JFrog Artifactory Vulnerabilities Exploited to Deploy Persistent Backdoors

Threat actors are actively exploiting three high-severity vulnerabilities in JFrog Artifactory to bypass authentication, escalate privileges, and deploy persistent backdoors within software environments.

Security researchers at Wiz reported that attackers have been using these flaws to compromise deployments and maintain long-term access. By gaining administrative control, threat actors have been observed installing malicious plugins to achieve arbitrary code execution, running shell commands, and deploying second-stage payloads.

Chained Vulnerabilities and Privilege Escalation

The exploitation involves a sophisticated chaining of multiple flaws. Since mid-August 2026, attackers have been observed combining CVE-2026-42018 and CVE-2026-42016 to target self-hosted Artifactory instances. The first vulnerability, an improper authentication bug, allows an attacker to obtain an anonymous-user token that provides access to sensitive repository data and artifacts. The second, an insufficient token validation issue, enables the attacker to leverage that token to escalate their privileges to administrator status.

A third flaw, CVE-2026-82329, provides a direct authentication bypass that was heavily exploited during the first week of September. This vulnerability allows remote attackers to gain administrative privileges without any prior authentication. Once access is established, researchers noted that attackers have been attaching their own SSH keys to newly created user accounts to ensure continued persistence.

CISA Adds Flaws to Known Exploited Vulnerabilities Catalogue

The Cybersecurity and Infrastructure Security Agency (CISA) has taken action by adding these vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalogue. CISA added CVE-2026-82329 to the list in late August, followed by CVE-2026-42018 and CVE-2026-42016 one week later.

Under federal directives, government agencies have been given a two-week window to patch their vulnerable Artifactory instances. These vulnerabilities pose a significant risk to the software supply chain, as Artifactory is widely used to manage software artifacts, binaries, containers, and AI models.

Required Remediation

Organisations running self-managed Artifactory deployments are urged to update to the following patched versions immediately to prevent unauthorised administrative access:

• 7.161.20
• 7.146.38
• 7.133.29
• 7.125.20
• 7.117.28
• 7.111.21