CVE-2026-42016 — JFrog Artifactory: JFrog Artifactory Incorrect Authorization Vulnerability

1. Executive summary

CVE-2026-42016 is a high-severity (CVSS 8.1, CWE-863 Incorrect Authorization) privilege-escalation vulnerability in JFrog Artifactory, in active exploitation and listed in CISA's KEV catalogue as of 2026-09-11 with a federal remediation deadline of 2026-09-25. The flaw stems from Artifactory validating only a token's signature/issuer and not its scope, allowing a low-privileged authenticated attacker to elevate privileges and perform unauthorised actions. Wiz has confirmed in-the-wild exploitation of this CVE — chained with CVE-2026-42018 against self-hosted instances from 15 August through 8 September 2026 — with attackers gaining admin access, installing Groovy plugins for remote code execution, and deploying a custom Rust backdoor for command-and-control. Artifactory is core developer tooling in most financial services estates; a compromised instance exposes source code, build artefacts, secrets and CI/CD pipelines, making this a supply-chain risk multiplier, not a single-server problem. JFrog patched this flaw on 27 July 2026, yet Wiz reports 59% of organisations remained vulnerable six weeks post-disclosure.

2. Regulatory framing

No UK NIS 2018 duty is specifically triggered by the facts of this item beyond generic incident-handling obligations.

3. Technical analysis & attack chain

Vulnerability mechanism. Artifactory's token validation logic checks the token's signature and issuer but does not validate the token's scope. A token legitimately issued to a low-privileged user therefore passes validation while carrying — or being treated as carrying — entitlements beyond the holder's actual permissions. An attacker with any low-privileged authenticated access (a basic account, a scoped CI token, or a token obtained via the companion flaw CVE-2026-42018) can use this to perform administrative actions. NVD classifies this as CWE-863 (Incorrect Authorization); the vendor description frames it as privilege escalation — both describe the same missing scope check.

Confirmed attack chain (Wiz-observed, 15 August – 8 September 2026)

1. Initial access. Attacker reaches an internet-exposed, self-hosted Artifactory instance. Wiz observed attackers chaining CVE-2026-42018 (improper authentication returning an internal anonymous-user token to an unauthenticated caller even when anonymous access is disabled) with CVE-2026-42016 to convert network access into admin access.
2. Privilege escalation. The unauthenticated foothold from CVE-2026-42018 is escalated via CVE-2026-42016's missing scope validation to administrative privilege.
3. Persistence. Multiple mechanisms observed: establishing persistent admin accounts; minting long-lived tokens; in some intrusions, attaching attacker-controlled SSH keys to created user accounts.
4. Execution. Installation of Groovy plugins on the Artifactory server to achieve remote code execution; shell commands executed through the plugin for reconnaissance and to scan for sensitive files; delivery of second-stage payloads; upload of web shells.
5. Command-and-control. Deployment of a custom Rust backdoor to establish C2 capability.
6. Discovery and collection. Enumeration of users, groups, credential sets, repositories, tokens and federated access topologies (the latter via watchTowr's honeypot network); exfiltration of configuration details; theft of keys.

Observed impact. Administrative control of the repository manager, credential and key theft, RCE on the Artifactory host, and potential poisoning of build artefacts — the sources confirm the access and post-exploitation actions but do not report downstream artefact-tampering incidents, so treat supply-chain compromise as a risk, not a confirmed outcome.

Context — the wider JFrog cluster. This CVE sits in a cluster of four KEV-listed Artifactory flaws: CVE-2026-82329 (critical authentication bypass granting admin to unauthenticated network attackers under default configuration; patched 28 August; exploited from ~1 September, four days post-disclosure per watchTowr), CVE-2026-42018 (improper authentication; patched 12 August), CVE-2026-42016 (this advisory; patched 27 July), and CVE-2026-66384 (path traversal allowing writes outside the Docker cache path under specific remote-repository conditions). Wiz confirms in-the-wild exploitation of CVE-2026-42016, CVE-2026-42018 and CVE-2026-82329 across multiple environments and states the intrusions are not a unified chain by a single threat actor. No named threat actor has a MITRE ATT&CK profile in the verified reference data — attribution is unconfirmed; the sources describe multiple, unattributed attackers.

