Attackers are actively breaking into self-hosted JFrog Artifactory servers and installing persistent backdoor malware. Wiz says multiple threat actors chained CVE-2026-42018 and CVE-2026-42016 between August 15 and September 8, 2026 to obtain an internal anonymous-user JSON Web Token and turn it into an administrator token; the broader risk also includes CVE-2026-82329, another critical auth bypass previously seen abused to mint admin tokens. Post-compromise activity included rogue admin account creation, malicious Groovy plugins, webshells, theft of configuration data and cluster join keys, and added SSH keys.
Why it matters: Organizations running self-hosted Artifactory are at immediate risk of server takeover and long-term persistence, especially if instances are internet-exposed. Admins should patch to the fixed 7.x releases immediately, review for rogue tokens and accounts, and hunt for plugin, webshell, and backdoor activity.
Ionut Arghire
2026.09.14
97% relevant
This source updates the same underlying Artifactory exploitation campaign by adding that a third flaw, CVE-2026-82329, is also being exploited; it details observed attacker actions including persistent admin creation, malicious plugins for code execution, shell command execution, SSH key addition, cluster key exfiltration, token minting, and notes CISA KEV additions for all three CVEs.
info@thehackernews.com (The Hacker News)
2026.09.12
90% relevant
This source likely updates the same JFrog Artifactory exploitation story by noting that one or both of the actively abused Artifactory flaws were added to CISA's KEV catalog, confirming official recognition of ongoing exploitation.
2026.09.11
96% relevant
This article directly updates that same Artifactory exploitation campaign by adding confirmation from Wiz that all three flaws are being exploited in the wild, including the newer authentication-bypass flaw CVE-2026-82329, and by detailing patch timing, exploitation windows, and observed post-exploitation actions such as admin-account creation, plugin-based remote code execution, shell commands, web shells, and backdoors.
Bill Toulas
2026.09.11
100% relevant
This article establishes a distinct tracked event by tying specific JFrog Artifactory CVEs to observed in-the-wild exploitation, a defined exploit chain, and post-exploitation malware deployment on self-hosted servers.
← Back to all stories