Attackers Chain JFrog Artifactory Flaws to Gain Admin Control and Plant Backdoors

Attackers exploited chained Artifactory vulnerabilities (CVE-2026-42018 and CVE-2026-42016) and a separate critical authentication bypass (CVE-2026-82329) to obtain administrator privileges on self-hosted JFrog Artifactory instances between mid‑August and early September; they created admin accounts, installed malicious Groovy plugins, dropped binaries including a Rust backdoor with C2 capabilities, and exfiltrated cluster join keys. JFrog published fixed builds for affected branches and Fastly/Wiz recommend treating exposed servers as compromised, rotating join keys, revoking tokens minted since late August, and auditing administrator accounts, repositories, and configuration changes.