Artifactory flaws chained in attacks deploying backdoor malware
Attackers chain JFrog Artifactory flaws CVE-2026-42018 and CVE-2026-42016 to gain admin tokens and deploy a Rust backdoor on self-hosted servers.
Wiz observed multiple threat actors chaining CVE-2026-42018 and CVE-2026-42016 against self-hosted JFrog Artifactory instances between August 15 and September 8, 2026, in some cases obtaining admin access in under five minutes. The critical authentication bypass CVE-2026-82329 was also exploited this month to mint administrator tokens. Attackers installed malicious Groovy plugins, dropped a Rust backdoor with C2 capabilities, uploaded webshells, stole configuration data and cluster join keys, and added SSH keys to new accounts. Wiz estimates 49-62% of internet-reachable Artifactory instances are vulnerable to at least one of the three flaws, and patched releases from 7.111.21 through 7.161.20 are available.
- Exploit chain converts anonymous low-privilege JWT into admin token in minutes
- Custom Rust backdoor with C2 deployed for persistence
- Attackers uploaded webshells, stole cluster join keys, added SSH keys
- 49-62% of reachable instances vulnerable; upgrade to 7.111.21 or later
- Wiz published IoCs for detection
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1078 Valid AccountsT1136 Create AccountT1098.004 SSH Authorized KeysT1505.003 Web Shell
- Products
- Artifactory
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-42016 | Token Scope Validation Flaw Enables Privilege Escalation in JFrog Artifactory | 8.8 | 9% | KEV | KEV |
| CVE-2026-42018 | Improper Authentication in JFrog Artifactory Exposes Internal Anonymous Tokens | 7.5 | 10% | KEV | KEV |
| CVE-2026-82329 | Improper Authentication in JFrog Artifactory Allows Unauthenticated Admin Access | 9.8 | 14% | KEVPoC ×2 | KEV |
From the original article
2 min read at bleepingcomputer.com
Threat actors are exploiting critical and high-severity vulnerabilities in JFrog Artifactory to bypass authentication, gain administrative privileges, and deploy a Rust backdoor on vulnerable self-hosted servers. [...]
By Bill Toulas · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.