---
schema: 1
kind: vulnerability
title: "CVE-2026-42016 + CVE-2026-42018 — JFrog Artifactory: chaining two previously-patched token flaws turns an unauthenticated request into full administrative control in two API calls, confirmed exploited since mid-August"
headline: "Two dormant JFrog Artifactory bugs, patched weeks ago, are now confirmed chained into full admin takeover"
summary: >
  Wiz Research documents in-the-wild exploitation, running 15 August–8 September 2026, of two
  distinct JFrog Artifactory flaws — CVE-2026-42018 (an unauthenticated caller can obtain an
  internal anonymous-user token) and CVE-2026-42016 (that token's scope is not validated when
  exchanged for a new one) — chained into an unauthenticated-to-admin escalation in two HTTP
  requests, in some cases reaching a created administrator account in under five minutes. Both
  CVEs were disclosed and patched by JFrog in July and August, weeks before this exploitation was
  reported; six weeks after disclosure, 59% of organizations running Artifactory remained
  vulnerable to CVE-2026-42016, and CVE-2026-42018 fell only from 69% to 62% over four weeks.
discovered_at: "2026-09-12T04:09:19Z"
updated_at: null
event_date: "2026-09-10"
run_id: 2026-09-12T0409Z-intel
priority: critical
immediate_action:
  title: "Patch and hunt JFrog Artifactory now — confirmed admin-takeover chain, backdoors already dropped"
  action: >
    Wiz Research confirms active, ongoing exploitation of this two-CVE chain against self-hosted
    JFrog Artifactory since 15 August 2026, reaching full administrative control and, in multiple
    cases, a dropped Rust-based backdoor with C2 capability — and six weeks after disclosure, most
    organizations running Artifactory still have at least one vulnerable instance. Patch every
    branch to its own fixed release now — 7.133.11 for CVE-2026-42016, and the CVE-2026-42018 fix
    matching your branch (7.111.20 / 7.117.27 / 7.125.19 / 7.133.28 / 7.146.8) — since a build
    already above 7.133.11 numerically can still be unpatched for the second CVE. Then search
    access logs for the chain's own signature: an unauthenticated POST to
    /access/api/v1/aws/token/ followed within minutes by a POST to /access/api/v1/tokens from the
    same client. Any hit is a confirmed compromise, not a near-miss — revoke all tokens, audit for
    administrator accounts you did not create, and check the Groovy plugins directory for anything
    unauthorized.
tags: [vulnerabilities, actively-exploited, auth-bypass, priv-esc, cisa-kev, patch-available, supply-chain]
regions: [global]
sectors: [public-sector, technology]
entities: []
techniques: [T1190, T1550.001, T1136.001, T1505, T1059]
affected_products: ["JFrog Artifactory"]
cves:
  - id: CVE-2026-42016
    cvss: "8.1"
    epss: "0.0027"
    type: priv-esc
    vector: zero-click
    auth: post-auth
    status: [exploited, cisa-kev, patch-available]
    affected: "JFrog Artifactory (Self-Hosted) before 7.133.11"
    fixed: "7.133.11"
  - id: CVE-2026-42018
    cvss: "7.5"
    epss: "0.0035"
    type: auth-bypass
    vector: zero-click
    auth: pre-auth
    status: [exploited, cisa-kev, patch-available]
    affected: "JFrog Artifactory before 7.111.20; 7.117.0–7.117.27; 7.125.0–7.125.19; 7.133.0–7.133.28; 7.146.0–7.146.8"
    fixed: "7.111.20 / 7.117.27 / 7.125.19 / 7.133.28 / 7.146.8"
sources:
  - url: "https://docs.jfrog.com/releases/docs/jfrog-security-advisories#cve-2026-42016---incorrect-user-token-authorization-validation-allows-privilege-escalation"
    publisher: "JFrog (vendor security advisories)"
    date: "2026-07-27"
    role: primary
  - url: "https://docs.jfrog.com/releases/docs/jfrog-security-advisories#cve-2026-42018---anonymous-user-token-generation-exposure"
    publisher: "JFrog (vendor security advisories)"
    date: "2026-08-13"
    role: primary
  - url: "https://www.wiz.io/blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201"
    publisher: "Wiz Research"
    date: "2026-09-10"
    role: primary
  - url: "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2808"
    publisher: "BSI / CERT-Bund (WID-SEC-2026-2808)"
    date: "2026-09-11"
    role: corroborating
  - url: "https://cveawg.mitre.org/api/cve/CVE-2026-42016"
    publisher: "MITRE CVE Record (CNA metrics)"
    date: "2026-09-12"
    role: corroborating
  - url: "https://cveawg.mitre.org/api/cve/CVE-2026-42018"
    publisher: "MITRE CVE Record (CNA metrics)"
    date: "2026-09-12"
    role: corroborating
  - url: "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"
    publisher: "CISA KEV catalog (catalogue version 2026.09.11)"
    date: "2026-09-11"
    role: corroborating
references: ["2026-09-01/jfrog-artifactory-cve-2026-82329-default-config-admin-bypass"]
closed_sources: []
evidence:
  - quote: "Wiz Research has identified active, in-the-wild exploitation of three critical and high-severity vulnerabilities affecting JFrog Artifactory: CVE-2026-42016, CVE-2026-42018, and CVE-2026-82329. Attackers are chaining these vulnerabilities to bypass authentication, escalate privileges, and gain administrative control over vulnerable Artifactory instances."
    publisher: "Wiz Research"
  - quote: "Between August 15 and September 8, 2026, we observed multiple actors chain CVE-2026-42018 and CVE-2026-42016 against self-hosted Artifactory instances. Across multiple cases we observed a custom Rust backdoor with C2 capabilities being dropped. Wiz Research is not aware of any prior public reporting of in-the-wild exploitation involving those two CVEs."
    publisher: "Wiz Research"
  - quote: "JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature/issuer and not the token's scope."
    publisher: "JFrog (vendor security advisories)"
verification: single-source
sourcing_note: >
  Wiz Research is the sole assessor of the active-exploitation claim and the two-step token-chain
  mechanism; no independent lab or national-CERT technical analysis of the exploitation itself was
  found in-window. JFrog's own advisory pages independently establish the vulnerabilities'
  existence, root causes and patched-version boundaries (dated 2026-07-27 and 2026-08-12/13, weeks
  before Wiz's report) but make no exploitation claim of their own. BSI's WID-SEC-2026-2808 tracks
  the CVEs and their KEV status but states no independent observation of exploitation, so it is not
  counted as a second assessor of the exploitation claim itself. This entry is a genuinely distinct
  finding from the existing CVE-2026-82329 entry —
  different CVE ids, different root causes (token scope-validation and anonymous-token exposure vs.
  a default-configuration join-key bypass), different disclosure dates — reported together only
  because Wiz's single report covers all three as one "Artifactory under attack" narrative;
  a link to the earlier entry is carried so a reader of either finds the other.
confidence: medium
deep_dive: true
deep_dive_category: supply-chain
org_triage: null
classification:
  reliability: B
  credibility: 2
watchlist_hit: false
actions:
  - "Patch every self-hosted JFrog Artifactory instance to ≥ 7.133.11 (closes CVE-2026-42016) and confirm the CVE-2026-42018 fix (7.111.20 / 7.117.27 / 7.125.19 / 7.133.28 / 7.146.8 depending on branch) is also applied — patching only one of the two leaves the chain's other half open."
  - "On any Artifactory instance that was internet-reachable and unpatched since 15 August 2026, search access logs for an unauthenticated POST to /access/api/v1/aws/token/ (trailing slash) followed within minutes by a POST to /access/api/v1/tokens from the same client — that two-request sequence is the chain's signature — and, where found, treat the instance as compromised: revoke all tokens, audit /api/security/users and /access/api/ui/users for administrator accounts you did not create, and inspect installed Groovy plugins for anything you did not deploy yourself."
updates: []
migrated_from: null
---

