SURIQ
Self-managed JFrog Artifactory had two separate ways in this summer, and both were open at once. Two weeks ago we wrote up one of them, an authentication bypass that let a stranger forge an administrator token. On September 11 CISA confirmed the second, adding CVE-2026-42016 and CVE-2026-42018 to its Known Exploited Vulnerabilities catalog. Chained, those two turn an unauthenticated request into a full admin account, and the cloud security firm Wiz says attackers were doing it in under five minutes. If you run Artifactory yourself, patching one door was never the same as patching the product.
The mechanics are almost mundane, which is the problem. The first bug, CVE-2026-42018 (CVSS 7.5), lets an outsider who has not logged in pull back a token belonging to Artifactory's built-in anonymous user, and it works even on instances where anonymous access is switched off. The second, CVE-2026-42016 (CVSS 8.1), accepts that weak token and upgrades it to administrator rights, because the server confirmed where the token came from without ever checking what it was permitted to do. Run them back to back and you cross from no credentials to full control. Wiz and the offensive-security firm watchTowr tracked the pair in live attacks from August 15 to September 8, which began just three days after the first fixed build reached one release branch. Federal agencies have until September 25 to install the update.
Two doors to admin, open at the same time
Our earlier post treated the story as one flaw: CVE-2026-82329, the CVSS 9.8 bypass that mints an admin token with no login and reached CISA's KEV list on September 2. That was real, and it was being exploited. It was also only half the picture. The 42018-to-42016 chain is a completely different code path to the same outcome, and it was live in the same window. A team that saw the September 2 KEV entry, patched for 82329, and moved on would still have had the chain open until this week.
Step back and a pattern shows up. This is the third distinct Artifactory weakness we have tracked onto CISA's must-patch list in about a month, after a cache path traversal and the token-forge bypass. None of them touched the packages Artifactory stores. All three hit the identity and token layer around them. Authentication and account-takeover bugs are the fourth-largest class in our own 90-day triage log, behind cross-site scripting, command injection, and SQL injection, and the build system is exactly the kind of high-trust, credential-dense target where they pay off.
The stopgap you can apply today, then the patch
The instances getting hit are internet-facing, self-managed ones. If yours does not need to be reachable from the public internet, the fastest thing you can do right now is put it behind a VPN or an allowlist so the unauthenticated request never lands. That buys time; it is not the fix. The fix is the version bump, and because the three CVEs were patched on different builds, you want the highest fixed build for your release train so all three close at once.
According to BleepingComputer's reporting, researchers estimated that roughly half to two-thirds of reachable Artifactory instances were on vulnerable builds while the attacks were underway, so treat exposure as the default until you confirm otherwise.
Why the chain is nearly invisible in your logs
Here is the detail that turns this from a patch task into an investigation. Once the chain runs, the admin actions that follow are logged against the issuer token:anonymous instead of a real user. So the obvious check, listing every admin account and asking whether you recognize it, walks right past the intrusion. You have to pivot on who minted the token, not on whose name the token wears.
The reported hands-on-keyboard activity is what you go looking for. Per Wiz and watchTowr, the operators planted administrator accounts that stick around, some named to pass as service accounts; loaded rogue Groovy plugins into Artifactory's plugin system to execute commands; and, in several intrusions, dropped a bespoke Rust backdoor that phones home to a control channel. The loaders staged binaries in writable spots such as /tmp, /dev/shm, and /var/tmp, and in some cases the cluster join key was carried off. Aim the hunt at the behavior, not one indicator:
admin actions whose issuer is the anonymous token (the chained path's tell) issuer = token:anonymous action in {createToken, createUser, updatePermissions} the internal anonymous user minting tokens or listing accounts principal = anonymous endpoint in {/access/api/v1/tokens, /api/security/users} new admin accounts using the campaign's blend-in or test names user in {jfrog-distribution, jfrog-insight, repo-service, 0xTerror} user matches ^(svc_|labadmin_) a Groovy user-plugin written or run, then the host reaching out POST /api/plugins/execute/* then outbound HTTP from the Artifactory host new files under /tmp, /dev/shm, /var/tmp
This is the gap the wire coverage leaves, and the reason a version number alone is a false comfort. A patch closes the code path. It does not revoke a token an attacker already minted, remove an administrator account they planted, uninstall a Groovy plugin, evict a Rust backdoor, or change a cluster join key they already copied. If your instance sat exposed during the exploitation window, assume identity was compromised and work the hunt before you call it closed.
Rotate tokens and clear planted admins before you call it patched
Do these in order. Patch to the highest fixed build for your release train. Revoke and reissue access tokens minted since the window opened in mid-August, because forged and stolen tokens survive the upgrade; a secrets manager makes that rotation far less painful than doing it by hand. Rotate the cluster join key if you run a clustered deployment. Remove any administrator account you cannot tie to a real operator, and audit installed Groovy plugins and repository permissions for changes you did not make. Then keep watching the token-issuance logs, and fold Artifactory into whatever you use for tracking KEV exposure so the next identity flaw in your build chain is not a surprise. The version bump is the easy part of this one. The identity cleanup is the job.
| CVE | Weakness | CVSS | Fixed in (or later) |
|---|---|---|---|
| CVE-2026-42018 | Anonymous token disclosure | 7.5 | 7.111.20, 7.117.27, 7.125.19, 7.133.28, 7.146.8 |
| CVE-2026-42016 | Token scope escalation | 8.1 | 7.133.11 |
| CVE-2026-82329 | Admin-token forge (bypass) | 9.8 | 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, 7.161.20 |