> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # CVE-2026-42018 — JFrog Artifactory: JFrog Artifactory Improper Authentication Vulnerability - URL: https://f4n6.co.uk/security-feed/cve-2026-42018-jfrog-artifactory-jfrog-artifactory-improper-authentication-vulnerability/ - Published: 2026-09-11T21:30:37.000Z - Updated: 2026-09-11T21:30:37.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2026-42018 ## 1\. Executive summary CVE-2026-42018 is a HIGH-severity (CVSS 7.5, CWE-287 Improper Authentication) vulnerability in JFrog Artifactory in which an unauthenticated caller can obtain an internal anonymous-user token even when anonymous access is disabled, then use that token to authenticate and access sensitive repository resources. It is listed in CISA's KEV catalogue (added 2026-09-11, remediation due 2026-09-25), and Wiz has confirmed in-the-wild exploitation of this CVE — chained with CVE-2026-42016 — against self-hosted Artifactory instances between 2026-08-15 and 2026-09-08, resulting in administrative access, persistent admin accounts, Groovy-plugin RCE, web shells and a custom Rust backdoor. Wiz reports 62% of organisations remained vulnerable four weeks after JFrog's 2026-08-12 patch. For EMEA financial services running self-hosted Artifactory — a common component in CI/CD and software supply chains — this is an actively exploited, internet-reachable path to source code, artefacts and build credentials, and it should be treated as an immediate patch-and-hunt priority. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 19: reporting of major ICT-related incidents to competent authorities | Confirmed in-the-wild exploitation of an internet-exposed Artifactory instance would compromise a CI/CD component holding source code, artefacts and credentials — a compromise with plausible major-impact classification, not a routine patch gap | If exploitation is confirmed on your estate, run it through your Art. 18 classification process immediately and prepare an Art. 19 report; do not wait for full forensic scope | | DORA Art. 28: ICT third-party risk — general principles | Artifactory is typically operated as internal infrastructure supporting third-party software intake and build pipelines; the Wiz data shows slow patching velocity (62% unpatched at four weeks) across the user base | Fold Artifactory version/patch state into third-party and supply-chain assurance for any provider running Artifactory on your behalf; NIS2 Art. 21(2)(d) supply chain security measures apply analogously to in-scope NIS2 entities | No other article in the regulatory reference is specifically engaged by the facts of this item. ## 3\. Technical analysis & attack chain **Vulnerability mechanism.** Artifactory returns an internal anonymous-user token to an unauthenticated caller even when anonymous access has been disabled. The token is usable for authentication to the repository manager, giving the attacker access to sensitive resources (repositories, artefacts, and potentially configuration and credential material reachable by that token context). Verified classification: CWE-287 Improper Authentication, CVSS 7.5 HIGH, CISA KEV listed 2026-09-11 with a 2026-09-25 remediation due date. EPSS is recorded at 0%, which is inconsistent with the confirmed in-the-wild exploitation below — treat EPSS as lagging and do not use it for prioritisation here. ### Confirmed attack chain (multi-source: Wiz via The Register, corroborated by CISA KEV listing) 1. **Initial access.** Attacker reaches an internet-exposed, self-hosted Artifactory instance running a version vulnerable to CVE-2026-42018 (unpatched against the 2026-08-12 fix). 2. **Token acquisition.** Unauthenticated request returns the internal anonymous-user token despite anonymous access being disabled. 3. **Authentication and chaining.** Attacker authenticates with the token. Wiz observed attackers chaining CVE-2026-42018 with CVE-2026-42016 (incorrect authorization: Artifactory validates token signature/issuer but not token scope) to elevate from low-privileged access to administrative control. This chaining was observed across multiple environments between 2026-08-15 and 2026-09-08. 4. **Persistence and post-exploitation.** With admin access, observed behaviours include: establishing persistent admin accounts; installing Groovy plugins to achieve remote code execution on the server; executing shell commands through the plugin for reconnaissance and sensitive-file scanning; delivering second-stage payloads; uploading web shells; and deploying a custom Rust backdoor for command-and-control. 5. **Credential and data access.