Artifactory flaws chained in attacks deploying backdoor malware September 11, 2026 Threat actors are exploiting critical and high-severity vulnerabilities in JFrog Artifactory to bypass authentication, gain administrative privileges, and deploy a Rust backdoor on vulnerable self-hosted servers. A new report from cloud security company Wiz confirmed exploitation across multiple environments, including an exploit chain that combines CVE-2026-42018 and CVE-2026-42016. The third vulnerability is CVE-2026-82329, a critical authentication bypass that offensive security company watchTowr observed being exploited earlier this month to mint administrator tokens . According to Wiz, attackers exploit CVE-2026-42018 to obtain a JSON Web Token (JWT) belonging to an internal Artifactory anonymous user, even when anonymous access is disabled, with low privileges. Then they increase permissions to admin level by exploiting CVE-2026-42016, caused by insufficient token validation. Between August 15 and September 8, multiple threat actors exploited the two vulnerabilities to obtain a JWT for the internal anonymous user and then exchange it for an admin-scoped token. The researchers note that in some cases the attacker took less than five minutes to create an administrator account. After creating admin accounts and generating long-lived access tokens, the attackers installed malicious Groovy plugins to execute arbitrary commands and established persistence by deploying a Rust-based backdoor. “Between August 15 and September 8, 2026, we observed multiple actors chain CVE-2026-42018 and CVE-2026-42016 against self-hosted Artifactory instances,” Wiz says . “Across multiple cases, we observed a custom Rust backdoor with C2 capabilities being dropped.” In the next stage, the threat actor downloaded additional payloads into /dev/shm , /tmp , and /var/tmp , uploaded webshells, stole Artifactory configuration data and cluster join keys, enumerated repositories, tokens, and users, and added their SSH keys to newly created accounts. Wiz warns that between 49% and 62% of reachable Artifactory instances are vulnerable to at least one of the three flaws. System administrators are recommended to upgrade immediately to one of the following Artifactory release versions or later: After upgrading, investigate internet-exposed instances for unexpected token creation, rogue administrator accounts, suspicious plugin activity, and enumeration requests, and restrict access to trusted systems only. Wiz has listed indicators of compromise (IoCs) associated with the observed attacks to help defenders detect them quickly. BleepingComputer has contacted JFrog to confirm the reported activity, but we have not received a response as of publication. Build your security blueprint for AI-powered attacks Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed. Related Articles: Hackers exploit critical JFrog Artifactory flaw to forge admin tokens Hackers target WordPress sites in miniOrange auth bypass attacks Hackers exploit macOS Screen Sharing flaw to deploy Monero miner

N-able warns of N-central auth bypass flaw exploited in attacks Check Point warns of SmartConsole zero-day exploited in attacks Actively Exploited Authentication Bypass Elevation of Privileges JFrog Artifactory Previous Article Not a member yet? Register Now You may also like: September Windows Server updates break Remote Desktop Services September Windows Server updates break Remote Desktop Services Microsoft Excel KB5002914 update breaks copy and paste for some users Microsoft Excel KB5002914 update breaks copy and paste for some users New Microsoft Defender 'ShieldCrash' zero-day grants SYSTEM access New Microsoft Defender 'ShieldCrash' zero-day grants SYSTEM access Find your gaps before an auditor does. Check your EU CRA readiness in 5 questions. Find your gaps before an auditor does. Check your EU CRA readiness in 5 questions. Overdue a password health-check? Audit your Active Directory for free Overdue a password health-check? Audit your Active Directory for free Stay one step ahead of new threats in the new year. Join Huntress for the monthly Tradecraft Tuesday. Stay one step ahead of new threats in the new year. Join Huntress for the monthly Tradecraft Tuesday. EtherHiding Malware on macOS: How Attackers Hide C2 on the Blockchain EtherHiding Malware on macOS: How Attackers Hide C2 on the Blockchain