Affected Systems

JFrog Artifactory self-hosted instances: CVE-2026-42018 and CVE-2026-42016 (chained, versions below 7.146.8 on multiple branches); CVE-2026-82329 (standalone critical bypass, CVSS 9.8, versions below 7.161.20 across six branches). Cloud instances not affected.

Exploitation Status

Active exploitation confirmed. CVE-2026-42018/42016 chain exploited August 15–September 8, 2026. CVE-2026-82329 exploited September 1–8 with public exploit available; CISA KEV catalog added September 2. Fastly observed ~406,000 exploitation attempts on September 2.

Business Impact

Attackers gain full administrator control of Artifactory servers, create persistent admin accounts, deploy Groovy plugins for code execution, install custom Rust backdoors, and exfiltrate cluster join keys. Compromised software repositories threaten entire CI/CD pipelines and supply chain integrity. Patching does not remove attacker-created accounts, tokens, or backdoors—manual remediation required.

Urgency

🔴 Immediate

Recommended Actions

  • Immediately upgrade self-hosted JFrog Artifactory to fixed versions: 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, or 7.161.20 depending on branch
  • Audit all administrator accounts in Artifactory for unauthorized entries created since August 15; remove any unrecognized accounts
  • Revoke all access tokens issued since August 28 and rotate the platform cluster join key
  • Review Artifactory audit logs for token:anonymous performing privileged actions or low-privilege accounts creating tokens
  • Inspect installed Groovy plugins for malicious code and check /tmp and other world-writable directories for dropped binaries or backdoors