Multiple attackers are actively exploiting three recently patched vulnerabilities in JFrog Artifactory, gaining administrative control over vulnerable instances and subsequently installing malicious plugins and backdoors. The affected party, JFrog, has not publicly commented on these attacks, but security researchers have confirmed in-the-wild exploitation across various environments.
The three vulnerabilities are CVE-2026-42018, CVE-2026-42016, and CVE-2026-82329. All three were patched by JFrog in July and August, with exploitation observed shortly after the fixes were released.
CVE-2026-42018 is a high-severity improper authentication flaw. It can return an internal anonymous-user token to an unauthenticated caller even when anonymous access is disabled. An attacker can then use this token to authenticate to the repository manager and access sensitive resources. JFrog released a patch for this on August 12.
CVE-2026-42016 is a high-severity privilege-escalation bug. Artifactory fails to properly validate a token's scope, allowing an attacker with low-privileged access to elevate their privileges and perform unauthorized actions. JFrog fixed this vulnerability on July 27.
CVE-2026-82329 is a critical authentication-bypass vulnerability. It allows unauthenticated attackers with network access to obtain administrative privileges. JFrog published a patch for this on August 28. Researchers noted that exploitation of this critical flaw began just four days after its disclosure.
Security researchers observed attackers chaining CVE-2026-42018 and CVE-2026-42016 against self-hosted Artifactory instances between August 15 and September 8 to gain administrative access. Many of these intruders then deployed a custom Rust backdoor to establish command-and-control capabilities.
Post-exploitation activities varied, but researchers documented attackers establishing persistent administrative accounts, installing Groovy plugins to achieve remote code execution on the server, executing shell commands through plugins for reconnaissance and sensitive file scanning, delivering second-stage payloads, and uploading web shells.
Between September 1 and September 8, several attackers were observed exploiting CVE-2026-82329. These intrusions were not a unified attack by a single threat actor. Observed behaviors included exfiltrating configuration details, establishing persistent administrative accounts, minting tokens for long-lived credentials, stealing keys, attaching SSH keys to created users, and enumerating users, repositories, and tokens.
Despite the availability of patches, the rate of remediation has been slow. Six weeks after the disclosure of CVE-2026-42016, 59 percent of organizations remained vulnerable. Four weeks after the patch for CVE-2026-42018, 62 percent of organizations were still vulnerable. While organizations have been quicker to address the critical CVE-2026-82329, 49 percent remained vulnerable two weeks after its publication.
Organizations are strongly advised to upgrade to a fixed Artifactory version immediately. Given that remote, unauthenticated exploitation may be possible under default configurations, prioritizing internet-accessible Artifactory instances and restricting network access to trusted users and systems is crucial. Organizations should also review Artifactory authentication and administrative activity for any unexpected privileged access.
