Hackers Chain Two JFrog Artifactory Bugs to Plant Backdoors on Unpatched Servers
Wiz tracked the attacks from August 15 to September 8. Both flaws were already fixed. Servers that skipped the update paid the price.
Key points
- Cloud security firm Wiz reported attackers chaining two flaws in JFrog Artifactory to seize administrator control of self-hosted servers.
- The attacks ran from August 15 to September 8, 2026, backdoors were planted on victim systems.
- JFrog had already patched both bugs before the campaign began, so only unpatched, self-hosted installs were exposed.
- Artifactory sits inside software build pipelines, meaning a compromised server can poison the code that ships to customers.
- Admins running self-hosted Artifactory should confirm they are on the latest release and hunt for signs of tampering.
Attackers strung together two separate bugs in JFrog Artifactory, the storage system that software teams pull code and build components from, to take full administrator control of servers running older versions. That's according to a report from cloud security company Wiz, first flagged by The Hacker News. Once inside, the attackers planted backdoors: hidden footholds that let them return even after the original hole is closed.
Wiz saw the activity between August 15 and September 8, 2026. We've been tracking this product closely; our story on 1 September 2026, "Hackers Are Already Exploiting a Critical Flaw in JFrog Artifactory", covered an earlier authentication weakness that attackers turned into full admin access within days of it being patched.
What is JFrog Artifactory and why does this matter?
Artifactory is the warehouse that feeds a company's software factory. Developers pull building blocks from it and push finished code into it. If an attacker owns that warehouse, they can quietly swap parts in products a company ships to its own customers. That's why a bug in back-office plumbing gets treated as a serious problem. It sits upstream of everything.
How did the attack work?
The attackers combined two flaws into a single chain. One got them a foothold; the second escalated it into full admin rights. From there they installed backdoors to keep access even after the server was cleaned up.
Wiz hasn't published a full technical writeup naming individual CVE identifiers, and JFrog's own advisory pages are the authoritative record for exact CVE numbers and fixed-version strings. Admins should pull those directly from the vendor.
Were any servers actually safe?
Yes. JFrog had shipped fixes for both bugs before the attacks started. Customers who applied those updates weren't exposed. The victims were self-hosted servers whose owners hadn't installed the patches. JFrog's cloud-hosted service, which the vendor updates for customers, isn't implicated in the same way.
Campaign at a glance
| Item | Detail |
|---|---|
| Product | JFrog Artifactory (self-hosted) |
| Bugs used | Two, chained together |
| Outcome | Administrator control, backdoors installed |
| Attack window | August 15 to September 8, 2026 |
| Reported by | Wiz |
| Patches available | Yes, before the attacks began |
What should Artifactory admins do now?
Check your version and update if you're behind. That's the single action that closes this door. After patching, assume nothing: review admin accounts, API tokens, scheduled tasks for anything you didn't create, and look at outbound network traffic from the Artifactory host for connections you can't explain.
Backdoors survive patches. A server that was owned before you updated is still owned after.
Does this affect ordinary people?
Not directly, not today. There's no customer data breach attached to this campaign. The risk is second-hand: if a software vendor you rely on was running a poisoned Artifactory, a future update from them could carry something nasty. That's the supply-chain concern, and it's why defenders take these bugs seriously even when no consumer name is on the incident.
The practical action lives with the companies running Artifactory, not with their customers. What's worth watching here isn't the backdoor count, it's how many organisations running Artifactory still haven't patched a product that's been under active attack for weeks.
