JFrog Artifactory CVE-2026-82329 / 42016 / 42018 exploited

What happened

27 July 2026: JFrog published CVE-2026-42016, incorrect user-token authorization validation allowing privilege escalation on self-hosted Artifactory before 7.133.11 (Wiz; JFrog).
12 August 2026: JFrog published CVE-2026-42018, anonymous-user token generation exposure (Wiz; JFrog).
15 August to 8 September 2026: Wiz observed CVE-2026-42018 and CVE-2026-42016 exploited together against self-hosted instances; Wiz says it knows of no prior public reporting of in-the-wild exploitation of this pair (Wiz).
26 August 2026: earliest indicator-of-compromise date Wiz records, an actor IP (121.123.141[.]155) exploiting the CVE-2026-42018 / CVE-2026-42016 chain (Wiz).
28 August 2026: JFrog published CVE-2026-82329, a separate authentication bypass leading to administrative access (Wiz; Bishop Fox).
1 to 8 September 2026: CVE-2026-82329 exploited in the wild. watchTowr reported attackers minting admin tokens and enumerating users, groups, credential sets and federated access topologies, and in a limited number of cases creating backdoor accounts (Bishop Fox); Wiz observed the same CVE exploited 1 to 8 September and reported several vendors seeing active exploitation (Wiz).
2 September 2026: CVE-2026-82329 added to the CISA Known Exploited Vulnerabilities catalog, with a remediation due date of 5 September and a forensic triage requirement (Bishop Fox; Wiz).

These are distinct vulnerabilities, not one issue. CVE-2026-42016 and CVE-2026-42018 are a token-authorization chain reported by Wiz; CVE-2026-82329 is an unrelated empty-cluster-join-key authentication bypass detailed by Bishop Fox (and also tracked by Wiz). They have different root causes, different endpoints and different fixed-version sets, and each is covered on its own below.

The vulnerabilities

CVE-2026-82329, authentication bypass via an empty cluster join key

CVSS: 9.8, rated Critical by JFrog; CWE-287 (Bishop Fox).
What it is: the flaw is in JFrog Access, the authentication microservice bundled with Artifactory, in its cluster-join subsystem. On a default self-managed install the “additional join keys” setting is unset, and the code registers an empty string as a valid join key. The key ID (SHA-256 of the empty string) and the signing secret (32 bytes of 0x20 after PKCS7 padding) can both be computed offline, so anyone can forge a join request. An unauthenticated call to /access/api/v1/registry/join returns HTTP 201 and a non-expiring, admin-scoped Access token; a second token request then reaches Artifactory admin. The root cause is validating that the join key is well-formed but never checking that it exists (Bishop Fox). Wiz records the initial-access request as an unauthenticated POST to /access/api/v1/registry/join returning HTTP 200 or 201 with an admin-scoped token (Wiz).
Affected (self-managed): 7.161.0 to 7.161.19; 7.146.0 to 7.146.36; 7.133.0 to 7.133.28; 7.125.0 to 7.125.19; 7.117.0 to 7.117.27; 7.111.4 to 7.111.21 (JFrog; Wiz). Bishop Fox lists the 7.146 range as 7.146.0 through 7.146.37 (Bishop Fox).
Fixed: 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, 7.161.20 (JFrog; Bishop Fox).
Exploited: yes, see the timeline above. Bishop Fox says patching is the only remediation (Bishop Fox).

CVE-2026-42016, incorrect user-token authorization validation (privilege escalation)

CVSS: not stated by either source; JFrog rates it High, CWE-863 (JFrog).
What it is: self-hosted Artifactory validates a token’s signature and issuer but does not properly enforce its intended scope, enabling privilege escalation (Wiz; JFrog).
Affected: self-hosted versions prior to 7.133.11 (Wiz; JFrog).
Fixed: 7.133.11 (JFrog).
Exploited: yes, chained with CVE-2026-42018 against self-hosted instances between 15 August and 8 September 2026 (Wiz).

CVE-2026-42018, anonymous-user token generation exposure

CVSS: not stated by either source; JFrog rates it High, CWE-287 (JFrog).
What it is: Artifactory may return an internal anonymous-user token to unauthenticated requesters even when anonymous access is disabled. Wiz records the exploit request as an unauthenticated POST to /access/api/v1/aws/token/ (with trailing slash), which returned HTTP 200 with a JWT for the internal anonymous user (Wiz).
Affected: below 7.111.20; 7.117.0 to 7.117.27; 7.125.0 to 7.125.19; 7.133.0 to 7.133.28; 7.146.0 to 7.146.8 (JFrog; Wiz).
Fixed: 7.111.20, 7.117.27, 7.125.19, 7.133.28, 7.146.8 (JFrog). Wiz notes JFrog corrected the fixed-version list for this CVE on 11 September 2026 (Wiz).
Exploited: yes, the lower half of the token-theft chain with CVE-2026-42016, observed 15 August to 8 September 2026 (Wiz).

What to do

Upgrade now. Move self-managed Artifactory to a fixed build: 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38 or 7.161.20 (or later). These cover all three CVEs; CVE-2026-42016 additionally requires at least 7.133.11 on the 7.133 line (JFrog; Wiz). JFrog patched hosted Cloud environments directly (Bishop Fox).
Rotate secrets. For CVE-2026-82329, Bishop Fox advises rotating the join key, Access tokens, LDAP, proxy and mail credentials, and upstream registry credentials; note that a revoked account’s basic-auth login may keep working for a cache window (Bishop Fox).
Hunt for compromise of CVE-2026-82329. Vulnerable builds log Adding join key with kid: e3b0c442... at WARN on each Access startup, marking the start of the exposure window. Look for HTTP 201 responses from /access/api/v1/registry/join from hosts that were never joined as cluster nodes, non-expiring admin-scoped tokens, unexpected administrator accounts, and accounts flagged artifactory_admin in custom data (Bishop Fox).
Hunt for compromise of the CVE-2026-42016 / CVE-2026-42018 chain. Review logs for unauthenticated POSTs to /access/api/v1/aws/token/ returning HTTP 200 with a JWT, and for token use beyond the token’s intended scope (Wiz).

JFrog Artifactory under in-the-wild attack, CVE-2026-82329, CVE-2026-42016 and CVE-2026-42018 exploited