Exploitation of JFrog Artifactory CVE-2026-82329: Unauthenticated Administrator Token Generation

1. Basic Information

• Original Title: Critical JFrog Artifactory Vulnerability Reportedly Exploited in the Wild
• Source: SecurityWeek, BleepingComputer, Wiz
• Publication Date: September 1, 2026
• Severity: Critical
• Reason for Severity: Wiz has confirmed administrator privilege acquisition and post-compromise activity across multiple environments. Configuration theft and backdoor installation have also been reported, requiring updates as well as investigations into unauthorized accounts, credentials, and servers.
• Original Link: Critical JFrog Artifactory Vulnerability Reportedly Exploited in the Wild
• Related Sources: Wiz: Artifactory Under Attack, BleepingComputer: Artifactory flaws chained in attacks, JFrog Security Advisories, CISA Known Exploited Vulnerabilities Catalog, JFrog: join key and master key, CISA KEV Official JSON
• Related Malware: custom Rust C2 backdoor
• Related CVEs: CVE-2026-82329, CVE-2026-42018, CVE-2026-42016
• Related Product: JFrog Artifactory
• Reason for Update: We reviewed Wiz active exploitation information added during the September 12 collection and corrected conditions/patched versions by CVE, observation periods and post-compromise behavior, statistical denominators, SSH key registration destinations, and ATT&CK mappings. We confirmed the disclosure dates of three entries in the newly provided CISA KEV version dated September 11, 2026, and distinguished between JFrog patched version notices and scope notation clarifications.

2. Executive Summary

Wiz has confirmed administrator privilege acquisition combining CVE-2026-42018 and CVE-2026-42016, along with active exploitation of CVE-2026-82329. Post-compromise behavior varies by case, with reports including Groovy plugins, web shells, Rust-based backdoors, and the theft of configurations or cluster join keys.

3. Attack Flow

Flow 1: Chaining CVE-2026-42018 and CVE-2026-42016 (Observed by Wiz)

1. An unauthenticated request obtains an internal anonymous user JWT. CVE-2026-42018 does not grant administrator privileges on its own at this stage.
2. Exploiting insufficient privilege scope validation in CVE-2026-42016, the JWT is exchanged for an administrator privilege token. Both vulnerabilities are required for the chain.
3. Administrative operations can now be performed under the anonymous username, and in some cases, an administrator account was created in less than five minutes from the initial request.
4. Following compromise, malicious Groovy plugin shell command execution, deployment of additional payloads or Rust-based backdoors, and web shell uploads were observed. Not all environments executed the same subsequent steps.

Flow 2: Administrator Privilege Acquisition via CVE-2026-82329 (Observed by Wiz)

1. An unauthenticated POST request is sent to /access/api/v1/registry/join to obtain an administrator privilege token.
2. Depending on the case, attackers create administrator accounts or long-lived tokens, retrieve configurations, or enumerate repositories, users, and tokens.
3. Some attackers obtained cluster join keys and added attacker SSH public keys to created Artifactory users. There are no reports of OS authorized_keys being overwritten.
4. Inference: Additional access using acquired credentials or administrative privileges is possible, but artifact tampering or successful downstream environment compromise cannot be confirmed from these observations alone.

4. Attacker Position and Execution Location

• CVE-2026-42018 and CVE-2026-82329 originate from unauthenticated attackers with network reachability to vulnerable Artifactory instances. CVE-2026-42016 alone requires a valid low-privilege token.
• After acquiring administrator privileges, some observed cases executed commands on the server via plugins.

5. Visibility for Victims and Administrators

Victims

• This is not an attack requiring user interaction, and intrusions may go unnoticed through normal artifact retrieval alone.

Administrators

• Internal anonymous user tokens when anonymous access is disabled, administrative operations under anonymous names, and new administrator accounts.
• Malicious Groovy plugins, unknown payloads placed in temporary directories, and suspicious communication from the server.
• Addition of SSH public keys to Artifactory users, configuration retrieval, and user/token enumeration. This is distinct from modifications to OS SSH key files.

6. Success and Failure Conditions

Success Conditions

• Attacker reachability to vulnerable self-managed Artifactory instances.
• For unauthenticated chaining, both CVE-2026-42018 and CVE-2026-42016 must be met. CVE-2026-82329 is a separate authentication bypass vector.
• Command execution after privilege acquisition requires server-side execution features such as plugins.

Failure Conditions

• Check and update according to CVE-specific patch statuses. Do not assume CVE-2026-42016 is patched based solely on old-series patched versions for CVE-2026-82329.
• Inference: Restricting management API access sources and managing plugin change controls are auxiliary measures to limit attack reach and subsequent execution.
• Inference: Post-compromise actions include revoking tokens, deleting unauthorized accounts, and removing registered SSH public keys. Applying patches does not necessarily eliminate existing access vectors.

CVE-Specific Conditions and Patched Versions

Patched versions listed in JFrog's individual advisories. Verify that the update destination meets all three remediation requirements.

