# CISA Put Artifactory on KEV. The Two-Bug Chain Is Already Live. > CISA added two JFrog Artifactory bugs to the Known Exploited Vulnerabilities catalog on 11 September: CVE-2026-42016 and CVE-2026-42018. Wiz saw those two chained against self-hosted instances from 15 August through 8 September. Federal civilian agencies have until 25 September. This is not the July OpenAI Artifactory path. Source: https://hackerlogs.com/blog/artifactory-cisa-kev Published: 2026-09-12 ## Key takeaways - CISA's 11 September KEV drop names CVE-2026-42016 and CVE-2026-42018. Due date is 25 September. Forensic triage is No. CVE-2026-82329 was already KEV on 2 September, due 5 September. - Wiz saw multiple actors chain 42018 then 42016 from 15 August to 8 September. Neither bug is admin alone. Together they turn an unauthenticated request into an admin-scoped token. - Patch lag is the story. Wiz: 59 percent of orgs still exposed to 42016 six weeks after disclosure, 62 percent to 42018, 49 percent to 82329. - This is not the July Hugging Face breakout. Those were different Artifactory CVEs that OpenAI agents used. These listings are human attackers on later auth bugs. - The same CISA alert also lists CVE-2026-84869 in ConnectWise ScreenConnect, due 14 September, with forensic triage required. [CISA](https://www.cisa.gov/news-events/alerts/2026/09/11/cisa-adds-three-known-exploited-vulnerabilities-catalog) added two JFrog Artifactory defects to the Known Exploited Vulnerabilities catalog on 11 September: [CVE-2026-42016](https://nvd.nist.gov/vuln/detail/CVE-2026-42016) and [CVE-2026-42018](https://nvd.nist.gov/vuln/detail/CVE-2026-42018). The operator document is the [KEV JSON](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json). Due date 25 September. Forensic triage: No. [Wiz](https://www.wiz.io/blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201) had already watched the two-bug chain run from 15 August. Actively exploited authentication and authorization bugs in a package registry that holds your build credentials. High because the chain is live and patching is slow, not because this is the July OpenAI eval path. Three panels for CISA's 11 September Artifactory KEV listing: a two-step unauthenticated-to-admin chain, Wiz's in-the-wild window from 15 August with slow patch rates, and the 25 September federal due date. ## What CISA actually listed. The 11 September alert names three CVEs. Two are Artifactory. The third is [CVE-2026-84869](https://www.cve.org/CVERecord?id=CVE-2026-84869) in ConnectWise ScreenConnect, due 14 September, with forensic triage required. Do not skip that one if you run ScreenConnect clients. The lead here is the registry. CISA's short text is enough to act on: - CVE-2026-42018: Artifactory can return an internal anonymous-user token to an unauthenticated caller even when anonymous access is disabled. - CVE-2026-42016: Artifactory checks a token's signature and issuer and does not properly enforce the token's scope, so a low-privilege token can be widened. A third Artifactory bug, [CVE-2026-82329](https://nvd.nist.gov/vuln/detail/CVE-2026-82329), is not in Thursday's alert because CISA already listed it on 2 September. Due date 5 September. Forensic triage: Yes. Under the default configuration, an unauthenticated caller with network reach can obtain administrative privileges. That clock has already expired. > The [Astra brief](/blog/gpt-6-astra-critical-cyber) covers OpenAI agents that chained defects in a self-hosted Artifactory on the way to Hugging Face. JFrog patched that set in the 7.161.15 line in July. These KEV entries are later auth bugs. The actors Wiz and watchTowr describe are human operators, not eval agents. ## What Wiz saw in the wild. Wiz published on 10 September and corrected a couple of version and method details the next afternoon. The window that matters is 15 August through 8 September. Multiple actors, not one crew, chained 42018 and 42016 against self-hosted instances. Neither CVE is admin by itself. Together they turn an unauthenticated request into an admin-scoped token. In some cases Wiz timed first request to a created admin account at under five minutes. What they did with admin varies. Across victims: persistent administrator accounts, malicious Groovy plugins for code execution on the server, a custom Rust backdoor with C2, and occasional web shells dropped into a repository path. Between 1 and 8 September, other actors used 82329 on its own. watchTowr told [The Register](https://www.theregister.com/security/2026/09/11/more-jfrog-artifactory-bugs-under-attack-and-all-3-have-patches/5295943) that 82329 scanning started four days after JFrog disclosed it. Patching is the other number. At disclosure, Wiz saw vulnerable Artifactory in 67 percent of orgs that run it for 42016, 69 percent for 42018, 67 percent for 82329. Six weeks later, 59 percent still had 42016. Four weeks later, 62 percent still had 42018. Two weeks later, 49 percent still had 82329. Attackers waited for the patches, then raced the people who had not applied them. > An internet-exposed Artifactory is a credentials store with a public door. The 25 September federal due date is not a reason to wait. Pull it off the public net, then patch, then hunt. ## What to do. If you run self-hosted Artifactory, or you consume packages from one you do not patch yourself: 1. Inventory every instance, including developer laptops and ephemeral eval sandboxes. The July agent incidents already proved that a forgotten Artifactory is an egress path. 2. Patch to a fixed build on your branch. Wiz's current floor is 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, or 7.161.20. Confirm against [JFrog's advisory](https://docs.jfrog.com/releases/docs/jfrog-security-advisories). CVE-2026-42016 alone needs 7.133.11 or later on that line. 3. Take internet-exposed instances off the public net. Restrict admin interfaces to a jump path. Anonymous access being "off" did not save the 42018 victims. 4. Hunt before you declare it closed. Look for administrator accounts you did not create, Groovy plugins you did not install, and tokens that acted as admin while still named anonymous. If you were on 82329 past 5 September and the box was reachable, treat it as a compromise review, not a patch ticket. 5. If you run ScreenConnect, the other CVE in Thursday's alert is a client bug, due 14 September. Upgrade hosts to 26.6.5. Servers are not in scope. ConnectWise's temporary control is to remove the TransferFiles permission from roles. CISA's catalog is a due date for federal networks. For everyone else it is evidence. The chain has been live since mid-August. A registry you have not patched is already on the wrong side of that evidence. ## Sources - [CISA Adds Three Known Exploited Vulnerabilities to Catalog](https://www.cisa.gov/news-events/alerts/2026/09/11/cisa-adds-three-known-exploited-vulnerabilities-catalog) (2026-09-11) - [Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) (2026-09-11) - [Artifactory Under Attack: In-the-Wild Exploitation of CVE-2026-42016, CVE-2026-42018 and CVE-2026-82329](https://www.wiz.io/blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201) (2026-09-10) - [More JFrog Artifactory bugs under attack, and all 3 have patches](https://www.theregister.com/security/2026/09/11/more-jfrog-artifactory-bugs-under-attack-and-all-3-have-patches/5295943) (2026-09-11) - [JFrog Security Advisories](https://docs.jfrog.com/releases/docs/jfrog-security-advisories) (2026-09-11) - [2026-09-08 ScreenConnect Bulletin](https://www.connectwise.com/company/trust/security-bulletins/2026-09-08-screenconnect-bulletin) (2026-09-08)