Multiple serious vulnerabilities in JFrog Artifactory are currently under active exploitation, allowing attackers to bypass authentication, elevate privileges, and seize full administrative control of exposed servers. These flaws—tracked as CVE-2026-42016, CVE-2026-42018, and CVE-2026-82329—impact various Artifactory release lines and pose a significant supply-chain risk. Attackers have already compromised self-hosted Artifactory installations, leaving backdoors and deploying malicious components.
How the Exploits Work
One vulnerability, CVE-2026-42018, lets unauthenticated remote actors obtain an internal anonymous-user token despite anonymous access being disabled. This token can carry privileges tied to Artifactory’s embedded anonymous identity. CVE-2026-42016, in turn, fails to properly validate a token’s effective scope—even when the signature and issuer check out—letting attackers use low-privilege tokens to gain elevated permissions.
The third vulnerability, CVE-2026-82329, is a critical authentication bypass in default installations; an attacker can generate an administrator-level token via the /access/api/v1/registry/join endpoint without any prior credentials.
Evidence of Active Attacks
From mid-August through early September 2026, threat actors linked CVE-42018 and CVE-42016 in chain attacks. They first requested anonymous tokens with a POST to /access/api/v1/aws/token/ (including a trailing slash) to obtain JWTs, then used those to generate admin tokens via /access/api/v1/tokens. Despite wielding full permissions, their actions appeared under ‘anonymous’ or similarly low-privileged identities in logs.
Other tactics observed: creation of persistent admin accounts via /api/security/users/ in under five minutes; installation of malicious Groovy plugins using Artifactory’s plugin framework to allow arbitrary server-side command execution; deploying payloads to writable folders such as /tmp, /var/tmp, and /dev/shm; and launching command-and-control communication channels.
The CVE-82329 exploit enabled configuration theft, repository and user enumeration, creation and misuse of tokens, and theft of cluster join keys. Attackers also slid in accounts with service-like names—“jfrog-distribution”, “repo-service”, etc.—to linger unnoticed even after fixes are in place.
Which Deployments Are at Risk
Analysis by security firm Wiz shows widespread vulnerability exposure. When CVE-42016 was disclosed on July 27, about 67% of organizations running Artifactory had at least one vulnerable instance. CVE-42018 impacted roughly 69% at disclosure. For CVE-82329, 67% were exposed based on observations starting August 28. Although fixes for the most critical bypass in CVE-82329 were rolled out relatively quickly, nearly half of affected organizations were still vulnerable two weeks after patch release.
Fixed versions differ depending on release branch and vulnerability. Upgrading to version 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, 7.161.20—or later versions tailored to specific vulnerability and branch—is strongly advised.
What Teams Should Do Now
Security operations teams should immediately identify all Artifactory servers, especially any exposed to the internet. Forensic investigation is advised on suspicious POST requests to paths like /access/api/v1/aws/token/ (with trailing slashes), /access/api/v1/tokens, or /access/api/v1/registry/join. Unusual activity from anonymous or low-privilege identities, unexpected creation of administrator accounts, plugin installations, token generation, configuration exports, or odd outbound connections from Artifactory should all be red flags.
This series of vulnerabilities underscores how critical supply-chain tools are increasingly under siege. Artifactory is widely deployed in CI/CD pipelines to store software artifacts, credentials, and metadata. If compromised, it can provide attackers a direct pathway into cloud environments and development workflows—spreading beyond a single server. The speed and stealth of these exploit chains suggest many organizations may be exposed without even knowing it.
