Wiz reports attackers chained JFrog Artifactory flaws to gain admin control

Wiz said it observed attacks between August 15 and September 8 in which intruders chained two JFrog Artifactory flaws to take administrator control of self-hosted servers and plant backdoors. CVE-2026-42018 hands an internal anonymous-user token to an unauthenticated caller; CVE-2026-42016 then lets that low-privilege token be exchanged for one with administrator scope because Artifactory does not check the token's permissions. In some cases attackers reached a new administrator account in under five minutes, and actions appeared in logs as token:anonymous. JFrog had fixed both flaws before the observed attacks, so only unpatched servers were exposed. Wiz also reported separate exploitation of critical authentication bypass CVE-2026-82329, rated 9.8, on six release branches up to 7.161.