CVE-2026-82329Active Exploitation(jfrog / artifactory)

Two days ago JFrog dropped CVE-2026-82329, a critical authentication bypass in Artifactory. It’s a CVSS 9.8, a disastrous vulnerability score. It’s like a 9.8 earthquake on the seismic scale. It affects default configs, requires no auth, no user interaction. It’s an RCE bomb because Artifactory hosts binaries, so you can basically poison everything, but an admin escalation can cause damage even beyond that. When the OpenAI / Hugging Face news came out of agents discovering zero-days, I was wondering if it was marketing-speak or reality, because I hadn’t seen a CVE filing. Now it’s here: https://www​.cve.org/CVERecord?id=CVE-2026-82329. I don’t see any official confirmation that it’s indeed the case, but one can speculate this is what the agents discovered and exploited. I’d previously written that it was obvious agents could help in finding serious vulnerabilities *alongside humans*, but exploiting them autonomously was a bridge not yet crossed. It seems like we’re now there. Our guidance for this new world: assume everything hackable will get hacked. And it will get hacked autonomously. You must also defend yourself autonomously, because your surface of attack is likely bigger and your code more vulnerable than you expect: https://vercel​.com/blog/everything-hackable-will-get-hacked

I have reversed and reproduced CVE-2026-82329, the JFrog Artifactory auth bypass that hands attackers a full admin token" Is this a backdoor or a vulnerability xD

🚨 CVE-2026-82329 - JFrog Artifactory Access Blank Join Key Authentication Bypass Nuclei Template - https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-82329.yaml Reference: https://www.pruva.dev/reproductions/REPRO-2026-00341 #bugbountytips #hackwithautomation #jfrog https://t.co/mkat57XGSa

CVE-2026-82329: JFrog Artifactory critical unauthenticated authentication bypass leading to administrative takeover #pruva reproduction. With 3 variants in the vuln version found https://www.pruva.dev/reproductions/REPRO-2026-00341 https://t.co/GaQzR5sOKk

CVE-2026-82329 JFrog Artifactory unauthenticated auth-bypass: reproducible Docker lab + URL-parameter validator PoC + patch-diff analysis https://github.com/dinosn/cve-2026-82329-jfrog-artifactory

watchTowr Intel is already seeing exploitation of the JFrog Artifactory Auth Bypass (CVE-2026-82329), with attackers minting themselves admin tokens. Reach out if you need help determining your exposure ahead of exploitation. https://t.co/r6kMLl7j3N

CVE-2026-82329 · JFrog Artifactory (self-hosted) Blank join key → unauth SERVICE admin JWT → platform admin token (aud=*). Validator (stdlib only): https://github.com/ynsmroztas/CVE-2026-82329-JFrog-Artifactory-Auth-Bypass Authorized testing only. #BugBounty #InfoSec #AppSec #bugbountytip #bugbountytips #infosec #recon https://t.co/xSGHmfxS7x

🚨 CRITICAL: CVE-2026-82329 (CVSS 9.8) is a critical authentication bypass in JFrog Artifactory. An unauthenticated attacker with network access can exploit the flaw to obtain administrative privileges under the default configuration. 🔴 Patch immediately. Fixed versions include 7.161.20, 7.146.38, 7.133.29, 7.125.20 and 7.117.28. 🔗 https://docs.jfrog.com/releases/docs/jfrog-security-advisories #JFrog #Artifactory #CVE #AuthBypass #CyberSecurity #DevSecOps #Infosec

Attackers are exploiting CVE-2026-82329 to mint admin tokens in JFrog Artifactory, putting trusted software packages at risk. Admin access is a powerful failure point. digibyte:native has no settlement admin: full nodes verify every UTXO, script and proof-of-work block.

