JFrog Artifactory Exploitation Chain Exposes Cloud CI/CD Pipelines to Administrative Takeover

Security researchers at Wiz revealed active in-the-wild exploitation campaigns targeting self-hosted instances of JFrog Artifactory between August 15 and September 8, 2026. Attackers successfully chained two distinct vulnerabilities—CVE-2026-42018 and CVE-2026-42016—to escalate unauthenticated access into full administrative control. CVE-2026-42018 allows an external caller to obtain an internal anonymous-user token even when anonymous access is explicitly disabled. Threat actors subsequently leveraged CVE-2026-42016 to exchange this token at Artifactory's token-creation endpoint for an administrator-scoped token, bypassing checks because the service verified cryptographic signatures without enforcing token scopes. Once elevated, adversaries created persistent administrator accounts, deployed malicious Groovy plugins for arbitrary server-side code execution, and dropped command-and-control backdoors. Software artifact repositories like JFrog Artifactory sit at the critical intersection of developer workflows and production cloud infrastructure. Because automated CI/CD pipelines continuously pull container images and software dependencies from Artifactory, compromising the registry grants adversaries direct leverage to tamper with build artifacts, poison internal package repositories, and pivot across adjacent deployment environments. Furthermore, actions taken via these forged tokens appear in audit trails as anonymous service activity rather than named operator logins, masking lateral movement and significantly complicating post-incident digital forensics. This campaign reflects the broader trend of threat actors shifting away from brute-force perimeter breaches toward chaining complex logical authorization flaws within internal DevOps tooling. As organizations increasingly automate build and deployment life cycles, centralized repository managers have become high-priority targets for initial access and software supply chain poisoning. The rapid weaponization of this chain alongside related authentication-bypass vulnerabilities demonstrates how quickly adversaries operationalize multi-stage exploits against internet-exposed platform engineering assets before enterprise patch cycles conclude. For cloud security and platform engineering teams, applying software patches is only the baseline remediation. Because an application upgrade does not invalidate previously generated authorization tokens, erase newly minted administrator accounts, or revoke compromised cluster join keys, security teams must actively investigate instances for indicators of compromise. Practitioners should immediately rotate platform join keys, audit and revoke tokens generated across the vulnerability window, inspect installed plugins and file systems, and restrict all artifact repository management interfaces to private network perimeters behind zero-trust access controls.