JFrog Artifactory Vulnerabilities Actively Exploited in the Wild to Gain Administrative Control

Wiz observed active exploitation of three critical JFrog Artifactory vulnerabilities that enable authentication bypass and token scope abuse, allowing attackers to mint administrator tokens, create persistent admin accounts, deploy malicious Groovy plugins, execute commands, and install backdoors; the report includes observed timelines, IOCs (IPs, payload URLs, file hashes, account names), affected versions and recommended upgrades, and notes broad cloud exposure with a large percentage of instances vulnerable at disclosure.