CVE Tools
Track your stack

Hackers exploit critical JFrog Artifactory flaw to forge admin tokens

BleepingComputerBy Bill Toulas

Reported exploitedJFrog Artifactory

Our summary

Attackers are actively exploiting a critical authentication bypass vulnerability, tracked as CVE-2026-82329, in self-managed JFrog Artifactory instances. This flaw exists within the default configuration and permits unauthenticated network attackers to forge administrative tokens, granting them full control over the repository manager.

The compromise allows adversaries to tamper with trusted software artifacts, potentially injecting malicious code into downstream build and deployment systems that automatically pull packages from Artifactory. Because issued tokens remain valid even after binary upgrades, organizations must revoke existing credentials alongside applying patches. JFrog resolved the issue on August 28 in versions 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, and 7.161.20.

Read at BleepingComputer

BleepingComputer publishes this story on its own site; we link to it rather than reprint it.

  1. The Hacker News⚡ Weekly Recap: Rogue AI Agents, WeChat Worm, PaperCut Attacks, AI Espionage, and RootkitsCVE-2026-82329
  2. SecurityWeekThree JFrog Artifactory Flaws Exploited for Backdoor DeploymentCVE-2026-82329
  3. The Hacker NewsCISA Adds 5 Actively Exploited Artifactory, ScreenConnect, and RouterOS Flaws to KEVCVE-2026-82329
  4. BleepingComputerArtifactory flaws chained in attacks deploying backdoor malwareCVE-2026-82329
  5. Bishop FoxCVE-2026-82329: Unauthenticated Administrative Access in JFrog Artifactory via an Empty Cluster Join KeyCVE-2026-82329
  6. The Hacker NewsAttackers Chain JFrog Artifactory Flaws to Gain Admin Control and Plant BackdoorsCVE-2026-82329
  7. Check Point Research7th September – Threat Intelligence ReportCVE-2026-82329
  8. The Hacker NewsCISA Adds Seven Exploited Flaws as Attackers Deploy Reverse Shells and Crypto MinersCVE-2026-82329
  9. Dark ReadingAttackers Pounce on Critical Artifactory Flaw Following DisclosureCVE-2026-82329
  10. The Hacker NewsAttackers Exploit Critical JFrog Artifactory Flaw to Mint Admin Tokens Days After DisclosureCVE-2026-82329

Worried this affects your company?

Discuss a security assessment of your internet-facing systems. Scope agreed before testing.

Check my exposure

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store