Attackers Chain JFrog Artifactory Flaws to Deploy Rust Backdoor
Summary
Wiz reports attackers chained three JFrog Artifactory flaws to gain admin access, steal data, and deploy a Rust backdoor. Administrators should upgrade to fixed versions and investigate exposed instances.
Key points
- Wiz reported active exploitation of CVE-2026-42018 and CVE-2026-42016 against self-hosted Artifactory instances from August 15 to September 8, 2026.
- The chain obtained a JWT for Artifactory’s internal anonymous user, then exploited insufficient token validation to gain admin-level access.
- Attackers created rogue administrator accounts, generated long-lived tokens, and installed malicious Groovy plugins.
- Observed activity included deploying a Rust backdoor with C2 capabilities, uploading webshells, stealing configuration data and cluster join keys, and adding SSH keys to new accounts.
- Wiz said 49% to 62% of reachable Artifactory instances were vulnerable to at least one of the three flaws.
- Upgrade to the listed fixed Artifactory releases or later; then investigate exposed instances for unexpected tokens, accounts, plugins, and enumeration activity.
Article Details
- Vulnerability Types
- Authentication bypass
- Insufficient token validation
- Severity
- Critical and high
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Restrict access to trusted systems only.
MITRE ATT&CK
T1005 · Data from Local SystemAttackers stole Artifactory configuration data and cluster join keys.T1098.004 · SSH Authorized KeysAttackers added their SSH keys to newly created accounts.T1105 · Ingress Tool TransferAttackers downloaded additional payloads to /dev/shm, /tmp, and /var/tmp.T1136.001 · Local AccountAttackers created administrator accounts on compromised Artifactory instances.T1505.003 · Web ShellAttackers uploaded webshells to compromised Artifactory instances.
CVE
CVE-2026-42016Wiz confirmed an exploit chain using CVE-2026-42018 and CVE-2026-42016 across multiple environments.CVE-2026-42018Wiz confirmed an exploit chain using CVE-2026-42018 and CVE-2026-42016 across multiple environments.CVE-2026-82329CVE-2026-82329 was also observed being used to mint administrator tokens.