“Between August 15 and September 8, 2026, we observed multiple actors chain CVE-2026-42018 and CVE-2026-42016 against self-hosted Artifactory instances,” Wiz reported — and across those cases, “we observed a custom Rust backdoor with C2 capabilities being dropped.”
How the chain worked: CVE-2026-42018 and CVE-2026-42016
Cloud security company Wiz says attackers used a two-step exploit chain to move from low privileges to full administrative control on self-hosted JFrog Artifactory servers. First, CVE-2026-42018 was abused to obtain a JSON Web Token (JWT) for an internal Artifactory anonymous user — notably, the researchers say this occurred even when anonymous access was disabled. That token initially carried only low privileges.
Attackers then exploited CVE-2026-42016, which Wiz attributes to insufficient token validation, to elevate the anonymous JWT to an admin-scoped token. Between August 15 and September 8, multiple threat actors executed this sequence: obtain the anonymous JWT, then exchange it for an admin-scoped token. In some observed cases, researchers say attackers were able to create an administrator account in under five minutes.
CVE-2026-82329 and token minting observed by watchTowr
Wiz’s reporting follows separate observation of a third vulnerability. Offensive security company watchTowr reported that CVE-2026-82329 — described in the reporting as a critical authentication bypass — was being exploited earlier in the month to mint administrator tokens. Taken together, Wiz says the three flaws have been chained or used in related campaigns against reachable Artifactory instances.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramblePayloads, persistence and post-exploit activity
Once administrative access was obtained, attackers installed malicious Groovy plugins to execute arbitrary commands and, according to Wiz, established persistence by deploying a Rust-based backdoor with command-and-control (C2) capabilities. The observed campaigns did not stop at implants: attackers downloaded additional payloads into temporary locations such as /dev/shm, /tmp, and /var/tmp; uploaded webshells; and stole Artifactory configuration data and cluster join keys.
Wiz further documents broad enumeration and credential theft behaviors: enumerating repositories, tokens and users; creating rogue administrator accounts; generating long-lived access tokens; and adding their SSH keys to newly created accounts. The company says these activities were consistent across multiple cases where the initial token-exchange chain succeeded.
Exposure and immediate mitigation steps for administrators
Wiz warns that between 49% and 62% of reachable Artifactory instances are vulnerable to at least one of the three flaws the report names. In response, the report lists specific Artifactory release versions administrators should upgrade to immediately or later:
- 7.111.21
- 7.117.28
- 7.125.20
- 7.133.29
- 7.146.38
- 7.161.20
After upgrading, Wiz recommends investigating internet-exposed instances for signs of compromise: unexpected token creation, rogue administrator accounts, suspicious plugin activity, and enumeration requests. The company also advises restricting access to trusted systems only. Wiz has published indicators of compromise (IoCs) tied to the observed attacks to help defenders detect infections quickly.
What this means for technologists, affected enterprises, and defenders
Technologists and security teams should prioritize patching and hunt for the specific behaviors Wiz documents: anonymous-user JWT issuance despite anonymous access settings, rapid admin-account creation, malicious Groovy plugin installations, and the presence of a Rust-based backdoor with C2 activity. Affected enterprises should search for copied Artifactory configuration, cluster join keys, and unusual SSH keys in accounts that were created recently.
Defenders operating exposed instances should use the IoCs Wiz provided to accelerate detection, and apply access restrictions while upgrades are performed. Wiz’s timeline — activity concentrated between August 15 and September 8, 2026 — suggests that rapid response and retroactive investigation of that window are particularly important.
BleepingComputer contacted JFrog to confirm the reported activity; the outlet says it had not received a response as of publication. Wiz’s report and watchTowr’s observations together underscore a coordinated exploitation pattern that administrators cannot treat as hypothetical.
For a full account and the IoCs referenced in this article, see the original report: https://www.bleepingcomputer.com/news/security/artifactory-flaws-chained-in-attacks-deploying-backdoor-malware/
