Three JFrog Artifactory Flaws Exploited for Backdoor Deployment
Source SecurityWeek
Mentioned vulnerabilities
Fixed in 7.161.20 : patch affected systems as a priority.
Data as of 14 Sep 2026, 09:31 UTC
Rated by Threat Radar
- Patch
- Available – fixed in 7.161.20, 7.146.38, 7.133.29 +2
What to do
AI-suggested
Official patches addressing these vulnerabilities have been released by JFrog. Organizations should immediately update their self-managed Artifactory deployments to one of the fixed versions: 7.161.20, 7.146.38, 7.133.29, 7.125.20, 7.117.28, or 7.111.21. Federal agencies have been mandated by CISA to patch within two weeks. No additional mitigation actions are indicated beyond applying these official updates.
Description
Three high-severity vulnerabilities in JFrog Artifactory have been exploited in the wild to bypass authentication and gain administrative privileges. These flaws allow attackers to deploy backdoors, create persistent admin accounts, and execute arbitrary code. The vulnerabilities, identified as CVE-2026-42016, CVE-2026-42018, and CVE-2026-82329, have been patched by JFrog. Multiple threat actors have chained these vulnerabilities to escalate privileges and maintain persistent access on self-hosted Artifactory instances. The Cybersecurity and Infrastructure Security Agency (CISA) has added these CVEs to its Known Exploited Vulnerabilities catalog and mandated federal agencies to patch within two weeks. Organizations are strongly advised to update to the fixed versions immediately.