Artifactory flaws chained in attacks deploying backdoor malware
Recorded: Sept. 11, 2026, 5:09 p.m.
| Original | Summarized |
Artifactory flaws chained in attacks deploying backdoor malware News Featured AdaptHealth confirms 4.1 million people exposed in July cyberattack Microsoft September 2026 Patch Tuesday fixes 966 flaws, 2 zero-days Over 36,000 exposed Plex servers vulnerable to recent flaws New Microsoft Defender 'ShieldCrash' zero-day grants SYSTEM access Artifactory flaws chained in attacks deploying backdoor malware How Threat Actors Are Turning Trusted AI Platforms Into an Attack Surface GitLab urges users to patch max severity path traversal flaw Learn to use Claude beyond basic prompts with this $20 course bundle Tutorials Latest How to access the Dark Web using the Tor Browser How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11 How to use the Windows Registry Editor How to backup and restore the Windows Registry How to start Windows in Safe Mode How to remove a Trojan, Virus, Worm, or other Malware How to show hidden files in Windows 7 How to see hidden files in Windows Webinars Latest Qualys BrowserCheck STOPDecrypter AuroraDecrypter FilesLockerDecrypter AdwCleaner ComboFix RKill Junkware Removal Tool Deals Categories eLearning IT Certification Courses Gear + Gadgets Security VPNs Popular Best VPNs How to change IP address Access the dark web safely Best VPN for YouTube Forums Virus Removal Guides HomeNewsSecurityArtifactory flaws chained in attacks deploying backdoor malware Artifactory flaws chained in attacks deploying backdoor malware By Bill Toulas September 11, 2026 Threat actors are exploiting critical and high-severity vulnerabilities in JFrog Artifactory to bypass authentication, gain administrative privileges, and deploy a Rust backdoor on vulnerable self-hosted servers. Build your security blueprint for AI-powered attacks Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed. Related Articles: Actively Exploited Bill Toulas Previous Article Post a Comment Community Rules You need to login in order to post a comment Not a member yet? Register Now You may also like: Upcoming Webinar Popular Stories Microsoft September 2026 Patch Tuesday fixes 966 flaws, 2 zero-days September Windows Server updates break Remote Desktop Services New Microsoft Defender 'ShieldCrash' zero-day grants SYSTEM access Sponsor Posts Overdue a password health-check? Audit your Active Directory for free EtherHiding Malware on macOS: How Attackers Hide C2 on the Blockchain Stay one step ahead of new threats in the new year. Join Huntress for the monthly Tradecraft Tuesday. Find your gaps before an auditor does. Check your EU CRA readiness in 5 questions. Upcoming Webinar Follow us: Main Sections News Community Forums Useful Resources Welcome Guide Company About BleepingComputer Terms of Use - Privacy Policy - Ethics Statement - Affiliate Disclosure Copyright @ 2003 - 2026 Bleeping Computer® LLC - All Rights Reserved Login Username Password Remember Me Sign in anonymously Sign in with Twitter Not a member yet? Register Now Help us understand the problem. What is going on with this comment? Spam Abusive or Harmful Inappropriate content Strong language Other Read our posting guidelinese to learn what content is prohibited. Submitting... |
Threat actors have demonstrated the ability to chain critical and high-severity vulnerabilities within JFrog Artifactory to achieve privilege escalation and deploy sophisticated backdoor malware on vulnerable self-hosted servers. This exploitation was confirmed by cloud security company Wiz, which identified this exploit chain involving CVE-2026-42018, CVE-2026-42016, and CVE-2026-82329. The attack sequence involved exploiting CVE-2026-42018 to illicitly obtain a JSON Web Token belonging to an internal Artifactory anonymous user, even when anonymous access was supposedly disabled and the user possessed low privileges. Subsequently, the threat actors leveraged CVE-2026-42016, which stems from insufficient token validation, to elevate these initial privileges to administrator level. Between August 15 and September 8, 2026, multiple threat actors successfully utilized this two-step process to generate administrator-scoped tokens. Following the privilege escalation, the attackers proceeded to install malicious Groovy plugins, which allowed them to execute arbitrary commands on the affected systems, establishing persistence by deploying a Rust-based backdoor configured with Command and Control capabilities. The post-exploitation phase involved extensive reconnaissance and data exfiltration, where threat actors downloaded additional payloads into temporary directories such as /dev/shm, /tmp, and /var/tmp. They subsequently uploaded webshells and stole sensitive Artifactory configuration data, including cluster join keys, repository details, user lists, and access tokens. Furthermore, they modified the system by adding their SSH keys to newly created administrator accounts. Wiz reported that between forty-nine and sixty-two percent of reachable Artifactory instances were susceptible to at least one of these three flaws. To mitigate this severe risk, system administrators are strongly advised to immediately upgrade their Artifactory instances to one of the recommended release versions or later, including 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, or 7.161.20. After implementing the necessary upgrades, defenders must conduct thorough investigations on internet-exposed instances to detect anomalous activity, such as unexpected token creation, the appearance of rogue administrator accounts, suspicious plugin execution, and excessive enumeration requests. Access should then be strictly limited to trusted systems. The findings are attributed to work by Bill Toulas. |