Three JFrog Artifactory Flaws Exploited for Backdoor Deployment

1. Executive summary

Three authentication-related flaws in JFrog Artifactory — CVE-2026-42018, CVE-2026-42016 and CVE-2026-82329 — have been exploited in the wild, with attackers chaining the first two to obtain an anonymous-user token and escalate to administrator, and separately exploiting the third for unauthenticated administrative access. CVE-2026-82329 carries a source-reported CVSS of 9.8; no verified reference data was resolved for this item, so every score, severity and CISA-KEV state in this advisory is as reported by the sources and has not been independently re-assessed by Adverse Trace. Post-exploitation activity reported by Wiz includes persistent admin accounts, malicious plugins used for arbitrary code execution, shell execution via the plugin endpoint, second-stage payloads, token minting, cluster key exfiltration and SSH key persistence. Any EMEA financial services firm running self-hosted Artifactory is exposed, and fixed versions are available now. The bottom line: this is an actively exploited, KEV-listed authentication bypass against a system that typically holds build artifacts, credentials and cluster keys — patch or isolate today, then hunt.

2. Regulatory framing

Article	Trigger (the fact in this item)	Practical impact
DORA Art. 18 — classification of ICT-related incidents and cyber threats	Active in-the-wild exploitation of three Artifactory authentication flaws, with CISA KEV listing reported for all three, against a component that sits in the ICT estate of most firms running self-hosted Artifactory.	Any compromise of a client's own Artifactory instance must be classified as an ICT-related incident and assessed against major-incident criteria; the reported KEV listing is material evidence for that severity determination.
DORA Art. 19 — reporting of major ICT-related incidents to competent authorities	If a client's self-hosted Artifactory was compromised via these CVEs (admin token minting, backdoor plugin, persistent admin accounts, cluster key exfiltration), that is a major-incident candidate.	Reporting to the competent authority within DORA timelines, with evidence preserved from Artifactory audit logs before remediation destroys it.
NIS2 Art. 21(2)(d) — supply chain security measures	The exploited system is a self-hosted artifact repository in the software supply chain; administrative compromise gives control over stored artifacts, build integrations and cluster keys.	Supply-chain security measures: verify artifact integrity, restrict plugin deployment, and review exposure of this third-party component in your build pipeline.

3. Technical analysis & attack chain

Confirmed attack chain — Wave 1 (CVE-2026-42018 + CVE-2026-42016)

Initial access. CVE-2026-42018, an improper authentication bug patched on 2026-08-12, is exploited to obtain an anonymous-user token that grants access to sensitive artifacts and repository data.
Privilege escalation. CVE-2026-42016, an insufficient token validation issue patched on 2026-07-27, is chained with the token from step 1 to elevate the attacker to administrator.
Persistence. Attackers create persistent admin accounts on the compromised instance.
Execution. Attackers install malicious plugins to gain arbitrary code execution, then run shell commands through the plugin endpoint.
Payload delivery. Second-stage payloads are dropped onto the Artifactory host.
Sustained access. Attackers were observed occasionally updating their scripts to maintain continuous access, and in some instances attaching their own SSH keys to the user accounts they created.

Wiz reports observing multiple actors chain CVE-2026-42018 and CVE-2026-42016 against self-hosted Artifactory instances between 2026-08-15 and 2026-09-08.

Confirmed attack chain — Wave 2 (CVE-2026-82329)

Unauthenticated remote access. CVE-2026-82329 is an authentication bypass, patched on 2026-08-28, exploitable remotely without authentication to gain administrative privileges. Source-reported CVSS: 9.8.
Post-exploitation. Multiple threat actors began exploiting it in the first week of September 2026 for configuration exfiltration, persistent admin access, token minting, cluster key exfiltration and asset enumeration.

