Artifactory chaining gave attackers admin backdoors
Wiz says multiple actors have chained three JFrog Artifactory flaws since mid-August, turning CVE-2026-42018, CVE-2026-42016, and CVE-2026-82329 into admin access, persistence, and backdoors on self-hosted instances. CISA has already added the first two to its Known Exploited Vulnerabilities catalog, after flagging CVE-2026-82329 a week earlier.
The chain starts with a bug that can hand out an anonymous-user token even when anonymous access is disabled. A second flaw then lets a limited token be treated as more powerful than it should be, so an attacker can climb to administrator and then plant persistent admin accounts, malicious plugins, SSH keys, and second-stage payloads.
That makes this a repository-layer problem, not just a login fix. If Artifactory sits in front of software artifacts, containers, AI models, or package distribution, a compromised instance can keep exposing build inputs and secrets even after the vulnerable login path is patched.
CVSS 8.1 HIGH: jFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a… EPSS 9% (95th percentile).
JFrog: rilevato sfruttamento in rete delle vulnerabilità CVE-2026-42016 e CVE-2026-42018 in Artifactory
Rilevato lo sfruttamento attivo in rete di due vulnerabilità con gravità "alta" - già sanate dal vendor - relative al prodotto JFrog Artifactory, piattaforma per la gestione e distribuzione di artefatti software