CVE	Condition	Patched Version
CVE-2026-42018	Obtains internal anonymous user token without authentication. Does not grant administrator privileges independently.	7.111.20, 7.117.27, 7.125.19, 7.133.28, 7.146.8 across respective series.
CVE-2026-42016	Privilege escalation from a valid low-privilege token. JFrog impact scope is prior to 7.133.11.	7.133.11. Backports to older series cannot be verified from this document.
CVE-2026-82329	A separate path to acquire administrator privileges without authentication under default configurations.	7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, 7.161.20 across respective series. 7.111.21 is explicitly stated in Patched Version and How to Fix.

7. What Happens Upon Success

• Acquisition of Artifactory administrator privileges and code execution on the server via plugins.
• Theft of configurations and cluster join keys, or unauthorized access to managed repository, user, and token information.
• Inference: If artifacts are tampered with and retrieved/executed downstream, the impact could spread to the software supply chain. Success at that stage is not confirmed in current public information.

8. Observable Logs

Email

• User-facing emails are not required for this attack path.

Proxy / SWG / DNS

• Wiz indicates requests for token acquisition/exchange and management API operations. Application logs or reverse proxy logs capable of recording HTTP methods, paths, response codes, and usernames serve as the starting point for investigation.

Endpoint / EDR

• Inference: Depending on acquired configurations, check for shell launches from Artifactory/Java, and writes/execution in /dev/shm, /tmp, or /var/tmp. The mere presence of these paths does not determine a compromise.

Identity / IdP

• Artifactory internal tokens and local user operations may not be traceable via external IdP logs alone. Correlate with Artifactory user and token records.

SaaS / Cloud

• Privilege operations under anonymous names, new administrators, token issuance, configuration/join key retrieval, and SSH public key registration to Artifactory users. Available fields depend on configuration and logging settings.

Network

• Inference: Check for payload retrieval or C2 communications from the server to unknown destinations. Cross-reference Wiz public IOCs with connection timestamps, and do not attribute all activity to the same attacker based solely on destination matches.

9. Attack Success Determination

The following outlines the scope confirmed in public information and the criteria used in organizational investigations:

• Malware Execution or Authentication Success Confirmed: Public Info: Wiz confirmed active exploitation of three CVEs and administrator privilege acquisition. Do not judge solely by HTTP 200/201; correlate with returned token privileges and subsequent management operations.
• Initial Execution Confirmed: Public Info: In some cases following the 42018->42016 chain, shell command execution via malicious Groovy plugins was reported. Token issuance alone is not treated as code execution on the OS.
• Information Theft or Session Compromise Confirmed: Public Info: Multiple cases of 82329 reported configuration theft, cluster join key acquisition, and enumeration of users, repositories, and tokens. Distinguish between enumeration and theft of all repository internal data.
• Subsequent Compromise Confirmed: Criteria: Cases where artifact tampering or malicious execution in downstream environments is confirmed. Unconfirmed in this document. Addition of administrator accounts or SSH keys and backdoor installation are treated separately as evidence of persistence.

10. Investigation Playbook

Triggers

• Management operations by anonymous users, unknown administrators/tokens/SSH public keys, unauthorized plugin modifications, or server-side execution.

Initial Verification

• Preserve CVE-specific vulnerable versions, exposure scopes, request/response timestamps, and token issuance/administrator creation records.

Endpoints and Servers

• Inspect Groovy plugins, temporary directory payloads, web shells, and process and communication histories.
• Inference: If OS command execution is suspected, investigate SSH configurations and startup execution mechanisms. Do not confuse this with the addition of SSH keys to Artifactory users indicated by Wiz.

Authentication and Cloud

• Verify token IDs, privilege scopes, issuers, administrators and service accounts, Artifactory-registered SSH public keys, and cluster join key retrieval history.

Subsequent Operations

• Review repository artifact digests and change histories, build provenances, and downstream retrieval/deployment records to determine tampering or downstream compromise.

Containment

• Preserve evidence, perform network isolation and updates, and invalidate unauthorized accounts, tokens, and registered SSH public keys. Revoke and reissue exposed integration credentials at the issuer.
• Verify impacts on related services and replace cluster join keys according to JFrog procedures. Distinguish from the master key used for database encryption and avoid bulk deletion of key files.
• If OS-level execution via plugins or backdoors is suspected, consider rebuilding from trusted images after preserving evidence.

Decision Categories

• Separate reconnaissance, token acquisition, administrator privileges, OS command execution, information retrieval, persistence, artifact tampering, and downstream compromise.

11. Defense and Detection Ideas

Single Events

• Candidate for detection: requests where names and privilege operations do not align, such as administrator creation or token issuance by internal anonymous users.
• Inference: Check for shells launched from Artifactory processes or unknown executables in temporary directories.

Time-Series Correlation

• Wiz detection proposal: correlate requests transitioning from 401 to 200 before and after path changes for token acquisition, followed by token exchange and administrator creation.
• Do not confirm exploitation based solely on 200/201 responses to POST requests to /access/api/v1/registry/join; correlate with subsequent operations such as administrator creation or configuration retrieval.

