Hackers Exploit Multiple Artifactory Flaws to Seize Administrative Control

Security researchers have confirmed that threat actors are exploiting a trio of newly disclosed vulnerabilities in JFrog Artifactory to bypass authentication and obtain full administrative privileges on vulnerable servers.

Artifactory, JFrog's widely adopted binary repository manager, serves as a central hub for storing, versioning, and distributing software packages across development pipelines. Because it often sits at the heart of continuous integration and delivery workflows, compromising an instance can give attackers unfettered access to the code and binaries that power modern applications.

The three flaws—identified as CVE-2026-42016, CVE-2026-42018 and CVE-2026-82329—affect distinct components of the product. The first enables unauthenticated users to craft specially formed requests that trick the server into treating them as logged‑in users. The second flaw escalates any low‑privilege session to full admin rights, while the third provides a path for remote code execution that can be chained with the other two to achieve persistent control.

Wiz Research, which first observed the exploit activity, reported that multiple independent groups are leveraging these vulnerabilities in the wild. Their telemetry shows repeated attempts to probe public‑facing Artifactory instances, followed by successful authentication bypass and privilege escalation in a subset of targets. The report cites GBHackers as the original source that publicized the issue.

For organizations that rely on Artifactory to manage internal libraries or to serve third‑party components, the consequences can be severe. An attacker with admin access can inject malicious artifacts, alter version metadata, or exfiltrate proprietary code, thereby opening a direct line into the software supply chain. Such a breach could cascade downstream, affecting any downstream services that consume compromised packages.

JFrog has responded by issuing patches for the three CVEs and urging customers to apply the updates immediately. In addition, the vendor recommends tightening network segmentation, enforcing multi‑factor authentication for all Artifactory accounts, and disabling any unnecessary public endpoints until the patches are in place.

The incident underscores a broader trend of attackers focusing on the software‑delivery infrastructure itself. Over the past year, similar supply‑chain attacks have targeted package managers, container registries, and build servers, reflecting the high value placed on the tools that automate code movement from developer workstations to production environments.

Security teams are advised to audit their Artifactory deployments for exposed services, verify that the latest security patches are applied, and monitor logs for anomalous authentication attempts. As researchers continue to track exploit activity, organizations that fail to remediate the flaws risk becoming part of a growing list of supply‑chain compromises that could have far‑reaching operational and reputational impacts.