JFrog Artifactory Vulnerabilities Exploited to Plant Backdoors in Software Supply Chains

Cloud security company Wiz has reported that attackers successfully chained two vulnerabilities in JFrog Artifactory to gain administrator control of self-hosted servers and install backdoors. The attacks occurred between 15 August and 8 September 2026, targeting organisations that had not applied patches released earlier in the year. JFrog Artifactory is a widely used repository manager in software development environments, acting as the central source from which build systems pull dependencies, libraries and artefacts. By compromising Artifactory, attackers can inject malicious code directly into software builds, potentially affecting every application that relies on those repositories.

Why this matters for UK organisations

For UK businesses using JFrog Artifactory in their development pipelines, this represents a direct supply chain risk. If an attacker gains administrator access to your Artifactory instance, they can modify artefacts, inject backdoors into builds, and compromise downstream applications without developers necessarily noticing. This type of attack can have cascading effects across your entire software estate, particularly in organisations with continuous integration and deployment workflows where code moves rapidly from development to production. The fact that these vulnerabilities were exploited in the wild after patches were available highlights a common operational challenge: development infrastructure may not always receive the same patch management discipline as production systems. Many organisations focus security attention on customer-facing applications and production servers, while development tools, build systems and internal repositories may be patched less frequently or monitored less closely. This creates an opportunity for attackers to compromise the software supply chain at its source.

What to review

UK organisations running self-hosted JFrog Artifactory should verify that all instances are patched to the latest version and review access controls, authentication mechanisms and logging for any signs of unauthorised administrative activity. Consider whether your development infrastructure receives the same patch management discipline as production systems, and ensure there is clear ownership for monitoring and responding to security advisories affecting build and deployment tools. Review whether your security team has visibility into development tooling, whether there are processes for auditing changes to repositories and artefacts, and whether your incident response plans account for supply chain compromise scenarios. If you use Artifactory as part of a continuous integration pipeline, consider whether you have controls in place to detect unexpected changes to build artefacts, such as code signing, integrity checks or anomaly detection in build processes. Clarify who is responsible for maintaining and securing development infrastructure, and ensure that security advisories for these tools are monitored and acted upon with the same urgency as vulnerabilities in production systems.

Source: The Hacker News