Attackers Exploit Three JFrog Artifactory Vulnerabilities to Gain Admin Access and Deploy Backdoors
Summary
Wiz reports active exploitation of three Artifactory flaws to bypass authentication and gain administrator access. Attackers have deployed persistent accounts, malicious Groovy plugins, and Rust backdoors; affected instances should be patched and investigated for signs,
Key points
- The three flaws enable token exposure, privilege escalation, or unauthenticated administrative access; attackers have chained two flaws to obtain admin-scoped tokens.
- Observed post-exploitation includes persistent administrator accounts, malicious Groovy plugins, webshells, and Rust-based backdoors.
- Plugins were used for command execution, credential and signing-key theft, internal network tunneling, and log removal; some persistence can survive upgrades.
- Wiz reports that 67–69% of organizations running Artifactory had at least one vulnerable instance at the respective disclosure dates.
- Upgrade affected Artifactory releases to fixed versions, prioritize internet-accessible instances, restrict network access, and review logs and administrative activity.
- If compromise is suspected, investigate and remove persistence; stolen Access signing keys may require certificate reset in addition to patching.
Article Details
- Vulnerability Types
- Improper authentication
- Privilege escalation
- Authentication bypass
- Severity
- CVE-2026-82329 is critical; CVE-2026-42018 and CVE-2026-42016 are described as critical and high-severity, respectively.
- Affected Versions
- CVE-2026-82329: 7.161.0 > 7.161.19; 7.146.0 > 7.146.36; 7.133.0 > 7.133.28; 7.125.0 > 7.125.19; 7.117.0 > 7.117.27; 7.111.4 > 7.111.21
- CVE-2026-42018: < 7.111.20; 7.117.0–7.117.27; 7.125.0–7.125.19; 7.133.0–7.133.28; 7.146.0–7.146.8
- CVE-2026-42016: prior to 7.133.11
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Restrict network access to trusted users and systems where possible.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 103[.]124[.]165[.]42 | Actor IP reported exploiting CVE-2026-82329. |
| IPV4 | 104[.]28[.]251[.]139 | Actor IP reported exploiting CVE-2026-82329. |
| IPV4 | 105[.]188[.]75[.]16 | Actor IP reported exploiting CVE-2026-82329. |
| IPV4 | 121[.]123[.]141[.]155 | Actor IP reported exploiting CVE-2026-42018 and CVE-2026-4016. |
| IPV4 | 129[.]121[.]56[.]234 | Actor IP reported exploiting CVE-2026-82329. |
| IPV4 | 137[.]184[.]111[.]69 | Actor IP reported exploiting CVE-2026-82329. |
| IPV4 | 146[.]19[.]216[.]120 | Actor IP reported exploiting CVE-2026-82329. |
| IPV4 | 149[.]102[.]229[.]150 | Actor IP reported exploiting CVE-2026-42018 and CVE-2026-42016. |
| IPV4 | 15[.]157[.]64[.]113 | Actor IP reported exploiting CVE-2026-82329. |
| IPV4 | 155[.]254[.]120[.]23 | Actor IP reported exploiting CVE-2026-82329. |
| IPV4 | 16[.]54[.]250[.]190 | Actor IP reported exploiting CVE-2026-82329. |
| IPV4 | 176[.]88[.]121[.]152 | Actor IP reported exploiting CVE-2026-82329. |
| IPV4 | 182[.]62[.]201[.]69 | Actor IP reported exploiting CVE-2026-42018. |
| IPV4 | 185[.]128[.]24[.]187 | Actor IP reported exploiting CVE-2026-82329. |
| IPV4 | 185[.]190[.]58[.]172 | Actor IP reported exploiting CVE-2026-82329. |
| IPV4 | 186[.]247[.]79[.]240 | Actor IP reported exploiting CVE-2026-42018. |
| IPV4 | 220[.]246[.]124[.]92 | Actor IP reported exploiting CVE-2026-82329. |
| IPV4 | 223[.]144[.]227[.]110 | Actor IP reported exploiting CVE-2026-82329. |
| IPV4 | 45[.]61[.]176[.]88 | Actor IP reported exploiting CVE-2026-82329. |
| SHA1 | 490b8bf4edf7638fb3762ae275bf0e37504acb4c | Hash of a malicious Groovy plugin named cmd.groovy. |
| SHA1 | 513a907b69edffc3cb77a494da395178d21ef9bd | SHA-1 hash of the /tmp/.z payload. |
| SHA1 | 625f4165d31973f149df907b599f097ae4e1ba47 | Hash of a malicious Groovy plugin named uploadFile.groovy or jwtToken.groovy. |
| SHA1 | a021ee4dae296ce421ce0a2d39357eb6778d6f36 | Hash of the malicious Groovy plugin httpSession.groovy. |
| SHA1 | a70dc1f3f759ef84891c2caf5612fa66a1bdc2dc | Hash of the malicious Groovy plugin JFrogImage.groovy. |
| SHA1 | ab14c4dfc8cfb3a5da8f1c34a190d82af7fb43c4 | Hash of the malicious Groovy plugin rce.groovy. |
| SHA1 | e65f0502a142dc14ffaf536798b2df543455c44c | Hash of the malicious Groovy plugin metrics.groovy. |
| URL | hxxp[:]//3[.]88[.]162[.]79:36789/smtp | Second payload-download URL observed after exploitation of CVE-2026-42018 and CVE-2026-42016. |
| URL | hxxp[:]//log[.]gitclone[.]org:45678/smtp | Payload download URL observed after exploitation of CVE-2026-42018 and CVE-2026-42016. |
MITRE ATT&CK
T1059.004 · Unix ShellMalicious plugins executed shell commands through /bin/sh or bash on compromised Artifactory hosts.T1105 · Ingress Tool TransferA dropper fetched a second-stage binary over HTTP and wrote it to a temporary or world-writable path.T1136.001 · Local AccountAfter exploitation, attackers created persistent administrator accounts in Artifactory.T1190 · Exploit Public-Facing ApplicationAttackers exploited vulnerabilities in exposed Artifactory instances to gain access and, in some cases, administrative privileges.T1505.003 · Web ShellActors deployed webshell scripts in repository paths for follow-on access.T1552.001 · Credentials In FilesMalicious plugins harvested stored credentials, database contents, and Access signing-key material from compromised instances.
CVE
CVE-2026-42016exploitation of three critical and high-severity vulnerabilities affecting JFrog Artifactory: CVE-2026-42016, CVE-2026-42018, and CVE-2026-82329. Attackers are chaining these vulnerabilities to bypassCVE-2026-42018September 11, 2026 3PM UTC: Corrected the HTTP method for CVE-2026-82329 and the impacted fixed versions for CVE-2026-42018.CVE-2026-82329September 11, 2026 3PM UTC: Corrected the HTTP method for CVE-2026-82329 and the impacted fixed versions for CVE-2026-42018.