What happened
Between August 15 and September 8, 2026, attackers ran a 24-day campaign against self-hosted JFrog Artifactory instances. Wiz Research caught it by correlating cloud telemetry: three vulnerabilities were chained to bypass authentication, escalate to admin, install malicious Groovy plugins, and deploy Rust-based backdoors. The backdoors survived the patching cycle because defenders patched the entry points without finding the persistence mechanism first.
The three-vulnerability chain
CVE-2026-42018 is the entry point: it leaks a JWT belonging to Artifactory's internal anonymous user even when anonymous access is disabled. CVE-2026-42016 escalates that token to admin level through insufficient token validation. CVE-2026-82329 (added to CISA KEV on September 2) is a parallel bypass in the default configuration: an unauthenticated attacker sends a POST to /access/api/v1/registry/join and receives an administrator-scoped token directly. With any of these tokens, attackers created long-lived access tokens, installed Groovy plugins with arbitrary command execution, and established Rust backdoors as persistent implants.
Why Rust backdoors survive patching
Patching the CVEs closes the front door. If an attacker already installed a Groovy plugin or planted a Rust binary during the 24-day exposure window, the persistence mechanism remains active post-patch. Roughly two-thirds of Artifactory deployments were still exposed at each disclosure point, giving attackers an extended opportunity. Vulnerability remediation and post-compromise hunting are two separate actions that must happen in parallel, not sequentially.
IOCs: fake accounts to hunt for immediately
Wiz identified these Artifactory account names created by the attackers: jfrog-distribution, jfrog-insight, repo-service, backup-service, ldap_admin, and 0xterror. If any of these exist in your instance, treat it as confirmed compromise. Also audit installed Groovy plugins for anything added after August 15. Check for long-lived access tokens created in the same window.
What to do right now
- Patch CVE-2026-42018, CVE-2026-42016, and CVE-2026-82329. JFrog has released fixes for all three.
- Audit all accounts for the six IOC names. Revoke any access tokens created since August 15.
- Review all Groovy plugins for unexpected additions. Remove anything you did not intentionally install.
- If you were in the exposure window (Aug 15 to Sep 8), assume compromise and run incident response alongside patching. File-based scanning alone is insufficient if a Rust implant intercepts file reads in memory.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if you need help scoping an Artifactory incident response or hardening your software supply chain.