🚨 JFROG ARTIFACTORY UNDER ACTIVE ATTACK — AUTH BYPASS LEADS TO ADMIN CONTROL AND BACKDOORS Wiz Research has confirmed active in-the-wild exploitation of THREE vulnerabilities affecting self-hosted JFrog Artifactory environments: * CVE-2026-82329 — Critical authentication bypass, CVSS 9.8 * CVE-2026-42018 — Anonymous-user token exposure * CVE-2026-42016 — Token scope validation / privilege escalation Attackers are using two different paths to obtain ADMINISTRATIVE CONTROL of vulnerable Artifactory servers. ATTACK PATH #1: CVE-2026-42018 → Obtain internal anonymous-user JWT → CVE-2026-42016 → Exchange it for an admin-scoped token → Create persistent administrator account Wiz observed attackers moving from the initial unauthenticated request to a newly created administrator account in UNDER FIVE MINUTES in some cases. ATTACK PATH #2: CVE-2026-82329 Under Artifactory's default configuration, an unauthenticated attacker can directly obtain administrative privileges. Wiz observed successful exploitation between September 1–8. 🚨 POST-EXPLOITATION ACTIVITY Once administrative access was obtained, attackers were observed: * Creating persistent admin accounts * Minting long-lived credentials * Stealing Artifactory configuration * Enumerating repositories, users and tokens * Extracting cluster join keys * Adding attacker-controlled SSH keys * Deploying malicious Groovy plugins * Executing arbitrary commands * Uploading web shells * Deploying custom Rust-based backdoors * Establishing external C2 communications This is particularly serious because Artifactory often sits directly inside the SOFTWARE SUPPLY CHAIN. A compromised Artifactory administrator potentially controls the repository infrastructure trusted by developers and CI/CD systems. ⚠️ EXPOSURE REMAINS HIGH According to Wiz telemetry, approximately 67% of organizations running Artifactory had at least one instance vulnerable to CVE-2026-82329 when it was disclosed. Two weeks later, approximately 49% remained vulnerable. ⚠️ Analyst Note: This isn't simply another vulnerable internet-facing application. Artifactory is part of the trust infrastructure behind software development. Internet → Artifactory auth bypass → Administrator access → Repository control → Build artifacts → CI/CD integrations → Potential software supply-chain compromise That makes administrative compromise particularly dangerous. JFrog has released patched versions. Organizations operating SELF-HOSTED Artifactory should upgrade immediately and investigate historical logs for exploitation rather than assuming patching alone resolves a previous compromise. JFrog Cloud environments were already remediated by JFrog and require no customer action for CVE-2026-82329. Original research — Wiz: https://www.wiz.io/blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-42018-cve-2026-82329 Official JFrog advisories: https://docs.jfrog.com/releases/docs/jfrog-security-advisories #DDW #JFrog #Artifactory #SupplyChain #CyberSecurity
Post summary
The post reports active exploitation of three CVEs in self-hosted JFrog Artifactory, detailing attack paths to admin control, ongoing post‑exploitation actions, and urges immediate patching and investigation.
