Chained JFrog Artifactory flaws used to plant administrator backdoors
Attackers chained two Artifactory flaws for administrator access
Wiz observed attackers chaining two vulnerabilities in self-hosted JFrog Artifactory instances between August 15 and September 8, 2026. The attacks combined CVE-2026-42018 and CVE-2026-42016 to obtain administrator control, create persistent accounts and install backdoors on repository servers used by software build pipelines.
Neither vulnerability independently grants administrator control. CVE-2026-42018 can return an internal anonymous-user token to an unauthenticated caller even when anonymous access is disabled. CVE-2026-42016 then permits a low-privilege token to be exchanged for an administrator-scope token because Artifactory validates the signature and issuer, but not the token's allowed scope.
In the observed sequence, an attacker requested a token without authentication, received one for the internal anonymous user and exchanged it through Artifactory's token-creation endpoint for administrator scope. The resulting token retains the anonymous username, so administrator operations can be recorded as token:anonymous instead of a named account. Wiz reported that attackers sometimes progressed from the first request to a new administrator account in less than five minutes.
Persistence and a separate critical bypass increase exposure
Across compromised servers, attackers created administrator accounts, installed malicious Groovy plugins through Artifactory's plugin framework and used the plugin execution endpoint to run shell commands. Wiz also saw a dropper download a binary over HTTP into a world-writable path such as /tmp, establish command-and-control communications and, in multiple cases, deploy a custom Rust backdoor.
A separate vulnerability, CVE-2026-82329, was exploited between September 1 and September 8. Rated 9.8 under CVSS, this authentication bypass can give a network-based, unauthenticated attacker administrator privileges on its own in Artifactory's default configuration. It affects six release branches through 7.161.20. CISA added the flaw to its Known Exploited Vulnerabilities catalog on September 2, while Fastly counted roughly 406,000 exploitation attempts across its platform on September 2. That figure represents observed traffic attempts, not confirmed compromises.
On servers accessed through CVE-2026-82329, Wiz saw attackers read system configuration and, in several cases, obtain the cluster join key used by Artifactory nodes to register with one another. The chained CVEs have a narrower reach because both flaws must be present; correcting either flaw breaks that path.
Upgrade, then investigate for persistence
JFrog says cloud instances require no action, but self-hosted deployments should be upgraded to the fixed build for their release branch. CVE-2026-42018 is fixed in versions 7.111.20, 7.117.27, 7.125.19, 7.133.28 and 7.146.8. CVE-2026-42016 is listed as fixed in 7.133.11. CVE-2026-82329 is fixed in 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38 and 7.161.20.
For CVE-2026-82329, JFrog provides a workaround for organizations unable to upgrade immediately: add a randomly generated extra join key in system.yaml so that only local keys are accepted during service registration. The published advisories provide no interim mitigation for the two-CVE chain.
Patching does not remove administrator accounts, revoke tokens already minted or replace a cluster join key that may have been stolen. Businesses should upgrade affected self-hosted systems, rotate exposed join keys, revoke access tokens issued since August 28, and investigate unexpected administrator accounts, token activity, plugin changes, repositories and configuration modifications as a complete remediation step.