NewsCompaniesFlawsGuides
Get the app
HighFixedBeing used in attacksClosedUpdated

JFrog Artifactory login and token flaws CVE-2026-42016 and CVE-2026-42018 used in attacks; upgrade and check for intruders

Attackers chained two JFrog Artifactory flaws (CVE-2026-42016, CVE-2026-42018) to become admin on self-hosted servers and install backdoors. Fixes exist. Upgrade, but assume compromise if exposed: plugins and stolen keys survive patching. JFrog Cloud needs no action.

What to do

If your company runs self-hosted Artifactory, ask your IT team to upgrade to the fixed build for your branch now, limit access to trusted networks, and check for unknown admin accounts, plugins and tokens. Nothing for a family to do unless you run one yourself.

What’s happening

Two flaws in self-hosted JFrog Artifactory, the software many companies use to store and distribute their code packages, have been used in attacks. CVE-2026-42018 lets an unauthenticated visitor obtain an internal anonymous-user token even when anonymous access is turned off. CVE-2026-42016 lets that low-privilege token be exchanged for administrator rights, because Artifactory checks a token's signature and issuer but not its scope. JFrog published them on 27 July and 12 August 2026 with fixes, and says its cloud service is already protected. Wiz saw several attackers chain the two from 15 August to 8 September, creating admin accounts, installing malicious plugins and dropping a custom backdoor. CISA listed both as exploited on 11 September. Wiz reports the plugins, stolen signing keys, extra admin accounts and added SSH keys survive an upgrade. A third flaw, CVE-2026-82329, was also attacked, but is not covered here. This is mainly a business risk, not a home one.

What
Flaw
Affects
JFrog Artifactory (self-hosted)
Affected
CVE-2026-42016: JFrog Artifactory (self-hosted) before 7.133.11
CVE-2026-42018: Artifactory before 7.111.20; 7.117.0 to 7.117.27; 7.125.0 to 7.125.19; 7.133.0 to 7.133.28; 7.146.0 to 7.146.8
Fixed in
7.133.11 (CVE-2026-42016)
7.111.20, 7.117.27, 7.125.19, 7.133.28, 7.146.8 (CVE-2026-42018)
CVE
CVE-2026-42016, CVE-2026-42018
Since
11 Sept 2026
Closed
17 Sept 2026

Timeline

  1. Update

    Wiz updated its report with details of six malicious Groovy plugins that survive upgrades, plus stolen signing keys that let attackers forge tokens. It says patching alone does not remove an intruder, and advises resetting the token certificate.

  2. Wider attacks

    BleepingComputer reported the attacks: admin accounts created in under five minutes, malicious Groovy plugins installed, and a custom Rust backdoor dropped. JFrog had not commented. Wiz and others advise upgrading to 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38 or 7.161.20 or later.

  3. Wider attacks

    Wiz began seeing several actors chain the two flaws against self-hosted Artifactory, turning an anonymous token into an admin-scoped one. Activity ran to 8 September, with the earliest indicator dated 26 August.

  4. Made publicFixed

    JFrog published CVE-2026-42018: Artifactory could hand an internal anonymous-user token to an unauthenticated caller even with anonymous access off. Fixes were listed per branch: 7.111.20, 7.117.27, 7.125.19, 7.133.28 and 7.146.8.

  5. Made publicFixed

    JFrog published CVE-2026-42016: self-hosted Artifactory before 7.133.11 checks a token's signature and issuer but not its scope, allowing privilege escalation. Fixed in 7.133.11.

Sources

  1. JFrog Security AdvisoriesJFrog · 13 Aug 2026
  2. Artifactory Under Attack: In-the-Wild Exploitation of CVE-2026-42016, CVE-2026-42018 & CVE-2026-82329Wiz · 17 Sept 2026
  3. Artifactory flaws chained in attacks deploying backdoor malwareBleepingComputer · 11 Sept 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from September 2026 · JSON · RSS