[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f4nLFtQcjhYfe4whxJ97pfWOUZ6zSz2muOA7gv1x9GBc":3},{"article":4,"iocs":49,"watch_terms":60,"solutions":61,"lesson":161},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"ff165912-dd8d-4feb-b752-b9b45f225e4e","Artifactory flaws chained in attacks deploying backdoor malware","artifactory-flaws-chained-in-attacks-deploying-backdoor-malware-a9e03a","Threat actors are exploiting critical and high-severity vulnerabilities in JFrog Artifactory to bypass authentication, gain administrative privileges, and deploy a Rust backdoor on vulnerable self-hosted servers. [...]","Threat actors are actively exploiting critical vulnerabilities in JFrog Artifactory, specifically CVE-2026-42018 and CVE-2026-42016, to bypass authentication and gain administrative privileges. Attackers are chaining these flaws to deploy a custom Rust backdoor on self-hosted Artifactory servers, with some instances compromised in under five minutes. Wiz reports that a significant percentage of Artifactory instances are vulnerable.","Attackers exploit Artifactory flaws to gain admin access and deploy Rust backdoor.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fartifactory-flaws-chained-in-attacks-deploying-backdoor-malware\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2025\u002F03\u002F12\u002Fhacker.jpg","2026-09-11T16:29:44+00:00","2026-09-11T18:00:38.517581+00:00",9,[17,20,23],{"name":18,"type":19},"Artifactory","product",{"name":21,"type":22},"JFrog","vendor",{"name":24,"type":25},"JWT","technology","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":26,"icon":28,"name":29,"slug":30},null,"Vulnerabilities","vulnerabilities",[32,37,39,44],{"category":33},{"id":34,"icon":28,"name":35,"slug":36},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":38},{"id":26,"icon":28,"name":29,"slug":30},{"category":40},{"id":41,"icon":28,"name":42,"slug":43},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":45},{"id":46,"icon":28,"name":47,"slug":48},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[50,54,57],{"type":51,"value":52,"context":53},"cve","CVE-2026-42018","Vulnerability used to obtain an internal Artifactory anonymous user JWT.",{"type":51,"value":55,"context":56},"CVE-2026-42016","Vulnerability used for insufficient token validation to increase permissions.",{"type":51,"value":58,"context":59},"CVE-2026-82329","Critical authentication bypass vulnerability observed being exploited.",[21,18],{"controls":62,"vendors":149},[63,91,120],{"slug":64,"name":65,"problem":66,"products":67},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[68,76,83],{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":64,"product_name":80,"url":81,"description":82},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","Privileged Access Management","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fprivileged-access-management","Gives elevated rights to specific applications only where needed, so users do not need local admin accounts.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"delinea","Delinea","\u002Fvendor-logos\u002Fdelinea.png","secret-server","Delinea Secret Server","https:\u002F\u002Fdelinea.com\u002Fproducts\u002Fsecret-server","Vault for privileged credentials with discovery, rotation and session recording.",{"slug":92,"name":93,"problem":94,"products":95},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[96,104,112],{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"slug":121,"name":122,"problem":123,"products":124},"patch-management","Automated patch management","Known holes get closed in days, not months.",[125,133,141],{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":142,"vendor_name":143,"vendor_logo":144,"product_slug":145,"product_name":146,"url":147,"description":148},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",[150,155],{"slug":151,"name":21,"logo_path":152,"roles":153},"jfrog","\u002Fvendor-logos\u002Fjfrog.png",[154],"affected",{"slug":156,"name":157,"logo_path":158,"roles":159},"wiz","Wiz","\u002Fvendor-logos\u002Fwiz.png",[160],"reported_by",{"slug":162,"title":163,"body":164,"framework_refs":165,"framework_notes":180},"chained-artifactory-flaws-enable-rapid-backdoor-deployment","Chained Artifactory Flaws Enable Rapid Backdoor Deployment","Attackers are actively chaining two critical vulnerabilities in JFrog Artifactory to bypass authentication and escalate to administrative privileges, enabling deployment of a custom Rust-based backdoor in as little as five minutes. The root cause is unpatched, internet-facing software hosting sensitive build artifacts and software supply chain components — a high-value target for adversaries. The speed of compromise underscores that simply knowing about a vulnerability is insufficient; organizations must act on patches immediately, especially for externally accessible infrastructure. Because Artifactory sits at the heart of software development pipelines, a compromise can cascade into downstream supply chain attacks affecting every artifact and dependency it manages.",[166,167,168,169,170,171,172,173,174,175,176,177,178,179],"CIS Control 7: Continuous Vulnerability Management","CIS Control 4: Secure Configuration of Enterprise Assets","CIS Control 6: Access Control Management","CIS Control 8: Audit Log Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 AC-2: Account Management","NIST SP 800-53 AC-17: Remote Access","NIST SP 800-53 AU-6: Audit Record Review and Analysis","NIST CSF ID.RA-1: Asset Vulnerabilities Identified","NIST CSF RS.MI-3: Newly Identified Vulnerabilities Mitigated","SSDF (NIST SP 800-218) PO.5: Implement and Maintain Secure Environments","ITIL Change Management: Emergency Change Procedures","OWASP Top 10 A05: Security Misconfiguration","GDPR Article 32: Security of Processing (for EU-hosted instances storing personal data)",{}]