JFrog disclosed the two flaws separately and weeks apart, labeling each only "High" without a numeric score; the CNA's own submitted CVSS 3.1 base scores — 8.1 for CVE-2026-42016 and 7.5 for CVE-2026-42018 — are recorded in the MITRE CVE record for each ([MITRE CVE Record, CVE-2026-42016](https://cveawg.mitre.org/api/cve/CVE-2026-42016); [MITRE CVE Record, CVE-2026-42018](https://cveawg.mitre.org/api/cve/CVE-2026-42018)). CVE-2026-42016 (CWE-863 Incorrect Authorization), disclosed 27 July 2026, is a privilege-escalation bug in Artifactory's token handling: the platform validates a token's signature and issuer but never checks whether the token's *scope* matches what it is being used for, so a low-privileged token can be exchanged for one carrying administrative authority ([JFrog, 2026-07-27](https://docs.jfrog.com/releases/docs/jfrog-security-advisories#cve-2026-42016---incorrect-user-token-authorization-validation-allows-privilege-escalation)). CVE-2026-42018 (CWE-287 Improper Authentication), disclosed 12–13 August 2026, is narrower but supplies the missing first step: Artifactory returns an internal anonymous-user token to a caller who never authenticated, even when anonymous access is disabled ([JFrog, 2026-08-13](https://docs.jfrog.com/releases/docs/jfrog-security-advisories#cve-2026-42018---anonymous-user-token-generation-exposure)). Neither flaw alone grants administrative control — Wiz Research states plainly that the anonymous token from CVE-2026-42018 and the scope-validation gap in CVE-2026-42016 "together... can turn an unauthenticated request into an admin-scoped token in two steps" ([Wiz Research, 2026-09-10](https://www.wiz.io/blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201)).

