Wiz: Attackers chained two JFrog Artifactory flaws to gain admin control and plant backdoors

September 11, 2026 at 12:31 PM2 min

This digest was compiled by AI from multiple sources — links to the originals are below.

Attackers chained two flaws in JFrog Artifactory to take administrator control of self-hosted servers and plant backdoors, cloud security firm Wiz said. Wiz observed the attacks between August 15 and September 8. JFrog had fixed both flaws before the attacks began, leaving only unpatched servers exposed.

Key Facts

Wiz observed the attacks between August 15 and September 8.
CVE-2026-42018 returns an internal anonymous-user token even when anonymous access is disabled.
CVE-2026-42016 allows that low-privilege token to be exchanged for one with administrator scope.
In some cases attackers went from the first request to a new administrator account in under five minutes.
A third flaw, CVE-2026-82329, was exploited separately between September 1 and September 8 and is rated 9.8 on the CVSS scale.

Attack Chain

Every observed case followed a similar pattern. The attacker sent an unauthenticated request to a token endpoint and received a token for the internal anonymous user. That token was then exchanged at Artifactory's token-creation endpoint for one with administrator scope. The second token retains the anonymous username, so administrator actions appear in logs as token:anonymous rather than under a named account. In some cases the attacker moved from the first request to a new administrator account in under five minutes.

Post-Exploitation Activity

Across compromised servers, attackers created administrator accounts and left them in place. They installed malicious Groovy plugins via Artifactory's plugin framework, gaining code execution on the server. Some attackers ran shell commands through the plugin execution endpoint to explore and list files. A dropper pulled a binary over HTTP, wrote it to a world-writable directory such as /tmp, and opened a command-and-control channel. Wiz also observed a custom Rust backdoor with command-and-control features dropped in multiple cases.

Third Vulnerability

CVE-2026-82329 was exploited separately between September 1 and September 8. It is a critical authentication bypass rated 9.8 on the CVSS scale. The flaw targets Artifactory's default configuration and requires no additional vulnerability. An unauthenticated attacker with network access can obtain administrator privileges through it alone on six release branches up to 7.161.