Vulnerability
A privilege-escalation vulnerability in JFrog Artifactory: JWTs are checked for signature and issuer but not intended scope, enabling privilege escalation.
Federal agencies now have three separate patch deadlines inside twelve days. The lowest-scoring pair of the five flaws added to KEV is the one with a documented 24-day intrusion campaign behind it.
Reality
One HTTP request to an unauthenticated cluster-join endpoint returns a non-expiring Artifactory admin token, and Fastly logged the volume going from single-digit probes to indiscriminate spraying in five days.
Reality
CISA added two JFrog Artifactory access-control flaws and one ConnectWise ScreenConnect privilege flaw to the Known Exploited Vulnerabilities catalog on 11 September, and by the catalog's own criteria published mitigation guidance already exists for each.
Perspective Coverage
13 publishersReality
Attackers chained two self-hosted JFrog Artifactory flaws, both patched more than a month before exploitation, to take admin and install backdoor plugins. Either fix breaks the chain, yet on the published tables only release 7.133.28 closes both.
Reality
Attackers are chaining three self-hosted JFrog Artifactory flaws, one rated CVSS 9.8, to mint administrator tokens in under five minutes. Because every build resolves its packages through that one repository, it is as efficient to attack as to run.
Reality
Wiz observed multiple actors chaining CVE-2026-42018 and CVE-2026-42016 against self-hosted JFrog Artifactory between August 15 and September 8, creating admin accounts, loading Groovy plugins and dropping a Rust backdoor.
Perspective Coverage
4 publishersReality
A default self-hosted Artifactory install trusted an empty string as a join key. Because JFrog supports non-expiring tokens, an upgrade can leave a forged administrator token valid.
Reality
Wiz reports multiple threat actors independently exploiting three patched JFrog Artifactory flaws, and its telemetry puts 49% to 62% of scanned instances still missing the fixes weeks after release. Two of the three chain into admin.
Reality
Wiz watched two chained flaws turn unauthenticated requests into administrator tokens on self-hosted Artifactory between August 15 and September 8. JFrog's fix list ends with two credential steps an upgrade ticket does not cover.
Reality