Hackers Chain Two JFrog Artifactory Bugs to Plant Backdoors on Unpatched Servers

Key points

• Cloud security firm Wiz reported attackers chaining two flaws in JFrog Artifactory to seize administrator control of self-hosted servers.
• The attacks ran from August 15 to September 8, 2025, and ended in backdoors planted on victim systems.
• JFrog had already patched both bugs before the campaign began, so only unpatched, self-hosted installs were exposed.
• Artifactory sits inside software build pipelines, meaning a compromised server can poison the code that ships to customers.
• Admins running self-hosted Artifactory should confirm they are on the latest release and hunt for signs of tampering.

Attackers strung together two separate bugs in JFrog Artifactory, the storage system that software teams pull code and build components from, to take full administrator control of servers running older versions. That is according to a report from cloud security company Wiz, first flagged by The Hacker News.

Once inside, the attackers planted backdoors: hidden ways back in that let them return whenever they like, even after the original hole is closed.

Wiz says it saw the activity between August 15 and September 8, 2025.

What is JFrog Artifactory and why does this matter?

Artifactory is the warehouse that feeds a company's software factory. Developers pull building blocks from it and push finished code into it. If an attacker owns that warehouse, they can quietly swap parts in the products a company ships to its own customers.

That is the reason a bug in a piece of back-office plumbing gets treated as a serious problem. It sits upstream of everything.

How did the attack work?

The attackers combined two separate flaws in Artifactory into a single chain. One flaw got them a foothold. The second escalated that foothold into full admin rights on the server. From there they installed backdoors so they could keep access even after the box was cleaned up.

Wiz has not published a full technical writeup naming the individual CVE identifiers in the source we reviewed, and JFrog's own advisory pages are the authoritative record for exact CVE numbers and fixed-version strings (admins should pull those directly from the vendor rather than trust a third-party summary).

Were any servers actually safe?

Yes. JFrog had already shipped fixes for both bugs before the attacks started. Any customer who applied those updates on schedule was not exposed to this chain. The victims were self-hosted servers, meaning Artifactory instances that a company runs on its own infrastructure, whose owners had not installed the patches.

JFrog's cloud-hosted service, which the vendor updates for customers, is not implicated in the same way.

Campaign at a glance

What should Artifactory admins do now?

Check your version and update if you are behind. That is the single action that closes this door. After patching, assume nothing: review admin accounts, API tokens and scheduled tasks for anything you did not create, and look at outbound network traffic from the Artifactory host for connections you cannot explain.

Backdoors survive patches. A server that was owned before you updated is still owned after.

Does this affect ordinary people?

Not directly, and not today. There is no customer data breach attached to this campaign. The risk is second-hand: if a software vendor you rely on was running a poisoned Artifactory, a future update from them could carry something nasty. That is the supply-chain concern, and it is why defenders take these bugs seriously even when no consumer name is on the incident.

For now, the practical action lives with the companies running Artifactory, not with their customers.