Exploitation status and remediation versions

CISA added CVE-2026-42018 and CVE-2026-42016 to its KEV catalog on the Friday preceding publication, one week after adding CVE-2026-82329. Under BOD 26-04, US federal agencies were given two weeks to patch. This is a US federal directive; the source states no equivalent mandated deadline for EMEA organisations.
Fixed versions: 7.161.20, 7.146.38, 7.133.29, 7.125.20, 7.117.28, 7.111.21 — apply the fixed build on your release line.

Caveats, single-sourcing and discrepancies

Single-sourced. The entire post-exploitation narrative — plugin abuse, shell execution via the plugin endpoint, second-stage payloads, token minting, cluster key exfiltration, SSH key attachment — rests on one research source (Wiz, reported by SecurityWeek). Treat as single-sourced; verify before enforcing detections or making attribution claims.
No named actor. The source refers only to "multiple actors" / "multiple threat actors". There is no named threat actor and no MITRE ATT&CK profile in the supplied material. Attribution is unconfirmed.
Broader advisories, different flaws. ANSSI (CERTFR-2026-AVI-1100) and BSI (WID-SEC-2026-3026) describe multiple Artifactory vulnerabilities including SSRF, security-policy bypass, data manipulation and denial of service. The source does not attribute SSRF or DoS to the three exploited CVEs. Do not conflate the national-advisory scope with the exploited set.
GHSA mapping is inferred. GHSA-x8pq-pxrh-26qh describes an "authentication handling weakness in internal request processing" that may allow privilege escalation beyond the intended access level. This is consistent with CVE-2026-42016 (insufficient token validation) but the GHSA does not name a CVE; the mapping is our inference, not a source statement.
No atomic artefacts. The source provides no hashes, filenames, file paths, plugin names, command lines, domains or IP addresses. Nothing in this advisory should be read as an IOC set.

4. Mitigation & containment

P1 — within 24 hours

Inventory and version-check every self-hosted Artifactory deployment, including non-production, air-gapped and forgotten instances. Upgrade to a fixed build on your release line: 7.161.20, 7.146.38, 7.133.29, 7.125.20, 7.117.28 or 7.111.21.
If you cannot patch immediately, remove internet exposure of the Artifactory UI/API and restrict access to trusted networks or VPN. CVE-2026-82329 is exploitable remotely without authentication, so exposure is the primary risk multiplier.
Hunt for the four post-exploitation behaviours (see §5): enumerate all accounts with administrative privileges against a known-good baseline; list installed plugins against the approved set; enumerate SSH keys attached to user accounts; review anonymous-user token issuance.
Rotate credentials and secrets: admin credentials, API keys and tokens, cluster keys, and any SSH keys associated with Artifactory user accounts. Revoke anonymous-user tokens.

P2 — within 72 hours

Review Artifactory audit and access logs back to at least 2026-08-15 for: anonymous token issuance, admin account creation, plugin upload/installation, plugin-endpoint command execution, configuration export, asset enumeration and cluster key access.
Check Artifactory hosts for second-stage payloads and unexpected outbound connections using EDR/host telemetry.
Disable or tightly restrict custom plugin deployment if it is not operationally required — plugin installation was the arbitrary-code-execution path in Wave 1.

P3 — within 7 days

Add all three CVEs to vulnerability management with KEV-driven priority and confirm Artifactory is covered by your external attack-surface monitoring.
Assess artifact integrity as a precaution. The source does not report artifact tampering, but administrative control of an artifact repository is a supply-chain risk; verify integrity of artifacts consumed by CI/CD where feasible.
Confirm Artifactory is in scope for incident detection, third-party risk monitoring and audit-log retention.

5. Indicators of compromise

No indicators of compromise available in the source material.

The sources describe observable behaviours but no atomic indicators (no hashes, domains, IPs, filenames or command lines). The following behavioural indicators are single-sourced (Wiz, via SecurityWeek) — verify against your own telemetry before enforcing.

