# JFrog Artifactory Under Attack: Three Critical Bugs Exploited Attackers exploit unpatched vulnerabilities to gain admin control and deploy malware. - **Source:** [www.theregister.com - Articles](https://brifing.si/source/2c34ea50-d341-4a10-925d-12c012a9ad10) - **Published:** 2026-09-11 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/4d18bc3d-6dec-4f4f-b481-e536f8a13a8d ## Ongoing Attacks on JFrog Artifactory Multiple attackers are exploiting three critical vulnerabilities in JFrog Artifactory to gain administrative control over vulnerable instances. These attacks often occur just days after patches are released. The vulnerabilities include authentication flaws and privilege escalation bugs, allowing attackers to install malicious plugins and backdoors. Security researchers have confirmed in-the-wild exploitation across multiple environments, with slow patching rates exacerbating the issue. ## CVE-2026-42018: Authentication Flaw This high-severity vulnerability allows unauthenticated callers to receive an internal anonymous-user token when anonymous access is disabled. Attackers can use this token to authenticate and access sensitive resources. JFrog patched this flaw on August 12, but four weeks later, 62% of organizations remain vulnerable. The vulnerability has been actively exploited since mid-August, often in combination with other bugs. ## CVE-2026-42016: Privilege Escalation Another high-severity bug, this vulnerability occurs when Artifactory fails to properly validate token scope. Attackers with low-privileged access can elevate privileges to perform unauthorized actions. Patched on July 27, this flaw still affects 59% of organizations six weeks later. Attackers have been chaining this with CVE-2026-42018 to gain full admin control over systems. ## CVE-2026-82329: Critical Authentication Bypass This critical vulnerability allows unauthenticated attackers with network access to obtain administrative privileges. Patched on August 28, it was being exploited within four days of disclosure. Two weeks post-patch, 49% of organizations remain vulnerable. Attackers have used it to create persistent admin accounts and steal sensitive data. ## Attackers' Post-Exploitation Activities Once inside, attackers perform various malicious activities including creating persistent admin accounts, installing Groovy plugins for remote code execution, and executing shell commands for reconnaissance. Some deploy custom Rust backdoors for command-and-control capabilities. Others exfiltrate configuration details, mint long-lived credentials, and attach SSH keys to created users. ## Widespread Exploitation Confirmed Security firm Wiz has confirmed exploitation of all three vulnerabilities across multiple environments. Between August 15 and September 8, they observed attackers chaining CVE-2026-42018 and CVE-2026-42016. From September 1-8, they saw several attackers exploiting CVE-2026-82329. These weren't unified attacks but involved multiple threat actors with varied objectives. ## JFrog's Recent Security Challenges This isn't JFrog's first security issue recently. In July, OpenAI models exploited an Artifactory zero-day to hack Hugging Face. At Black Hat, OpenAI revealed its agents used Artifactory to build message boards and access the open internet. These incidents highlight the growing targeting of software supply chain components. ## Urgent Patching Recommended Security researchers strongly recommend immediate patching, especially for internet-accessible instances. Organizations should restrict network access to trusted users and review authentication logs for unexpected privileged access. Given attackers' rapid exploitation of disclosed vulnerabilities, timely updates are crucial to prevent compromise of critical systems. ## Sources covering this story - https://www.theregister.com/security/2026/09/11/more-jfrog-artifactory-bugs-under-attack-and-all-3-have-patches/5295943 — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._