** Enumeration of users, groups, credential sets, repositories, tokens and federated access topologies (watchTowr honeypot observation, reported via The Register); token minting for long-lived credentials; key theft; and in some cases attaching attacker-controlled SSH keys to created users. **Related exploited CVEs in the same campaign window** (all JFrog Artifactory, all CISA KEV-listed, all with 2026-09-25 or earlier due dates unless noted): - **CVE-2026-82329** — critical authentication bypass; unauthenticated attacker with network access obtains administrative privileges under default configuration. Patched 2026-08-28; exploited in the wild from \~2026-09-01 per Wiz, with watchTowr observing attacks four days after disclosure. KEV due date 2026-09-05 (already passed — treat as overdue). Post-exploitation overlaps with the chain above. - **CVE-2026-42016** — high-severity privilege escalation via token scope validation failure; patched 2026-07-27; confirmed exploited in the wild, chained with CVE-2026-42018. - **CVE-2026-66384** — path traversal allowing an authenticated user to write outside the intended Docker cache path under specific remote-repository conditions; KEV-listed with a 2026-09-10 due date. No exploitation detail is given in the source material beyond the KEV listing. **Confidence caveats.** The exploitation detail (chaining behaviour, Rust backdoor, Groovy-plugin RCE, web shells, SSH-key attachment) is single-sourced to the Wiz report as relayed by The Register; watchTowr's honeypot observations corroborate the exploitation timing and enumeration behaviour but not the full post-exploitation set. Verify against your own telemetry before enforcement action. No threat actor is named in any source; no MITRE ATT&CK actor profile exists in the verified reference data, so attribution is unconfirmed and should be treated as multiple independent actors ("not a unified attack chain by a single threat actor" per Wiz). No ransomware involvement is indicated — "Known ransomware campaign use: Unknown" per CISA; do not categorise the observed data access as extortion. ## 4\. Mitigation & containment ### P1 — within 24 hours - **Inventory and patch.** Locate all self-hosted Artifactory instances (including those run by third parties on your behalf) and upgrade to a fixed version. JFrog patched CVE-2026-42018 on 2026-08-12, CVE-2026-42016 on 2026-07-27, and CVE-2026-82329 on 2026-08-28 — any build older than the 2026-08-28 fix should be assumed vulnerable to at least one of the three. The CISA KEV due date for CVE-2026-42018 is 2026-09-25; CVE-2026-82329's due date (2026-09-05) has already passed. - **Restrict network exposure.** Artifactory must not be internet-facing. Where it must be reachable, restrict to VPN/allowlisted CIDRs at the edge. Wiz explicitly advises prioritising internet-accessible instances. - **Hunt for exploitation on any instance that was exposed and unpatched in the window 2026-08-15 to 2026-09-08** (and from \~2026-09-01 for CVE-2026-82329): review admin-account creation events, user and token enumeration in access logs, newly installed Groovy plugins under the Artifactory plugins directory, unexpected web shells in web-accessible paths, and unknown SSH keys attached to Artifactory users. ### P2 — within 72 hours - **Token hygiene.** Rotate all Artifactory access tokens, API keys and credentials reachable from compromised or exposed instances; invalidate long-lived tokens minted in the exposure window. Review federated access topologies for unauthorised entries. - **Plugin audit.** Enumerate installed Groovy plugins and diff against your change record; remove anything unaccounted for. Review shell-command execution originating from plugin contexts. - **EDR/network coverage.** Ensure EDR is deployed on Artifactory hosts with behavioural detection for Rust-compiled unknown binaries and outbound C2 from the Artifactory service account; alert on the service account spawning shells. ### P3 — within 7 days - **Configuration hardening.** Confirm anonymous access is disabled and verify the fix behaves as expected (an unauthenticated request must not return a token). Validate token scope enforcement post-upgrade given the CVE-2026-42016 weakness. - **Third-party assurance.** For Artifactory operated by suppliers, obtain version and patch attestations; fold into DORA Art. 28 third-party risk processes and NIS2 Art. 21(2)(d) supply chain measures where applicable. - **Patch-velocity process fix.