Preliminary research

Artifactory Under Attack: In-the-Wild Exploitation of CVE-2026-42016, CVE-2026-42018 & CVE-2026-82329

Shahar Dorfman, Sean Johnstone, Zohar Kaplan and Kurt Giacchino · Wiz Research · 10 September 2026

AI-collected research leads through 12 October 2026, including bounded month-by-month reviews of selected social and community sources from January through September. Unranked, incomplete, not community-vetted, and subject to change.

The article documents attackers chaining an exposed Artifactory anonymous-user token with weak scope validation to mint an administrator token. It analyzes recovered Groovy implants that provide command execution, credential and signing-key theft, internal tunnelling, in-memory persistence and anti-forensics, then gives behavioural detection guidance.

Record

Researcher

Shahar Dorfman, Sean Johnstone, Zohar Kaplan and Kurt Giacchino

Published by

Wiz Research

Date

10 September 2026

In the archive

• Collected in the 2026 preliminary research sweep

Tags

• auth-bypass
• privilege-escalation
• rce
• credential-theft
• persistence
• command-and-control
• malware
• rest-api
• attack-chain
• owasp-a01-2021

This page is the archive's own catalogue record. The research is the work of Shahar Dorfman, Sean Johnstone, Zohar Kaplan and Kurt Giacchino, first published at the original source. Preserved copies are kept so the citation survives its host.