A recent report by cloud security firm Wiz has revealed that cybercriminals have exploited two vulnerabilities in JFrog Artifactory to gain administrative control over self-hosted servers and deploy backdoor malware. These incidents occurred between August 15 and September 8, affecting servers that had not yet been updated with the necessary patches. The vulnerabilities, although individually not sufficient for admin access, were used in combination to create a critical security breach.

The attackers utilized an unauthenticated request to acquire a token for the internal anonymous user, which was then exchanged for a token with administrative privileges. This administrative token retained the anonymous username, allowing malicious actions to be logged under a generic 'token:anonymous' entry rather than a specific user account. In some instances, the transition from initial request to the creation of a new admin account took less than five minutes.

The vulnerabilities, identified as CVE-2026-42016 and CVE-2026-42018, were patched by JFrog before the attacks began, but the breaches were successful on servers that had not implemented these updates. Additionally, another vulnerability, CVE-2026-82329, was exploited separately and poses a critical risk due to its ability to bypass authentication on default configurations.

Attackers have been observed using their administrative access to create new accounts, install malicious plugins, and execute shell commands. The presence of a custom Rust backdoor further highlights the severity of these breaches. While JFrog has released fixes for these vulnerabilities, the need for immediate action is crucial to prevent further exploitation.

Organizations using JFrog Artifactory are advised to promptly update their systems to the latest patched versions. JFrog has provided a workaround for those unable to upgrade immediately by adding a random value as an extra join key. Security teams must also review and revoke any unauthorized administrator accounts and tokens that may have been created during these attacks.