Three Chained JFrog Flaws Let Attackers Skip Authentication Entirely

An attacker with network access to a default-configured JFrog Artifactory server can walk away with full administrative control and no password, using a flaw the security firm Wiz says has been under active exploitation since Aug. 15. Wiz published its findings Sept. 10, tying the activity to three separate CVEs that attackers have learned to chain together.

How the three flaws fit together

The first, CVE-2026-42016, published July 27, lets an attacker exchange a low-privilege token for one with administrator scope, because Artifactory checks a token's signature and issuer but not what it is actually authorized to do. JFrog rated it 8.1 out of 10 on the CVSS severity scale; the National Institute of Standards and Technology scores it higher, at 8.8, because it also allows an attacker to disrupt the service, not just read and alter it.

The second, CVE-2026-42018, published Aug. 12, carries a lower score of 7.5, and on its own the score is fair: it only returns an internal anonymous-access token to a caller who should not have one. Chained with the third flaw, CVE-2026-82329, published Aug. 28 and rated a critical 9.8, that token becomes the key to a server that will hand over administrative privileges to anyone who asks under Artifactory's default settings.

1. CVE-2026-42016 (6 wks)59 %
2. CVE-2026-42018 (4 wks)62 %
3. CVE-2026-82329 (2 wks)49 %

Source: Wiz Research, published 2026-09-10, accessed 2026-09-12

What Wiz found once attackers were inside

Wiz researchers Shahar Dorfman, Sean Johnstone, Zohar Kaplan and Kurt Giacchino wrote that intruders created new administrator accounts under names built to blend into normal service traffic, including jfrog-distribution, jfrog-insight, repo-service and ldap_admin, alongside more obviously malicious ones like 0xTerror. From there, the researchers said, attackers deployed malicious Groovy plugins for code execution and installed Rust-based backdoors intended to survive a later patch.

Because Artifactory typically stores software packages, deployment credentials and CI/CD pipeline secrets, Wiz said a successful compromise can become a route into whatever systems a company builds and ships from that server, well beyond Artifactory alone.

Where patching stands, six weeks in

Wiz measured 67 percent of scanned organizations running Artifactory as vulnerable to CVE-2026-42016 the day it was disclosed; six weeks later, 59 percent still were. The pattern repeats for the other two flaws, with the most severe, CVE-2026-82329, dropping only from 67 percent to 49 percent in its first two weeks.

A federal deadline has already passed

CISA added CVE-2026-82329 to its Known Exploited Vulnerabilities catalog on Sept. 2, giving federal civilian agencies until Sept. 5 to remediate under Binding Operational Directive 26-04. That deadline has come and gone. The other two flaws followed on Sept. 11, with a Sept. 25 deadline, meaning any federal instance still running an affected build is now out of compliance on at least one of the three.

JFrog's fix for all three requires upgrading to Artifactory 7.161.20 or later. Operators who cannot upgrade immediately can add an additionalJoinKeys entry to Artifactory's system.yaml file to close the default-configuration bypass in CVE-2026-82329, according to JFrog's own advisory page, though that workaround does not address the other two CVEs in the chain.

The pattern echoes the MikroTik RouterOS flaws CISA added to its catalog earlier this month: a known fix sitting unapplied for weeks while a public deadline passes unnoticed. It also follows the same federal timeline structure CISA used when it gave agencies a hard cutoff on a separate firewall bug in Cisco's FMC software.