Reported Artifactory exploit chain deploys Rust backdoors on self-hosted servers

From an anonymous token to administrator access

Wiz reported observing multiple threat actors chain CVE-2026-42018 and CVE-2026-42016 between August 15 and September 8, 2026, against self-hosted Artifactory instances. The report says the actors established persistence with a custom Rust backdoor with command-and-control capabilities and, in some cases, performed follow-on actions including data theft and webshell uploads.

Before the reported activity, the available account does not establish that these self-hosted Artifactory instances had been compromised through this two-vulnerability chain.

The reported attacks chain CVE-2026-42018 and CVE-2026-42016: first obtaining a low-privilege internal anonymous-user JWT, then exchanging it for an administrator-scoped token. Attackers reportedly used that access to create accounts, install malicious Groovy plugins, and deploy a Rust-based backdoor for persistence.

Persistence after administrative access

The reported sequence combines authentication bypass and insufficient token validation to turn limited access into administrator-level control, then uses plugins and long-lived tokens to maintain access. Wiz also warned that 49% to 62% of reachable Artifactory instances were vulnerable to at least one of three cited flaws.