CVE-2026-4201Active Exploitation

Artifactory Under Attack: In-the-Wild Exploitation of CVE-2026-42016, CVE-2026-42018 & CVE-2026-82329 | Wiz Blog https://www.wiz.io/blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201

JFrog Artifactory under active attack weeks after disclosure. Anon token → admin → Rust backdoor. Half the exposed instances still unpatched. https://www.wiz.io/blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201

CISA put Artifactory on KEV. The two-bug chain is already live. @CISAgov listed CVE-2026-42016 and CVE-2026-42018 as Known Exploited on 11 Sep (federal due 25 Sep). @wiz_io watched multiple actors chain them against self-hosted @jfrog Artifactory from 15 Aug to 8 Sep: unauth request to admin-scoped token, sometimes under five minutes. Patch lag is ugly. Wiz: weeks later, roughly half to three-fifths of orgs still exposed depending on the CVE. CVE-2026-82329 was already KEV earlier and still unfinished in many fleets. This is not the July OpenAI/Hugging Face Artifactory path. Human operators. Pull exposed instances off the public net, patch, then hunt. Primary (CISA): https://www.cisa.gov/news-events/alerts/2026/09/11/cisa-adds-three-known-exploited-vulnerabilities-catalog Wiz: https://www.wiz.io/blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201 Write-up: https://hackerlogs.com/blog/artifactory-cisa-kev/

#threatreport #LowCompleteness Artifactory Under Attack: In-the-Wild Exploitation of CVE-2026-42016, CVE-2026-42018 & CVE-2026-82329 | 11-09-2026 Source: https://www.wiz.io/blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201 Key details below ↓ 🎯Victims: Organizations running jfrog artifactory 🔓CVEs: CVE-2026-42018 \[[Vulners](https://vulners.com/cve/CVE-2026-42018)] - CVSS V3.1: *7.5*, - Vulners: Exploitation: Unknown CVE-2026-82329 \[[Vulners](https://vulners.com/cve/CVE-2026-82329)] - CVSS V3.1: *9.8*, - Vulners: Exploitation: True Soft: - jfrog artifactory (<7.111.21, <7.117.28, <7.125.20, <7.133.29, <7.146.38) CVE-2026-42016 \[[Vulners](https://vulners.com/cve/CVE-2026-42016)] - CVSS V3.1: *Unknown*, - Vulners: Exploitation: Unknown 📚TTPs: ⚔️Tactics: 2 🛠️Technics: 0 🤖LLM extracted TTPs:` T1059, T1059.004, T1068, T1078, T1083, T1105, T1136, T1190, T1505, T1505.003, ... 🧨IOCs: - IP: 19 - Url: 2 - Hash: 1 - Domain: 0 - Email: 0 - BrowserExtension: 0 🔢Algorithms: sha1 📜Programming Languages: groovy, rust 💻Platforms: intel #threatreport: Between August 15 and September 8, 2026, threat actors actively exploited CVE-2026-42018 and CVE-2026-42016 against self-hosted JFrog Artifactory instances. CVE-2026-42018 allows an unauthenticated requester to obtain a JWT for Artifactory’s internal anonymous user, even when anonymous access is disabled. CVE-2026-42016 insufficiently validates token scope, allowing a low-privileged token to be exchanged or used with elevated administrative authority. Chained together, the vulnerabilities enable an unauthenticated attacker to obtain an admin-scoped token. Observed attacks began with a trailing-slash request to `POST /access/api/v1/aws/token/`, which returned HTTP 200 and an anonymous-user JWT. The attacker then submitted the token to `POST /access/api/v1/tokens`, receiving an admin-scoped token that retained the username `anonymous`. Subsequent actions appeared in logs as originating from `token:anonymous`. In some cases, attackers created a persistent administrator account within five minutes using `PUT /api/security/users/<username>` or `PUT /access/api/ui/users/<username>`. Post-exploitation activity included deploying malicious Groovy plugins through Artifactory’s native plugin framework to execute arbitrary code. Attackers used plugin endpoints such as `GET` or `POST /api/plugins/execute/<plugin>` to run shell commands, conduct reconnaissance, and enumerate files. They also delivered second-stage payloads by downloading binaries over HTTP, writing them to world-writable locations including `/dev/shm`, `/tmp`, and `/var/tmp`, and establishing command-and-control communication. A custom Rust-based backdoor was observed in multiple incidents, while some actors uploaded scripts to repository paths to maintain webshell-style access. From September 1 to September 8, 2026, separate actors exploited the critical CVE-2026-82329, an authentication-bypass vulnerability affecting Artifactory’s default configuration. Exploitation involved unauthenticated requests to `POST /access/api/v1/registry/join`, which returned HTTP 201 and an admin-scoped token. Subsequent activities varied across environments. At initial disclosure, approximately 67–69% of observed Artifactory deployments were vulnerable to the three flaws. Remediation remained incomplete, although exposure to CVE-2026-82329 declined more rapidly because of its critical severity.