Attackers have chained multiple vulnerabilities in JFrog Artifactory, a repository platform used by software development and build pipelines, to gain administrator-level access to self-hosted servers and deploy backdoors, according to a report from cloud security company Wiz. The attacks were observed between August 15 and September 8, targeting servers that had not applied available security updates. JFrog had already released fixes for the exploited vulnerabilities before the observed activity began, limiting exposure to unpatched systems. The attack campaign relied on combining two separate flaws, CVE-2026-42018 and CVE-2026-42016, as neither vulnerability provided administrator control independently. CVE-2026-42018 allowed Artifactory to provide an internal anonymous-user token to a caller who had not authenticated, even when anonymous access settings were disabled. Attackers then used CVE-2026-42016 to exchange that low-privilege token for one with administrator-level permissions because Artifactory validated the token signature and issuer but did not properly verify the permissions assigned to the token. Wiz reported that every observed attack followed a similar process, where an unauthenticated request was sent to a token endpoint, followed by an exchange that produced an administrator-scope token. Although the resulting token retained the anonymous username, actions performed with it appeared in logs as token:anonymous instead of being linked to a specific account. In some incidents, attackers moved from the initial request to creating a new administrator account within less than five minutes.
The combined exploit chain affected a smaller range of systems compared with individual vulnerabilities because both flaws needed to exist on the same server. JFrog addressed CVE-2026-42018 through updates released for different branches, including version 7.146 on April 28 and version 7.133 on August 12, shortly before Wiz detected exploitation activity. After gaining administrator access, attackers carried out different activities across compromised environments. Wiz found that attackers created administrator accounts and maintained access by leaving them active. They also installed malicious Groovy plugins through Artifactory’s plugin framework, which provided the ability to execute code on affected servers. In several cases, attackers used plugin execution functionality to run shell commands, inspect files, and explore system environments. Some incidents involved a dropper that downloaded a binary over HTTP, stored it in writable directories such as /tmp, and established communication channels with external infrastructure. Wiz also identified a custom Rust-based backdoor with command-and-control capabilities deployed in multiple cases.
The same investigation also highlighted CVE-2026-82329, a separate critical authentication bypass vulnerability affecting JFrog Artifactory. Unlike the chained flaws, CVE-2026-82329 could provide administrator privileges without requiring another vulnerability and was rated 9.8 on the CVSS scale. The issue affected default configurations across multiple release branches up to version 7.161, allowing unauthenticated attackers with network access to obtain administrative privileges. Earlier reports from The Hacker News noted that attackers had started creating administrator tokens through this vulnerability shortly after JFrog disclosed it. CISA added CVE-2026-82329 to its catalog of known exploited vulnerabilities on September 2 and issued remediation guidance for federal agencies. Fastly also reported increased scanning activity after a public exploit became available, recording hundreds of thousands of exploitation attempts through its platform, although those figures represented attack attempts rather than confirmed compromises. JFrog recommends that organizations using self-hosted Artifactory upgrade to fixed versions listed in its security advisories. Cloud-based Artifactory instances do not require customer action, according to JFrog. For CVE-2026-42018, fixes are available in versions including 7.111.20, 7.117.27, 7.125.19, 7.133.28, and 7.146.8. CVE-2026-42016 is addressed in version 7.133.11, while CVE-2026-82329 has fixes across multiple branches, including 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, and 7.161.20. Organizations unable to immediately upgrade against CVE-2026-82329 can apply JFrog’s workaround by adding an additional join key value in system.yaml to restrict unauthorized service registration.
Security teams should also investigate systems beyond applying patches because updates alone do not remove persistence mechanisms already created by attackers. Administrator accounts created during attacks remain active after upgrades, and previously issued tokens or stolen cluster join keys may continue to provide access. Wiz and Fastly recommend reviewing administrator accounts, repositories, plugins, configuration changes, and token activity. Organizations should also monitor for unusual actions involving anonymous or low-privilege accounts, including unexpected token creation, user listings, plugin modifications, or access to sensitive configurations. Wiz identified suspicious administrator accounts using names such as 0xTerror, svc_ and labadmin_ variations, along with names designed to appear legitimate, including jfrog-distribution, jfrog-insight, and repo-service. The vulnerabilities were disclosed as part of JFrog’s July 27 advisory release, with several issues credited to security researchers, including OpenAI researchers.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
