If your software build pipeline pulls from a self-hosted JFrog Artifactory server, you need to pay attention. Attackers have been chaining two flaws in Artifactory to take administrator control of vulnerable servers and plant backdoors.

Wiz discovered the attacks. They happened between August 15 and September 8. The Hacker News covered the findings in detail.

The good news? JFrog fixed both flaws before the attacks began. The bad news? Servers that hadn't been updated were wide open.

Let me break down what happened.

Quick Summary

The Two-Flaw Chain

Neither of these flaws gives an attacker administrator control on its own. But together? They're a serious problem.

CVE-2026-42018:

This flaw makes Artifactory hand an internal anonymous-user token to someone who hasn't logged in. It works even when anonymous access is turned off. That shouldn't happen.

CVE-2026-42016:

This flaw lets that low-privilege anonymous token be swapped for one with administrator scope. Why? Because Artifactory checks a token's signature and who issued it. But it doesn't check what the token is actually allowed to do.

The Chain:

• Attacker sends an unauthenticated request to a token endpoint
• They receive a token for the internal anonymous user
• They exchange it at Artifactory's token-creation endpoint
• They get a token with administrator scope

The Sneaky Part:

That second token keeps the anonymous username. So administrator actions taken with it show up in the logs as token:anonymous rather than under a named account. It's hiding in plain sight.

The Speed:

In some cases, the attacker went from the first request to a new administrator account in under five minutes.

A Third Flaw Stands Alone

CVE-2026-82329 is different. It doesn't need another flaw to work. It's a critical authentication bypass, rated 9.8 on the CVSS scale.

An unauthenticated attacker with network access can obtain administrator privileges through this flaw alone. It affects six release branches up to 7.161.

The Hacker News reported on September 1 that attackers had begun creating administrator tokens for themselves through that flaw days after JFrog disclosed it. CISA added it to its catalog of known exploited vulnerabilities on September 2 and set a September 5 deadline for federal agencies.

The Scale:

Fastly, a content delivery network, counted about 406,000 exploitation attempts across its platform on September 2. That was its busiest day. Those are attempts seen in traffic, not confirmed compromises.

What Attackers Did Once Inside

The activity varied depending on the attacker. Wiz said no single actor carried out every step they observed.

Common Actions:

Through CVE-2026-82329 Specifically:

Wiz saw attackers read the system configuration and, in several cases, take the cluster join key. That's the shared secret Artifactory nodes use to register with one another. If an attacker has that, they can potentially join their own node to the cluster.

The Fixed Versions

Upgrade self-hosted Artifactory to the fixed build for your release branch. JFrog says cloud instances need no action.

Note on CVE-2026-42016:

JFrog lists one fixed version 7.133.11 and no separate fix for each branch. Its advisory doesn't say whether a later build on an older branch, like 7.117.28, also closes it. The Hacker News has asked JFrog that question.

Workaround for CVE-2026-82329:

If you can't upgrade quickly, JFrog published a workaround. Generate a random value and add it as an extra join key in system.yaml. That way, only your own keys are accepted when a service registers.

No Workaround for the Chain:

There's no interim option for the two chained flaws in any of the advisories or reports consulted.

What Patching Doesn't Undo

Here's the part people miss. Updating the software doesn't magically fix everything.

Admin Accounts Persist:

The administrator accounts attackers created don't disappear when you patch. Wiz saw them created through both the two-flaw chain and through CVE-2026-82329.

Tokens Stay Valid:

"A patch does not revoke tokens already minted," Fastly said. So any tokens attackers created are still valid unless you revoke them.

Join Keys Stay Stolen:

An upgrade doesn't change a join key attackers have already taken.

What Fastly Recommends:

• Rotate the platform join key
• Revoke access tokens issued since August 28
• Review administrator accounts, repositories, and configuration changes

How to Check If You've Been Hit

The Clearest Signal:

An account doing something its privileges shouldn't allow. Look for the internal anonymous user or any low-privilege account creating tokens, listing users, or reading and writing plugins.

Suspicious Admin Accounts:

Look for administrator accounts nobody created on purpose. Most of the ones Wiz saw have names like:

• 0xTerror
• svc_ followed by random characters
• labadmin_ followed by random characters

Some were made to blend in with names like:

• jfrog-distribution
• jfrog-insight
• repo-service
• Wiz's report lists attacker addresses and a payload hash.

The OpenAI Connection

CVE-2026-42016 was published on July 27 as part of a batch of Artifactory advisories. Several of those advisories credit OpenAI researchers, including this one.

The Hacker News reported in July that JFrog had confirmed OpenAI models exploited an Artifactory zero-day during an internal evaluation. Neither company has said which CVE records match the flaws used.

What You Should Do

1. Update Immediately

Upgrade to the fixed build for your release branch. Check JFrog's security advisories for your specific version.

2. Revoke and Rotate

• Revoke access tokens issued since August 28
• Rotate the platform join key
• Change credentials for any admin accounts you didn't create

3. Audit Admin Accounts

Look for accounts with suspicious names. Remove anything you didn't create.

4. Review Configuration

Check for unexpected changes to repositories, plugins, and system settings.

5. Monitor for Suspicious Activity

Watch for anonymous or low-privilege accounts doing things they shouldn't.

The Bottom Line

Attackers chained two JFrog Artifactory flaws to take administrator control and plant backdoors. A third flaw works on its own. Patching fixes the vulnerabilities but doesn't undo the damage. You need to audit your systems and revoke stolen credentials.

What You Need to Know:

What You Need to Do:

• Update immediately
• Revoke tokens issued since August 28
• Rotate the platform join key
• Audit admin accounts
• Monitor for suspicious activity

FAQ Section

What are the JFrog Artifactory vulnerabilities?

Three flaws: CVE-2026-42018 (anonymous token leak), CVE-2026-42016 (token scope escalation), and CVE-2026-82329 (standalone auth bypass). The first two can be chained for admin access.

How did the attack work?

The attacker requested a token, received an anonymous-user token, then exchanged it for one with administrator scope. This happened in under five minutes in some cases.

What is CVE-2026-82329?

A critical authentication bypass rated 9.8. It lets an unauthenticated attacker gain administrator privileges on its own. No other flaw needed.

Would patching solve everything?

No, patching solves only the problem with the vulnerabilities. Admin accounts, tokens and join keys are still required to be revoked.

How can I know that I am compromised?

There will be activity from anonymous or low-privileged accounts for privileged actions. There should be admin accounts with such names as 0xTerror, svc_, labadmin_ and others which start with jfrog- prefixed names.

Source: The Hacker News