Three JFrog Artifactory Flaws Exploited for Backdoor Deployment
Wiz reports multiple actors chaining three JFrog Artifactory auth flaws to gain admin and deploy backdoors; CISA added all three CVEs to KEV.
Wz reports threat actors exploiting CVE-2026-42018, CVE-2026-42016, and CVE-2026-82329 in self-hosted JFrog Artifactory instances to bypass authentication and gain administrative privileges. Between August 15 and September 8, 2026, multiple actors chained CVE-2026-42018 and CVE-2026-42016 to mint anonymous-user tokens, escalate privileges, create persistent admin accounts, install malicious plugins for code execution, and drop second-stage payloads. From early September, CVE-2026-82329 was exploited for configuration exfiltration, cluster key theft, token minting, and SSH key attachment to attacker-created accounts. CISA added all three CVEs to its KEV catalog, giving federal agencies two weeks under BOD 26-04 to patch to versions 7.161.20, 7.146.38, 7.133.29, 7.125.20, 7.117.28, or 7.111.21.