Artifactory flaws chained in attacks deploying backdoor malware
Attackers chain JFrog Artifactory flaws CVE-2026-42018 and CVE-2026-42016 to gain admin tokens and deploy a Rust backdoor on self-hosted servers.
Wiz observed multiple threat actors chaining CVE-2026-42018 and CVE-2026-42016 against self-hosted JFrog Artifactory instances between August 15 and September 8, 2026, in some cases obtaining admin access in under five minutes. The critical authentication bypass CVE-2026-82329 was also exploited this month to mint administrator tokens. Attackers installed malicious Groovy plugins, dropped a Rust backdoor with C2 capabilities, uploaded webshells, stole configuration data and cluster join keys, and added SSH keys to new accounts. Wiz estimates 49-62% of internet-reachable Artifactory instances are vulnerable to at least one of the three flaws, and patched releases from 7.111.21 through 7.161.20 are available.
- Exploit chain converts anonymous low-privilege JWT into admin token in minutes
- Custom Rust backdoor with C2 deployed for persistence
- Attackers uploaded webshells, stole cluster join keys, added SSH keys
- 49-62% of reachable instances vulnerable; upgrade to 7.111.21 or later
- Wiz published IoCs for detection
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-42016 | Token Scope Validation Flaw Enables Privilege Escalation in JFrog Artifactory JFrog Artifactory (Self-Hosted) versions before 7.133.11 fail to validate a token's scope, checking only the token's signature and issuer, which constitutes an incorrect authorization flaw (CWE-863). A remote, authenticated user with low privileges can obtain or present a token whose scope is never verified, bypassing authorization checks and escalating to higher privileges. Successful attackers gain administrative control of the Artifactory instance; in observed attacks this flaw has been chained with CVE-2026-42018 and CVE-2026-82329 to bypass authentication, take admin control, and deploy backdoor malware. Only self-hosted Artifactory deployments are within the stated affected scope. Exploitation is confirmed in the wild and the vulnerability was added to CISA's KEV catalog on 2026-09-11, although no public proof-of-concept code is known. Do: Upgrade self-hosted Artifactory to version 7.133.11 or later immediately, in line with vendor instructions and CISA KEV/BOD 26-04 timelines. Audit issued tokens and logs for tokens carrying elevated scope granted to low-privilege users, and look for signs of compromise such as unexpected admin accounts or persistence, given reported backdoor deployments. Also patch CVE-2026-42018 and CVE-2026-82329, which attackers are chaining with this flaw. | 8.8 | <1% | KEV |
| largetens of thousands of self-hosted instances (subset internet-exposed) | |
| CVE-2026-42018 | Improper Authentication in JFrog Artifactory Exposes Internal Anonymous Tokens JFrog Artifactory contains an improper authentication flaw (CWE-287) in which the server may return its internal anonymous-user token to an unauthenticated caller, even on instances where anonymous access is disabled. An attacker triggers the issue by sending unauthenticated requests to the affected Artifactory interface over the network; the vector requires no privileges or user interaction and is of low complexity. Successful abuse yields the internal anonymous-user token, which can then be used to reach sensitive resources (such as repositories or artifacts) that should be protected when anonymous access is disabled, with high confidentiality impact but no integrity or availability impact. Any organization running an affected JFrog Artifactory deployment - particularly those relying on disabled anonymous access as a control - is affected, though only instances where the vulnerable endpoint is reachable are actually exposed. Exploitation has been reported in the wild as part of an ongoing Artifactory attack campaign alongside CVE-2026-42016 and CVE-2026-82329, although there is no public PoC and the flaw is not yet in the CISA KEV catalog. Do: Upgrade Artifactory to the fixed release identified in JFrog's security advisory (JFrog is the assigning CNA; exact version numbers are not included in the available data). Until patched, restrict unauthenticated network access to Artifactory, verify the anonymous-access configuration, and review logs for unauthenticated requests that retrieved tokens or accessed sensitive resources. Because in-the-wild exploitation has been reported alongside CVE-2026-42016 and CVE-2026-82329, patch for all three and consider rotating internal/anonymous tokens and auditing artifact access. | 7.5 | <1% | KEV |
| large≈ tens of thousands of deployments (only the subset with anonymous access disabled and a reachable endpoint is affected) | |
