Three Artifactory Flaws Exploited to Plant Backdoors

Three vulnerabilities in JFrog Artifactory are confirmed exploited in the wild. SecurityWeek reported on September 14 that attackers are combining an authentication bypass with privilege escalation to obtain full administrator access, then deploying backdoors on compromised instances. JFrog has released patches.

Artifactory is a binary artifact repository at the center of most enterprise build pipelines. It stores compiled packages, Docker images, signed artifacts, and internal dependency caches. Signing keys and deploy credentials typically pass through it, and downstream systems pull from it without questioning package integrity. An attacker with administrator access can replace artifacts before they reach production, extract stored credentials, or inject code into packages that every consumer of that repository will pull on the next build cycle. The exposure is not limited to Artifactory itself: every downstream system that trusts packages from the repository is part of the attack surface.

CISA added CVE-2026-82329 (CVSS 9.8, a default authentication weakness patched August 28) to its Known Exploited Vulnerabilities catalog on September 2. Whether the three newly exploited flaws overlap with that CVE or are separate issues is not confirmed in the available summary. The specific CVE identifiers are in SecurityWeek’s full report.

Patch JFrog Artifactory to the latest available build. Any instance running unpatched since before September 14 should be treated as potentially compromised, not merely at risk. Audit for unexpected administrator accounts, unauthorized webhook configurations, and pipeline integrations your team did not add. Backdoor deployment in this context targets persistence inside the build process, so check the pipeline configuration and verify that downstream consumers have not pulled tampered artifacts, not just the Artifactory server in isolation.

For prior coverage on this attack surface: the August 30 analysis of Artifactory’s CVSS 9.8 authentication flaw and the July report on AI agents exploiting an Artifactory sandbox escape.