** Wiz's data (62% unpatched at four weeks) indicates the systemic failure is remediation speed for internet-facing CI/CD infrastructure — set a hard SLA for KEV-listed CVEs on internet-exposed assets and make Artifactory ownership explicit. ## 5\. Indicators of compromise No atomic indicators of compromise (hashes, domains, IPs, file names) are available in the source material. The sources describe observable behaviours only. ### Behavioural indicators | Behaviour | Where to observe | Confidence | | ------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------ | -------------------------------------------------------- | | Unauthenticated requests returning anonymous-user tokens despite anonymous access being disabled | Artifactory access/request logs | High — direct consequence of the vulnerability mechanism | | Creation of new persistent admin accounts | Artifactory admin/user management audit logs | High — observed by Wiz across multiple environments | | Enumeration of users, groups, credential sets, repositories, tokens and federated access topologies | Artifactory access logs (high-volume sequential GET patterns by a single session) | High — observed by both Wiz and watchTowr | | Installation of Groovy plugins enabling RCE, followed by shell command execution for reconnaissance and sensitive-file scanning | Artifactory plugins directory; process telemetry for shell children of the Artifactory JVM | Medium — single-sourced to Wiz | | Upload of web shells | Web-accessible paths on the Artifactory host; file-integrity monitoring | Medium — single-sourced to Wiz | | Deployment of a custom Rust backdoor establishing C2 | EDR on Artifactory hosts; outbound network telemetry from the service account | Medium — single-sourced to Wiz | | Token minting for long-lived credentials; key theft; attacker SSH keys attached to created users | Artifactory token/SSH key management logs | Medium — single-sourced to Wiz | ## 6\. Detection Insufficient indicators to author detection rules. The source material describes behaviours (§5) but contains no strings, file names, paths, registry keys, mutexes or command-line artefacts specific to the malicious tooling — a YARA or Sigma rule built from vendor names or CVE identifiers would detect reporting about the threat, not the threat itself. Revisit if the Wiz technical report publishes backdoor artefacts. ## CVE assessment 1 referenced CVE — **1 actively exploited (CISA KEV)** | CVE | CVSS | Exploited | EPSS | Summary | | -------------------------------------------------------------------------------- | -------- | ---------------- | ---- | -------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2026-42018](https://nvd.nist.gov/vuln/detail/CVE-2026-42018?ref=f4n6.co.uk) | 7.5 High | ⚠ KEV 2026-09-11 | 0% | JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled,… | ## 7\. Sources - NVD — CVE-2026-42018 — JFrog Artifactory Improper Authentication Vulnerability — https://nvd.nist.gov/vuln/detail/CVE-2026-42018 — 2026-09-10 - CISA KEV (via NVD) — CVE-2026-42016 — JFrog Artifactory Incorrect Authorization Vulnerability — https://nvd.nist.gov/vuln/detail/CVE-2026-42016 — accessed 2026-09-11 - CISA KEV (via NVD) — CVE-2026-82329 — JFrog Artifactory Improper Authentication Vulnerability — https://nvd.nist.gov/vuln/detail/CVE-2026-82329 — accessed 2026-09-11 - CISA KEV (via NVD) — CVE-2026-66384 — JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability — https://nvd.nist.gov/vuln/detail/CVE-2026-66384 — accessed 2026-09-11 - The Register Security — More JFrog Artifactory bugs under attack, and all 3 have patches — https://www.theregister.com/security/2026/09/11/more-jfrog-artifactory-bugs-under-attack-and-all-3-have-patches/5295943 — 2026-09-11 - Dark Reading — Attackers Pounce on Critical Artifactory Flaw Following Disclosure — https://www.darkreading.com/application-security/attackers-pounce-critical-artifactory-flaw-disclosure — accessed 2026-09-11 - SecurityWeek — Critical JFrog Artifactory Vulnerability Reportedly Exploited in the Wild — https://www.securityweek.com/critical-jfrog-artifactory-vulnerability-reportedly-exploited-in-the-wild/ — accessed 2026-09-11 ## 8\. Adverse Trace position We assess this as a **high-priority, actively exploited vulnerability** — CVSS 7.5 HIGH per NVD, CISA KEV-listed with a 2026-09-25 due date, with multi-source confirmation of in-the-wild exploitation and a documented chain to administrative compromise, RCE and backdoor deployment on self-hosted instances. The verified EPSS of 0% contradicts the observed exploitation and should be disregarded for triage; the KEV listing and Wiz/watchTowr reporting are the authoritative signals. The post-exploitation detail is single-sourced to Wiz (via The Register) — verify against internal telemetry before enforcement or incident declaration. For EMEA financial services, the exposure is not merely the Artifactory instance: it is the build pipeline, source code, artefact integrity and downstream software supply chain, which is why we treat confirmed compromise as a candidate DORA Art. 19 major incident rather than a routine asset compromise. Our next steps: monitor for release of the Wiz technical report and any IOC/backdoor artefacts, update this advisory if atomic indicators emerge, and track patch-velocity metrics across the client base for the three exploited CVEs. --- [Read the original source →](https://nvd.nist.gov/vuln/detail/CVE-2026-42018?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*