JFrog Artifactory Critical Vulnerability Comes Under Attack Within Days

watchTowr has reported that attackers are already exploiting a recently patched critical vulnerability in JFrog Artifactory — a platform for storing and distributing software artifacts. The flaw in question is CVE-2026-82329, which carries a rating of 9.8 on the CVSS scale, about as high as it gets in practice.

What it's about

The issue is an authentication bypass. According to the description on CVE.org, in a default configuration an unauthenticated attacker with network access to the system can obtain administrative privileges. The vulnerability lies in the JFrog Access component, which is responsible for issuing and validating credentials: instances without a separately configured join key receive a “phantom” key, which attackers then use to forge access and issue themselves administrator-level credentials.

JFrog fixed the problem in Artifactory version 7.161.20, released on August 28, 2026. Several product branches are affected — from 7.111.4 through 7.161.19 inclusive.

Exploitation has already begun

Jordan Ganchev, lead threat intelligence specialist at watchTowr, noted that as of September 1, 2026, attackers had started putting the vulnerability to practical use: they generate administrative tokens and enumerate users, groups, credential sets, and federated access topologies. “The path from disclosure to real-world exploitation was covered with uncomfortable efficiency,” he said. “It's only going to get worse from here.”

The danger is compounded by Artifactory's role in the software supply chain. As Vercel's head Guillermo Rauch observed, because the system stores binary files, the vulnerability turns into an “RCE bomb”: literally anything can be compromised. Having gained administrator rights over the central node, attackers are able to do what any engineering team does best — quickly build, publish, and distribute software. From there, the door opens to tampering with build pipelines, lateral movement into production, and injecting malicious changes that reach customers.

What to do

Organizations running self-managed versions of Artifactory are advised to immediately apply the updates to any internet-facing systems. Beyond patching, it's worth reviewing audit logs, rotating potentially compromised credentials, and inspecting connected systems for malicious changes or pre-planted backdoors.

Source: The Hacker News