Behavioural indicators

Behaviour	Where to observe	Confidence
Issuance or use of an anonymous-user token granting access to artifacts and repository data	Artifactory access/audit logs	Single-sourced
Creation of persistent administrative accounts	Artifactory user management / audit logs	Single-sourced
Installation of non-approved plugins	Artifactory plugin management / audit logs	Single-sourced
Shell command execution via the plugin endpoint	Artifactory logs plus host process telemetry	Single-sourced
Second-stage payload dropped on the Artifactory host	EDR / host telemetry	Single-sourced
SSH keys attached to attacker-created user accounts	Artifactory user configuration / audit logs	Single-sourced
Token minting	Artifactory audit logs	Single-sourced
Cluster key exfiltration	Artifactory audit logs / egress monitoring	Single-sourced
Configuration exfiltration and asset enumeration	Artifactory audit logs / egress monitoring	Single-sourced

6. Detection

Insufficient indicators to author detection rules.

The source material contains no file artefacts (no hashes, filenames, paths, registry keys, mutexes or command-line strings) from which a YARA rule could be built, and no log schema or field-level detail from which a Sigma rule could be written without inventing values. Hunting guidance instead: prioritise Artifactory audit-log review for the behaviours in §5 — anonymous token issuance, administrative account creation, plugin installation, plugin-endpoint command execution, configuration export, asset enumeration and cluster key access — and correlate with host telemetry for shell processes spawned by the Artifactory service and for unexpected outbound connections from Artifactory hosts. Baseline your legitimate admin-account and plugin inventory first; without that baseline these behaviours will generate heavy false positives.

7. Sources

SecurityWeek — Three JFrog Artifactory Flaws Exploited for Backdoor Deployment — https://www.securityweek.com/three-jfrog-artifactory-flaws-exploited-for-backdoor-deployment/ — 2026-09-14
SecurityWeek — Critical JFrog Artifactory Vulnerability Reportedly Exploited in the Wild — https://www.securityweek.com/critical-jfrog-artifactory-vulnerability-reportedly-exploited-in-the-wild/ — date not supplied in feed
The Hacker News — Attackers Exploit Critical JFrog Artifactory Flaw to Mint Admin Tokens Days After Disclosure — https://thehackernews.com/2026/09/attackers-exploit-critical-jfrog.html — date not supplied in feed
Dark Reading — Attackers Pounce on Critical Artifactory Flaw Following Disclosure — https://www.darkreading.com/application-security/attackers-pounce-critical-artifactory-flaw-disclosure — date not supplied in feed
GitHub Security Advisories — GHSA-x8pq-pxrh-26qh — https://github.com/advisories/GHSA-x8pq-pxrh-26qh — date not supplied in feed
ANSSI / CERT-FR — Multiples vulnérabilités dans JFrog Artifactory (CERTFR-2026-AVI-1100) — https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1100/ — 2026-09-01
BSI — JFrog Artifactory: Mehrere Schwachstellen (WID-SEC-2026-3026) — https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-3026 — date not supplied in feed

8. Adverse Trace position

We assess this as a high-urgency, actively exploited vulnerability set against a system that sits on the credential and build-artifact critical path for most EMEA financial services firms running self-hosted Artifactory. The severity picture is source-derived only: no verified reference data was resolved for this item, so the CVSS 9.8 for CVE-2026-82329 and the CISA KEV listings for all three CVEs are reported as stated by the sources and are not independently re-assessed by Adverse Trace — clients should confirm KEV status and scores against their own authoritative feeds before finalising risk acceptance. The post-exploitation narrative is single-sourced to Wiz and the attribution is unconfirmed — the source names no actor and we have no MITRE profile to map. Client impact is concentrated in two places: unpatched internet-exposed instances (immediate compromise risk via CVE-2026-82329) and any instance compromised since mid-August (admin accounts, plugins, SSH keys and cluster keys that survive a patch). Next, we will track vendor and national-CERT updates for the fixed-version matrix, monitor for the emergence of atomic indicators from incident responders, and re-issue this advisory if a named actor or corroborating telemetry emerges.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.