Malicious actors are leveraging critical and high-severity flaws in JFrog Artifactory to circumvent authentication controls, escalate to administrative privileges, and install a Rust-based backdoor on self-hosted deployments. Wiz, a cloud security research firm, has published findings detailing active exploitation in multiple environments through an attack chain combining CVE-2026-42018 and CVE-2026-42016.

A third vulnerability, CVE-2026-82329, represents a critical authentication bypass that offensive security firm watchTowr documented being weaponized earlier this month to generate administrator tokens.

According to Wiz's analysis, the attack begins when adversaries leverage CVE-2026-42018 to obtain a JSON Web Token (JWT) tied to an internal Artifactory anonymous user account, even when anonymous access has been explicitly disabled. The initial token carries minimal privileges.

Attackers then escalate permissions to administrative level by exploiting CVE-2026-42016, which stems from inadequate token validation mechanisms.

During the period from August 15 through September 8, multiple threat actors chained these two vulnerabilities against self-hosted Artifactory instances to obtain tokens for the internal anonymous user and subsequently convert them into admin-scoped credentials. In certain incidents, adversaries established full administrator accounts in under five minutes.

Once administrative access was secured and long-lived tokens generated, attackers deployed malicious Groovy plugins capable of executing arbitrary system commands. They then established persistence through installation of a custom Rust backdoor with command-and-control functionality.

Between August 15 and September 8, 2026, we observed multiple actors chain CVE-2026-42018 and CVE-2026-42016 against self-hosted Artifactory instances. Across multiple cases, we observed a custom Rust backdoor with C2 capabilities being dropped.

Wiz

Following backdoor deployment, attackers retrieved additional payloads into temporary directories including /dev/shm, /tmp, and /var/tmp. They also uploaded webshells, exfiltrated Artifactory configuration files and cluster join keys, conducted enumeration of repositories and user accounts, and injected their own SSH keys into newly created accounts.

Wiz estimates that between 49% and 62% of internet-accessible Artifactory instances remain vulnerable to at least one of these three flaws.

Recommended Actions

System administrators should prioritize immediate upgrades to patched Artifactory versions:

  • 7.111.21
  • 7.117.28
  • 7.125.20
  • 7.133.29
  • 7.146.38
  • 7.161.20

Following patching, organizations should audit internet-exposed instances for signs of compromise, including unexpected token generation events, unauthorized administrator accounts, anomalous plugin execution, and suspicious enumeration activity. Access should be restricted to trusted networks only.

Wiz has published indicators of compromise (IoCs) from the observed attacks to assist security teams in detection efforts.

JFrog was contacted for comment on the reported exploitation activity but had not responded at the time of publication.

Source: BleepingComputer