| CVE-2026-82329 | Improper Authentication in JFrog Artifactory Allows Unauthenticated Admin Access JFrog Artifactory contains an improper authentication flaw (CWE-287) that, under the product's default configuration, can let an unauthenticated attacker with network access obtain administrative privileges. The weakness is reachable over the network with no privileges or user interaction required, which is why it carries a critical 9.8 CVSS 3.1 score; an attacker who succeeds effectively gains full administrator control of the artifact repository, and public reporting describes attackers using the flaw to mint admin tokens days after disclosure. Any organization running JFrog Artifactory is in scope — CISA's entry lists the product without version detail, so deployments should verify their versions against JFrog's advisory (AV26-867, Update 1) — with internet-exposed instances at greatest risk. Exploitation is confirmed in the wild: CISA added the CVE to its Known Exploited Vulnerabilities Catalog on 2026-09-02, a public proof-of-concept is available, and news headlines report active exploitation alongside related Artifactory flaws CVE-2026-42016 and CVE-2026-42018. Do: Upgrade Artifactory to a fixed release per JFrog's advisory AV26-867 (Update 1) — the exact affected and fixed versions are not specified in this data, so check the advisory before patching. Until patched, restrict network access to the Artifactory UI and APIs to trusted sources (VPN/firewall allowlists) and review the instance for unauthorized admin tokens or accounts, as in-the-wield attackers have been minting admin tokens. CISA KEV stakeholders must apply mitigations in line with BOD 26-04 within the required timeline or discontinue use of the product. | 9.8 | 8% | KEV PoC ×2 |
| largetens of thousands of deployments, many of them internet-exposed (estimate) |
Full article425 words · extracted from bleepingcomputer.com · click to collapse
Threat actors are exploiting critical and high-severity vulnerabilities in JFrog Artifactory to bypass authentication, gain administrative privileges, and deploy a Rust backdoor on vulnerable self-hosted servers.
A new report from cloud security company Wiz confirmed exploitation across multiple environments, including an exploit chain that combines CVE-2026-42018 and CVE-2026-42016.
The third vulnerability is CVE-2026-82329, a critical authentication bypass that offensive security company watchTowr observed being exploited earlier this month to mint administrator tokens.
According to Wiz, attackers exploit CVE-2026-42018 to obtain a JSON Web Token (JWT) belonging to an internal Artifactory anonymous user, even when anonymous access is disabled, with low privileges.
Then they increase permissions to admin level by exploiting CVE-2026-42016, caused by insufficient token validation.
Between August 15 and September 8, multiple threat actors exploited the two vulnerabilities to obtain a JWT for the internal anonymous user and then exchange it for an admin-scoped token.
The researchers note that in some cases the attacker took less than five minutes to create an administrator account.
After creating admin accounts and generating long-lived access tokens, the attackers installed malicious Groovy plugins to execute arbitrary commands and established persistence by deploying a Rust-based backdoor.
“Between August 15 and September 8, 2026, we observed multiple actors chain CVE-2026-42018 and CVE-2026-42016 against self-hosted Artifactory instances,” Wiz says.
“Across multiple cases, we observed a custom Rust backdoor with C2 capabilities being dropped.”
In the next stage, the threat actor downloaded additional payloads into /dev/shm, /tmp, and /var/tmp, uploaded webshells, stole Artifactory configuration data and cluster join keys, enumerated repositories, tokens, and users, and added their SSH keys to newly created accounts.
Wiz warns that between 49% and 62% of reachable Artifactory instances are vulnerable to at least one of the three flaws.
System administrators are recommended to upgrade immediately to one of the following Artifactory release versions or later:
- 7.111.21
- 7.117.28
- 7.125.20
- 7.133.29
- 7.146.38
- 7.161.20
After upgrading, investigate internet-exposed instances for unexpected token creation, rogue administrator accounts, suspicious plugin activity, and enumeration requests, and restrict access to trusted systems only.
Wiz has listed indicators of compromise (IoCs) associated with the observed attacks to help defenders detect them quickly.
BleepingComputer has contacted JFrog to confirm the reported activity, but we have not received a response as of publication.
Build your security blueprint for AI-powered attacks
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.bleepingcomputer.com/news/security/artifactory-flaws-chained-in-attacks-deploying-backdoor-malware/