Critical JFrog Artifactory Vulnerabilities Actively Exploited

Key Takeaways

• Three critical vulnerabilities in JFrog Artifactory (CVE-2026-42016, CVE-2026-42018, CVE-2026-82329) are being actively exploited in the wild.
• Attackers are bypassing authentication, escalating privileges, and gaining full administrative control over self-hosted Artifactory instances.
• These flaws pose a significant supply chain risk, potentially leading to broader compromise of development and cloud environments.
• JFrog has released patches; organizations must update to fixed versions immediately.

Widespread Exploitation of Critical JFrog Artifactory Flaws

Threat actors are actively exploiting a trio of severe vulnerabilities within JFrog Artifactory, enabling them to circumvent authentication mechanisms, elevate their privileges, and seize complete administrative control of exposed servers. These security defects introduce substantial supply-chain risks, with successful compromises potentially paving the way for wider intrusions into development pipelines and cloud infrastructure.

The identified flaws, cataloged as CVE-2026-42016, CVE-2026-42018, and CVE-2026-82329, impact various Artifactory release branches. Attack campaigns have specifically targeted self-hosted Artifactory deployments, where adversaries have been observed establishing persistent administrator accounts, deploying malicious Groovy plugins, executing arbitrary shell commands, and installing Rust-based backdoors.

Given Artifactory’s central role in storing software packages, managing credentials, maintaining repository metadata, and integrating with CI/CD systems, a breach of this platform can provide attackers with deep access into an organization’s critical development and operational environments.

Understanding the Vulnerabilities

CVE-2026-42018 is an authentication bypass vulnerability. This flaw can inadvertently expose an internal anonymous-user token to an unauthenticated remote attacker, even when anonymous access is explicitly disabled. The retrieved token could then grant access to resources typically available to Artifactory’s internal anonymous identity.

Complementing this is CVE-2026-42016, a weakness in token scope validation. While Artifactory correctly verifies a token’s signature and issuer, it may fail to properly enforce its authorized scope. This oversight allows an attacker to leverage a valid, low-privilege token to request and receive elevated permissions, effectively bypassing intended access controls.

The third critical flaw, CVE-2026-82329, is another authentication bypass affecting Artifactory installations utilizing the default configuration. This vulnerability allows an unauthenticated attacker to send a POST request to the /access/api/v1/registry/join endpoint and potentially acquire an administrator-scoped token.

In-the-Wild Attack Chains Observed

Wiz observed exploitation of CVE-2026-42018 and CVE-2026-42016 in a chained attack between August 15 and September 8, 2026. The attack sequence typically began with a POST request to /access/api/v1/aws/token/ (including a trailing slash), which successfully returned an anonymous JSON Web Token (JWT).

Subsequently, attackers would submit this anonymous token to /access/api/v1/tokens to generate a new token with administrator scope. Intriguingly, subsequent actions performed with this escalated token often appeared in logs as originating from “token: anonymous,” despite possessing full administrative authority.

In numerous instances, attackers swiftly created persistent administrator accounts, often in under five minutes, leveraging endpoints like /api/security/users/. They also deployed malicious Groovy plugins via Artifactory’s native plugin framework, which enabled arbitrary server-side command execution. Payload droppers were used to download binaries into common writable directories such as /tmp, /dev/shm, and /var/tmp, subsequently establishing command-and-control communications.

Separately, Wiz also detected exploitation of CVE-2026-82329 from September 1 through September 8. This activity involved configuration theft, enumeration of users and repositories, token creation, and the exfiltration of cluster join keys.

During these attacks, threat actors created accounts with names such as jfrog-distribution, jfrog-insight, repo-service, backup-service, ldap_admin, and 0xterror. These carefully crafted account names are designed to blend in with legitimate service identities, providing a covert means for long-term persistence even after the initial vulnerabilities are patched.

Prevalence and Remediation Status

Cloud exposure to these vulnerabilities remains significant. Wiz analysis revealed that 67 percent of organizations operating Artifactory had at least one vulnerable instance when CVE-2026-42016 was publicly disclosed on July 27. For CVE-2026-42018, 69 percent of organizations were vulnerable at the time of disclosure. CVE-2026-82329, published on August 28, affected 67 percent of organizations. While remediation for the critical authentication bypass (CVE-2026-82329) was comparatively faster, a concerning 49 percent of organizations still remained exposed two weeks later.

JFrog has released fixed versions to address these vulnerabilities. Organizations are urged to upgrade to patched releases as soon as possible.

What You Should Do

• Immediate Patching: Identify all Artifactory instances, prioritizing those exposed to the internet, and upgrade to fixed versions: 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, and 7.161.20 or later, depending on your specific release branch and the affected vulnerability.
• Log Review and Threat Hunting: Actively hunt for successful requests to the following endpoints in your Artifactory access logs: /access/api/v1/aws/token/, /access/api/v1/tokens, and /access/api/v1/registry/join.
• Monitor for Anomalous Activity: Investigate any unexpected privileged activity originating from anonymous or low-privilege identities. Look for newly created administrator accounts, unauthorized plugin deployments, unusual token minting, configuration exports, and any suspicious outbound network connections from Artifactory servers.
• Review User Accounts: Scrutinize recently created or suspicious user accounts, especially those with names like 0xterror, jfrog-distribution, jfrog-insight, repo-service, backup-service, ldap_admin, or patterns such as svc_[a-zA-Z0-9]{8} and Nxploited_[a-zA-Z0-9]{3}.
• Implement Network Segmentation: Ensure Artifactory instances are adequately segmented from other critical infrastructure to limit potential lateral movement in case of compromise.
• Review IOCs: Cross-reference your logs and network traffic against the following Indicators of Compromise (IOCs):
  • IP / C2: 93.104.155[.]133, 146.19.216[.]120, 185.190.58[.]172, 45.61.176[.]88, 137.184.111[.]69, 64.207.232[.]6:8443
  • Payload URLs: hxxp://log.gitclone[.]org:45678/smtp, hxxp://3.88.162[.]79:36789/smtp
  • File / Hash: /tmp/.z — 513a907b69edffc3cb77a494da395178d21ef9bd
  • Account Patterns: 0xterror, svc_[a-zA-Z0-9]{8}, Nxploited_[a-zA-Z0-9]{3}

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.