Artifactory anonymous token chain hits CISA KEV

CISA put CVE-2026-42018 and CVE-2026-42016 on the Known Exploited Vulnerabilities catalog today (2026-09-11). Wiz Research already documented in-the-wild chaining of those two bugs on self-hosted JFrog Artifactory: an unauthenticated call mints an internal anonymous JWT, then that low-privilege token is exchanged for admin scope. Operators who only chased CVE-2026-82329 (the join-key path we covered on 28 Aug) can still be open on this older pair.

Upgrade self-hosted Artifactory to a build that clears both CVEs on your train. Prefer the later trains JFrog listed for the Critical sibling as well: 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, or 7.161.20. Then hunt logs for the chain below.

What breaks

JFrog rates CVE-2026-42018 High (CWE-287). Published 12 Aug 2026. Artifactory can return an internal anonymous-user token to an unauthenticated caller even when anonymous access is disabled. Fixed builds on the advisory: 7.111.20, 7.117.27, 7.125.19, 7.133.28, 7.146.8.

JFrog rates CVE-2026-42016 High (CWE-863). Published 27 Jul 2026. Token validation checks signature and issuer but not intended scope, so a low-privilege token can be escalated. The advisory lists a single fixed floor: 7.133.11.

Neither bug alone is full admin. Together they are. Wiz's observed sequence (Aug 15 through Sep 8, 2026):

1. POST /access/api/v1/aws/token/ with a trailing slash returns HTTP 200 and a JWT for the internal anonymous user (CVE-2026-42018).
2. POST /access/api/v1/tokens exchanges that JWT for an admin-scoped token while the username stays anonymous (CVE-2026-42016).
3. Actors then create persistent admins via PUT /api/security/users/... or /access/api/ui/users/..., install malicious Groovy plugins, run /api/plugins/execute/..., and in several cases drop a Rust C2 binary under /dev/shm, /tmp, or /var/tmp.

Wiz notes a useful probe signature for 42018: the same client gets 401 on the bare path, then 200 on a trailing-slash or path variant, inside a short window. Later requests often show actor token:anonymous doing admin work. That is not normal operator traffic.

Exposure when those CVEs first published was not a niche corner case. Wiz measured about two-thirds of organizations with Artifactory still holding at least one vulnerable instance at disclosure, with slow patch velocity on the High pair versus the Critical 82329.

Who is not in scope

• JFrog Cloud. Both advisories say affected Cloud environments were already fortified.
• Self-hosted nodes already on fixed builds for both CVEs on your train. Clearing only 42016 or only 42018 breaks the published chain; clearing neither leaves it open.
• The CVE-2026-82329 join-key path (POST /access/api/v1/registry/join). That is a different unauth-admin bug with its own ranges and KEV add on 2026-09-02. Patching 82329 does not automatically mean you cleared 42018/42016.
• Branches where JFrog's 42016 advisory does not claim impact. JFrog only listed "< 7.133.11" for 42016. Do not invent that 7.146/7.161 are vulnerable to 42016, and do not invent that they are immune to 42018 without checking the 42018 table.

How to check

Confirm product version (not a single microservice build):

jf rt curl /api/system/version

Compare version to the fixed floors above. If you are still below 7.146.8 on the 7.146 train, or below 7.133.28 / 7.133.11 on 7.133, treat the chain as open until proven otherwise.

Then search Access / reverse-proxy logs for the Wiz sequence: unauthenticated POST /access/api/v1/aws/token/ (trailing slash) returning 200, followed quickly by POST /access/api/v1/tokens, then admin user creates. Flag accounts matching patterns Wiz reported (Nxploited_*, labadmin_*, svc_*, jfrog-distribution, repo-service, 0xTerror, and similar). Pull join keys and token inventories if those endpoints were hit.

How to fix

Upgrade self-hosted Artifactory on your current train to builds that include the 42018 and 42016 fixes. Practical target set that also clears the Critical sibling many fleets still chase:

• 7.161.x → 7.161.20
• 7.146.x → 7.146.38 (42018 floor on this train was 7.146.8; take the later Critical build)
• 7.133.x → 7.133.29 (must be at least 7.133.28 for 42018 and 7.133.11 for 42016)
• 7.125.x → 7.125.20
• 7.117.x → 7.117.28
• 7.111.x → 7.111.21

CISA KEV dateAdded for both CVEs is 2026-09-11 (catalogVersion 2026.09.11). dueDate is 2026-09-25. Follow BOD 26-04 and the forensic triage requirements linked from the KEV notes. After upgrade, re-run the version API and require an exact match on a patched string. Restrict the Access API from the public internet while you patch.

What this is not

This is not a JFrog Cloud emergency. It is not remote code execution by itself. Admin on Artifactory is the vendor impact; shells and Rust backdoors showed up after actors abused plugins and write paths. It is not CVE-2026-82329 (different endpoint, Critical, KEV 2026-09-02). It is not "anonymous access was left on." Wiz and JFrog both describe token minting while anonymous access is disabled.

This article is the operator write-up for the KEV / in-the-wild chain. The HOL Guard evidence pages remain the source records for CVE-2026-42018 and CVE-2026-42016. Our earlier operator post on the Critical sibling is CVE-2026-82329.

References

• JFrog Security Advisories (CVE-2026-42018, CVE-2026-42016)
• Wiz: Artifactory under attack (in-the-wild chain)
• CISA KEV catalog (added 2026-09-11)
• HOL: CVE-2026-82329 Artifactory unauth admin
• HOL Guard CVE-2026-42018
• HOL Guard CVE-2026-42016