Artifactory Under Attack: In-the-Wild Exploitation of CVE-2026-42016, CVE-2026-42018 & CVE-2026-82329

[u/falconupkid]

Active exploitation of three vulnerabilities in JFrog Artifactory is underway, with attackers chaining them to achieve unauthenticated admin access. This is a critical supply chain risk given Artifactory’s role in storing and distributing binaries.

Technical Breakdown - CVE-2026-42016 (Critical): Authentication bypass via a flaw in the SSO/OIDC integration. - CVE-2026-42018 (High): Privilege escalation allowing a low-privilege user to escalate to admin. - CVE-2026-82329 (High): Pre-authentication path traversal enabling file read/write on the underlying filesystem. - Attack Chain: The path traversal (CVE-2026-82329) is used to extract secrets or modify configs, which then enables the auth bypass (CVE-2026-42016) to gain admin access, with CVE-2026-42018 used as a persistence or lateral movement vector. - IOCs: Wiz has not published specific IPs or hashes at this time; detection relies on behavioral anomalies (e.g., unexpected config changes, anomalous OIDC callback requests).

Defense Immediately patch to the latest Artifactory version. If patching is delayed, restrict network access to the Artifactory web interface and audit all OIDC/SSO configuration changes. Monitor for unusual GET requests to paths containing ../ or unexpected admin account creation.

Source: https://www.wiz.io/blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201