Vulnerabilities · 44 days ago
Artifactory chaining gave attackers admin backdoors Wiz says multiple actors have chained three JFrog Artifactory flaws since mid-August, turning CVE-2026-42018 , CVE-2026-42016 , and CVE-2026-82329 into admin access, persistence, and backdoors on self-hosted instances. CISA has already added the first two to its Known Exploited Vulnerabilities catalog, after flagging CVE-2026-82329 a week earlier.
The chain starts with a bug that can hand out an anonymous-user token even when anonymous access is disabled. A second flaw then lets a limited token be treated as more powerful than it should be, so an attacker can climb to administrator and then plant persistent admin accounts, malicious plugins, SSH keys, and second-stage payloads.
That makes this a repository-layer problem, not just a login fix. If Artifactory sits in front of software artifacts, containers, AI models, or package distribution, a compromised instance can keep exposing build inputs and secrets even after the vulnerable login path is patched.
NVD KEV
Known exploited · CISA KEV
CVSS 9.8 CRITICAL: jFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated… EPSS 14% (97th percentile).
CISA federal remediation date Sep 5 · date passed
NVD KEV
Known exploited · CISA KEV
CVSS 8.1 HIGH: jFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a… EPSS 9% (95th percentile).
CISA federal remediation date Sep 25
NVD KEV
Known exploited · CISA KEV
CVSS 7.5 HIGH: jFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is…
CISA federal remediation date Sep 25
Timeline Sources 13 sources covering this story
SecurityWeek Sep 14
Three JFrog Artifactory Flaws Exploited for Backdoor Deployment
The vulnerabilities can allow attackers to bypass authentication and elevate their privileges to administrator.
CSIRT Italia / ACN Sep 14
JFrog: rilevato sfruttamento in rete delle vulnerabilità CVE-2026-42016 e CVE-2026-42018 in Artifactory
Rilevato lo sfruttamento attivo in rete di due vulnerabilità con gravità "alta" - già sanate dal vendor - relative al prodotto JFrog Artifactory, piattaforma per la gestione e distribuzione di artefatti software
SecurityWeek Sep 14
ConnectWise Patches ScreenConnect Vulnerability Exploited in Worm-Like Attacks
The flaw allows attackers to send files and execute them without authorization through an active remote session.
CSIRT Italia / ACN Sep 14
Rilevato sfruttamento della CVE-2026-84869 relativa al prodotto ConnectWise ScreenConnect
Rilevato lo sfruttamento attivo in rete della vulnerabilità CVE-2026-84869 con gravità "critica" - già sanata dal vendor - relativa al prodotto ConnectWise ScreenConnect
The Register Security Sep 11
More JFrog Artifactory bugs under attack, and all 3 have patches
If you're waiting for a sign to upgrade to a fixed version: this is it
BleepingComputer Sep 11
Artifactory flaws chained in attacks deploying backdoor malware
Threat actors are exploiting critical and high-severity vulnerabilities in JFrog Artifactory to bypass authentication, gain administrative privileges, and deploy a Rust backdoor on vulnerable self-hosted servers.
The Hacker News Sep 11
Attackers Chain JFrog Artifactory Flaws to Gain Admin Control and Plant Backdoors
Attackers chained two JFrog Artifactory flaws on unupdated servers to gain admin control, while a third flaw was exploited separately.
CCCS Advisories Sep 11
AL26-020 - Vulnerabilities Impacting MikroTik RouterOS - CVE-2026-67276, CVE-2026-67277 and CVE-2026-86060 - Canadian Centre for Cyber Security
AL26-020 - Vulnerabilities Impacting MikroTik RouterOS - CVE-2026-67276, CVE-2026-67277 and CVE-2026-86060
Wiz Research Sep 10
Artifactory Under Attack: In-the-Wild Exploitation of CVE-2026-42016, CVE-2026-42018 & CVE-2026-82329 | Wiz Blog
Wiz Research has identified active, in-the-wild exploitation of three critical and high-severity vulnerabilities impacting JFrog Artifactory (CVE-2026-42016, CVE-2026-42018 & CVE-2026-82329).
CSO Online Sep 9
MikroTik patches flaws currently being exploited to take over routers
MikroTrick chains together two of six patched vulnerabilities to obtain root privileges on MikroTik devices with SSH exposed to the internet, of which they are more than 120,000.
Industrial Cyber Sep 9
CERT Polska alerts MikroTik RouterOS vulnerabilities actively being exploited in ‘MikroTrick’ attack chain - Industrial Cyber
CERT Polska alerts that MikroTik RouterOS vulnerabilities are actively being exploited in ‘MikroTrick’ attack chain.
SecurityWeek Sep 8
MikroTik Patches Critical Flaws Chained to Hack Routers
Dubbed MikroTrick, the bugs allow attackers to bypass authentication, overwrite configuration files, and take over devices.
