Wiz Research (10 September 2026) documents in-the-wild chaining of CVE-2026-42018 and CVE-2026-42016 against self-hosted JFrog Artifactory between 15 August and 8 September 2026, often dropping a custom Rust C2 backdoor. CVE-2026-42018 is an authentication flaw that can return an internal anonymous-user token to an unauthenticated requester even when anonymous access is disabled. Alone it is not admin; chained with CVE-2026-42016 (token scope / privilege escalation) Wiz saw unauthenticated requests become admin-scoped tokens, with follow-on admin account creation, malicious Groovy plugins, and Rust backdoors.

JFrog's advisory lists the patched versions for CVE-2026-42018 as 7.111.20, 7.117.27, 7.125.19, 7.133.28 and 7.146.8 (rated High); for the chain, Wiz advises upgrading to 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38 or 7.161.20 or later, depending on the release branch. (sources: Wiz; JFrog)

UPDATE 11 September 2026: CISA added CVE-2026-42018 to the Known Exploited Vulnerabilities catalog (dateAdded 2026-09-11; catalogVersion 2026.09.11). Prioritise patching self-hosted Artifactory under BOD 26-04-style exploited-first triage; hunt anonymous/admin tokens, Groovy plugins, and Rust C2 per Wiz.

Correction (26 Oct 2026): JFrog's own advisory lists 7.111.20, 7.117.27, 7.125.19, 7.133.28 and 7.146.8 as the patched versions for CVE-2026-42018, and the JFrog CVE record agrees. The card had listed 7.117.27, 7.125.19, 7.133.28 and 7.146.8 as still affected and given 7.117.28, 7.125.20, 7.133.29 and 7.146.9 as the fixed builds; that has been corrected. Wiz's separate upgrade advice for the two-flaw chain is kept and credited to Wiz. (source: JFrog security advisories)

Correction (02 Nov 2026): removed The Hacker News as a source. (source: Wiz; JFrog)