In a recent report by cloud security firm Wiz, it was revealed that attackers exploited two vulnerabilities in JFrog Artifactory, a popular repository used in software build pipelines, to gain administrator access to self-hosted servers and install backdoors. These exploits occurred between mid-August and early September.
Vulnerability Details and Exploitation
The flaws in question, identified as CVE-2026-42018 and CVE-2026-42016, were independently patched by JFrog before these attacks. However, only servers that had not implemented these updates were at risk. While neither vulnerability alone allowed admin access, their combination enabled attackers to compromise systems.
CVE-2026-42018 involved Artifactory issuing an anonymous user token without proper login, even when anonymous access was disabled. CVE-2026-42016 allowed this token to be upgraded to admin privileges, bypassing checks on token permissions. Attackers typically sent an unauthorized token request that was then exchanged for an admin-level token.
Attack Patterns and Consequences
Once inside, attackers swiftly created admin accounts and installed malicious plugins, giving them the ability to execute code on affected servers. Some even ran shell commands to investigate server files, while others installed a custom Rust backdoor for command-and-control operations. These activities were often completed in under five minutes from the initial attack.
The vulnerabilities affected a limited range of builds, and closing either flaw would prevent the exploit chain. JFrog’s patches were released in late April and August for different build branches, effectively mitigating these security issues.
Preventive Measures and Future Outlook
To protect against these vulnerabilities, JFrog recommends upgrading Artifactory to the latest fixed versions as outlined in their security advisories. For CVE-2026-82329, which allows unauthenticated admin access, a workaround involves modifying system configurations to restrict key registrations.
Despite these patches, attackers’ admin accounts persist unless manually removed, and compromised servers should be considered at risk. Security experts advise rotating platform keys and revoking recent access tokens to mitigate further damage.
In summary, vigilance and timely updates are crucial to preventing similar exploits. Organizations using JFrog Artifactory should regularly review their security practices to protect against evolving cyber threats.
