Attackers Chain JFrog Artifactory Flaws to Gain Admin Control and Plant Backdoors

Attackers have chained two flaws in JFrog Artifactory, the repository that software build pipelines pull from, to take administrator control of self-hosted servers and plant backdoors, cloud security company Wiz said in a report. Wiz saw the attacks between August 15 and September 8. JFrog had fixed both flaws before then, so only servers that had not been updated were open to them.

Fact: Wiz reports that attackers chained two already-patched vulnerabilities in self-hosted JFrog Artifactory to gain administrator control and implant backdoors on servers that had not been updated, in attacks observed between August 15 and September 8; only unpatched instances were exposed. Fact: Artifactory is a core software repository used in build pipelines, so compromise can taint artifacts and potentially propagate malicious code downstream. RealGround analysis: For organizations using Artifactory or similar repositories in AI development pipelines, this illustrates an AI supply chain risk where unpatched build infrastructure can result in contaminated models or dependencies. RealGround analysis: Hardening and continuously monitoring artifact repositories, maintaining SBOMs, and enforcing timely patching are critical to prevent backdoored components from entering AI systems and agents.