Overview
- Wiz documented attacks that ran between August 15 and September 8 where attackers used CVE-2026-42018 to obtain an internal anonymous token and then CVE-2026-42016 to exchange that token for administrator scope.
- A separate critical bypass, CVE-2026-82329, was weaponized after a public exploit appeared on September 1 and Fastly recorded roughly 406,000 automated exploitation attempts on September 2.
- With administrator access, intruders created hidden admin accounts, installed malicious Groovy plugins for code execution, executed shell commands, dropped binaries and deployed a custom Rust command-and-control backdoor.
- JFrog has published branch-specific fixes and a temporary join-key workaround but patches do not revoke already-minted tokens, so responders must upgrade first, then rotate join keys, revoke recent tokens, remove rogue accounts and audit repositories and plugins.
- The compromise threatens software supply chains because Artifactory admins control what build pipelines consume and exposed join keys let attackers persist across a cluster so any internet-facing, unpatched instance should be treated as breached.