JFrog Artifactory Vulnerabilities Chained for Admin Access and Backdoors

Attackers have chained two flaws in JFrog Artifactory to seize administrator control of self-hosted instances and deploy persistent backdoors, according to a report from cloud security firm Wiz. CVE-2026-42018 causes Artifactory to issue an internal anonymous-user token to unauthenticated callers even when anonymous access is disabled, while CVE-2026-42016 lets that low-privilege token be exchanged for one with full administrative scope. Because Artifactory validates a token's signature and issuer but not its privileges, the two flaws combine into a complete takeover path. Wiz observed exploitation between August 15 and September 8, and in some cases attackers moved from an unauthenticated request to a freshly minted administrator account in under five minutes, with admin activity logged under "token:anonymous" rather than any named user.

Once in control, the attackers behaved inconsistently across compromised servers. Wiz saw administrators create new accounts and leave them in place for persistence, alongside the installation of malicious Groovy plugins through Artifactory's plugin framework for code execution on the host. Some used the plugin execution endpoint to run shell commands, explore the filesystem, and trigger a dropper that fetched a binary over HTTP, wrote it into a world-writable directory such as /tmp, and opened a command-and-control channel. In multiple cases, a custom Rust-based backdoor with built-in C2 functionality was deployed, suggesting deliberate tradecraft rather than automated opportunism.

A third Artifactory vulnerability in the same report, CVE-2026-82329, carries a CVSS 9.8 rating and was exploited independently between September 1 and September 8. It is a standalone authentication bypass that grants administrator privileges to any unauthenticated network attacker on six release branches up to 7.161 in default configuration. JFrog had already shipped patches for the chained flaws before activity began: the CVE-2026-42018 fix landed on the 7.146 branch on April 28 and on the 7.133 branch on August 12, three days before Wiz first observed attacks on August 15. The CVE-2026-42016 advisory range ends at 7.133.11, leaving the 7.146 and 7.161 branches technically outside that window, which is why CVE-2026-82329 remains necessary to fully close the exposure.

Operators running self-hosted JFrog Artifactory should confirm they are on a fully patched branch and audit logs for unfamiliar administrator accounts, suspicious Groovy plugins, and unexpected outbound traffic from Artifactory hosts. Verify the perimeter with a port scanner to make sure management interfaces are not inadvertently exposed to the public internet, and run an SSL/TLS checker to confirm the certificate and protocol configuration on the instance. Token issuance records should be reviewed for anonymous-scope grants in environments where anonymous access is supposed to be disabled, and any service tokens active during the affected window should be rotated.