{
 "Event": {
  "uuid": "82d67df5-545f-59b5-bdad-47706b5845aa",
  "info": "JFrog Artifactory flaws chained to administrator access and Rust backdoor deployment",
  "date": "2026-09-01",
  "threat_level_id": "1",
  "analysis": "2",
  "distribution": "3",
  "published": false,
  "Orgc": {
   "name": "SecurityStudies.info"
  },
  "Tag": [
   {
    "name": "tlp:clear"
   },
   {
    "name": "securitystudies:status=\"curated\""
   },
   {
    "name": "securitystudies:type=\"supply_chain\""
   },
   {
    "name": "misp-galaxy:country=\"united states\""
   },
   {
    "name": "misp-galaxy:country=\"germany\""
   },
   {
    "name": "misp-galaxy:country=\"israel\""
   },
   {
    "name": "misp-galaxy:country=\"india\""
   },
   {
    "name": "misp-galaxy:country=\"japan\""
   },
   {
    "name": "misp-galaxy:sector=\"Technology and Software Supply Chain\""
   },
   {
    "name": "misp-galaxy:sector=\"Financial Services\""
   },
   {
    "name": "misp-galaxy:sector=\"Telecommunications\""
   }
  ],
  "Attribute": [
   {
    "type": "link",
    "category": "External analysis",
    "value": "https://securitystudies.info/cyber/incidents/jfrog-artifactory-flaws-chained-to-administrator-access-and-rust-backdoor-deployment/",
    "comment": "SecurityStudies.info entry",
    "to_ids": false
   },
   {
    "type": "link",
    "category": "External analysis",
    "value": "https://thehackernews.com/2026/09/attackers-chain-jfrog-artifactory-flaws.html",
    "comment": "source",
    "to_ids": false
   },
   {
    "type": "link",
    "category": "External analysis",
    "value": "https://www.bleepingcomputer.com/news/security/artifactory-flaws-chained-in-attacks-deploying-backdoor-malware/",
    "comment": "source",
    "to_ids": false
   },
   {
    "type": "link",
    "category": "External analysis",
    "value": "https://www.cisa.gov/news-events/alerts/2026/09/02/cisa-adds-seven-known-exploited-vulnerabilities-catalog",
    "comment": "source",
    "to_ids": false
   },
   {
    "type": "text",
    "category": "Other",
    "value": "Wiz disclosed coordinated exploitation of CVE-2026-42018, which returns an internal anonymous-user token to an unauthenticated caller, chained with CVE-2026-42016 to escalate that token to administrator scope, taking attackers from first request to new admin account in under five minutes. Separately CVE-2026-82329, a CVSS 9.8 authentication bypass, was exploited between 1 and 8 September with approximately 406,000 attempts detected on 2 September alone. Post-compromise activity included persistent admin account creation, malicious Groovy plugin installation, custom Rust backdoor deployment and extraction of cluster join keys for lateral movement. Cloud instances were unaffected; CISA KEV-listed CVE-2026-42016 and CVE-2026-42018 on 11 September and CVE-2026-82329 on 2 September.",
    "comment": "summary",
    "to_ids": false
   }
  ]
 }
}