🚨 JFROG ARTIFACTORY UNDER ACTIVE ATTACK — AUTH BYPASS LEADS TO ADMIN CONTROL AND BACKDOORS Wiz Research has confirmed active in-the-wild exploitation of THREE vulnerabilities affecting self-hosted JFrog Artifactory environments: * CVE-2026-82329 — Critical authentication bypass, CVSS 9.8 * CVE-2026-42018 — Anonymous-user token exposure * CVE-2026-42016 — Token scope validation / privilege escalation Attackers are using two different paths to obtain ADMINISTRATIVE CONTROL of vulnerable Artifactory servers. ATTACK PATH #1: CVE-2026-42018 → Obtain internal anonymous-user JWT → CVE-2026-42016 → Exchange it for an admin-scoped token → Create persistent administrator account Wiz observed attackers moving from the initial unauthenticated request to a newly created administrator account in UNDER FIVE MINUTES in some cases. ATTACK PATH #2: CVE-2026-82329 Under Artifactory's default configuration, an unauthenticated attacker can directly obtain administrative privileges. Wiz observed successful exploitation between September 1–8. 🚨 POST-EXPLOITATION ACTIVITY Once administrative access was obtained, attackers were observed: * Creating persistent admin accounts * Minting long-lived credentials * Stealing Artifactory configuration * Enumerating repositories, users and tokens * Extracting cluster join keys * Adding attacker-controlled SSH keys * Deploying malicious Groovy plugins * Executing arbitrary commands * Uploading web shells * Deploying custom Rust-based backdoors * Establishing external C2 communications This is particularly serious because Artifactory often sits directly inside the SOFTWARE SUPPLY CHAIN. A compromised Artifactory administrator potentially controls the repository infrastructure trusted by developers and CI/CD systems. ⚠️ EXPOSURE REMAINS HIGH According to Wiz telemetry, approximately 67% of organizations running Artifactory had at least one instance vulnerable to CVE-2026-82329 when it was disclosed. Two weeks later, approximately 49% remained vulnerable. ⚠️ Analyst Note: This isn't simply another vulnerable internet-facing application. Artifactory is part of the trust infrastructure behind software development. Internet → Artifactory auth bypass → Administrator access → Repository control → Build artifacts → CI/CD integrations → Potential software supply-chain compromise That makes administrative compromise particularly dangerous. JFrog has released patched versions. Organizations operating SELF-HOSTED Artifactory should upgrade immediately and investigate historical logs for exploitation rather than assuming patching alone resolves a previous compromise. JFrog Cloud environments were already remediated by JFrog and require no customer action for CVE-2026-82329. Original research — Wiz: https://www.wiz.io/blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-42018-cve-2026-82329 Official JFrog advisories: https://docs.jfrog.com/releases/docs/jfrog-security-advisories #DDW #JFrog #Artifactory #SupplyChain #CyberSecurity

A PoC/exploit has been discovered for vulnerability CVE-2026-82329 Vendor: JFrog Product: Artifactory Description: JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges. Link: https://github.com/dinosn/cve-2026-82329-jfrog-artifactory #dbugs_vuln

Your artifact server can still be taken over with no login. CISA just put that on the must-patch list. Federal agencies have until Friday. Patch today. CVE-2026-82329 https://hol.org/blog/cve-2026-82329-jfrog-artifactory-unauth-admin-default https://t.co/ubAZCB9Mmj

CyberPulse | Cybersecurity Awareness Bulletin 🚨This week's biggest threat: A critical authentication bypass in JFrog Artifactory (CVE-2026-82329) is being actively exploited to create admin-level tokens with no credentials required. Artifactory manages every build artifact, container image, and deployment package in enterprise pipelines an attacker with admin access can silently poison any package or inject malicious code into any software release. Patch immediately, restrict external access, and rotate all tokens now. Also flagged: ❗️Virtualizor BGP Hijack: Attackers pushed backdoored updates to VPS panels worldwide verify your version against the official release hash ❗️Dropbox via Lenovo Email Flaw: Fraudulent ID registrations hijacked linked Dropbox accounts revoke unrecognized third-party access ❗️14 Trojanized npm Packages: Fake calendar utilities deployed an AI-powered Linux backdoor audit dependencies and rotate credentials 💡Tip: Attackers are hijacking BGP routing to redirect update traffic to malicious servers. Always verify updates using cryptographic hashes before installing, especially for server tools. Protect yourself: ✔️Verify software versions against official hashes ✔️Revoke unrecognized third-party account access ✔️Audit dependencies after suspicious installs Read, share, help build a safer digital Uganda. #CyberPulse #CyberSecurity #CERTUg #PoweredByNITAU

