JFrog Artifactory: Three Chained Flaws Turn an Unauthenticated Request Into Admin — and a Rust Backdoor Survived the Patch
Two patched JFrog Artifactory flaws chain into unauth-to-admin in under five minutes, CISA put both on KEV with a Sep 25 due date, and Wiz found attackers installing Groovy plugins and a custom Rust backdoor that reportedly outlived patching.
Critical severity, 4 of 4. Act now — exploited, or trivially exploitable on an exposed service.CVSS 8.1Exploited in the wildKEV due 25 SEP 2026CVE-2026-42018 +2
jfrogartifactorykev