Three Patches, One Attack Chain
JFrog has shipped fixes for three separate Artifactory vulnerabilities since July 27, 2026, and attackers spent weeks chaining the first two together before the third became public.
| CVE | Disclosed | Vulnerable now |
|---|---|---|
| CVE-2026-42016 | 27 Jul 2026 | 59% (+6 wk) |
| CVE-2026-42018 | 12 Aug 2026 | 62% (+4 wk) |
| CVE-2026-82329 | 28 Aug 2026 | 49% (+2 wk) |
CVE-2026-42016 lets a low-privilege token get exchanged for an administrator-scope token. CVE-2026-42018 hands an internal anonymous-user token to a caller who never logged in, even with anonymous access turned off. CVE-2026-82329, disclosed August 28 with a CVSS score of 9.8, lets an unauthenticated attacker obtain administrator privileges outright under a default configuration.
The Exact Steps That Turn a Guest Into an Admin
Security firm Wiz documented the precise mechanism: attackers send a POST request to /access/api/v1/aws/token/, with a trailing slash, which returns an anonymous JWT even though anonymous access is disabled. They then send that token to /access/api/v1/tokens to request an administrator-scoped token, which Artifactory issues without properly checking the requester's real privilege level.
For the newest flaw, CVE-2026-82329, Wiz found the shortcut is even more direct: a single POST to /access/api/v1/registry/join returns an admin-scoped token outright, no chaining required. Once inside, attackers created persistent administrator accounts, installed malicious Groovy plugins through Artifactory's own plugin framework to run code on the server, and in some cases deployed Rust-based backdoors with command-and-control capability. Wiz observed the chained attacks running from August 15 to September 8, 2026, with a separate wave exploiting CVE-2026-82329 from September 1 to September 8.
Patched Does Not Mean Fixed
The gap between a patch existing and a server actually running it is the real story here, and it is measured in months, not days. JFrog fixed CVE-2026-42016 in version 7.133.11 on July 27; six weeks later, 59 percent of organizations were still vulnerable to it, according to Wiz's telemetry.
CVE-2026-42018 fared no better: fixed across five branches by August 12, 62 percent of organizations remained exposed four weeks on. CVE-2026-82329 moved fastest, dropping from 67 percent vulnerable at disclosure to 49 percent after two weeks, but that still leaves roughly half of all Artifactory deployments open to a flaw rated 9.8 out of 10 for severity. The scale of automated exploitation attempts against unpatched servers is not theoretical: Fastly recorded roughly 406,000 exploitation attempts against CVE-2026-82329 in a single day, September 2, the same day CISA added it to its Known Exploited Vulnerabilities catalog.
The EU Obligation Nobody Is Enforcing Yet
CISA gave US federal agencies a hard deadline, September 5, three days after adding CVE-2026-82329 to its KEV catalog on September 2. The EU has no equivalent public, dated order for private companies, even though NIS2's Article 21 already requires many mid-sized software and IT-service firms to run a documented vulnerability-handling process covering exactly this kind of unpatched, internet-facing supply-chain tool.
That leaves a real gap for any EU-based company self-hosting Artifactory: there is a legal obligation to manage this risk under NIS2, but no published national or EU-wide deadline forcing the point the way CISA's order does in the US. For now, the only reliable driver of patching an EU-hosted Artifactory instance is a company's own security team reading a vendor advisory and acting on it, not a regulator's clock.
Read next: GitLab's Worst-Rated Flaw Needs Just One Public Project | The Bug That Broke The Thing Patching Depends On