Confidence caveats. The chaining behaviour (CVE-2026-42018 → CVE-2026-42016), the Rust backdoor, Groovy-plugin RCE and web shells are single-sourced to the Wiz report as relayed by The Register — verify against your own telemetry before enforcement action. The Register notes JFrog has not responded to inquiries about the attacks. Patching-lag figures (59% vulnerable to CVE-2026-42016 at six weeks; 62% to CVE-2026-42018 at four weeks; 49% to CVE-2026-82329 at two weeks) are likewise Wiz-sourced.

4. Mitigation & containment

P1 — within 24 hours

• Inventory and patch. Locate every self-hosted Artifactory instance (including those owned by development teams or third-party providers) and upgrade to a fixed version. JFrog fixed CVE-2026-42016 on 27 July 2026; any instance unpatched since then is six weeks overdue and in the exploited population. Patch all four KEV CVEs in the same change — the exploit chain combines them.
• Restrict network exposure. Remove internet exposure from Artifactory instances immediately; allow only CI/CD and developer network ranges. Wiz explicitly advises prioritising internet-accessible instances and restricting network access.
• Hunt for compromise on every instance that was internet-exposed or running an unpatched version since 27 July 2026:
• Audit admin accounts and user creations since 1 August 2026; disable any unrecognised accounts.
• Review all access tokens, especially long-lived and admin-scoped tokens; revoke any not tied to a known owner or purpose.
• Inspect SSH keys attached to Artifactory user accounts for unrecognised entries.
• Enumerate installed Groovy plugins ($ARTIFACTORY_HOME/etc/plugins/ and user plugins configured via the UI) — remove anything not in your change record.
• Hunt for web shells and unexpected files in web-served paths; look for the custom Rust backdoor (no hash or filename available in sources — hunt by behaviour: unexpected outbound connections from the Artifactory host process tree).
• Review Artifactory access logs for enumeration patterns against users, groups, repositories, tokens and federated access topology endpoints.

P2 — within 72 hours

• Rotate all credentials resident in or reachable from Artifactory: repository credentials, federated/remote-repository credential sets, API keys, signing keys and any secrets stored as repository properties or in build configs. The observed intrusions stole keys and configuration.
• Verify SaaS posture. If you use JFrog Cloud, confirm with the provider that your instance is patched; the KEV entry directs stakeholders to follow BOD 26-04 guidance for cloud services or discontinue use if mitigations are unavailable.
• Contain laterally. Segment the Artifactory host from build agents and internal registries; the RCE path via Groovy plugins makes the Artifactory server a pivot point.
• Re-examine artefact integrity. For any instance with confirmed suspicious activity, diff published artefacts against upstream sources and re-sign from a known-good build.

P3 — within 7 days

• Meet the KEV deadline of 2026-09-25 for all four Artifactory CVEs and evidence completion.
• Harden token handling. Where the vendor provides configuration to enforce scope validation or restrict token issuance, enable it; review whether low-privileged tokens in your estate could have been scope-abused during the exposure window.
• Close the Docker cache path issue (CVE-2026-66384) in the same patch cycle — an authenticated write outside the intended Docker cache path is a natural follow-on for an attacker holding stolen credentials.
• Feed the lesson into change management. 59% of organisations were still vulnerable six weeks after patch release; if your Artifactory estate took weeks to patch, that is a DORA Art. 24 digital operational resilience testing and patch-velocity finding in its own right.

5. Indicators of compromise

No atomic indicators of compromise (hashes, domains, IPs, filenames) are available in the source material. The sources describe observable behaviours only.

