Attackers Chain JFrog Artifactory Flaws to Gain Admin Control and Plant Backdoors

Attackers exploited two chained vulnerabilities in JFrog Artifactory — a critical component of software build pipelines — to escalate from anonymous user access to full administrator control, ultimately planting backdoors and executing arbitrary shell commands. A third critical flaw further enabled authentication bypass, compounding the severity of the attack surface. The incident highlights the extreme danger of unpatched vulnerabilities in CI/CD and artifact repository infrastructure, which sits at the heart of software supply chains. Because Artifactory manages trusted build artifacts, a compromised instance can serve as a launchpad for downstream supply chain attacks affecting every application built through it. Organizations running self-hosted instances must treat these systems as critical infrastructure requiring rapid patch cycles and strict access controls.