Entities CVE-2026-42016 CVE-2026-42018 CVE-2026-82329 Part of the PlainSec briefing for 2026-09-09
Editions Related stories Vulnerabilities · 44 days ago
Artifactory chaining gave attackers admin backdoors Wiz says multiple actors have chained three JFrog Artifactory flaws since mid-August, turning CVE-2026-42018 , CVE-2026-42016 , and CVE-2026-82329 into admin access, persistence, and backdoors on self-hosted instances. CISA has already added the first two to its Known Exploited Vulnerabilities catalog, after flagging CVE-2026-82329 a week earlier.
The chain starts with a bug that can hand out an anonymous-user token even when anonymous access is disabled. A second flaw then lets a limited token be treated as more powerful than it should be, so an attacker can climb to administrator and then plant persistent admin accounts, malicious plugins, SSH keys, and second-stage payloads.
That makes this a repository-layer problem, not just a login fix. If Artifactory sits in front of software artifacts, containers, AI models, or package distribution, a compromised instance can keep exposing build inputs and secrets even after the vulnerable login path is patched.
NVD KEV
Known exploited · CISA KEV
CVSS 9.8 CRITICAL: jFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated… EPSS 14% (97th percentile).
CISA federal remediation date Sep 5 · date passed
NVD KEV
Known exploited · CISA KEV
CVSS 8.1 HIGH: jFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a… EPSS 9% (95th percentile).
CISA federal remediation date Sep 25
NVD KEV
Known exploited · CISA KEV
CVSS 7.5 HIGH: jFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is…
CISA federal remediation date Sep 25
Timeline Sources 13 sources covering this story
SecurityWeek Sep 14
Three JFrog Artifactory Flaws Exploited for Backdoor Deployment
The vulnerabilities can allow attackers to bypass authentication and elevate their privileges to administrator.
CSIRT Italia / ACN Sep 14
JFrog: rilevato sfruttamento in rete delle vulnerabilità CVE-2026-42016 e CVE-2026-42018 in Artifactory
Rilevato lo sfruttamento attivo in rete di due vulnerabilità con gravità "alta" - già sanate dal vendor - relative al prodotto JFrog Artifactory, piattaforma per la gestione e distribuzione di artefatti software
SecurityWeek Sep 14
ConnectWise Patches ScreenConnect Vulnerability Exploited in Worm-Like Attacks
The flaw allows attackers to send files and execute them without authorization through an active remote session.
CSIRT Italia / ACN Sep 14
Rilevato sfruttamento della CVE-2026-84869 relativa al prodotto ConnectWise ScreenConnect
Rilevato lo sfruttamento attivo in rete della vulnerabilità CVE-2026-84869 con gravità "critica" - già sanata dal vendor - relativa al prodotto ConnectWise ScreenConnect
The Register Security Sep 11
More JFrog Artifactory bugs under attack, and all 3 have patches
If you're waiting for a sign to upgrade to a fixed version: this is it
BleepingComputer Sep 11
Artifactory flaws chained in attacks deploying backdoor malware
Threat actors are exploiting critical and high-severity vulnerabilities in JFrog Artifactory to bypass authentication, gain administrative privileges, and deploy a Rust backdoor on vulnerable self-hosted servers.
The Hacker News Sep 11
Attackers Chain JFrog Artifactory Flaws to Gain Admin Control and Plant Backdoors
Attackers chained two JFrog Artifactory flaws on unupdated servers to gain admin control, while a third flaw was exploited separately.
CCCS Advisories Sep 11
AL26-020 - Vulnerabilities Impacting MikroTik RouterOS - CVE-2026-67276, CVE-2026-67277 and CVE-2026-86060 - Canadian Centre for Cyber Security
AL26-020 - Vulnerabilities Impacting MikroTik RouterOS - CVE-2026-67276, CVE-2026-67277 and CVE-2026-86060
Wiz Research Sep 10
Artifactory Under Attack: In-the-Wild Exploitation of CVE-2026-42016, CVE-2026-42018 & CVE-2026-82329 | Wiz Blog
Wiz Research has identified active, in-the-wild exploitation of three critical and high-severity vulnerabilities impacting JFrog Artifactory (CVE-2026-42016, CVE-2026-42018 & CVE-2026-82329).
CSO Online Sep 9
MikroTik patches flaws currently being exploited to take over routers
MikroTrick chains together two of six patched vulnerabilities to obtain root privileges on MikroTik devices with SSH exposed to the internet, of which they are more than 120,000.
Industrial Cyber Sep 9
CERT Polska alerts MikroTik RouterOS vulnerabilities actively being exploited in ‘MikroTrick’ attack chain - Industrial Cyber
CERT Polska alerts that MikroTik RouterOS vulnerabilities are actively being exploited in ‘MikroTrick’ attack chain.
SecurityWeek Sep 8
MikroTik Patches Critical Flaws Chained to Hack Routers
Dubbed MikroTrick, the bugs allow attackers to bypass authentication, overwrite configuration files, and take over devices.
Entities CVE-2026-42016 CVE-2026-42018 CVE-2026-82329 Part of the PlainSec briefing for 2026-09-09
Editions Related stories