Attackers Chain JFrog Artifactory Flaws to Gain Admin Control and Plant Backdoors
Summary: Wiz reported that attackers chained two JFrog Artifactory flaws to gain administrator control of self-hosted servers and plant backdoors, with attacks observed between August 15 and September 8 on servers that had not applied fixes JFrog shipped beforehand. A separate flaw, CVE-2026-82329, a 9.8-rated authentication bypass requiring no additional flaw, was exploited between September 1 and September 8, and Fastly counted about 406,000 exploitation attempts across its platform on September 2.
Why it matters: The administrator accounts and tokens attackers created survive the upgrade, and a patch does not revoke tokens already minted or change a join key already taken - so the servers Wiz saw compromised, some with admin accounts created in under five minutes, need credential rotation and account review, not just a version bump.
Read the original at The Hacker News ↗
- Topics
- Cloud Security
- Mentions
- CVE-2026-42016CVE-2026-42018CVE-2026-82329
- Related
- ⚡ Weekly Recap: Rogue AI Agents, WeChat Worm, Paper Cut Attacks, AI Espionage, and Rootkits Cyber Risks ·CVE-2026-42018: JFrog Artifactory Improper Authentication Vulnerability Known Exploited Vulnerabilities · Sep 11, 2026CVE-2026-42016: JFrog Artifactory Incorrect Authorization Vulnerability Known Exploited Vulnerabilities · Sep 11, 2026