Wiz has published research on attacks, observed between 15 August and 8 September, in which intruders chained two Artifactory flaws to obtain administrator control of self-hosted servers and plant backdoors. CVE-2026-42018 makes Artifactory hand an internal anonymous-user token to a caller who has not logged in, even when anonymous access is disabled; CVE-2026-42016 then allows that low-privilege token to be exchanged for one with administrator scope, because Artifactory validates a token's signature and issuer but not its permitted actions. Neither flaw grants administrator control alone, and JFrog had fixed both before the observed attacks, so only unpatched servers were exposed. Every case Wiz examined followed the same chain: an unauthenticated request to a token endpoint returning an internal anonymous-user token, followed by an exchange for a higher-privilege token and backdoor placement in the repository that software build pipelines pull from. Both Artifactory flaws were added to CISA's KEV Catalog on 11 September on evidence of active exploitation. Artifactory's position in the supply chain is the material risk here — a poisoned repository can deliver malicious artefacts to every downstream build — and the exploit path is notable for beginning with a request that is unauthenticated by design rather than any credential compromise, meaning the flaws leave little forensic trace in the credential layer.

• Source article