JFrog Artifactory login bypass CVE-2026-82329 exploited; update self-hosted servers
JFrog Artifactory flaw CVE-2026-82329 (CVSS 9.8) lets an unauthenticated attacker gain admin access on default self-hosted setups, and is being exploited. Update to your branch's fixed version, e.g. 7.161.20, and review admin tokens and accounts.
If your business runs its own Artifactory server, upgrade to the fixed version for your branch now, starting with internet-facing servers, and check for unexpected admin tokens or new accounts. JFrog Cloud users need do nothing; ask your IT provider if unsure.
What’s happening
CVE-2026-82329 is a critical authentication flaw in self-hosted JFrog Artifactory, a tool businesses use to store software packages and build files. Under default configuration, someone with network access and no password may be able to gain administrator privileges. JFrog published the advisory and fixes on 28 August 2026. CISA added it to its list of exploited flaws on 2 September 2026. A report relaying watchTowr's observations says attacks began by 1 September: attackers created administrator tokens, listed users, groups and credentials, and in a few cases created backdoor accounts. That report also says a public proof of concept exists and names no attacker; JFrog's advisory itself gives no exploitation details. JFrog Cloud customers need do nothing, as JFrog says it has already protected them. Self-hosted customers should upgrade to 7.161.20, 7.146.38, 7.133.29, 7.125.20, 7.117.28 or 7.111.21, depending on their branch. JFrog's table lists 7.111.21 as both the last affected and the fixed version for that branch, so confirm that entry with JFrog. Where an immediate upgrade isn't possible, JFrog offers a workaround that adds an extra join key.
- What
- Flaw
- Affects
- JFrog Artifactory (self-hosted)
- Affected
- Artifactory 7.161.0 to 7.161.19
Artifactory 7.146.0 to 7.146.36
Artifactory 7.133.0 to 7.133.28
Artifactory 7.125.0 to 7.125.19
Artifactory 7.117.0 to 7.117.27
Artifactory 7.111.4 to 7.111.21 (as listed by JFrog; verify with JFrog) - Fixed in
- 7.161.20
7.146.38
7.133.29
7.125.20
7.117.28
7.111.21 - Since
- 2 Sept 2026
- Closed
- 2 Sept 2026
Timeline
- CISA added
CISA added CVE-2026-82329 to its list of vulnerabilities being used in attacks.
- Wider attacks
Per a report relaying watchTowr's observations, attackers were exploiting the flaw by this date, creating administrator tokens and listing users, groups and credentials. A public proof of concept was also reported. The report named no attacker.
- Made publicFixed
JFrog published an advisory for CVE-2026-82329, a critical authentication flaw in self-hosted Artifactory that could give an unauthenticated attacker administrator access under default settings. Fixed releases were issued for six version lines, and JFrog Cloud was already protected.
Sources
- JFrog Security AdvisoriesJFrog · 28 Aug 2026
- Artifactory Self-Managed ReleasesJFrog · 28 Aug 2026
- CVE-2026-82329: Critical JFrog Artifactory Authentication Bypass Exploited in the WildSOC Prime · 2 Sept 2026