CVE-2026-42016

What is JFrog Artifactory?

JFrog Artifactory is a binary and artifact repository manager that stores and serves Docker images, Maven, npm, PyPI, and other packages across an organization's CI/CD pipelines. It sits at the heart of the software supply chain: developers pull dependencies from it and push build outputs to it. Administrative control of Artifactory means the ability to poison packages, plant backdoors in build artifacts, and harvest credentials, which is why it is a high-value target for supply-chain attacks.

Overview

CVE-2026-42016 is an incorrect authorization flaw (CWE-863) in Artifactory that leads to privilege escalation. Artifactory validates a token's signature and issuer but does not enforce the token's scope, so a low-privilege token can be exchanged for a full administrator token. It is rated CVSS 8.1. In the wild it was chained with CVE-2026-42018, which supplies an unauthenticated starting token, to convert an anonymous request into full admin control. JFrog published fixes on 2026-07-27, and CISA added the CVE to KEV on 2026-09-11.

Affected Versions

One source cites 7.133.11 as an early fixed floor; Wiz lists the branch-by-branch remediated builds above as the fully patched versions. Upgrade to the fixed build on your branch or later. JFrog Cloud (SaaS) instances were addressed by JFrog.

Technical Details

Artifactory issues and accepts access tokens for its REST API. When validating a presented token, it checked the cryptographic signature and the issuer but did not verify that the token's scope authorized the requested privileged action. A caller holding a low-privilege or anonymous-scoped token could therefore call the token-creation endpoint (POST /access/api/v1/tokens) and mint a new token carrying full administrator privileges.

Attack characteristics:

• Authentication: low-privilege token required (PR:L); in practice supplied by chaining CVE-2026-42018
• Complexity: low
• Vector: network, to the Artifactory access API
• Impact: privilege escalation to administrator (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)

Chained with CVE-2026-42018 (which returns an anonymous token to an unauthenticated caller), the combination turns an unauthenticated request into full admin control. The same campaign also involved CVE-2026-82329, a separate authentication-bypass bug patched 2026-08-28.

Discovery

The vulnerability was disclosed through JFrog's own security-advisory process on 2026-07-27. The JFrog advisory identifier was not surfaced in available reporting. Wiz Research stated it was not aware of any prior public reporting of in-the-wild exploitation before its own analysis, making Wiz the first to publicly document the active campaign.

Exploitation Context

Wiz Research documented exploitation between 2026-08-15 and 2026-09-08, chaining CVE-2026-42016 with CVE-2026-42018. In some cases attackers moved from initial exploitation to creating an admin account in under five minutes. Wiz reported that about 67 percent of organizations running Artifactory had vulnerable instances at initial disclosure, with 59 percent still vulnerable six weeks later. Post-exploitation tooling included a custom Rust backdoor with command-and-control capabilities and malicious Groovy plugins for code execution and persistence, staged in world-writable paths such as /dev/shm.

Indicators reported by Wiz: command-and-control IP 64.207.232.6:8443; payload SHA-1 513a907b69edffc3cb77a494da395178d21ef9bd; and attacker-created account name patterns matching Nxploited_[A-Za-z0-9]{3} and labadmin_<hex>.

Remediation

1. Upgrade Artifactory to the fixed build on your release branch (see table) or later. Patch both this CVE and CVE-2026-42018 together, since they are chained.
2. Hunt for the campaign. Audit for low-privilege tokens exchanged for admin-scoped tokens at POST /access/api/v1/tokens, review for unexpected admin account creation matching the Nxploited_ and labadmin_ patterns, and check for uploaded Groovy plugins and files or processes under /dev/shm.
3. Block and search the indicators above (C2 IP and payload hash) in egress and endpoint telemetry.
4. Assume compromise if the instance was exposed and unpatched during 2026-08-15 to 2026-09-08. The Rust backdoor and Groovy plugins can survive a patch, so rotate all Artifactory access tokens, admin credentials, and any secrets stored in or reachable from Artifactory, and reinspect for persistence after upgrading.
5. Restrict access to the Artifactory access API and management interface to trusted networks while you remediate.