Attackers Chain JFrog Artifactory Flaws to Gain Admin Control and Plant Backdoors

Attackers Chain JFrog Artifactory Flaws to Gain Admin Control and Plant Backdoors Swati KhandelwalSep 11, 2026Vulnerability / DevOps Attackers have chained two flaws in JFrog Artifactory, the repository that software build pipelines pull from, to take administrator control of self-hosted servers and plant backdoors, cloud security company Wiz said in a report. Wiz saw the attacks between August 15 and September 8. JFrog had fixed both flaws before then, so only servers that had not been updated were open to them. Neither flaw gives administrator control on its own. CVE-2026-42018 makes Artifactory hand an internal anonymous-user token to a caller who has not logged in, even when anonymous access is turned off. CVE-2026-42016 then allows that low-privilege token to be…