JFrog Artifactory Flaws Exploited in the Wild, Rust Backdoor Deployed

Attackers chain authentication bypass vulnerabilities to gain admin access on self-hosted servers

edit

By LineZotpaper

Published12 September 2026

Read Time2 min

Threat actors are actively exploiting critical and high-severity vulnerabilities in JFrog Artifactory to bypass authentication, gain administrative privileges, and deploy a Rust-based backdoor on vulnerable self-hosted servers, according to a new report from cloud security company Wiz.

Wiz confirmed exploitation across multiple environments, including an exploit chain that combines CVE-2026-42018 and CVE-2026-42016. The third vulnerability, CVE-2026-82329, is a critical authentication bypass that offensive security company watchTowr observed being exploited earlier this month to mint administrator tokens.

According to Wiz, attackers exploit CVE-2026-42018 to obtain a JSON Web Token (JWT) belonging to an internal Artifactory anonymous user, even when anonymous access is disabled, with low privileges. They then increase permissions to admin level by exploiting CVE-2026-42016, caused by insufficient token validation.

Between August 15 and September 8, multiple threat actors exploited the two vulnerabilities to obtain a JWT for the internal anonymous user and then exchange it for an admin-scoped token. The researchers note that in some cases the attacker took less than five minutes to create an administrator account.

After creating admin accounts and generating long-lived access tokens, the attackers installed malicious Groovy plugins to execute arbitrary commands and established persistence by deploying a Rust-based backdoor.

In the next stage, the threat actor downloaded additional payloads into /dev/shm, /tmp, and /var/tmp, uploaded webshells, stole Artifactory configuration data and cluster join keys, enumerated repositories, tokens, and users, and added their SSH keys to newly created accounts.

Wiz warns that between 49% and 62% of reachable Artifactory instances are vulnerable to at least one of the three flaws. System administrators are recommended to upgrade immediately to one of the following Artifactory release versions or later: 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, or 7.161.20.

After upgrading, organizations should investigate internet-exposed instances for unexpected token creation, rogue administrator accounts, suspicious plugin activity, and enumeration requests, and restrict access to trusted systems only. Wiz has listed indicators of compromise (IoCs) associated with the observed attacks to help defenders detect them quickly.

Analysis

Why This Matters

Active exploitation of these flaws puts thousands of organizations using self-hosted Artifactory at risk of full compromise, including data theft and persistent backdoor access.
The speed of exploitation (under five minutes to create an admin account) means defenders have little time to respond once an attack begins.
The Rust-based backdoor and C2 capabilities indicate a sophisticated threat actor intent on long-term access.

Background

JFrog Artifactory is a popular artifact repository manager used by software development teams for storing and managing binary artifacts, dependencies, and build outputs. Self-hosted instances are often exposed to the internet for team access. The vulnerabilities disclosed earlier this year were patched by JFrog, but not all users have updated.

Key Perspectives

Wiz (Cloud Security Company): They reported the exploitation chain and urged immediate patching, noting that between 49% and 62% of reachable instances are vulnerable. watchTowr (Offensive Security Company): They observed exploitation of CVE-2026-82329 for minting admin tokens earlier this month. JFrog: The company has not responded to BleepingComputer's request for comment as of publication. They have released patches in multiple version lines. System Administrators and Security Teams: They face pressure to rapidly patch and investigate potentially compromised instances, balancing uptime with security.

What to Watch

JFrog's official response or additional security advisories.
Reports of data breaches or ransomware deployments linked to these attacks.
Indicators of compromise (IoCs) released by Wiz to help defenders detect compromises.

Sources

Artifactory flaws chained in attacks deploying backdoor malware — BleepingComputer