JFrog Artifactory, the artifact repository manager used in countless software build pipelines, is under active attack. Cloud security firm Wiz tracked exploitation across multiple self-hosted Artifactory environments from August 15 through September 8, 2026, finding that attackers chained two vulnerabilities to reach full administrative control without a valid account — and in the most alarming cases they got there in less than five minutes.
The attack chain works in two steps. CVE-2026-42018 lets an unauthenticated attacker obtain a JSON Web Token (JWT) tied to Artifactory’s internal anonymous user, even on instances where anonymous access is explicitly disabled. CVE-2026-42016 — an insufficient token-validation flaw — then lets that low-privilege token be exchanged for an administrator-scoped one. With admin rights in hand, the attackers installed malicious Groovy plugins to execute arbitrary commands, then dropped a custom Rust-based backdoor with command-and-control (C2) capabilities, writing it into directories like /dev/shm, /tmp, and /var/tmp. They also uploaded webshells, stole Artifactory configuration data and cluster join keys, enumerated repositories and user lists, and added SSH keys to newly created accounts. A separate vulnerability, CVE-2026-82329 (the critical auth bypass first observed in active exploitation earlier in September), was also abused in parallel but as a standalone attack rather than part of this chain. Wiz estimates that between 49% and 62% of internet-reachable Artifactory instances remain vulnerable to at least one of the three flaws.
How to check if you’re affected
Affected versions of JFrog Artifactory are all releases older than the following patched builds: 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, and 7.161.20. Check your installed version in the Artifactory administration console and upgrade to the nearest patched build immediately. After upgrading, audit the instance for unexpected token creation events, rogue administrator accounts, suspicious Groovy plugin installations, and unusual enumeration requests in access logs. Restrict management-API endpoints to trusted internal networks and rotate all long-lived access tokens as a precaution. Wiz has published indicators of compromise (IoCs) to help defenders identify activity linked to the observed attacks.