What Changed
Attackers are exploiting CVE-2026-82329 (CVSS 9.8), an authentication bypass in JFrog Artifactory that gives an unauthenticated attacker administrator access on a default configuration. JFrog fixed it on August 28 in version 7.161.20, with fixes for older release lines.
Affected ranges are 7.161.0–7.161.19, 7.146.0–7.146.36, 7.133.0–7.133.28, 7.125.0–7.125.19, 7.117.0–7.117.27 and 7.111.4–7.111.21.
Root Cause And Activity
watchTowr researcher Yordan Ganchev traced the bug to a “phantom” join key in JFrog Access, the component that handles authentication and tokens. Exploitation was observed from September 1: attackers minted admin tokens, enumerated the instances and on some created backdoor user accounts.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Why This Is An Operations Problem
Artifactory sits at the center of the software supply chain. It stores build artifacts, container images and package mirrors, and CI/CD systems pull from it automatically. Admin access lets an attacker read secrets in artifacts and replace what downstream builds pull. Many organizations run Artifactory on-premises or in their own cloud accounts, so they patch it themselves on their own schedule.
What To Verify First
- Upgrade self-managed Artifactory to 7.161.20 or the fixed release for your line.
- Inspect audit logs for admin token creation, new users and permission changes since late August.
- Remove unknown accounts and revoke tokens you cannot account for.
- Rotate credentials stored in or used by Artifactory, including CI/CD tokens.
- Check recently changed artifacts and repository settings.
- Restrict network access to the Artifactory web interface and API to the systems that need it.
What Teams May Be Underestimating
A backdoor user survives the upgrade, and so does any token minted before it. Patching without reviewing accounts and tokens may leave the attacker with admin access to your build pipeline.
Source Context
This item was rebuilt from the following primary sources and original reporting:
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Related In The Daily Brief
See this item in The 5-Minute Cyber Brief
Newer CyberExperts coverage on this topic
This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.
Coder’s registry infrastructure compromised to push malicious modules
The Coder incident is a supply-chain lesson in miniature: once attackers can tamper with trusted module distribution, defenders are no longer verifying...
Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks
The useful lesson in this campaign is not that Node.js is bad. It is that adversaries keep choosing legitimate runtimes defenders already...
HPE patches critical ArubaOS-CX remote code execution flaw
ArubaOS-CX deserves attention because switching software rarely gets treated with the same urgency as identity or edge security until exploitation arrives. A...
Tuesday’s brief: GitLab’s critical fix, then Patch Tuesday, hijacked fridge controllers and Server 2012’s last update
The fastest way to catch up on what changed after this article was published.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
