JFrog Artifactory CVE-2026-82329 Exploited

A critical authentication bypass vulnerability in JFrog Artifactory, tracked as CVE-2026-82329, is under active exploitation, posing an immediate threat to self-managed software supply chains worldwide. Under default configurations, unauthenticated network attackers can gain full administrative control over exposed instances.

Following security patches issued by JFrog on August 28, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on September 2, 2026, establishing a strict federal remediation deadline of September 5, 2026. While JFrog Cloud environments remain secured, organizations running self-managed deployments must act immediately to prevent severe compromise.

What Is CVE-2026-82329?

CVE-2026-82329 (CVSS 9.8) is an improper authentication vulnerability in JFrog Artifactory, classified as CWE-287. It is a potential authentication bypass that can lead to administrative access in Artifactory.

Essentially, an attacker who can reach a vulnerable self-managed Artifactory instance may be able to cross an authentication boundary and gain administrative privileges without valid credentials.

Public technical details remain limited. Independent analysis has associated the behavior with Artifactory and JFrog Access trust or registration logic, but JFrog has not fully documented the internal request flow, affected endpoint, or complete exploit sequence in the public advisory.

Which JFrog Artifactory Versions Are Affected?

JFrog lists the following affected Artifactory release branches in its advisory. Administrators should verify the exact build against current JFrog guidance, especially when running versions near a branch boundary.

JFrog Cloud customers do not need to apply a customer-side patch for this issue. Artifactory instances managed by customers on AWS, Azure, other cloud infrastructure, or on-premises remain self-managed and require remediation.

Is CVE-2026-82329 Being Exploited?

Yes. CISA’s recent KEV update added seven exploited vulnerabilities to the catalog, including CVE-2026-82329. CISA’s KEV catalog lists the JFrog Artifactory issue with a September 5, 2026 due date.

Reported exploitation has focused on exposed, self-managed Artifactory instances, with attackers reportedly creating administrative access tokens. Public proof-of-concept (PoC) material has also been reported, but defenders should treat unverified exploit repositories cautiously.

What Should Defenders Do Now?

Patch Self-Managed Artifactory Instances

Upgrade self-managed Artifactory instances immediately to the fixed version for their branch. Prioritize internet-facing systems, then instances reachable from developer, build, production, or shared corporate networks.

Check Every Deployment

Review every node, replica, container image, standby environment, and disaster recovery deployment. A patched primary instance is not enough if another reachable system remains vulnerable.

Reduce Exposure While Patching

If patching is delayed, restrict Artifactory and related services to trusted networks, approved administrative sources, private connectivity, or tightly controlled reverse proxy paths. These controls reduce exposure, but do not replace upgrading.

SOCRadar can support this prioritization by combining Cyber Threat Intelligence (CTI) and Attack Surface Management (ASM) modules. The CTI module, through its Vulnerability Intelligence capabilities, helps teams track CVE-2026-82329, CISA KEV status, exploitation reporting, public PoC developments, and JFrog advisory updates, while ASM helps identify internet-facing Artifactory services, exposed assets, vulnerable technologies, domains, certificates, and unexpected infrastructure.

Hunt for Authentication Abuse

Review Artifactory, JFrog Access, identity provider, CI/CD, build runner, container registry, and cloud audit logs for unusual admin tokens, new administrator accounts, group or permission changes, federation changes, and user or repository enumeration.

Review Repository and Build Activity

Look for unexpected artifact uploads, overwrites, deletions, metadata changes, unfamiliar source addresses, and suspicious build or deployment activity after token creation.

Revoke and Validate

Do not assume patching invalidates existing tokens. Revoke suspicious tokens, rotate exposed credentials or secrets, and compare high value artifacts, container images, build outputs, metadata, and signing records with trusted baselines.