Key Facts
Wiz Research reports active, in-the-wild exploitation of CVE-2026-42016, CVE-2026-42018, and CVE-2026-82329 in JFrog Artifactory. Wiz says attackers have used the issues to bypass authentication, escalate privileges, and obtain administrative control of vulnerable instances.
Technical Details
Wiz describes CVE-2026-42018 as exposure of an internal anonymous-user token and CVE-2026-42016 as insufficient token-scope validation. It says attackers chained those issues against self-hosted instances; separately, it describes CVE-2026-82329 as a default-configuration authentication bypass that can yield administrative privileges.
Impact & Mitigation
Wiz observed persistent administrator accounts, malicious Groovy plugins, and Rust-based backdoors after compromise. Prioritize exposed self-hosted Artifactory deployments, apply the vendor fixes identified in the JFrog advisories, and investigate for unexpected administrator accounts, plugins, tokens, and outbound command-and-control activity.