Loading story…
Attackers are actively exploiting CVE-2026-82329, a critical authentication-bypass vulnerability in JFrog Artifactory, to mint administrative access tokens on exposed vulnerable instances. Under the default configuration, the flaw allows an unauthenticated network attacker to obtain administrative privileges and affects multiple Artifactory release branches.
JFrog released fixes on August 28; its cloud-hosted instances were already patched, but self-hosted customers must upgrade to a fixed Artifactory release immediately. WatchTowr reported exploitation within days of disclosure. The vulnerability was not yet listed in CISA's Known Exploited Vulnerabilities catalog, and is distinct from the previously patched Artifactory flaws connected to the OpenAI-Hugging Face testing-environment escape incident.
See which actors are running it and whether you're in range.
8 events from the most recent confirmed update back to the earliest known activity.
CISA added the actively exploited JFrog Artifactory authentication-bypass vulnerability CVE-2026-82329 to its Known Exploited Vulnerabilities catalog. The KEV entry set a September 5, 2026 remediation deadline for U.S. federal civilian agencies.
In some observed CVE-2026-82329 intrusions, attackers created backdoor Artifactory users after gaining administrative access, allowing them to retain persistence. The activity accompanied administrator-token generation and reconnaissance of compromised environments.
Observed exploitation of CVE-2026-82329 included not only minting administrator tokens but also enumerating Artifactory users, groups, credential sets, and federated access topologies. The activity followed exploitation of self-managed vulnerable instances.
watchTowr reported observing attackers actively exploiting CVE-2026-82329 against vulnerable Artifactory instances. The attackers were reportedly minting Artifactory administrative tokens.
JFrog published advisories and released updates for CVE-2026-82329, a critical Artifactory authentication-bypass flaw that can grant an unauthenticated network attacker administrative privileges under the default configuration. JFrog had already deployed the fixes to its cloud-hosted instances and advised self-hosted customers to upgrade to patched releases.
CISA added the separate JFrog Artifactory vulnerability CVE-2026-66384 to its Known Exploited Vulnerabilities catalog. The flaw requires authentication and can allow writes outside the intended Docker cache path under specific conditions.
Reporting noted that administrative tokens forged through CVE-2026-82329 before remediation may remain valid after an Artifactory binary update, as those credentials use separate expiration controls. This creates a persistence risk that may require invalidating or reviewing forged tokens in addition to applying patches.
A CVEReports report described alleged weaknesses in JFrog Access cryptographic initialization, cluster joining-key validation, and JWT signature verification that could permit reconstruction of master.key, forging of administrative tokens, or acceptance of crafted inter-node messages. The report characterized the self-managed Artifactory issue as network-reachable and critical (CVSS 9.8).
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
17 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcesocradar.io
Open sourcecysecurity.news
Open sourceheise.de
Open sourcecybersecuritynews.com
Open sourcesecurityweek.com
Open sourcegithub.com
Open sourcecvereports.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers are actively exploiting self-hosted JFrog Artifactory servers by chaining `CVE-2026-42018`, which exposes an internal anonymous-user token, with `CVE-2026-42016`, which fails to enforce token scope. The chain turns unauthenticated access into administrator authority. Attackers are also exploiting `CVE-2026-82329`, a CVSS 9.8 authentication-bypass flaw that independently grants administrative access under default configurations on affected release branches. Observed post-compromise activity includes creation of persistent administrator accounts, deployment of malicious Groovy plugins for server-side code execution, webshell uploads, shell commands and downloaders, theft of credentials, configuration data and cluster join keys, and installation of a custom Rust-based backdoor with command-and-control capability. Organizations should immediately upgrade to JFrog's fixed builds, restrict internet exposure, and treat exposed vulnerable instances as potentially compromised by revoking tokens, rotating join keys, and reviewing administrator accounts, plugins, repositories, logs, and configuration changes.
Sep 14, 2026
JFrog disclosed **CVE-2026-42016**, a high-severity privilege-escalation vulnerability in **Artifactory Self-Hosted** caused by incorrect authorization validation of user tokens. The flaw affects versions **before 7.133.11** and stems from token checks that validate the signature and issuer but do **not** verify the token scope, allowing an authenticated user with low privileges to gain elevated access. The issue is tracked as **CWE-863** and carries a **CVSS v3.1** vector of `AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N`, indicating high confidentiality and integrity impact with no direct availability impact. JFrog’s self-managed release documentation lists **7.133.11** as the fixed version for affected deployments, and organizations running on-premises Artifactory are expected to prioritize upgrades. Because exploitation requires only valid low-privilege access and no user interaction, the vulnerability raises the risk of unauthorized access to repositories, artifacts, and administrative functions in environments that have not yet patched.
Jul 28, 2026
JFrog disclosed **CVE-2026-66014**, a high-severity vulnerability in **Artifactory** caused by improper authentication in internal request processing. The flaw, classified as **`CWE-287`**, can allow an authenticated attacker with low privileges to bypass intended authorization boundaries and escalate privileges under specific conditions. The issue carries a **CVSS v3.1 score of 8.8** with vector **`AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`**, indicating high potential impact on confidentiality, integrity, and availability. Multiple Artifactory version ranges are affected, and JFrog has published release and security advisory information identifying remediated versions outside those ranges. The CVE record credits **Amy Burnett of OpenAI** with reporting the issue, and organizations running Artifactory are being directed to review JFrog’s advisory and upgrade guidance to prevent privilege escalation through the vulnerable internal request handling path.
Jul 29, 2026