Threat actors have been chaining critical vulnerabilities in JFrog Artifactory to gain unauthorized access, install backdoor malware, and compromise sensitive data. According to a report from cloud security company Wiz, multiple threat actors have exploited these flaws across various environments, targeting self-hosted servers that store and manage software dependencies.
The attacks rely on three key vulnerabilities: CVE-2026-42018, which allows attackers to obtain a JSON Web Token (JWT) belonging to an internal Artifactory anonymous user; CVE-2026-42016, caused by insufficient token validation, which enables attackers to increase permissions to admin level; and CVE-2026-82329, a critical authentication bypass that allows minting administrator tokens. Wiz notes that in some cases, the attacker can create an administrator account in under five minutes.
Once attackers gain administrative privileges, they install malicious Groovy plugins to execute arbitrary commands and deploy a Rust-based backdoor for persistence. In the next stage, the threat actor downloads additional payloads into system directories such as /dev/shm, /tmp, and /var/tmp, uploads webshells, steals Artifactory configuration data and cluster join keys, enumerates repositories, tokens, and users, and adds their SSH keys to newly created accounts.
Wiz warns that between 49% and 62% of reachable Artifactory instances are vulnerable to at least one of the three flaws. System administrators are urged to upgrade immediately to one of the following Artifactory release versions or later: 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, or 7.161.20.
After upgrading, administrators should investigate internet-exposed instances for unexpected token creation, rogue administrator accounts, suspicious plugin activity, and enumeration requests, and restrict access to trusted systems only. Wiz has also listed indicators of compromise (IoCs) associated with the observed attacks to help defenders detect them quickly.
The JFrog Artifactory vulnerability highlights the importance of regular security updates and monitoring for software dependency management tools like Artifactory. With the increasing complexity of modern software development, it’s essential for organizations to prioritize security and ensure that their infrastructure is up-to-date and secure. By taking proactive measures to address vulnerabilities like this one, organizations can reduce the risk of data breaches and protect their sensitive assets.
In light of these attacks, system administrators should consider implementing additional security measures such as monitoring logs for suspicious activity, restricting access to Artifactory instances based on user roles, and using web application firewalls (WAFs) to block malicious traffic. By staying vigilant and proactive in addressing potential threats, organizations can maintain the integrity of their software supply chain and protect against sophisticated attacks like this one.
Source: Bleeping Computer — 2026-09-11