🚨 JFrog Artifactory Authentication Bypass (CVE-2026-82329) Exploited in the Wild Critical Vulnerability Alert! JFrog Artifactory is affected by CVE-2026-82329. 🔍 Identify Targets via ZoomEye: Search Dork: app="JFrog Artifactory" Exposure: 17.9k instances identified globally. ZoomEye Search Link: 👉 http://zoomeye.ai/searchResult?q... #JFrog #Artifactory #CVE202682329 #SupplyChain #CyberSecurity #InfoSec@zoomeyebot

⚠️ New Actively-Exploited Vulnerability • CVE-2026-82329 affects JFrog Artifactory. • Allows network attackers to gain admin access. • Not yet linked to ransomware groups. • CISA KEV lists it as actively exploited. Apply mitigations now as per vendor instructions. Full report: 🔗 https://darkfeed.io #CyberSecurity #JFrog #ThreatAlert

🚨 CVE-2026-82329 - critical 🚨 JFrog Artifactory Access Blank Join Key Authentication Bypass > JFrog Artifactory contains an authentication weakness that, under default configurati... 👾 https://cloud.projectdiscovery.io/library/CVE-2026-82329 @pdnuclei #NucleiTemplates #cve

CyberPulse | Weekly Threat Bulletin. JFrog Artifactory CVE-2026-82329 actively exploited to bypass auth & create admin tokens. Risk: supply chain poisoning. ALSO FLAGGED, - Virtualizor BGP hijack - Dropbox/Lenovo ID flaw - 14 trojanized npm packages Stay patched. Stay vigilant. #GoldenPosts #CyberSecurityUG #InfoSec #ThreatIntel

A critical authentication bypass vulnerability in JFrog Artifactory is reportedly being exploited in the wild. CVE-2026-82329 Potential authentication bypass leading to administrative access in Artifactory Artifactory is a central component of the software supply chain, managing artifacts, binaries, containers, and packages. Admin access to this system provides a direct path to tamper with build pipelines, move laterally into production systems, and push malicious changes downstream to customers. Under default configuration, an unauthenticated attacker with network access can obtain administrative privileges. WatchTowr confirmed exploitation on September 1, with attackers minting admin tokens and enumerating users, groups, credential sets, and federated access topologies. JFrog has patched cloud instances. This marks the second Artifactory vulnerability exploited in attacks this year. The first: CVE-2026-66384 was used by OpenAI models during the Hugging Face incident to conduct a container-image supply-chain attack by poisoning Artifactory's cache. Software supply chain systems are high-value targets, and the window between disclosure and exploitation is shrinking. Organizations running self-hosted Artifactory should apply patches immediately, inspect audit logs, rotate exposed credentials, and review connected systems for malicious changes or backdoor access. How quickly can your organization identify and patch internet-exposed Artifactory instances, and what visibility do you have into unauthorized admin token generation? Reach out if you need help determining your exposure ahead of exploitation.

#JFrog #Artifactory: Attackers are already exploiting critical auth bypass CVE-2026-82329 (CVSS 9.8) to mint admin tokens. Compromising your organisation's artifact repository could poison builds and trigger #SoftwareSupplyChain attacks - patch now! 👇 https://www.csoonline.com/article/4217534/exploited-jfrog-artifactory-bug-puts-software-supply-chain-on-alert.html

🔴 Kritik JFrog Artifactory açığı: CVE-2026-82329 JFrog Artifactory'de keşfedilen CVSS 9.8 seviyesindeki kritik güvenlik açığı, varsayılan yapılandırmada kimlik doğrulaması olmayan bir saldırganın ağ üzerinden yönetici yetkileri elde etmesine neden olabiliyor. CVE-2026-82329 — CWE-287 CVSS: 9.8 Critical Etkilenen: Artifactory 7.111.x – 7.161.x'in belirli sürümleri Çözüm: İlgili branch için güncel sürüme yükseltmek JFrog Cloud ortamları zaten güvence altına alınmış durumda. Self-hosted Artifactory kullananların güncelleme yapması gerekiyor.