JFrog Artifactory auth-bypass, CVSS 9.8, now confirmed under active exploitation (watchTowr, NCSC-CH); attackers minting admin tokens via a default 'phantom' join key

CVE-2026-82329 has moved from disclosed to actively exploited. NCSC Switzerland's advisory, created 2026-09-01, records the current exploitation status as "Actively Exploited" (NCSC Switzerland Cyber Security Hub, 2026-09-01), and watchTowr's own telemetry independently caught the same activity: "this moved from disclosure to real-world exploitation with uncomfortable efficiency," per watchTowr's Yordan Ganchev (The Hacker News, 2026-09-01). Data from watchTowr's global Attacker Eye honeypot network shows attackers minting administrator tokens and enumerating users, groups, credential sets and federated access topologies (SecurityWeek, 2026-09-01). watchTowr names the mechanism: the flaw sits in JFrog Access, the component that issues and validates Artifactory credentials, and an instance with no additional join key configured receives a default "phantom" join key that an unauthenticated attacker can abuse to forge access and mint administrator-level credentials (The Hacker News, 2026-09-01), reconnaissance consistent with staging a software-supply-chain pivot into the binaries and containers Artifactory distributes downstream. As of 1 September, CISA had not yet added CVE-2026-82329 to its Known Exploited Vulnerabilities catalog (SecurityWeek, 2026-09-01).

Given confirmed active exploitation of a pre-auth, no-interaction path to full administrative control of a system that custodies CI/CD credentials and build artifacts, this entry's priority moves to critical.

Defender takeaway (updated): treat any unpatched, internet-reachable, self-hosted instance as already probed. Beyond patching, inspect Artifactory audit logs and JFrog Access logs for admin-scoped tokens minted with no preceding interactive admin login, review newly created or modified users, groups and permission targets, and rotate every credential the instance held.

Wiz Research has now published the specific exploitation pattern this entry previously said the vendor had withheld. Between 1 and 8 September 2026, Wiz observed several threat actors successfully exploit this flaw, every initial exploitation following the same pattern: "an unauthenticated POST /access/api/v1/registry/join returning HTTP 200 or 201 with an admin-scoped token in the response body, followed by post-exploitation activities" (Wiz Research, 2026-09-10). Wiz describes the post-exploitation behavior as varying by actor rather than a single fixed chain, drawn from: configuration exfiltration via the system-configuration endpoint, creation of persistent administrator accounts, minting of long-lived credentials, theft of the instance's own join key from its security endpoint, and enumeration of users, repositories and tokens; some actors also attached their own SSH keys to newly created accounts. NCSC Switzerland's own advisory for this CVE was updated on 2026-09-14 to point administrators to Wiz's findings.

Defender takeaway (updated again): the specific exploitation signature is now public: an unauthenticated POST to the registry-join endpoint returning a 200 or 201 with a token is the confirmable indicator, and it must be correlated with follow-on activity (new administrator accounts, configuration reads, token or credential enumeration, or a request for the instance's own join key) to distinguish exploitation from a false positive, since the join-request alone is not sufficient evidence on its own.