Threat actors are exploiting critical vulnerabilities in JFrog Artifactory, a popular software repository management platform, to gain unauthorized access and deploy backdoor malware on self-hosted servers. A recent report from cloud security company Wiz has confirmed that multiple threat actors have chained these flaws to bypass authentication, elevate privileges, and install malicious plugins.
The attacks involve exploiting three vulnerabilities: CVE-2026-42018, a critical flaw in the handling of JSON Web Tokens (JWTs); CVE-2026-42016, an insufficient token validation issue; and CVE-2026-82329, a critical authentication bypass vulnerability. By combining these flaws, attackers can obtain administrative privileges and deploy malicious Groovy plugins to execute arbitrary commands.
Wiz researchers observed that between August 15 and September 8, multiple threat actors exploited the two vulnerabilities to create admin accounts and generate long-lived access tokens in under five minutes. Once inside, the attackers installed a custom Rust-based backdoor with C2 capabilities and downloaded additional payloads into various system directories. They also stole Artifactory configuration data, enumerated repositories and users, and uploaded webshells.
The researchers note that between 49% and 62% of reachable Artifactory instances are vulnerable to at least one of the three flaws. This is a disturbing statistic, especially considering the severity of the vulnerabilities involved. System administrators are strongly advised to upgrade their Artifactory installations immediately to one of the recommended release versions: 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, or 7.161.20.
After upgrading, administrators should investigate internet-exposed instances for signs of unauthorized activity, such as unexpected token creation, rogue administrator accounts, suspicious plugin activity, and enumeration requests. They should also restrict access to trusted systems only and monitor their environments closely for any indicators of compromise (IoCs).
Wiz has published IoCs associated with the observed attacks to help defenders detect them quickly. It’s essential that system administrators take prompt action to mitigate these vulnerabilities and prevent further exploitation.
In today’s rapidly evolving threat landscape, it’s crucial for organizations to stay vigilant and prioritize security updates and patches. The Artifactory flaws highlighted in this report serve as a reminder of the importance of proactive security measures and the need for continuous monitoring and incident response planning.
Source: Bleeping Computer — 2026-09-11