JFrog Artifactory Vulnerabilities Actively Exploited in the Wild to Gain Administrative Control
Wiz observed active exploitation of three JFrog Artifactory flaws used to mint admin tokens, deploy malicious plugins, and install Rust backdoors on self-hosted servers.
JFrog Artifactory flaws CVE-2026-42016, CVE-2026-42018, and CVE-2026-82329 are being actively exploited against self-hosted instances, enabling token exposure, token scope abuse, and a critical default-configuration authentication bypass. Wiz observed attackers chaining CVE-2026-42018 and CVE-2026-42016 from August 15 to September 8, 2026, creating persistent administrator accounts in under five minutes, deploying malicious Groovy plugins, and installing Rust-based backdoors. At disclosure, 67-69 percent of Wiz-monitored organizations ran vulnerable instances; fixed releases include 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, and 7.161.20 or later depending on branch.
- CVE-2026-82329: unauthenticated admin token via /access/api/v1/registry/join
- Attackers created rogue accounts like 0xterror and jfrog-distribution for persistence
- 67% of organizations with Artifactory had a vulnerable instance at disclosure
- Defenders should hunt for hits on aws/token, tokens, and registry/join endpoints
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1528 Steal Application Access TokenT1136.001 Create Account: Local AccountT1059 Command and Scripting Interpreter
- Products
- JFrog Artifactory
- Malware
- Rust-based backdoor
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-42016 | Token Scope Validation Flaw Enables Privilege Escalation in JFrog Artifactory | 8.8 | 9% | KEV | KEV |
| CVE-2026-42018 | Improper Authentication in JFrog Artifactory Exposes Internal Anonymous Tokens | 7.5 | 10% | KEV | KEV |
| CVE-2026-82329 | Improper Authentication in JFrog Artifactory Allows Unauthenticated Admin Access | 9.8 | 14% | KEVPoC ×2 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | gitclone.org | .184.111[.]69 , 64.207.232[.]6:8443 Payload URLs hxxp://log.gitclone[.]org:45678/smtp , hxxp://3.88.162[.]79:36789/smtp File / Hash |
| ipv4 | 137.184.111.69 | 33 , 146.19.216[.]120 , 185.190.58[.]172 , 45.61.176[.]88 , 137.184.111[.]69 , 64.207.232[.]6:8443 Payload URLs hxxp://log.gitclone[.] |
| ipv4 | 146.19.216.120 | ry Exploitation IOCs : Type IOCs IP / C2 93.104.155[.]133 , 146.19.216[.]120 , 185.190.58[.]172 , 45.61.176[.]88 , 137.184.111[.]69 , |
| ipv4 | 185.190.58.172 | s : Type IOCs IP / C2 93.104.155[.]133 , 146.19.216[.]120 , 185.190.58[.]172 , 45.61.176[.]88 , 137.184.111[.]69 , 64.207.232[.]6:8443 |
| ipv4 | 3.88.162.79 | Payload URLs hxxp://log.gitclone[.]org:45678/smtp , hxxp://3.88.162[.]79:36789/smtp File / Hash /tmp/.z — 513a907b69edffc3cb77a494 |
| ipv4 | 45.61.176.88 | C2 93.104.155[.]133 , 146.19.216[.]120 , 185.190.58[.]172 , 45.61.176[.]88 , 137.184.111[.]69 , 64.207.232[.]6:8443 Payload URLs hxx |
| ipv4 | 64.207.232.6 | 20 , 185.190.58[.]172 , 45.61.176[.]88 , 137.184.111[.]69 , 64.207.232[.]6:8443 Payload URLs hxxp://log.gitclone[.]org:45678/smtp , |
| ipv4 | 93.104.155.133 | 27. JFrog Artifactory Exploitation IOCs : Type IOCs IP / C2 93.104.155[.]133 , 146.19.216[.]120 , 185.190.58[.]172 , 45.61.176[.]88 , |
| sha1 | 513a907b69edffc3cb77a494da395178d21ef9bd | mtp , hxxp://3.88.162[.]79:36789/smtp File / Hash /tmp/.z — 513a907b69edffc3cb77a494da395178d21ef9bd Account 0xterror , svc_[a-zA-Z0-9]{8} , Nxploited_[a-zA-Z0- |
| url | http://3.88.162.79:36789/smtp | ]6:8443 Payload URLs hxxp://log.gitclone[.]org:45678/smtp , hxxp://3.88.162[.]79:36789/smtp File / Hash /tmp/.z — 513a907b69edffc3cb77a494da395178d21 |
| url | http://log.gitclone.org:45678/smtp | [.]88 , 137.184.111[.]69 , 64.207.232[.]6:8443 Payload URLs hxxp://log.gitclone[.]org:45678/smtp , hxxp://3.88.162[.]79:36789/smtp File / Hash /tmp/.z — 5 |
From the original article
3 min read at cybersecuritynews.com
An active exploitation of three JFrog Artifactory vulnerabilities that attackers are using to bypass authentication, elevate privileges, and take administrative control of exposed servers. The flaws, tracked as CVE-2026-42016, CVE-2026-42018, and CVE-2026-82329, affect multiple Artifactory release branches and create a serious supply-chain security risk.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.