Behavioural indicators

6. Detection

The sources provide no file hashes, distinctive strings, mutexes, or exact command-line artefacts for the Rust backdoor or web shells, so no YARA rule can be authored from threat artefacts without fabrication. However, the observed behaviours support a Sigma rule for the highest-value log signal: suspicious admin account and token activity on Artifactory.

title: JFrog Artifactory CVE-2026-42016 / CVE-2026-42018 Exploitation - Admin Account and Token Activity
id: 7c1f2a44-8b3e-4d19-9f6a-2e5b8c0d1a73
status: experimental
description: >
  Detects creation of admin accounts and minting of long-lived tokens on JFrog Artifactory,
  consistent with observed post-exploitation behaviour for CVE-2026-42016, CVE-2026-42018 and
  CVE-2026-82329 intrusions reported by Wiz (Aug-Sep 2026). Tune against baseline admin activity.
references:

  - https://nvd.nist.gov/vuln/detail/CVE-2026-42016
  - https://www.theregister.com/security/2026/09/11/more-jfrog-artifactory-bugs-under-attack-and-all-3-have-patches/5295943
author: Adverse Trace
date: 2026-09-11
logsource:
  product: artifactory
  service: audit
detection:
  selection_admin_create:
    event_type: 'user_created'
    user_role|contains: 'admin'
  selection_token_mint:
    event_type: 'token_created'
  filter_baseline:
    user|re: '^(ci-bot|build-agent|svc-artifactory)'
  condition: (selection_admin_create or selection_token_mint) and not filter_baseline
falsepositives:

  - Legitimate CI/CD service accounts minting tokens (tune the filter to your naming conventions)
  - Planned administrative account creation during onboarding
level: high

Note: Artifactory audit event field names vary by deployment; map event_type, user_role and user to your instance's audit schema before deployment. The rule is behavioural, not artefact-based — treat alerts as investigation triggers, not confirmations.

CVE assessment

1 referenced CVE — 1 actively exploited (CISA KEV)

7. Sources

• NVD — CVE-2026-42016 — JFrog Artifactory Incorrect Authorization Vulnerability — https://nvd.nist.gov/vuln/detail/CVE-2026-42016 — 2026-09-10
• CISA Known Exploited Vulnerabilities — CVE-2026-42018 — JFrog Artifactory Improper Authentication Vulnerability — https://nvd.nist.gov/vuln/detail/CVE-2026-42018
• CISA Known Exploited Vulnerabilities — CVE-2026-82329 — JFrog Artifactory Improper Authentication Vulnerability — https://nvd.nist.gov/vuln/detail/CVE-2026-82329
• CISA Known Exploited Vulnerabilities — CVE-2026-66384 — JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability — https://nvd.nist.gov/vuln/detail/CVE-2026-66384
• The Register Security — More JFrog Artifactory bugs under attack, and all 3 have patches — https://www.theregister.com/security/2026/09/11/more-jfrog-artifactory-bugs-under-attack-and-all-3-have-patches/5295943 — 2026-09-11
• The Hacker News — Attackers Exploit Critical JFrog Artifactory Flaw to Mint Admin Tokens Days After Disclosure — https://thehackernews.com/2026/09/attackers-exploit-critical-jfrog.html — 2026-09
• Dark Reading — Attackers Pounce on Critical Artifactory Flaw Following Disclosure — https://www.darkreading.com/application-security/attackers-pounce-critical-artifactory-flaw-disclosure — 2026-09

8. Adverse Trace position

We assess this as a high-severity, actively exploited vulnerability (CVSS 8.1, CISA KEV, deadline 2026-09-25) with confirmed in-the-wild chaining into full administrative compromise, RCE and backdoor deployment — the KEV listing plus Wiz's multi-environment exploitation evidence puts this firmly in "patch this week" territory for any EMEA financial services client running self-hosted Artifactory. The specific danger for our clients is not the Artifactory server itself but what it guards: signing keys, repository credentials, federated topology and the build pipeline — a compromised instance is a supply-chain compromise waiting to propagate, which is why we treat unpatched instances as a reportable cyber threat under DORA Art. 18 even before compromise is confirmed. Attribution is unconfirmed (no MITRE-profiled actor in the verified data; Wiz describes multiple, unattributed attackers), and the detailed post-exploitation picture — Rust backdoor, Groovy-plugin RCE, web shells — is single-sourced to Wiz via The Register, so we recommend verifying against internal telemetry before any enforcement or notification decision. We will monitor for a JFrog advisory with concrete fixed-version numbers, for release of the Rust backdoor sample (which would enable YARA coverage), and for any confirmation of artefact tampering in compromised environments; an updated advisory will follow if any of these materialise or if CISA adds further Artifactory CVEs to the KEV catalogue.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.