Three patched JFrog Artifactory flaws reportedly under active exploitation

Administrative takeovers reported after patches

The report describes exploitation of CVE-2026-42018, CVE-2026-42016, and CVE-2026-82329 in JFrog Artifactory. It says attackers used the flaws to obtain administrative control over vulnerable instances. Reported follow-on activity includes persistent administrator accounts, malicious plugins, remote command execution, credential-related activity, and backdoors. The three flaws were patched by JFrog before the reported exploitation activity.

The three flaws had patches available from JFrog, and exploitation had not begun until after those fixes were issued, according to the report.

The report says attackers are now exploiting all three patched flaws across multiple environments, obtaining administrative access and in some cases adding backdoors or other persistence.

The reported intrusions and persistence continued after fixes were released for the software repository. The account illustrates the gap between patches being available and individual installations having applied them.