--- schema: 1 kind: vulnerability title: "CVE-2026-82329 — JFrog Artifactory: an unauthenticated attacker gets administrative access under default configuration (CVSS 9.8)" headline: "JFrog patches a default-configuration authentication bypass that hands an unauthenticated network attacker full Artifactory admin" summary: > JFrog disclosed CVE-2026-82329 on 2026-08-28, a Critical (CVSS 9.8) authentication weakness in Artifactory that, under default configuration, lets an unauthenticated attacker with only network access obtain administrative privileges. Self-hosted branches across six release lines are affected; JFrog-hosted cloud instances were already remediated. The flaw is now confirmed under active exploitation, with attackers minting administrator tokens within days of the patch. discovered_at: "2026-09-01T04:11:32Z" updated_at: "2026-09-02T04:40:00Z" event_date: "2026-08-28" run_id: 2026-09-01T0411Z-intel priority: critical immediate_action: title: "Patch every self-hosted JFrog Artifactory instance now — active exploitation confirmed" action: > CVE-2026-82329 (CVSS 9.8) is a pre-auth authentication bypass that hands an unauthenticated network attacker full administrative access to Artifactory under default configuration, and watchTowr's Attacker Eye honeypot network has recorded real-world exploitation since 1 September — attackers minting admin tokens and enumerating users, groups, credential sets and federated access topologies within days of the 28 August patch. Any unpatched, self-hosted, internet-reachable instance should be treated as already probed: patch to the fixed build for its branch immediately, then inspect JFrog Access and audit logs for admin-scoped tokens minted without a preceding interactive admin login and rotate every credential the instance held — an admin-compromised Artifactory instance is a software-supply-chain pivot point. tags: [vulnerabilities, rce, auth-bypass, patch-available, actively-exploited] regions: [global] sectors: [technology] entities: [] techniques: [T1190, T1606] affected_products: ["JFrog Artifactory"] cves: - id: CVE-2026-82329 cvss: "9.8" epss: "0.377" type: auth-bypass vector: zero-click auth: pre-auth status: [exploited, patch-available] affected: "7.111.4–7.111.20, 7.117.0–7.117.27, 7.125.0–7.125.19, 7.133.0–7.133.28, 7.146.0–7.146.36, 7.161.0–7.161.19" fixed: "7.111.21 / 7.117.28 / 7.125.20 / 7.133.29 / 7.146.38 / 7.161.20" sources: - url: "https://docs.jfrog.com/releases/docs/jfrog-security-advisories" publisher: "JFrog Security Advisories" date: "2026-08-28" role: primary - url: "https://github.com/advisories/GHSA-c5pf-6p5j-gj87" publisher: "GitHub Advisory Database (NVD mirror)" date: "2026-08-28" role: corroborating - url: "https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases" publisher: "JFrog Artifactory Self-Managed Release Notes" date: "2026-08-28" role: corroborating - url: "https://www.ionix.io/threat-center/cve-2026-82329/" publisher: "IONIX Threat Center" date: "2026-08-31" role: corroborating - url: "https://security-hub.ncsc.admin.ch/#/posts/12902" publisher: "NCSC Switzerland (GovCERT.ch) Cyber Security Hub" date: "2026-09-01" role: corroborating - url: "https://thehackernews.com/2026/09/attackers-exploit-critical-jfrog.html" publisher: "The Hacker News" date: "2026-09-01" role: corroborating - url: "https://www.securityweek.com/critical-jfrog-artifactory-vulnerability-reportedly-exploited-in-the-wild/" publisher: "SecurityWeek" date: "2026-09-01" role: corroborating closed_sources: [] evidence: - quote: "JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges." publisher: "GitHub Advisory Database (NVD mirror)" - quote: "The flaw carries a CVSS v3.1 base score of 9.8 (Critical) and requires no authentication, privileges, or user interaction to exploit." publisher: "IONIX Threat Center" - quote: "Current exploitation status: Actively Exploited" publisher: "NCSC Switzerland (GovCERT.ch) Cyber Security Hub" - quote: "Instances without an additional join key configured receive a 'phantom' join key that attackers can abuse to forge access and mint administrator-level credentials." publisher: "The Hacker News, quoting Yordan Ganchev (watchTowr)" - quote: "Data from watchTowr's global Attacker Eye honeypot network shows attackers minting administrator tokens and enumerating users, groups, credential sets and federated access topologies." publisher: "SecurityWeek, quoting Yordan Ganchev (watchTowr)" verification: multi-source sourcing_note: "The vulnerability disclosure itself is corroborated by independent parties (JFrog's own advisory, GitHub Advisory Database, IONIX Threat Center). The 2026-09-02 exploitation-confirmation update traces to a single origin, watchTowr, restated by NCSC-CH, The Hacker News and SecurityWeek rather than independently confirmed by any of them — the same restates-not-corroborates pattern that keeps credibility at 2 rather than 1." confidence: high references: ["2026-08-28/cve-2026-66384-jfrog-artifactory-docker-cache-traversal-kev"] deep_dive: false deep_dive_category: null org_triage: null classification: reliability: A credibility: 2 watchlist_hit: false actions: - "Upgrade every self-hosted Artifactory instance to its fixed build now — exploitation is confirmed, not hypothetical. On any instance that was internet-reachable and unpatched since 28 August, review JFrog Access and audit logs for admin-scoped tokens minted without a matching interactive admin login, and rotate every credential the instance held." updates: - at: "2026-09-02T04:40:00Z" run_id: 2026-09-02T0411Z-intel type: update summary: > CVE-2026-82329 has moved from disclosed to actively exploited within days of the patch. NCSC Switzerland's advisory and watchTowr's own Attacker Eye honeypot telemetry both record active exploitation, and watchTowr names the mechanism: a default "phantom" join key in JFrog Access lets an unauthenticated attacker forge access and mint administrator-level credentials, which attackers are now using to enumerate users, groups, credential