Critical JFrog Artifactory Vulnerabilities Exploited to Deploy Backdoors

Post Views: 4

Three JFrog Artifactory vulnerabilities have been actively exploited by malicious actors to infiltrate systems and deploy malicious backdoors, according to cybersecurity firm Wiz.

Vulnerabilities Overview

The flaws, which affect the widely used JFrog Artifactory platform for managing software artifacts, binaries, AI models, containers, and packages, enable attackers to bypass authentication mechanisms and achieve administrative control over vulnerable deployments.

CVE-2026-42018 and CVE-2026-42016

CVE-2026-42018, a flaw resolved on August 12, allows unauthorized access to sensitive data by obtaining an anonymous-user token. This vulnerability was exploited in combination with CVE-2026-42016, which was patched on July 27 and involves insufficient token validation that enables privilege escalation. Attackers reportedly chained these two flaws starting in mid-August 2026 to gain administrative privileges on self-hosted Artifactory instances. The exploitation process included deploying persistent admin accounts, installing malicious plugins for arbitrary code execution, executing shell commands via plugin endpoints, and deploying secondary payloads. In some cases, attackers modified scripts to maintain long-term access.

CVE-2026-82329

A separate vulnerability, CVE-2026-82329, patched on August 28, allows remote exploitation without authentication to achieve administrative access. This flaw was actively targeted in early September 2026, with attackers leveraging it for configuration exfiltration, persistent admin access, token generation, cluster key extraction, and asset enumeration. Some incidents involved attackers adding custom SSH keys to compromised user accounts to ensure continued access.

Patching and Mitigation

The Cybersecurity and Infrastructure Security Agency (CISA) included CVE-2026-42018 and CVE-2026-42016 in its Known Exploited Vulnerabilities (KEV) catalog one week after CVE-2026-82329 was added. Federal agencies were given a two-week deadline to apply patches under BOD 26-04. Organizations are urged to update their self-managed Artifactory instances to specific versions, including 7.161.20, 7.146.38, 7.133.29, 7.125.20, 7.117.28, or 7.111.21, to mitigate risks.

Implications and Recommendations

The exploitation campaigns highlight the critical need for timely patching and proactive monitoring of artifact repositories. Attackers’ methods demonstrate a sophisticated approach to maintaining persistence and escalating privileges, underscoring the importance of securing infrastructure components that manage sensitive software assets.

According to cybersecurity firm Wiz, the vulnerabilities have been actively exploited by malicious actors to infiltrate systems and deploy malicious backdoors.

Conclusion

Organizations must prioritize updating their systems and implementing robust security measures to prevent exploitation of these critical vulnerabilities. Proactive monitoring and adherence to patching guidelines are essential to safeguarding sensitive software assets.