Attackers exploited two chained vulnerabilities in JFrog Artifactory to seize administrator access on self-hosted instances and deploy persistent backdoors, according to research from cloud security firm Wiz. The attacks occurred between August 15 and September 8, targeting unpatched servers after JFrog had already released fixes for both flaws.
JFrog Artifactory serves as a central repository for software build pipelines across organizations worldwide. Compromising it grants attackers access to the software supply chain itself. An attacker with admin control can inject malicious code into packages, modify builds, or distribute compromised artifacts to downstream users. This positions Artifactory as a high-value target for supply chain attacks.
Wiz identified active exploitation during the two-week window. The research team observed attackers chaining the two vulnerabilities sequentially to escalate privileges. While JFrog had already patched both flaws in earlier updates, organizations running older versions remained exposed. This gap between patch availability and deployment created the attack window.
The specifics of which CVEs were exploited remains partially unclear from the available reporting, but the attack pattern follows standard privilege escalation methodology. The attackers first gained initial access through one vulnerability, then leveraged a second flaw to elevate to administrator privileges. Once in control, they installed backdoors for persistent access and future exploitation.
Organizations running JFrog Artifactory on-premises deployments faced the greatest risk during this period. Cloud-hosted instances managed by JFrog likely received automatic updates, reducing their exposure window. Self-hosted deployments depend on system administrators to manually apply security patches, creating a common delay between patch release and deployment.
The backdoor installation compounds the severity of this attack. A backdoor grants attackers long-term access even after the original vulnerabilities are patched. Defenders must detect and remove backdoors separately, requiring threat hunting and forensic investigation. This creates a secondary cleanup burden beyond simply applying patches.
Organizations should verify their JFrog Artifactory versions immediately. The company publishes security advisories detailing affected versions and required updates. Any instance running a version prior to the patch dates requires emergency patching. Administrators should check deployment logs between August 15 and September 8 for suspicious activity, including unusual login attempts, permission changes, or repository modifications.
Artifact repositories occupy a critical position in modern development infrastructure. Compromising them enables attackers to reach every organization that consumes the poisoned artifacts. This makes supply chain attacks through repositories particularly valuable to threat actors pursuing mass compromise campaigns or targeting specific high-value organizations.
Wiz recommends implementing network segmentation around artifact repositories, enforcing strong authentication, and maintaining audit logs of all administrative actions. Organizations should also consider implementing integrity verification for downloaded artifacts and restricting which build systems can access repositories. These layered controls reduce the blast radius if a repository is compromised.
The incident underscores why patch management timelines matter for infrastructure software. Even brief delays between patch release and deployment can expose organizations to active exploitation. DevOps teams managing artifact repositories should prioritize these updates above standard patch cycles.