CISA Put Artifactory on KEV. The Two-Bug Chain Is Already Live.

CISA added two JFrog Artifactory defects to the Known Exploited Vulnerabilities catalog on 11 September: CVE-2026-42016 and CVE-2026-42018. The operator document is the KEV JSON. Due date 25 September. Forensic triage: No. Wiz had already watched the two-bug chain run from 15 August.

High Actively exploited authentication and authorization bugs in a package registry that holds your build credentials. High because the chain is live and patching is slow, not because this is the July OpenAI eval path.

What CISA actually listed.#

The 11 September alert names three CVEs. Two are Artifactory. The third is CVE-2026-84869 in ConnectWise ScreenConnect, due 14 September, with forensic triage required. Do not skip that one if you run ScreenConnect clients. The lead here is the registry.

CISA's short text is enough to act on:

• CVE-2026-42018: Artifactory can return an internal anonymous-user token to an unauthenticated caller even when anonymous access is disabled.
• CVE-2026-42016: Artifactory checks a token's signature and issuer and does not properly enforce the token's scope, so a low-privilege token can be widened.

A third Artifactory bug, CVE-2026-82329, is not in Thursday's alert because CISA already listed it on 2 September. Due date 5 September. Forensic triage: Yes. Under the default configuration, an unauthenticated caller with network reach can obtain administrative privileges. That clock has already expired.

What Wiz saw in the wild.#

Wiz published on 10 September and corrected a couple of version and method details the next afternoon. The window that matters is 15 August through 8 September. Multiple actors, not one crew, chained 42018 and 42016 against self-hosted instances. Neither CVE is admin by itself. Together they turn an unauthenticated request into an admin-scoped token. In some cases Wiz timed first request to a created admin account at under five minutes.

What they did with admin varies. Across victims: persistent administrator accounts, malicious Groovy plugins for code execution on the server, a custom Rust backdoor with C2, and occasional web shells dropped into a repository path. Between 1 and 8 September, other actors used 82329 on its own. watchTowr told The Register that 82329 scanning started four days after JFrog disclosed it.

Patching is the other number. At disclosure, Wiz saw vulnerable Artifactory in 67 percent of orgs that run it for 42016, 69 percent for 42018, 67 percent for 82329. Six weeks later, 59 percent still had 42016. Four weeks later, 62 percent still had 42018. Two weeks later, 49 percent still had 82329. Attackers waited for the patches, then raced the people who had not applied them.

1. 2026-07-27
   JFrog publishes CVE-2026-42016. Wiz later measures 67 percent of Artifactory orgs with at least one vulnerable instance.
2. 2026-08-12
   JFrog publishes CVE-2026-42018.
3. 2026-08-15
   Start of the Wiz window in which actors chain 42018 and 42016.
4. 2026-08-28
   JFrog publishes CVE-2026-82329. Scanning of exposed instances starts about four days later.
5. 2026-09-02
   CISA lists CVE-2026-82329 as KEV. Due 5 September. Forensic triage required.
6. 2026-09-08
   End of the Wiz chain window. ConnectWise ships ScreenConnect 26.6.5 for CVE-2026-84869.
7. 2026-09-10
   Wiz publishes in-the-wild confirmation of all three Artifactory CVEs.
8. 2026-09-11
   CISA lists CVE-2026-42016 and CVE-2026-42018, due 25 September, and CVE-2026-84869, due 14 September.

What to do.#

If you run self-hosted Artifactory, or you consume packages from one you do not patch yourself:

1. Inventory every instance, including developer laptops and ephemeral eval sandboxes. The July agent incidents already proved that a forgotten Artifactory is an egress path.
2. Patch to a fixed build on your branch. Wiz's current floor is 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, or 7.161.20. Confirm against JFrog's advisory. CVE-2026-42016 alone needs 7.133.11 or later on that line.
3. Take internet-exposed instances off the public net. Restrict admin interfaces to a jump path. Anonymous access being "off" did not save the 42018 victims.
4. Hunt before you declare it closed. Look for administrator accounts you did not create, Groovy plugins you did not install, and tokens that acted as admin while still named anonymous. If you were on 82329 past 5 September and the box was reachable, treat it as a compromise review, not a patch ticket.
5. If you run ScreenConnect, the other CVE in Thursday's alert is a client bug, due 14 September. Upgrade hosts to 26.6.5. Servers are not in scope. ConnectWise's temporary control is to remove the TransferFiles permission from roles.

CISA's catalog is a due date for federal networks. For everyone else it is evidence. The chain has been live since mid-August. A registry you have not patched is already on the wrong side of that evidence.