**Kill chain, as Wiz reconstructed it from real intrusions (initial access, T1190).** An unauthenticated `POST /access/api/v1/aws/token/` — the trailing slash matters; the bare path without it returns 401 — returns HTTP 200 with a JWT scoped to Artifactory's internal anonymous identity, exploiting CVE-2026-42018. The operator then exchanges that JWT for a new one via `POST /access/api/v1/tokens`, which returns HTTP 200 carrying admin authority despite the request originating from the anonymous identity — exploiting CVE-2026-42016's missing scope check (**T1550.001**, forging elevated authority onto an application access token). The escalated token still shows `token:anonymous` as its actor in logs, which is itself a detection anomaly: no legitimate administrative action originates from the anonymous identity. Wiz observed actors reach a created administrator account in under five minutes from the first request in some cases. CISA added both CVEs to its Known Exploited Vulnerabilities catalog on 2026-09-11 ([CISA KEV, catalogue version 2026.09.11](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)).

**Post-exploitation observed across the chained cases.** Operators create persistent administrator accounts via `PUT /api/security/users/<username>` or `/access/api/ui/users/<username>` (**T1136.001**); deploy malicious Groovy plugins through Artifactory's own extensible plugin framework to gain arbitrary code execution (**T1505**, abusing a legitimate server extension mechanism for persistence); and run ad-hoc shell commands through the plugin-execution endpoint (`GET`/`POST /api/plugins/execute/<plugin>`), used for reconnaissance and file enumeration (**T1059**). Across multiple cases Wiz observed a custom Rust-based backdoor with command-and-control capability dropped to disk as a further persistence layer.

Wiz's own patching-velocity data is the second half of the defender-relevant finding: at first disclosure, 67% of organizations running Artifactory had at least one instance vulnerable to CVE-2026-42016, and a similar 69% for CVE-2026-42018; six weeks after CVE-2026-42016's disclosure, 59% remained vulnerable, and CVE-2026-42018 fell only from 69% to 62% over four weeks — versus the separately-disclosed CVE-2026-82329 (a default-configuration join-key bypass, disclosed 28 August 2026), which dropped from 67% to 49% within two weeks of its own disclosure. Wiz attributes the gap to CVE-2026-82329's critical-severity label likely driving faster security-team attention, while these two high-severity CVEs went unpatched at far higher rates for far longer — precisely the CVSS-driven prioritization trap that let this chain stay open long enough to be found under active exploitation.

**Defender takeaway:** patching one CVE in this pair without the other leaves the chain intact, and a "high" rather than "critical" severity label on either individual flaw is not a reason to deprioritize a bug that, chained, hands over full administrative control of your artifact-repository and CI/CD supply-chain infrastructure. **Triage:** the highest-confidence detection signal is behavioral rather than a single request — a 401 on the bare `/access/api/v1/aws/token/` path followed by a 200 on a variant of it (with the trailing slash), from the same client, in a short window, is an operator confirming the vulnerable variant before relying on it, a pattern a normal client does not produce; correlate any resulting anonymous-identity token activity against subsequent user-creation, plugin-execution or credential-enumeration calls.