Attackers Chain JFrog Artifactory Flaws to Deploy Rust Backdoor

Attackers are actively compromising self-hosted JFrog Artifactory servers by chaining authentication and authorization vulnerabilities, then establishing persistent administrative access and deploying custom malware.

Wiz observed attacks involving CVE-2026-42018 and CVE-2026-42016 across multiple environments between August 15 and September 8, 2026. In some cases, the attackers created a new administrator account less than five minutes after beginning exploitation.

A separate critical vulnerability, CVE-2026-82329, has also been exploited to generate administrator tokens. It entered the US Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog on September 2, 2026.

Wiz estimated that 49% to 62% of reachable Artifactory instances were exposed to at least one of the three vulnerabilities. The reported attacks primarily concern self-hosted systems, particularly those accessible from the internet.

Low-Privilege Token Becomes Administrator Access

The two-vulnerability chain starts with CVE-2026-42018, an improper authentication flaw carrying a CVSS score of 7.5. It is remotely exploitable without credentials or user interaction.

An unauthenticated caller can obtain a JSON Web Token associated with Artifactory’s internal anonymous user, including when administrators have disabled anonymous access. The resulting token initially has limited permissions, but it gives the attacker the credential needed for the next stage.

CVE-2026-42016 then provides the privilege-escalation path. Artifactory validates the token’s signature and issuer but does not adequately verify its scope. An attacker possessing the internal anonymous-user token can exploit that authorization gap to obtain administrator-level privileges.

CVE-2026-42016 has a CVSS score of 8.1 and affects JFrog Artifactory Self Hosted versions before 7.133.11. It is categorized as an incorrect authorization vulnerability and requires a low-privilege token, a condition supplied by CVE-2026-42018.

The exact affected-version range for CVE-2026-42018 has not been disclosed in the available NVD information. Administrators should therefore not use the absence of a listed version range as evidence that a deployment is unaffected.

No user interaction is required for either stage. Once attackers can reach a vulnerable Artifactory service, the chain can progress from unauthenticated access to full administrative control.

Groovy Plugins and a Rust Backdoor Provide Persistence

Administrative access allowed the intruders to move beyond token abuse. They created unauthorized administrator accounts and generated long-lived access tokens, giving them additional ways to return after the initial compromise.

The attackers also installed malicious Groovy plugins. Because such plugins can execute commands within the Artifactory environment, they provided a direct mechanism for running attacker-controlled code on the underlying system.

Wiz repeatedly found a custom Rust backdoor with command-and-control capabilities across the investigated incidents. Its appearance in multiple environments indicates a recurring post-exploitation component, although the identity of the operators has not been established.

Observed activity included:

• Downloading additional payloads into /dev/shm, /tmp, and /var/tmp
• Uploading webshells
• Enumerating repositories, users, and access tokens
• Stealing Artifactory configuration information and cluster join keys
• Adding attacker-controlled SSH keys to newly created accounts
• Creating administrator users and persistent access tokens
• Installing Groovy plugins capable of arbitrary command execution

The theft of cluster join keys broadens the potential consequences. Defenders should treat exposed configuration material and authentication secrets as compromised rather than assuming that removing the backdoor alone restores security.

Wiz published indicators associated with the campaign, but the individual indicators are not available here. Organizations will therefore need to combine vendor or researcher-provided detection material with behavioral searches for accounts, tokens, plugins, files, and commands that do not match normal administration.

A Separate Critical Flaw Is Already in CISA’s KEV Catalog

WatchTowr separately observed exploitation of CVE-2026-82329 to mint administrator tokens. The vulnerability is an authentication weakness affecting JFrog Artifactory versions before 7.111.21 under the default configuration.

It has a CVSS score of 9.8, reflecting remote exploitation without authentication or user interaction and potential effects on confidentiality, integrity, and availability.

The available evidence does not establish that the operators exploiting CVE-2026-82329 are the same actors using the CVE-2026-42018 and CVE-2026-42016 chain. The activities should be treated as distinct unless further attribution connects them.

CISA added CVE-2026-82329 to its KEV catalog on September 2, 2026, confirming exploitation in the wild. The remediation deadline for US federal civilian agencies was September 5, 2026.

CISA requires affected organizations to apply vendor mitigations while complying with BOD 26-04, “Prioritizing Security Updates Based on Risk,” and its Forensics Triage Requirements. Agencies must follow the applicable BOD 26-04 guidance for cloud services or discontinue using the product if mitigations are unavailable. They must also evaluate each asset’s internet exposure and apply the relevant patching requirements.

This is not JFrog’s only recent KEV entry. CVE-2026-66384, another vulnerability associated with the vendor, was added to the catalog on August 27, 2026.

Patch Guidance Spans Multiple Artifactory Release Branches

JFrog Artifactory administrators should upgrade immediately to one of the following releases or a later version in the corresponding branch:

• 7.111.21
• 7.117.28
• 7.125.20
• 7.133.29
• 7.146.38
• 7.161.20

These remediation releases should not be confused with the specific NVD threshold for CVE-2026-42016, which identifies versions before 7.133.11 as vulnerable. The reason for the difference between that threshold and the recommended branch releases has not been explained.

The known version exposure is therefore:

Vulnerability	Function in attacks	Affected versions
CVE-2026-42018	Obtains an internal anonymous-user JWT	Exact range not disclosed
CVE-2026-42016	Elevates the low-privilege token to administrator scope	Artifactory Self Hosted before 7.133.11
CVE-2026-82329	Allows unauthenticated administrative access under the default configuration	Artifactory before 7.111.21

Because CVE-2026-42018 lacks a published affected-version range, organizations should follow the supplied fixed-release guidance rather than patching only according to the threshold listed for one vulnerability.

Compromise Checks Must Continue After Upgrading

Installing a fixed version closes known entry points but does not remove accounts, tokens, webshells, plugins, or malware already placed on a server. Every exposed instance should undergo a post-upgrade investigation.

Defenders should examine Artifactory audit and access records for unexpected token issuance, especially tokens connected to anonymous or newly created identities. All administrator accounts should be reconciled against an approved inventory, and unexplained long-lived tokens should be revoked.

Groovy plugins require particular scrutiny. Administrators should identify recently added or modified plugins, determine who installed them, and review any commands or child processes they launched.

Systems should also be searched for unusual executables, scripts, or staged payloads in /dev/shm, /tmp, and /var/tmp. Web-accessible directories should be inspected for webshells, while account configurations should be checked for unauthorized SSH keys.

If configuration data or cluster join keys may have been accessed, defenders should rotate the affected secrets and assess connected Artifactory nodes. Repository, user, and token enumeration may also indicate that attackers mapped the environment before stealing data or expanding access.

Finally, self-hosted Artifactory services should be restricted to trusted networks and administrative systems instead of being directly exposed to the public internet. JFrog had not publicly confirmed the reported exploitation when contacted for comment, according to BleepingComputer.