GoKawiilJFrog Artifactory bugs chained to plant Rust backdoor on self-hosted servers
Wiz researchers found multiple threat actors exploiting two Artifactory vulnerabilities, CVE-2026-42018 and CVE-2026-42016, to escalate from a low-privileged anonymous session to full administrator access in under five minutes in some cases. Once inside, attackers installed malicious Groovy plugins to run commands and deployed a custom Rust-based backdoor with command-and-control capabilities, alongside webshells and stolen configuration data. A separate critical flaw, CVE-2026-82329, has also been used by other attackers to mint admin tokens on unpatched instances.
GoKawiil's interpretation of the reporting above, not reported fact.
Artifactory instances often store build artifacts, credentials, and cluster join keys, so admin-level compromise can let attackers pivot into software supply chains and internal networks far beyond the artifact repository itself. The speed of exploitation, minutes rather than hours, shows these bugs are being actively weaponized at scale, making rapid patching and token rotation urgent for self-hosted deployments.
- Attackers chain two Artifactory flaws to escalate from anonymous access to admin in minutes.
- A custom Rust backdoor with C2 features is being deployed for persistence after compromise.
- A significant share of exposed Artifactory instances remain unpatched against these vulnerabilities.
Yubico YubiKey 5 NFC Security Key — When attackers can mint admin tokens in under five minutes, strong hardware-backed authentication for your admin accounts matters. The YubiKey 5 NFC plugs into USB-A or taps via NFC and supports FIDO2/WebAuthn, TOTP and smart card protocols, making it a practical layer of defense for the consoles and repositories your build pipeline depends on.
See Yubico YubiKey 5 NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-09-11
Published there as: “Artifactory flaws chained in attacks deploying backdoor malware”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.