A newly disclosed active exploitation of a JFrog Artifactory authentication bypass warns that attackers are minting administrator tokens on vulnerable internet-accessible instances.
Tracked as CVE-2026-82329, the flaw can enable unauthenticated network attackers to obtain administrative privileges when Artifactory runs with its default configuration. The vulnerability carries a CVSS v3.1 score of 9.8 and is classified as critical.
Its vector, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicates that exploitation is remotely reachable, requires low complexity, requires no existing account, and requires no user interaction.
Critical JFrog Artifactory Authentication Bypass Exploited
Artifactory is a repository manager for software packages, container images, binaries, and build artifacts. Administrative access to such an environment could give an intruder control over repository settings, identities, access tokens, and the artifacts consumed by developers and automated build systems.
That makes the incident a significant software supply chain risk, rather than simply an exposed management console issue. watchTowr’s observation that attackers are creating their own admin tokens is particularly concerning.
Security teams should treat the compromise of an affected instance as a possible identity and artifact-integrity incident: determine whether new administrative principals or tokens were created, identify their scopes and expiry dates, and establish whether repositories.
JFrog released fixes on August 28. Affected self-managed deployments include releases before 7.111.21 and later release trains: 7.117.0 through 7.117.27, 7.125.0 through 7.125.19, 7.133.0 through 7.133.28, 7.146.0 through 7.146.37, and 7.161.0 through 7.161.19.
Patched versions include 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38 and 7.161.20, depending on the supported branch. JFrog-hosted cloud environments have reportedly already been patched.
Organizations should immediately inventory self-hosted Artifactory instances. Upgrade to the applicable fixed release on an emergency basis.
Where a patch cannot be applied at once, restrict access to trusted networks, remove unnecessary public exposure, and tightly control administrative endpoints.
Watchtower states that Incident responders should retain and review Artifactory, access, and proxy logs around the disclosure and exposure period.
Hunt for newly issued administrator tokens, anomalous token use, unfamiliar administrative accounts, permission changes, repository configuration edits, and unexpected artifact uploads, replacements, or downloads.
Revoke suspicious tokens, rotate credentials that could have been exposed, and validate the provenance and integrity of critical artifacts before downstream deployment.
With exploitation reported in the wild, organizations should assume exposed, unpatched, default-configured instances are at immediate risk. Rapid patching, token-focused forensics, and artifact-integrity checks are essential to contain an intrusion before it propagates into development and delivery pipelines.
Give your security team the visibility and context to investigate suspicious activity faster and contain threats before business impact grows. Strengthen Your Investigations with ANY.RUN
