Threat actors are exploiting critical and high-severity vulnerabilities in JFrog Artifactory to bypass authentication, gain administrative privileges, and deploy a Rust backdoor on vulnerable self-hosted servers.
A new report from cloud security company Wiz confirmed exploitation across multiple environments, including an exploit chain that combines CVE-2026-42018 and CVE-2026-42016.
The third vulnerability is CVE-2026-82329, a critical authentication bypass that offensive security company watchTowr observed being exploited earlier this month to mint administrator tokens.
According to Wiz, attackers exploit CVE-2026-42018 to obtain a JSON Web Token (JWT) belonging to an internal Artifactory anonymous user, even when anonymous access is disabled, with low privileges.
Then they increase permissions to admin level by exploiting CVE-2026-42016, caused by insufficient token validation.
Between August 15 and September 8, multiple threat actors exploited the two vulnerabilities to obtain a JWT for the internal anonymous user and then exchange it for an admin-scoped token.
The researchers note that in some cases the attacker took less than five minutes to create an administrator account.
After creating admin accounts and generating long-lived access tokens, the attackers installed malicious Groovy plugins to execute arbitrary commands and established persistence by deploying a Rust-based backdoor.
“Between August 15 and September 8, 2026, we observed multiple actors chain CVE-2026-42018 and CVE-2026-42016 against self-hosted Artifactory instances,” Wiz says.
“Across multiple cases, we observed a custom Rust backdoor with C2 capabilities being dropped.”
In the next stage, the threat actor downloaded additional payloads into /dev/shm, /tmp, and /var/tmp, uploaded webshells, stole Artifactory configuration data and cluster join keys, enumerated repositories, tokens, and users, and added their SSH keys to newly created accounts.
Wiz warns that between 49% and 62% of reachable Artifactory instances are vulnerable to at least one of the three flaws.
System administrators are recommended to upgrade immediately to one of the following Artifactory release versions or later:
- 7.111.21
- 7.117.28
- 7.125.20
- 7.133.29
- 7.146.38
- 7.161.20
After upgrading, investigate internet-exposed instances for unexpected token creation, rogue administrator accounts, suspicious plugin activity, and enumeration requests, and restrict access to trusted systems only.
Wiz has listed indicators of compromise (IoCs) associated with the observed attacks to help defenders detect them quickly.
BleepingComputer has contacted JFrog to confirm the reported activity, but we have not received a response as of publication.
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.
