Attackers Chain JFrog Artifactory Flaws to Gain Admin Control and Plant Backdoors
Attackers exploited a chain of two vulnerabilities in JFrog Artifactory to gain administrator control of self-hosted servers and install malicious plugins, including backdoors and droppers. The initial flaw allowed an unauthenticated user to obtain a low-privilege token, which could then be swapped for an administrator token. A separate, critical authentication bypass flaw allowed unauthenticated access to administrator privileges. This led to the creation of numerous administrator accounts and the deployment of malicious code, including a Rust backdoor and a dropper. The attacks were widespread, with Fastly reporting a high volume of exploitation attempts.
Attackers have chained two flaws in JFrog Artifactory, the repository that software build pipelines pull from, to take administrator control of self-hosted servers and plant backdoors, according to a Wiz report. The attacks occurred between August 15 and September 8.
Neither flaw gives administrator control on its own. CVE-2026-42018 allows Artifactory to hand an internal anonymous-user token to a caller who has not logged in, even when anonymous access is turned off. CVE-2026-42016 then allows that low-privilege token to be swapped for one with administrator scope, because Artifactory checks a token's signature and who issued it, but not what the token is allowed to do. Every case Wiz saw followed a similar pattern: the attacker sent an unauthenticated request to a token endpoint and received a token for the internal anonymous user, then exchanged it at Artifactory's token-creation endpoint for a token with administrator scope. That second token keeps the anonymous username. Administrator actions taken with it show up in the logs as token:anonymous rather than under a named account.
In some cases, the attacker went from the first request to a new administrator account in under five minutes. Across the compromised servers, attackers created administrator accounts and left them in place. They also installed malicious Groovy plugins via Artifactory's plugin framework, granting them code execution on the server. Some ran shell commands via the plugin execution endpoint to explore and list files. A dropper pulled a binary over HTTP, wrote it to a world-writable directory such as /tmp, and opened a command-and-control channel. Wiz also saw a custom Rust backdoor with command-and-control features dropped in multiple cases.
A third Artifactory flaw, CVE-2026-82329, was exploited separately between September 1 and September 8, and it is the reason a server on a newer branch may still be affected. It is a critical authentication bypass, rated 9.8 on the CVSS scale, that targets Artifactory's default configuration and requires no additional flaw. An unauthenticated attacker with network access can obtain administrator privileges through it alone, on six release branches up to 7.161. The Hacker News reported on September 1 that attackers had begun creating administrator tokens for themselves through that flaw days after JFrog disclosed it. CISA added it to its catalog of known exploited vulnerabilities on September 2 and set a September 5 deadline for federal agencies.
Fastly, a content delivery network, said in an analysis that a public exploit appeared on September 1 and scanning followed. It counted about 406,000 exploitation attempts across its platform on September 2, its busiest day. Those are attempts seen in traffic, not compromises. On servers taken through that flaw, Wiz saw attackers read the system configuration and, in several cases, take the cluster join key, the shared secret Artifactory nodes use to register with one another.
What to Install: Upgrade self-hosted Artifactory to the fixed build for your release branch, listed in JFrog's security advisories. JFrog says cloud instances need no action. JFrog lists one fixed version for CVE-2026-42016, 7.133.11, and no separate fix for each branch. Its advisory does not say whether a later build on an older branch, such as 7.117.28, also closes it. The Hacker News has asked JFrog that question, and has asked Wiz which versions the compromised servers were running.
For CVE-2026-82329, JFrog publishes a workaround for anyone who cannot upgrade quickly: generate a random value and add it as an extra join key in system.yaml, so that only your own keys are accepted when a service registers. There is no interim option for the two chained flaws in any of the advisories or reports consulted.
What Patching Does Not Undo: The administrator accounts the attackers created do not disappear when the software is updated. Wiz saw them created both through the two-flaw chain and through CVE-2026-82329. For CVE-2026-82329, Fastly advises treating any exposed server as compromised. "A patch does not revoke tokens already minted," the company said. An upgrade also does not change a join key attackers have already taken. Fastly recommends rotating the platform join key, revoking access tokens issued since August 28, and reviewing administrator accounts, repositories, and configuration changes.
How to Check: The clearest signal is an account doing something its privileges should not allow: the internal anonymous user, or any low-privilege account, creating tokens, listing users, or reading and writing plugins. Then look for administrator accounts nobody created on purpose. Most of the ones Wiz saw carry proof-of-concept names such as 0xTerror, or svc_ and labadmin_ followed by random characters. Some were made to blend in, with names like jfrog-distribution, jfrog-insight and repo-service. Wiz's report lists attacker addresses and a payload hash.