Hunting

• The observation period for the chain is August 15 to September 8, 2026, and for 82329 is September 1 to 8. Organizations should look back based on vulnerable version exposure periods and not treat reported initial observation dates as the lower bound for attack start dates.

Log Shortages

• Response codes alone cannot confirm acquired token privileges or command execution success. Combine records of users, privileges, management operations, processes, and communications.

Priority Measures

• Prioritize CVE-specific updates, reduction of exposure scope, invalidation of unauthorized access vectors, host rebuild decisions, and artifact integrity verification.

12. Facts, Inference, and Hypothesis

Facts

• JFrog describes CVE-2026-42018 as exposure of internal anonymous user tokens, CVE-2026-42016 as insufficient validation of token privilege scopes, and CVE-2026-82329 as an authentication weakness leading to administrator privileges under default configurations.
• Wiz observed the 42018->42016 chain from August 15 to September 8, 2026, and active exploitation of 82329 from September 1 to 8. The company handled multiple attackers and environments and explicitly stated that not all steps were executed by a single attacker.
• Following the chain, administrator account creation, malicious Groovy plugins, shell commands, additional payloads, Rust-based backdoors, and web shells were observed depending on the case.
• In 82329 cases, reports included configuration and cluster join key acquisition, administrator creation, long-lived token issuance, user enumeration, and addition of SSH keys to Artifactory users.
• Wiz statistics represent the percentage of organizations among its Artifactory-using observational targets that possess at least one instance vulnerable to the respective CVE. For 42016, it went from 67% at publication to 59% about 6 weeks later; for 42018, from 69% to 62% about 4 weeks later; and for 82329, from 67% to 49% about 2 weeks later. This does not represent the proportion of all public assets nor the combined value of organizations matching any of the three.
• In the September 11, 2026 version of CISA KEV, CVE-2026-82329 was added on September 2, and CVE-2026-42016 and CVE-2026-42018 on September 11. KEV listing alone does not determine individual organizational compromise stages or impact scopes.
• JFrog states it has completed responses for affected cloud environments and guides self-managed environments to updates corresponding to CVEs and release series.
• JFrog disclosed CVE-2026-82329 on August 28, 2026, rating it Critical with CWE-287 (Improper Authentication). Patched versions for the 7.111 series are guided as 7.111.21 in both the Patched Version and How to Fix individual tables.

Inference

• Trusting token usernames alone may cause oversight of operations where anonymous identities are granted administrator privileges. Privilege scopes and executed API operations must be checked together.
• Unauthorized tokens, accounts, registered keys, or backdoors may persist even after updates. Fixing entry vectors and eliminating existing access means must be performed separately.

Hypothesis

No additional hypotheses. Unconfirmed items are listed under "Unresolved Items and Additional Investigations."

13. MITRE ATT&CK Mapping

• T1190 Exploit Public-Facing Application (Confidence: high): Exploits vulnerabilities in Artifactory public APIs.
• T1136 Create Account (Confidence: high): Reports Artifactory administrator account creation. Does not determine creation of OS local users.
• T1505.003 Server Software Component: Web Shell (Confidence: high): Wiz reports web shell uploads to repository paths.
• T1059.004 Command and Scripting Interpreter: Unix Shell (Confidence: high): Corresponds to server-side shell command execution via Groovy plugins. Groovy is not classified as JavaScript.
• T1098 Account Manipulation (Confidence: high): Reports adding SSH public keys to Artifactory users. Mappings based on rewriting OS authorized_keys are not performed.

14. Unresolved Items and Additional Investigations

• Number of victim organizations, specific attacker attributions, and connections between cases.
• Instances where artifact tampering or downstream build/deployment compromises succeeded.
• Full scope of data acquired in each environment. Repository enumeration alone does not determine theft of all internal data.
• The impact scope of CVE-2026-82329 is notated as 7.111.4 > 7.111.21, leaving it unclear whether endpoints are included. Meanwhile, Patched Version and How to Fix explicitly designate 7.111.21 as the patched version. What remains unconfirmed is the notation of the impact scope, not the vendor's patched version guidance itself.

15. Impact on SOCs and Organizations

For organizations centralizing software artifacts or CI/CD credentials in Artifactory, administrator privilege compromises may ripple into development and deployment processes. Verify update statuses by CVE, and investigate anonymous management operations, unauthorized plugins, registered SSH keys, and tokens. Confirming artifacts and downstream usage is also necessary, though administrator privilege acquisition alone does not determine successful downstream compromise.

16. Summary by Target Audience

• SOC: Correlate CVE-specific requests and privilege operations, judging token acquisition, OS execution, information retrieval, and downstream impact separately.
• Administrators: Verify patch status for each of the three issues, and invalidate unauthorized accounts, tokens, and Artifactory-registered SSH keys. Replace cluster join keys according to product procedures.
• Users: This is an attack requiring no user interaction. Report any unexpected changes in retrieved artifacts or build results to administrators.