Artifactory Vulnerability Chain: Attackers Exploited Three Flaws to Gain Admin Access and Deploy Backdoors

Researchers have documented a wave of attacks against JFrog Artifactory deployments that chained multiple authentication weaknesses to grant attackers full administrator control, then used that access to plant backdoors, execute code, and establish persistent footholds inside build pipelines.

The campaign targeted three distinct vulnerabilities. The first, CVE-2026-42018, allowed any remote requester—even on systems where administrators had explicitly disabled anonymous access—to obtain a valid JSON Web Token scoped to Artifactory’s internal anonymous user. A second flaw, CVE-2026-42016 (rated 8.1 under CVSS and classified as CWE-863, an improper-authorization weakness), meant that once an attacker held any valid token, the platform validated the token’s signature and issuer but failed to properly enforce the scope for which it had been issued. That gap allowed the attacker to exchange the low-privilege anonymous token for one carrying full administrator rights.

A third and independently discovered flaw, CVE-2026-82329, carried the highest severity: a CVSS 9.8 authentication bypass that let unauthenticated attackers with network access obtain administrative privileges outright under Artifactory’s default configuration, without chaining a second vulnerability. CISA added this flaw to its Known Exploited Vulnerabilities catalog, setting a remediation deadline for federal agencies.

Attack Pattern Reconstruction

Researchers reconstructed the chained attack pattern from telemetry across multiple victim environments. An attacker first sent an unauthenticated HTTP POST to Artifactory’s token endpoint, which returned an anonymous-scoped JWT regardless of whether anonymous access had been disabled. Presenting that token to a second endpoint—which failed to enforce proper scope boundaries—yielded a new token with administrator privileges. From there, attackers typically created persistent administrator accounts within minutes, ensuring access would survive rotation of the original exploited token.

The logging weakness compounded the problem. Because Artifactory recorded every privileged action performed with a token derived from the anonymous identity under the generic label “token:anonymous,” defenders reviewing audit logs after an incident could not distinguish legitimate anonymous traffic from attacker activity.

Post-Exploitation Activity

Observed post-exploitation activity included installing malicious Groovy plugins—an Artifactory native extensibility mechanism, which runs with the same privileges as the platform itself—deploying custom-written Rust-based backdoors, executing arbitrary shell commands through plugin endpoints, and extracting cluster join keys that could allow attackers to expand access across federated Artifactory deployments. Attackers created administrator accounts using two distinct approaches: some used conspicuous names suggesting opportunistic actors, while others used patterns designed to blend with legitimate automation, such as names mimicking built-in service accounts.

Attacker Infrastructure

Wiz Research identified specific source infrastructure tied to the campaign, including IP addresses 93.104.155.133 and 149.102.229.150 among more than fifteen distinct addresses, a payload-hosting endpoint at log.gitclone.org, and command-and-control infrastructure reachable at 64.207.232.6 over port 8443. WatchTowr‘s honeypot network recorded exploitation attempts against CVE-2026-82329 within days of disclosure, observing attackers minting administrator tokens and enumerating users, groups, credentials, and federated access configurations. Fastly separately recorded approximately 406,000 exploitation attempts against the flaw on a single day in early September.

Patching Delays

Patching lagged significantly behind disclosure. Wiz Research found that six weeks after CVE-2026-42016‘s disclosure, 59 percent of scanned instances remained vulnerable. CVE-2026-42018‘s exposure had only declined from 69 to 62 percent over the same four-week post-patch window.

JFrog released patches for the flaws in builds from 7.133.11 onward for CVE-2026-42016 and in version-specific fixes for CVE-2026-42018. Fixes for CVE-2026-82329 covered six affected release branches.

Strategic Risk Assessment

WatchTowr’s principal threat intelligence specialist described the strategic risk: an attacker with administrative control of a central artifact repository can tamper with build pipelines directly, move laterally into production environments that trust artifacts pulled from that repository, and potentially distribute compromised software to every downstream customer or internal system that consumes it.

This incident reflects a broader pattern in which developer tooling and CI/CD infrastructure has become a preferred entry point for supply chain compromise. A single successful intrusion at this layer can propagate outward to every organization and system that trusts the compromised tool’s output.

JFrog’s CTO clarified that the flaws involve improper authentication rather than remote code execution in the platform itself, and that only self-hosted deployments—not the SaaS offering—are affected. The full scope of organizations whose build artifacts were tampered with during the exploitation window has not been publicly disclosed.

Remediation Steps

Organizations running self-hosted Artifactory should verify their deployed version against the patched builds and upgrade immediately if running any version prior to 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, or 7.161.20, with priority given to internet-facing instances.

Security teams should audit administrator account lists for unfamiliar entries, paying particular attention to service-account-style names not provisioned through normal change management. Any newly created administrator account discovered during this review should be treated as a confirmed compromise requiring full incident response, not simple deletion.

Given the logging gap that obscures attacker actions behind the “token:anonymous” label, defenders should correlate Artifactory access logs against network-level indicators—including the specific IP addresses and infrastructure published by Wiz—since the application’s own audit trail cannot be trusted in isolation to reveal the full scope of unauthorized activity.

Beyond patching, teams should audit all installed Groovy plugins, rotating credentials and tokens associated with any Artifactory instance reachable from the internet during the exploitation window. Restricting network access to Artifactory’s management and token-issuance endpoints to trusted internal networks rather than the open internet would have blocked the unauthenticated first step of both attack chains regardless of the underlying code flaw.

Long-Term Security Posture

Longer-term, organizations should apply the same security scrutiny to repository managers and artifact stores that they reserve for production systems. Least-privilege design should extend to CI/CD tooling itself: build and scanning jobs should hold only the credentials required for their specific task. Cryptographic provenance mechanisms such as Sigstore or SLSA attestations can help downstream consumers detect tampering even when an upstream repository has been compromised.

Security and platform engineering teams should build monitoring specifically tuned to detect anomalous administrative actions in build infrastructure—unexpected plugin installations, out-of-band account creation, and privilege escalation patterns—rather than relying exclusively on vendor patch cadence to close this class of exposure.