Hackers Chained Three Already-Patched JFrog Artifactory Flaws, Planted Rust Backdoors for 24 Days

What Happened

Multiple hacking groups broke into self-hosted JFrog Artifactory build servers over a 24-day window, chaining two authentication bugs to get administrator access, then planting Rust-based backdoors with remote command-and-control capability. Cloud security firm Wiz disclosed the campaign on September 10, according to reports from The Hacker News, Bleeping Computer, Tech Times, and Dev.to. Wiz says the activity ran from August 15 through September 8, 2026.

Artifactory is not some obscure corner of a company's tech stack. It's the repository that build pipelines pull code and dependencies from before software ships. Tech Times reports roughly 6,600 organizations worldwide run JFrog products, including 83% of the Fortune 100. Whoever controls that server controls what every downstream build consumes.

The Chain, and Why It Worked

The attack combined two flaws that are individually limited but lethal together. CVE-2026-42018 (CVSS 7.5) tricks Artifactory into handing an internal anonymous-user token to an unauthenticated caller, even when anonymous access has been explicitly turned off. That token alone is nearly worthless. CVE-2026-42016 (CVSS 8.1) is the escalation: Artifactory checks a token's cryptographic signature and issuer but never verifies whether its scope claim matches what the bearer is actually allowed to do. Feed the low-privilege anonymous token back into the token-creation endpoint, and it comes out the other side with full administrator scope.

Wiz says every case it examined followed that exact sequence, and in some instances attackers went from an unauthenticated network request to a brand-new admin account in under five minutes. Dev.to's writeup flags a detail worth noting: the resulting admin token still carries the "anonymous" username, so every privileged action shows up in logs as token:anonymous rather than under a named account. A defender hunting for a rogue admin username finds nothing.

Once inside, per Bleeping Computer and The Register, attackers created persistent administrator accounts, installed malicious Groovy plugins for arbitrary code execution, ran shell commands through the plugin endpoint, dropped webshells, and pulled binaries into world-writable directories like /tmp, /dev/shm, and /var/tmp. Multiple cases involved a custom Rust backdoor with command-and-control features. Wiz noted no single actor performed every step it observed, meaning more than one crew was working the same exposure independently.

A Third Flaw Made It Worse

A separate, more severe bug, CVE-2026-82329, rated 9.8 out of 10 on the CVSS scale, needs no chain at all. It's a straight authentication bypass in Artifactory's default configuration that hands an unauthenticated attacker with network access full administrator privileges on its own, across six release branches up to 7.161. JFrog patched it August 28. Yordan Ganchev, principal threat intelligence specialist at watchTowr, told The Register his firm's honeypot network caught attackers exploiting it within days of disclosure, enumerating "users, groups, credential sets and federated access topologies."

Content delivery network Fastly counted roughly 406,000 exploitation attempts against that flaw across its platform, with September 2 as its busiest day, according to Dev.to. Those are attempts observed in traffic, not confirmed breaches. CISA added the CVE to its Known Exploited Vulnerabilities catalog on September 2 and gave federal agencies until September 5 to patch. Whether every federal agency actually hit that deadline is not addressed in any of the available reporting, and no source has confirmed a specific federal breach tied to this CVE.

The Patching Numbers

Startup Fortune reports that 67% of organizations running Artifactory had at least one vulnerable instance when CVE-2026-42016 was disclosed on July 27. That number barely moved. The Register reports that six weeks after that disclosure, 59% of organizations remained vulnerable to it. Four weeks after CVE-2026-42018's disclosure, 62% were still exposed. Even the critical 9.8-severity bug, CVE-2026-82329, still had 49% of instances vulnerable two weeks after JFrog shipped a fix.

JFrog issued patches before any of this exploitation began. CVE-2026-42018 was fixed on the 7.146 branch back on April 28 and on the 7.133 branch on August 12, three days before Wiz observed the first chained attack. The vulnerability existed and the fix existed. Organizations simply didn't apply it.

Why This Matters Beyond One Vendor

John Watters, CEO and chairman of iCounter, told SCWorld that Artifactory "sits upstream of the software supply chain: it's not where data lives, it's where trust gets manufactured." An attacker who mints admin tokens on an unpatched instance can touch every build, package, and container image a company ships to its own customers.

Noelle Murata, chief operating officer at Xcape, told SCWorld that defenders need to decouple artifact trust from repository security entirely, through cryptographic signing and build provenance, so a compromised repository can't silently poison what gets deployed downstream. Collin Hogue-Spears, senior director at Black Duck, called it a zero-trust failure at its core and said organizations that ran a vulnerable build need to revoke and reissue every administrator token on every affected self-hosted instance, not just patch and move on.

Bleeping Computer and The Register both say JFrog has not responded to their requests for comment on the exploitation reports. With fixes available for weeks and roughly half of exposed organizations still unpatched as of Wiz's report, the question remains whether compromised instances are still quietly running attacker-controlled admin accounts.