Three JFrog Artifactory Flaws Exploited to Deploy Backdoors
Summary
Wiz reports attackers exploited three JFrog Artifactory flaws to gain access, escalate privileges, and deploy backdoors. Organizations are urged to update self-managed deployments to patched versions.
Key points
- Wiz reports multiple actors chained CVE-2026-42018 and CVE-2026-42016 against self-hosted Artifactory instances from August 15 to September 8, 2026.
- The chain reportedly used CVE-2026-42018 to obtain an anonymous-user token, then CVE-2026-42016 to escalate privileges to administrator.
- Attackers reportedly created persistent admin accounts, installed malicious plugins, ran shell commands, and dropped second-stage payloads.
- CVE-2026-82329, an authentication bypass, was exploited in the wild for configuration and cluster-key theft, persistent access, token minting, and asset enumeration.
- CISA added all three vulnerabilities to its Known Exploited Vulnerabilities catalog; federal agencies were given two weeks to patch the first two listed flaws.
- Organizations are advised to update self-managed Artifactory deployments to one of the patched versions listed in the article.
Article Details
- Vulnerability Types
- Improper authentication
- Insufficient token validation
- Authentication bypass
- Severity
- High
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
MITRE ATT&CK
T1059.004 · Unix ShellAttackers ran shell commands through the Artifactory plugin endpoint.T1083 · File and Directory DiscoveryAttackers enumerated Artifactory assets.T1098 · Account ManipulationAttackers created persistent administrator accounts and attached their SSH keys to accounts they created.T1105 · Ingress Tool TransferAttackers dropped second-stage payloads.T1505.003 · Web ShellAttackers installed malicious plugins in Artifactory for persistence and arbitrary code execution.T1528 · Steal Application Access TokenAttackers obtained an anonymous-user token and minted tokens during exploitation.T1567 · Exfiltration Over Web ServiceAttackers exfiltrated configuration data and cluster keys.
CVE
CVE-2026-42016The three flaws, CVE-2026-42016, CVE-2026-42018, and CVE-2026-82329, can allow attackers to bypass authentication and gain administrative privileges on vulnerable Artifactory instances.CVE-2026-42018The three flaws, CVE-2026-42016, CVE-2026-42018, and CVE-2026-82329, can allow attackers to bypass authentication and gain administrative privileges on vulnerable Artifactory instances.CVE-2026-82329The three flaws, CVE-2026-42016, CVE-2026-42018, and CVE-2026-82329, can allow attackers to bypass authentication and gain administrative privileges on vulnerable Artifactory instances.