{"id":"jfrog-artifactory-auth-bypass-sep-2026","category":"patch","status":"closed","title":"JFrog Artifactory login bypass CVE-2026-82329 exploited; update self-hosted servers","tldr":"JFrog Artifactory flaw CVE-2026-82329 (CVSS 9.8) lets an unauthenticated attacker gain admin access on default self-hosted setups, and is being exploited. Update to your branch's fixed version, e.g. 7.161.20, and review admin tokens and accounts.","summary":"CVE-2026-82329 is a critical authentication flaw in self-hosted JFrog Artifactory, a tool businesses use to store software packages and build files. Under default configuration, someone with network access and no password may be able to gain administrator privileges. JFrog published the advisory and fixes on 28 August 2026. CISA added it to its list of exploited flaws on 2 September 2026. A report relaying watchTowr's observations says attacks began by 1 September: attackers created administrator tokens, listed users, groups and credentials, and in a few cases created backdoor accounts. That report also says a public proof of concept exists and names no attacker; JFrog's advisory itself gives no exploitation details. JFrog Cloud customers need do nothing, as JFrog says it has already protected them. Self-hosted customers should upgrade to 7.161.20, 7.146.38, 7.133.29, 7.125.20, 7.117.28 or 7.111.21, depending on their branch. JFrog's table lists 7.111.21 as both the last affected and the fixed version for that branch, so confirm that entry with JFrog. Where an immediate upgrade isn't possible, JFrog offers a workaround that adds an extra join key.","action":"If your business runs its own Artifactory server, upgrade to the fixed version for your branch now, starting with internet-facing servers, and check for unexpected admin tokens or new accounts. JFrog Cloud users need do nothing; ask your IT provider if unsure.","product":"JFrog Artifactory (self-hosted)","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-82329"],"tags":["jfrog","artifactory","authentication-bypass","exploited","cisa-kev","devops","self-hosted"],"affected":["Artifactory 7.161.0 to 7.161.19","Artifactory 7.146.0 to 7.146.36","Artifactory 7.133.0 to 7.133.28","Artifactory 7.125.0 to 7.125.19","Artifactory 7.117.0 to 7.117.27","Artifactory 7.111.4 to 7.111.21 (as listed by JFrog; verify with JFrog)"],"fixed":["7.161.20","7.146.38","7.133.29","7.125.20","7.117.28","7.111.21"],"matches":[],"sources":[{"kind":"advisory","title":"JFrog Security Advisories","url":"https://docs.jfrog.com/releases/docs/jfrog-security-advisories","by":"JFrog","date":"2026-08-28"},{"kind":"advisory","title":"Artifactory Self-Managed Releases","url":"https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases","by":"JFrog","date":"2026-08-28"},{"kind":"news","title":"CVE-2026-82329: Critical JFrog Artifactory Authentication Bypass Exploited in the Wild","url":"https://socprime.com/?p=51833","by":"SOC Prime","date":"2026-09-02"}],"started":"2026-09-02","closed":"2026-09-02","created":"2026-11-03T22:09:41.680Z","updated":"2026-11-03T22:09:41.680Z","cve_notes":[{"cve":"CVE-2026-82329","name":"Authentication bypass to admin in JFrog Artifactory","what":"An improper authentication flaw in self-hosted Artifactory that, under default settings, lets an unauthenticated attacker with network access obtain administrator privileges.","severity":"critical","cvss":9.8}],"timeline":[{"at":"2026-09-02","added":"2026-11-03T22:05:27.736Z","kind":"cisa-added","text":"CISA added CVE-2026-82329 to its list of vulnerabilities being used in attacks.","url":"https://docs.jfrog.com/releases/docs/jfrog-security-advisories","by":"CISA (via HARD intake)","patch":null},{"at":"2026-09-01","added":"2026-11-03T22:05:27.736Z","kind":"wider-attacks","text":"Per a report relaying watchTowr's observations, attackers were exploiting the flaw by this date, creating administrator tokens and listing users, groups and credentials. A public proof of concept was also reported. The report named no attacker.","url":"https://socprime.com/?p=51833","by":"SOC Prime","patch":null},{"at":"2026-08-28","added":"2026-11-03T22:05:27.736Z","kind":"disclosed","text":"JFrog published an advisory for CVE-2026-82329, a critical authentication flaw in self-hosted Artifactory that could give an unauthenticated attacker administrator access under default settings. Fixed releases were issued for six version lines, and JFrog Cloud was already protected.","url":"https://docs.jfrog.com/releases/docs/jfrog-security-advisories","by":"JFrog","patch":"patched"}],"url":"https://hard.fyi/live/jfrog-artifactory-auth-bypass-sep-2026/","json":"https://hard.fyi/api/live?id=jfrog-artifactory-auth-bypass-sep-2026"}