Full Report
Wiz Research has identified active, in-the-wild exploitation of three critical and high-severity vulnerabilities impacting JFrog Artifactory (CVE-2026-42016, CVE-2026-42018 & CVE-2026-82329). Attackers are chaining these vulnerabilities to bypass authentication and gain administrative control.
Analysis Summary
# Vulnerability: JFrog Artifactory Multi-Vulnerability Chain (Auth Bypass & RCE)
## CVE Details
- **CVE ID:** CVE-2026-42016, CVE-2026-42018, CVE-2026-82329
- **CVSS Score:** Up to 10.0 (Critical) for CVE-2026-82329
- **CWE:** CWE-287 (Improper Authentication), CWE-269 (Improper Privilege Management), CWE-863 (Incorrect Authorization)
## Affected Systems
- **Products:** JFrog Artifactory
- **Versions:** Multiple versions (Self-hosted instances specifically highlighted).
- **Configurations:** Default configurations are particularly susceptible to CVE-2026-82329; CVE-2026-42018 is exploitable even when anonymous access is disabled.
## Vulnerability Description
Attackers are chaining three distinct flaws to compromise Artifactory instances:
1. **CVE-2026-42018 (Information Leak):** An improper authentication flaw where the system returns an internal anonymous-user token to unauthenticated requesters (triggered via a POST request to `/access/api/v1/aws/token/` with a trailing slash).
2. **CVE-2026-42016 (Privilege Escalation):** A token scope validation flaw. Artifactory fails to enforce the intended scope of a token, allowing an attacker to upgrade a low-privileged (anonymous) token to administrative scope.
3. **CVE-2026-82329 (Authentication Bypass):** A critical flaw in default configurations allowing unauthenticated network attackers to obtain full administrative access.
## Exploitation
- **Status:** **Exploited in the wild.** Wiz Research and CISA (KEV) confirm active targeting.
- **Complexity:** Low (Scriptable chains observed).
- **Attack Vector:** Network.
- **Observed Post-Exploitation:** Creation of persistent admin accounts, deployment of malicious **Groovy plugins** for remote code execution (RCE), and installation of **Rust-based backdoors** for C2 communication.
## Impact
- **Confidentiality:** High (Access to sensitive artifacts, credentials, and secrets).
- **Integrity:** High (Modification of software packages/artifacts and system configurations).
- **Availability:** High (Full administrative control allows for system shutdown or data deletion).
## Remediation
### Patches
- JFrog has released updates to address these vulnerabilities. Users should refer to the [JFrog Security Advisory](https://docs.jfrog.com/releases/docs/jfrog-security-advisories) for the specific version-mapping fix.
### Workarounds
- Disable or restrict access to the `/access/api/v1/aws/token/` endpoint at the Load Balancer/WAF level if not required.
- Audit and restrict default administrative permissions and ensure Artifactory is not exposed directly to the public internet without additional authentication layers.
## Detection
- **Indicators of Compromise (IoC):**
- Unusual POST requests to `*/access/api/v1/aws/token/` (especially with trailing slashes).
- Presence of unknown `.groovy` files in the Artifactory plugins directory.
- Identification of unauthorized Rust-based binary executions.
- Creation of new, unexpected administrator accounts in Artifactory logs.
- **Tools:** Use Wiz or similar CSPM/Vulnerability scanners to identify unpatched self-hosted instances.
## References
- JFrog Security Advisories: hxxps[://]docs[.]jfrog[.]com/releases/docs/jfrog-security-advisories
- CISA Known Exploited Vulnerabilities (KEV) Catalog: hxxps[://]www[.]cisa[.]gov/known-exploited-vulnerabilities-catalog
- Wiz Research Blog: hxxps[://]www[.]wiz[.]io/blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-42018-cve-2026-82329