JFrog Artifactory Flaws Chained to Install Backdoor

Self-hosted JFrog Artifactory servers are under active attack through a chain of authentication flaws that let intruders take administrative control and plant a Rust-based backdoor. Artifactory is a popular software repository manager used by development teams to store and distribute code packages, build files, and other software artifacts. When organizations run it on their own servers instead of using a cloud-hosted version, they are responsible for patching it. A new report from cloud security company Wiz confirms that attackers have exploited multiple vulnerabilities in these self-hosted instances, combining two of them in a single attack chain.

Wiz observed exploitation across multiple environments between August 15 and September 8, 2026. The main attack chain pairs CVE-2026-42018 with CVE-2026-42016. A third vulnerability, CVE-2026-82329, is a critical authentication bypass that offensive security company watchTowr reported being exploited earlier this month to mint administrator tokens. Authentication bypass means an attacker can get past a system's login checks without knowing a valid password. In this case, the flaw lets someone create a digital token that grants the highest level of control.

According to Wiz, the first step abuses CVE-2026-42018 to obtain a JSON Web Token (JWT), which is a digital pass that proves who a user is, for an internal Artifactory anonymous user. The problem is that this works even when anonymous access is disabled, and the token carries only low privileges. Next, the attacker exploits CVE-2026-42016, caused by insufficient token validation, to raise those privileges to administrator level. Token validation is the process of checking that a digital pass is genuine and that the permissions it carries are allowed. Here, that check is too weak, so the attacker can turn a low-privilege token into an admin-scoped one. Wiz researchers note that in some cases the attacker needed less than five minutes to create an administrator account.

After creating admin accounts and generating long-lived access tokens, the attackers installed malicious Groovy plugins. Groovy is a programming language that Artifactory uses for some of its extension features, and plugins can add new functions or automate tasks. Malicious plugins let the attackers run arbitrary commands on the server. To keep access over time, they deployed a custom Rust-based backdoor with command and control (C2) capabilities. A backdoor is a hidden way for an attacker to get back into a system later, and C2 means the malware can receive instructions from a remote server controlled by the attackers. Wiz stated: "Between August 15 and September 8, 2026, we observed multiple actors chain CVE-2026-42018 and CVE-2026-42016 against self-hosted Artifactory instances." The researchers added: "Across multiple cases, we observed a custom Rust backdoor with C2 capabilities being dropped."

In the next stage, the threat actor downloaded additional payloads into temporary directories such as /dev/shm, /tmp, and /var/tmp. They uploaded webshells, which are small scripts placed on a server to give a remote attacker a web-based control panel. They stole Artifactory configuration data and cluster join keys, which are secrets used by multiple Artifactory nodes to trust each other. They enumerated repositories, tokens, and users, meaning they listed all stored packages, access passes, and accounts. They also added their own SSH keys to newly created accounts. SSH keys are a passwordless login method that uses cryptographic keys, so adding their key gives the attacker a direct encrypted way to log in later without needing a password.

Wiz warns that between 49% and 62% of reachable Artifactory instances are vulnerable to at least one of the three flaws. That means roughly half of the internet-facing Artifactory servers they scanned could be attacked. System administrators should upgrade immediately to one of the following Artifactory release versions or later: 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, and 7.161.20. After upgrading, Wiz recommends investigating any internet-exposed instances for unexpected token creation, rogue administrator accounts, suspicious plugin activity, and enumeration requests. Access should be restricted to trusted systems only. Wiz has published indicators of compromise (IoCs), which are technical fingerprints that help defenders detect the attacks. For teams that manage self-hosted software like Artifactory, AEU-I provides security-first IT and infrastructure consulting to help with patching, access control, and continuous monitoring. BleepingComputer contacted JFrog to confirm the reported activity, but no response had been received as of publication.