JFrog patched three server vulnerabilities exploited to create admin accounts.
Attackers exploited three vulnerabilities in JFrog Artifactory to deploy backdoors on self-hosted instances, SecurityWeek reported.
The flaws had been patched months earlier.
CVE-2026-42016 was fixed on 27 July. CVE-2026-42018 followed on 12 August, then CVE-2026-82329 on 28 August.
Between mid-August and early September, attackers chained CVE-2026-42018 with CVE-2026-42016 against self-hosted instances. They created persistent admin accounts and installed malicious plugins. From there, they ran shell commands and dropped additional payloads.
Other actors used CVE-2026-82329 to steal configuration and mint tokens. They also exfiltrated cluster keys. SecurityWeek states that CISA added all three flaws to its Known Exploited Vulnerabilities catalog.
The designation under BOD 26-04 gives federal agencies two weeks to patch. An artifact repository is where builds originate. An admin account there signs whatever the pipeline ships next.
When did you last patch the systems that build your software, rather than the ones that run it?
Sources
For your next steering committee
- 1Ask when systems of this kind in your landscape were last patched, and who confirms it.
- 2Ask which finance and ERP accounts can be reached from outside, and how each sign-in is protected.
- 3Ask how long a restore took the last time it was tested.
Issue 01 of the ERP LEADERS brief puts a timeline, the three-number review and six questions on one page. Read issue 01
Welcome back. · Issue 01