Threat actors are exploiting a newly patched critical security flaw impacting JFrog Artifactory merely days after public disclosure, according to watchTowr.
The vulnerability in question is CVE-2026-82329 (CVSS score: 9.8), a case of authentication bypass that could lead to administrative access in Artifactory.
“JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges,” according to a description of the flaw on CVE.org.
The vulnerability was patched by JFrog with Artifactory version 7.161.20 released on August 28, 2026. It affects the following versions –
- 7.161.0 > 7.161.19
- 7.146.0 > 7.146.36
- 7.133.0 > 7.133.28
- 7.125.0 > 7.125.19
- 7.117.0 > 7.117.27
- 7.111.4 > 7.111.21
“It affects default configs, requires no auth, no user interaction,” Vercel CEO Guillermo Rauch said in a post on LinkedIn. “It’s an RCE bomb because Artifactory hosts binaries, so you can basically poison everything, but an admin escalation can cause damage even beyond that.”
The issue resides in JFrog Access, which is designed to issue and validate credentials. “Instances without an additional join key configured receive a ‘phantom’ join key that attackers can abuse to forge access and mint administrator-level credentials,” Yordan Ganchev, principal threat intelligence specialist at watchTowr, said in a statement shared with The Hacker News.
Ganchev also pointed out that threat actors have begun to weaponize the flaw as of September 1, 2026, to generate admin tokens and enumerate users, groups, credential sets and federated access topologies.
“This moved from disclosure to real-world exploitation with uncomfortable efficiency,” Ganchev added. “Anyone following along knows what comes next: things will get worse.”
“When attackers gain admin level access to a central software supply chain system, they can do what every engineering team does best – build, ship and distribute software fast. From there, they could tamper with build pipelines, move laterally into production systems and potentially push malicious changes downstream to customers.”
Organizations that are running self-managed versions of JFrog Artifactory are recommended to apply patches to internet-exposed systems with immediate effect, as well as inspect audit logs, rotate exposed credentials, and review connected systems for malicious changes or backdoor access.