sets and federated access topologies. Priority moves to critical given confirmed exploitation of a pre-auth path to full admin control of CI/CD supply-chain infrastructure. fields: [cves, tags, techniques, actions, priority, immediate_action, summary, sources, evidence, classification, sourcing_note] migrated_from: null --- JFrog disclosed CVE-2026-82329 on 2026-08-28: an authentication weakness in Artifactory, its widely deployed CI/CD binary and artifact repository, that under default configuration lets an unauthenticated attacker with only network access obtain full administrative privileges ([GitHub Advisory Database, 2026-08-28](https://github.com/advisories/GHSA-c5pf-6p5j-gj87)). CVSS 3.1 base score is 9.8 (`AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`) and the flaw carries CWE-287, Improper Authentication. JFrog has not published the specific request path or authentication defect being bypassed, so defenders cannot yet reason about a concrete exploitation signature beyond the precondition: a self-hosted, network-reachable instance still on its default configuration ([IONIX Threat Center, 2026-08-31](https://www.ionix.io/threat-center/cve-2026-82329/)). Self-hosted branches 7.111.4 through 7.111.20, 7.117.0 through 7.117.27, 7.125.0 through 7.125.19, 7.133.0 through 7.133.28, 7.146.0 through 7.146.36 and 7.161.0 through 7.161.19 are affected; fixes shipped the same day in 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38 and 7.161.20 respectively, per each fixed release's own "CVEs Addressed" listing ([JFrog Artifactory Self-Managed Release Notes, 2026-08-28](https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases)). JFrog's summary advisory table names the same six fixed versions but its "Versions" column is internally inconsistent for the 7.111 branch alone — it prints the fixed version, 7.111.21, as the range's own end rather than the last affected build — so the affected/fixed boundaries above are drawn from the per-release notes, the more granular and internally consistent source, rather than that summary column ([JFrog Security Advisories, 2026-08-28](https://docs.jfrog.com/releases/docs/jfrog-security-advisories)). JFrog-hosted cloud environments were already remediated before disclosure and need no customer action ([JFrog Security Advisories, 2026-08-28](https://docs.jfrog.com/releases/docs/jfrog-security-advisories)). No party reported observed in-the-wild exploitation at disclosure, but the flaw's own mechanics (pre-auth, no user interaction, network-reachable, full admin takeover) put it in the imminent-exploitation risk class for any instance an attacker could reach, particularly since Artifactory instances custody CI/CD credentials and build artifacts — a risk the update below confirms materialized within days. This is a distinct vulnerability from CVE-2026-66384, the Medium-severity, KEV-listed Docker-cache path-traversal bug on the same product already covered separately (patched 12 August) — this critical-severity flaw is the more severe of the two Artifactory vulnerabilities to surface within the same August 2026 release cycle. **Defender takeaway:** patch every self-hosted branch to its fixed build now; there is no configuration workaround published, only network exposure reduction. Because the vendor has withheld the specific bypass mechanism, treat any newly discovered administrator account, API key, or permission-group change on an unpatched instance as a compromise indicator requiring investigation rather than routine configuration drift, and review Artifactory's own access and audit logs for administrative-privilege API actions with no matching successful authentication event immediately preceding them. ## Update — 2026-09-02T04:40:00Z CVE-2026-82329 has moved from disclosed to actively exploited. NCSC Switzerland's advisory, created 2026-09-01, records the current exploitation status as "Actively Exploited" ([NCSC Switzerland Cyber Security Hub, 2026-09-01](https://security-hub.ncsc.admin.ch/#/posts/12902)), and watchTowr's own telemetry independently caught the same activity: "this moved from disclosure to real-world exploitation with uncomfortable efficiency," per watchTowr's Yordan Ganchev ([The Hacker News, 2026-09-01](https://thehackernews.com/2026/09/attackers-exploit-critical-jfrog.html)). Data from watchTowr's global Attacker Eye honeypot network shows attackers minting administrator tokens and enumerating users, groups, credential sets and federated access topologies ([SecurityWeek, 2026-09-01](https://www.securityweek.com/critical-jfrog-artifactory-vulnerability-reportedly-exploited-in-the-wild/)). watchTowr names the mechanism: the flaw sits in JFrog Access, the component that issues and validates Artifactory credentials, and an instance with no additional join key configured receives a default "phantom" join key that an unauthenticated attacker can abuse to forge access and mint administrator-level credentials ([The Hacker News, 2026-09-01](https://thehackernews.com/2026/09/attackers-exploit-critical-jfrog.html)) — reconnaissance consistent with staging a software-supply-chain pivot into the binaries and containers Artifactory distributes downstream. As of 1 September, CISA had not yet added CVE-2026-82329 to its Known Exploited Vulnerabilities catalog ([SecurityWeek, 2026-09-01](https://www.securityweek.com/critical-jfrog-artifactory-vulnerability-reportedly-exploited-in-the-wild/)). Given confirmed active exploitation of a pre-auth, no-interaction path to full administrative control of a system that custodies CI/CD credentials and build artifacts, this entry's priority moves to critical. **Defender takeaway (updated):** treat any unpatched, internet-reachable, self-hosted instance as already probed. Beyond patching, inspect Artifactory audit logs and JFrog Access logs for admin-scoped tokens minted with no preceding interactive admin login, review newly created or modified users, groups and permission targets, and rotate every credential the instance held.