Full Report
Attackers have chained two flaws in JFrog Artifactory, the repository that software build pipelines pull from, to take administrator control of self-hosted servers and plant backdoors, cloud security company Wiz said in a report. Wiz saw the attacks between August 15 and September 8. JFrog had fixed both flaws before then, so only servers that had not been updated were open to them.
Analysis Summary
# Main Topic
**Chain exploitation of two JFrog Artifactory CVEs (CVE‑2026‑42018 & CVE‑2026‑42016) to gain full administrator control and plant backdoors on self‑hosted Artifactory servers.**
The attacks were observed between **August 15 – September 8 2026** by cloud‑security firm Wiz. Only servers that had not applied JFrog’s patches were vulnerable.
## Key Points
- **Dual‑flaw chain**:
- *CVE‑2026‑42018* – returns an internal anonymous‑user token to unauthenticated callers, even when anonymous access is disabled.
- *CVE‑2026‑42016* – allows that low‑privilege token to be exchanged for an administrator‑scope token because Artifactory does not validate the token’s scope.
- The chain requires both flaws to be present; closing either flaw breaks the attack.
- **CVE‑2026‑82329** (authentication bypass, CVSS 9.8) was also exploited separately from September 1‑8, giving direct admin rights on newer branches.
- Attackers performed **multiple stages**:
1. Unauthenticated token request → anonymous token.
2. Token exchange → admin‑scope token (username remains “anonymous”).
3. Creation of new admin accounts.
4. Deployment of malicious Groovy plugins (code execution).
5. Execution of shell commands via plugin endpoint to enumerate the file system.
6. Download of a binary dropper over HTTP, written to a world‑writable directory (e.g., `/tmp`).
7. Establishment of a command‑and‑control channel; in several cases a custom Rust backdoor was dropped.
- No single actor performed all steps; multiple actors were involved across different compromised servers.
- The attacks were **unnoticed until discovered by Wiz’s monitoring**; they were not publicly disclosed until after JFrog had released fixes.
## Threat Actors
- **Attribution**: Not definitively attributed; multiple actors observed across incidents.
- **Motivation**: Likely financial gain or espionage (backdoor installation for persistence).
- **Known TTPs**: Use of chained vulnerabilities, creation of stealth admin accounts, exploitation of plugin frameworks, dropping of custom backdoors.
## TTPs
| Technique | MITRE ATT&CK ID | Description |
|-----------|-----------------|-------------|
| **Valid Accounts** | T1078 | Creation of new admin accounts with “anonymous” credentials. |
| **Exploitation for Privilege Escalation** | T1068 | Chain of CVE‑2026‑42018 → CVE‑2026‑42016 to elevate privileges. |
| **Execution via Remote Services** | T1028 | Running shell commands through Groovy plugin endpoints. |
| **Exfiltration Over Command‑and‑Control** | T1041 | Rust backdoor used for C2. |
| **Persistence via Implant** | T1053 | Dropping binaries into world‑writable directories. |
| **Defense Evasion** | T1070 | Using “anonymous” token to mask admin actions. |
## Affected Systems
- **JFrog Artifactory** self‑hosted installations on branches **< 7.111.20, < 7.117.27, < 7.125.19, < 7.133.28, < 7.146.8** (CVE‑2026‑42018) and **< 7.1** (CVE‑2026‑42016).
- **Branches up to 7.161** vulnerable to CVE‑2026‑82329 (authentication bypass).
- **All affected servers** had **anonymous access disabled** (yet still exploitable due to flaw).
- **Cloud‑hosted Artifactory** instances are not impacted (no action required).
## Mitigations
1. **Patch immediately** – upgrade to the fixed builds listed in JFrog’s security advisories:
- CVE‑2026‑42018: 7.111.20, 7.117.27, 7.125.19, 7.133.28, 7.146.8
- CVE‑2026‑42016: 7.1 and above (latest release).
- CVE‑2026‑82329: 7.161 and earlier (apply latest patch).
2. **Disable anonymous access** in Artifactory configuration.
3. **Audit admin accounts** – look for accounts with “anonymous” username or recent creation dates.
4. **Inspect plugin directories** for unknown Groovy plugins; remove or quarantine suspicious files.
5. **Monitor file system** for new binaries in world‑writable directories (`/tmp`, `/var/tmp`, etc.).
6. **Check network traffic** for outbound connections to unknown C2 endpoints; block if detected.
7. **Enable logging** of all token exchanges and admin actions; alert on `token:anonymous` admin activity.
8. **Apply network segmentation** to limit Artifactory exposure to trusted hosts only.
9. **Run vulnerability scans** regularly to detect unpatched CVEs.
## Conclusion
The exploitation of JFrog Artifactory’s chained CVEs demonstrates the danger of unpatched self‑hosted DevOps tools. Attackers leveraged a two‑step privilege escalation to create hidden administrator accounts, deploy malicious plugins, and install persistent backdoors. Prompt patching, disabling anonymous access, and vigilant monitoring of admin actions and plugin changes are essential to mitigate this threat. Organizations using self‑hosted Artifactory must verify their version, apply the latest security fixes, and enforce strict access controls to prevent similar attacks in the future.
**Defanged IoCs**
- `hxxps://www.wiz.io/blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201`
- `hxxps://thehackernews.com/2026/09/attackers-chain-jfrog-artifactory-flaws.html`
- `hxxps://thehackernews.com/2026/09/attackers-exploit-critical-jfrog.html`
- `hxxps://www.fastly.com/blog/cve-2026-82329-jfrog-artifactory-authentication-bypass-exploitation-activity`