Cybersecurity researchers are sounding the alarm over in-the-wild exploitation of multiple vulnerabilities in **JFrog Artifactory**, a popular universal repository manager. Attackers are leveraging these flaws to gain unauthorized access and establish persistent backdoors. ### The Exploit Chain Uncovered A recent report from cloud security company **Wiz** details an exploit chain combining **CVE-2026-42018** and **CVE-2026-42016**. These vulnerabilities allow threat actors to bypass authentication and achieve administrative control. Separately, **watchTowr**, an offensive security company, observed active exploitation of **CVE-2026-82329**, a critical authentication bypass that enables the minting of administrator tokens. ### How Attackers Gain Control According to **Wiz**, the attack typically begins with exploiting **CVE-2026-42018** to obtain a JSON Web Token (JWT) associated with an internal **Artifactory** anonymous user. This occurs even when anonymous access is supposedly disabled, granting low-level privileges. Subsequently, attackers escalate their permissions to administrator level by exploiting **CVE-2026-42016**. This vulnerability stems from insufficient token validation within **Artifactory**. Between August 15 and September 8, multiple threat actors were observed chaining these two vulnerabilities. In some instances, researchers noted that attackers took less than five minutes to create a full administrator account. ### Backdoor Deployment and Persistence Once administrative accounts are created and long-lived access tokens generated, the attackers proceed to install malicious Groovy plugins. These plugins are used to execute arbitrary commands and establish persistence by deploying a custom Rust-based backdoor. "Across multiple cases, we observed a custom Rust backdoor with C2 capabilities being dropped," states **Wiz** in their report. Further malicious activities included downloading additional payloads to temporary directories (`/dev/shm`, `/tmp`, and `/var/tmp`), uploading webshells, stealing **Artifactory** configuration data and cluster join keys, enumerating repositories, tokens, and users, and adding SSH keys to newly created accounts. ### Widespread Vulnerability and Mitigation **Wiz** warns that a significant portion of internet-reachable **Artifactory** instances are vulnerable, estimating between 49% and 62% are susceptible to at least one of the three identified flaws. System administrators are strongly advised to upgrade their **Artifactory** instances immediately to one of the following release versions or later: * 7.111.21 * 7.117.28 * 7.125.20 * 7.133.29 * 7.146.38 * 7.161.20 Following the upgrade, it is crucial to investigate internet-exposed instances for any signs of compromise. This includes checking for unexpected token creation, rogue administrator accounts, suspicious plugin activity, and unusual enumeration requests. Furthermore, access to **Artifactory** instances should be restricted to trusted systems only. **Wiz** has also provided a list of Indicators of Compromise (IoCs) to assist defenders in quickly detecting and responding to these attacks.