Attackers are exploiting critical and high-severity vulnerabilities in the JFrog Artifactory platform to bypass authentication, elevate their privileges to the administrator level, and install malware that gives them the ability to execute commands and maintain a presence inside self-hosted servers. Wiz, a cloud security company, confirmed observing the exploitation in multiple environments, including an attack chain that combines CVE-2026-42018 and CVE-2026-42016.
watchTowr, an offensive security company, also observed the exploitation of CVE-2026-82329, a critical authentication-bypass vulnerability, earlier in September 2026 to issue access tokens with administrative privileges.
How Does the Exploitation Chain Work?
According to Wiz, the attacker begins by exploiting CVE-2026-42018 to obtain a JSON Web Token, or JWT, belonging to an anonymous internal user in Artifactory, even when anonymous access is disabled. The initial token has low privileges, but the attacker exploits CVE-2026-42016, which results from insufficient token validation, to convert it into a token with administrative privileges.
Between August 15 and September 8, 2026, several attackers used this chain against self-hosted Artifactory instances. In some cases, the attacker needed less than five minutes to create an administrative account before generating long-lived access tokens.
From Administrative Access to Persistence
After taking control of the accounts, the attackers installed malicious Groovy plugins that enabled arbitrary command execution, then deployed a custom Rust-written backdoor that supports communication with a command-and-control server. Wiz also observed additional payloads being downloaded to the /dev/shm, /tmp, and /var/tmp paths, webshells being uploaded, and Artifactory configuration data and cluster join keys being stolen.
The observed activities also included enumerating repositories, tokens, and users, and adding SSH keys to accounts created by the attackers. This means that compromising the server may not be limited to temporary command execution, but could provide multiple ways to regain access and steal software infrastructure data.
What Should Administrators Do?
Wiz recommends upgrading immediately to one of the following Artifactory versions or a later version:
- 7.111.21
- 7.117.28
- 7.125.20
- 7.133.29
- 7.146.38
- 7.161.20
After upgrading, exposed instances should be examined for unexpected token creation, unauthorized administrative accounts, suspicious plugin activity, and unusual enumeration requests. The company also recommends restricting access to trusted systems and using the indicators of compromise published by Wiz.
Why Does This News Matter?
The significance of the development lies in the combination of three stages within a single path: authentication bypass, privilege escalation, and malware persistence. According to Wiz, between 49% and 62% of accessible Artifactory instances are exposed to at least one of the three vulnerabilities. JFrog had not responded to BleepingComputer’s inquiry about the observed activity by the time of publication, so the overall scope of the exploitation and the manufacturer’s assessment remain unconfirmed in the available material.