{"id":5059,"date":"2026-09-14T09:48:08","date_gmt":"2026-09-14T09:48:08","guid":{"rendered":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/2026\/09\/14\/more-jfrog-artifactory-bugs-are-under-attack-and-all-three-have-patches\/"},"modified":"2026-09-14T09:48:08","modified_gmt":"2026-09-14T09:48:08","slug":"more-jfrog-artifactory-bugs-are-under-attack-and-all-three-have-patches","status":"publish","type":"post","link":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/2026\/09\/14\/more-jfrog-artifactory-bugs-are-under-attack-and-all-three-have-patches\/","title":{"rendered":"More JFrog Artifactory Bugs Are Under Attack, and All Three Have Patches"},"content":{"rendered":"
\"\"<\/div>\n

\"\"<\/p>\n

Artifact repositories sit in an odd blind spot for many security teams. They don\u2019t face the internet as a web app does, and they don\u2019t hold customer data as a database does. But they hold something arguably more valuable: the binaries, containers, and packages that every build pipeline pulls from before code ships. Compromise the repository, and you\u2019re not attacking one application. You\u2019re attacking everything downstream.<\/span><\/p>\n

That\u2019s the backdrop for a new report from Wiz detailing active exploitation of three JFrog Artifactory vulnerabilities, all of which already have patches available. The gap between \u201cpatched\u201d and \u201cactually applied\u201d is where this story lives.<\/span><\/p>\n

The most serious of the three, CVE-2026-82329, is an authentication-bypass bug that lets an unauthenticated attacker with network access reach the repository and walk straight into administrative privileges. JFrog shipped a fix on August 28. Wiz says multiple threat actors are exploiting it independently, which usually signals that proof-of-concept details spread fast once a critical bug like this gets attention.<\/span><\/p>\n

The other two are being chained together. CVE-2026-42018 is an improper-authentication flaw that returns internal anonymous-user tokens to callers even when anonymous access is disabled, giving an attacker a foothold to authenticate as if they belonged there. JFrog patched it on August 12. CVE-2026-42016 is a privilege-escalation bug rooted in improper token-scope validation, letting a low-privileged, already-authenticated user climb to permissions they were never granted. That one was patched earlier still, on July 27. Wiz\u2019s researchers describe attackers combining the two to go from a low-privilege foothold to full administrative control of the Artifactory instance.<\/span><\/p>\n

Once inside, the attackers aren\u2019t just poking around. Wiz found custom Rust-based backdoors installed for persistence, Groovy plugins used to execute arbitrary code on the server, and web shells left behind for remote access. That\u2019s a full toolkit built specifically for what an Artifactory server is: a place where malicious code, planted deep in a build pipeline, can quietly ride into every downstream product that pulls a package from it.<\/span><\/p>\n

What makes this a story about patch management as much as it\u2019s a story about vulnerabilities is how long these bugs have stayed exploitable after fixes shipped. Wiz\u2019s telemetry shows CVE-2026-42016 still present in 59% of scanned instances six weeks after the patch went out. CVE-2026-42018 was still unpatched in 62% of instances a full month later. Even the critical bypass, CVE-2026-82329, was still exploitable in 49% of instances two weeks after JFrog fixed it. As Wiz put it in its research, \u201cpatching velocity has been slow.\u201d<\/span><\/p>\n

Mitch Ashley, vice president and practice lead for CIO & Technology Buyers and Software Lifecycle Engineering at The Futurum Group<\/a>, sees these numbers as a mismatch in how teams decide what to patch first. \u201cPatch urgency still prioritizes internet exposures versus downstream dependence, which is why a repository manager can sit unpatched for weeks while a public web app gets fixed in hours or days,\u201d he said. \u201cCompromising a repository is a software supply chain security event. Every build that pulls from it inherits the result.\u201d His prescription is direct: \u201cBuild infrastructure deserves the same patch clock as anything customer-facing. Security teams should be asking today who holds administrative tokens on their repository and what those tokens can reach.\u201d<\/span><\/p>\n

None of this is unique to JFrog. Artifact repositories, package registries and build servers have become a recurring target precisely because they sit upstream of so much else, and because they don\u2019t always get the same patching discipline as customer-facing systems. A vulnerability in a repository manager doesn\u2019t generate the same urgency as one in a public web app, even though the potential blast radius- poisoned builds moving downstream to every team and product that depends on them- can be larger.<\/span><\/p>\n

It also helps explain why attackers keep chaining lower-severity bugs together instead of waiting for the next critical one. A privilege-escalation flaw and an authentication weakness, each modest on its own, add up to full administrative control once combined. That\u2019s a pattern worth watching beyond this one product: two \u201chigh\u201d severity CVEs sitting unpatched next to each other can quietly become as dangerous as a single \u201ccritical\u201d one, and vulnerability scoring rarely accounts for that kind of combination.<\/span><\/p>\n

For teams running Artifactory, the fix itself isn\u2019t complicated: three CVEs, three patches, all available for weeks. The harder part is organizational. Build infrastructure tends to be treated as internal plumbing, patched on whatever cadence feels convenient rather than the cadence the threat actually requires. That habit is exactly what these exploitation numbers measure, and it predates this specific set of bugs and will outlast them too.<\/span><\/p>\n

The practical takeaway is to treat repository managers, CI\/CD servers, and anything else your build pipeline depends on as first-class attack surface, not background infrastructure. That means patching them on the same urgent timeline as anything internet-facing, auditing who holds administrative tokens, and watching for exactly the kind of persistence mechanisms Wiz found here: unexpected plugins, unfamiliar service accounts, or processes that don\u2019t belong in a repository server\u2019s normal operation. The vulnerabilities get fixed. Whether they get exploited in your environment depends on how fast that fix reaches production.<\/span><\/p>\n

Read More<\/a><\/p>\n

\u200b<\/p>","protected":false},"excerpt":{"rendered":"

Artifact repositories sit in an odd blind spot for many security teams. They don\u2019t face the internet as a web […]<\/p>\n","protected":false},"author":1,"featured_media":5060,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[5],"tags":[],"class_list":["post-5059","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-devops"],"_links":{"self":[{"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/posts\/5059","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/comments?post=5059"}],"version-history":[{"count":0,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/posts\/5059\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/media\/5060"}],"wp:attachment":[{"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/media?parent=5059"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/categories?post=5059"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/tags?post=5059"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}