Attackers Chain JFrog Artifactory CVEs for Rapid Admin Takeover and Backdoor Deployment
Real-world attacks against self-hosted JFrog Artifactory have combined several CVEs to move from unauthenticated requests to administrator privileges. The objective extends beyond initial access: attackers establish persistence, deploy backdoors, and open the door to potential software supply chain compromise.
Between 15 August and 8 September 2026, multiple self-hosted JFrog Artifactory instances received attacks that resulted in administrative control, creation of persistent accounts, and deployment of backdoors. The timeframe is significant because these were not isolated proof-of-concept attempts but complete intrusions that, in some cases, progressed from initial access to a new administrator account in under five minutes.
The primary attack path relies on chaining CVE-2026-42018 and CVE-2026-42016. The flaw CVE-2026-42018 allows an attacker to obtain an internal token associated with the anonymous user without logging in, even when anonymous access is disabled. Using this foothold, CVE-2026-42016 enables conversion of a low-privilege token into one with administrator scope because the validation checks only signature and issuer, not the actual token scope. This escalation has an additional side effect: certain administrative actions may appear in logs as token:anonymous rather than a named account, complicating forensic analysis.
Attackers then leveraged the Artifactory plugin ecosystem to solidify their presence. Malicious Groovy plugins were installed through the plugin framework, enabling server-side code execution. From there, shell commands were executed via a plugin execution endpoint for reconnaissance and file enumeration. A dropper downloaded a binary over HTTP, wrote it to globally writable paths such as /tmp, and opened a command-and-control channel. In several cases the deployment culminated in a Rust backdoor for remote control.
In parallel, CVE-2026-82329 was exploited independently between 1 and 8 September 2026. This critical authentication bypass flaw, rated CVSS 9.8, allows administrative privileges without chaining other defects and primarily affects default configurations of self-hosted Artifactory. Observed exploitation included creation of administrator tokens and enumeration of users, groups, and credential sets.
Priority must be given to patching. Fixes for CVE-2026-82329 are available in versions 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38 and 7.161.20. For the CVE-2026-42018 plus CVE-2026-42016 chain, correcting at least one of the two vulnerabilities is sufficient to break the attack, although applying all available updates is recommended, especially for internet-exposed instances.
If immediate patching is not possible, a quick mitigation for CVE-2026-82329 is to configure an extra random join key in system.yaml. Organizations should still treat exposed servers as potentially compromised: review audit logs for administrative actions linked to token:anonymous and new high-privilege accounts, rotate exposed credentials and tokens, and audit changes to users, groups, and federated access topologies. Additional steps include inspecting for unauthorized Groovy plugins, checking file systems and scheduled tasks for binaries in paths such as /tmp, and verifying integrity of critical repositories and artifacts to protect the CI/CD pipeline.
Related articles
PKCE Becomes Mandatory for OAuth Public Clients as RFC 9700 and OAuth 2.1 Close Authorization Code Interception Risks
PKCE, or Proof Key for Code Exchange, was introduced in RFC 7636 to prevent code interception attacks in OAuth 2.0 flows used by mobile and single-page applications. The mechanism generates a code_verifier and derives a code_challenge using S256 hashing to bind the authorization code to the original client session. Without PKCE, malicious apps on the same device can hijack custom URI schemes like myapp://callback and exchange stolen codes for access tokens. RFC 9700, published in January 2025, now mandates PKCE for public clients and recommends it for confidential ones while requiring S256 over the weaker plain method. The upcoming OAuth 2.1 draft further embeds PKCE into the core authorization code flow and removes implicit and resource owner password credentials grants. Major providers including Auth0, Okta, and Microsoft Entra ID show varying default support, highlighting the need for explicit S256 implementation. The standard also protects against code injection attacks even when client secrets are present.
Check Point Patches Two Critical VPN Vulnerabilities Allowing Unauthenticated Remote Code Execution
Check Point has released fixes for two critical vulnerabilities affecting its Security Gateway, Security Management Server, and locally managed Spark Firewall products. Both flaws received a CVSS score of 9.8 and enable remote code execution without requiring authentication. CVE-2026-85102 resides in certificate trust validation during VPN negotiation, allowing an unauthenticated attacker to force the process and execute arbitrary code. CVE-2026-85103 is a heap buffer overflow triggered while parsing the ASN.1 structure of VPN certificates. Affected versions include R81.20, R82, and R82.10 before the listed hotfixes, as well as unsupported R80.40 and R81 releases. R82.20 remains unaffected. The issues were discovered internally by Check Point researchers, with no active exploitation or public proof-of-concept observed as of the September 10 disclosure.
Positive Technologies Acquires Stake in CyberOK to Advance EASM and PentOps Technologies
Positive Technologies has acquired a stake in cybersecurity developer CyberOK, with the size of the investment and deal terms remaining undisclosed. The partnership will focus on developing External Attack Surface Management (EASM) solutions and PentOps technologies that identify overlooked external assets and validate whether attackers can exploit them. Collaboration between the companies began in 2026, with CyberOK technologies already integrated into PT EASM and the PT X cloud platform. In less than six months, pilot projects for PT EASM exceeded 70, and Positive Technologies expects 80 percent of successful trials to convert into deals by late 2026 or early 2027. The Russian EASM market is projected at 2-2.5 billion rubles by the end of 2026, potentially reaching 8 billion rubles by 2031 when combined with continuous security validation solutions. PentOps will provide continuous cloud-based penetration testing that automatically verifies exploitability of discovered issues, moving beyond simple vulnerability lists. In 96 percent of pilots, unaccounted IT assets with critical vulnerabilities were identified, and CyberOK continues to develop the Vulnum knowledge base along with AI agents and Offensive SOC capabilities.
Exploiting CVE-2025-55182 React2Shell Vulnerability on Hack The Box Reactor Machine
A detailed walkthrough demonstrates remote code execution against a seasonal Hack The Box machine named Reactor by abusing the critical Next.js deserialization flaw CVE-2025-55182, also known as React2Shell. The attack begins with Nmap reconnaissance revealing an exposed Next.js service on port 3000, followed by Wappalyzer identification of an outdated framework version. Public exploit code is used to obtain an initial reverse shell as the node user without authentication. Credential access is achieved by extracting password hashes from the reactor.db SQLite database and cracking the engineer account with Hashcat against rockyou.txt. Privilege escalation leverages an exposed Node.js Inspector debug port on 9229, allowing WebSocket interaction via websocat to set the SUID bit on /bin/bash and obtain root access. The article highlights both the impact of the unauthenticated RCE vulnerability and common misconfigurations such as forgotten debug ports on production systems.