Hackers Chain Artifactory Flaws to Install Rust Backdoor on Self-Hosted Servers
Threat actors are actively exploiting vulnerabilities in self-hosted JFrog Artifactory servers to gain administrative access and deploy a custom Rust-based backdoor with command-and-control capabilities. According to a new report from cloud security firm Wiz, attackers chain CVE-2026-42018 and CVE-2026-42016 to first obtain a JSON Web Token belonging to an internal anonymous user, then escalate its permissions to admin level by exploiting insufficient token validation. A third flaw, CVE-2026-82329, is a critical authentication bypass that security firm watchTowr observed being exploited to mint administrator tokens earlier this month.
Between August 15 and September 8, multiple threat actors used the exploit chain against vulnerable instances, and in some cases created an administrator account in under five minutes. After gaining admin access and generating long-lived access tokens, the attackers install malicious Groovy plugins to execute arbitrary commands and establish persistence with the Rust backdoor. From there, they download additional payloads into temporary directories, upload webshells, steal Artifactory configuration data and cluster join keys, enumerate repositories, tokens, and users, and add their own SSH keys to newly created accounts.
Wiz warns that between 49% and 62% of reachable Artifactory instances remain vulnerable to at least one of the three flaws. Administrators are urged to upgrade immediately to version 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, or 7.161.20 or later. After upgrading, they should investigate internet-exposed instances for unexpected token creation, rogue administrator accounts, and suspicious plugin activity.