JFrog Artifactory Flaws Enable Rapid Admin Takeover

Cybersecurity firm Wiz has documented a series of attacks where hackers chained two distinct flaws in JFrog Artifactory to gain full administrative control. Artifactory is the central repository from which software build pipelines pull their components, making it a high-value target for attackers seeking to disrupt or compromise software supply chains. The attacks, observed between mid-August and early September, allowed intruders to plant backdoors and execute arbitrary code on affected servers.

The exploitation relied on a specific sequence: first obtaining an internal anonymous user token without logging in, and then swapping that low-privilege token for one with administrator scope. Because the second token retained the anonymous identifier, malicious actions appeared in logs as coming from a generic 'anonymous' user rather than a named account. In some instances, the entire process from initial request to administrator access took less than five minutes.

Flaw Chain Enables Privilege Escalation

Neither vulnerability alone grants administrator rights. The first flaw, CVE-2026-42018, forces the system to issue an internal token to unauthenticated callers, even when anonymous access is disabled. The second, CVE-2026-42016, allows this token to be exchanged for a higher-privilege one because the system verifies the token's signature but not its intended permissions. This gap in validation creates a pathway for attackers to escalate their access levels.

Once administrators, attackers created new privileged accounts and installed malicious Groovy plugins to maintain control. Some deployed custom backdoors written in Rust, establishing command-and-control channels that allowed them to read system configurations and steal cluster join keys. These keys are shared secrets used by server nodes to communicate, meaning their compromise could allow attackers to impersonate legitimate parts of the infrastructure.

Third Flaw Widens Attack Surface

A separate critical vulnerability, CVE-2026-82329, presents a broader threat. Rated 9.8 on the CVSS scale, this flaw allows an unauthenticated attacker to gain administrator privileges directly, without needing to chain multiple bugs. It affects several release branches up to version 7.161 and targets the default configuration. The Hacker News reported that public exploits for this flaw appeared in early September, leading to a significant spike in scanning and exploitation attempts.

Fastly, a content delivery network, recorded approximately 406,000 exploitation attempts in a single day following the public disclosure of this third flaw. While these numbers reflect traffic rather than confirmed compromises, they indicate widespread scanning activity. Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its catalog of known exploited vulnerabilities, urging federal agencies to patch by September 5.

Patching Requirements and Trade-offs

JFrog has released fixes for all three vulnerabilities. Organizations running self-hosted instances must upgrade to the latest patched build for their specific release branch. The company states that its cloud-hosted services are not affected and require no action. However, the trade-off for self-hosted users is the need for timely updates; servers running older versions remain exposed to the chained attacks described by Wiz.

The complexity of the attack chain means that closing either of the first two flaws breaks the specific sequence used by Wiz’s observed attackers. Nevertheless, the existence of the standalone critical flaw means that comprehensive patching is essential. Relying on network isolation or access controls is insufficient if the software itself allows unauthenticated privilege escalation. Administrators should verify their patch levels against JFrog’s security advisories to ensure all affected components are secured.