deploy malicious Groovy plugins through Artifactory's own extensible plugin framework to gain arbitrary code execution (T1505, abusing a legitimate server extension mechanism for persistence); and run ad-hoc shell commands through the plugin-execution endpoint (GET/POST /api/plugins/execute/<plugin>), used for reconnaissance and file enumeration (T1059). Across multiple cases Wiz observed a custom Rust-based backdoor with command-and-control capability dropped to disk as a further persistence layer.

Wiz's own patching-velocity data is the second half of the defender-relevant finding: at first disclosure, 67% of organizations running Artifactory had at least one instance vulnerable to CVE-2026-42016, and a similar 69% for CVE-2026-42018; six weeks after CVE-2026-42016's disclosure, 59% remained vulnerable, and CVE-2026-42018 fell only from 69% to 62% over four weeks, versus the separately-disclosed CVE-2026-82329 (a default-configuration join-key bypass, disclosed 28 August 2026), which dropped from 67% to 49% within two weeks of its own disclosure. Wiz attributes the gap to CVE-2026-82329's critical-severity label likely driving faster security-team attention, while these two high-severity CVEs went unpatched at far higher rates for far longer; precisely the CVSS-driven prioritization trap that let this chain stay open long enough to be found under active exploitation.