JFrog Artifactory CVE-2026-82329 Now Exploited
Active exploitation of the critical Artifactory authentication bypass has started, just days after public disclosure. If your instance is unpatched, that ends now.
Marisol "Fuse" DelgadoCVE-2026-82329, the 9.8-critical authentication bypass in JFrog Artifactory, is now confirmed exploited in the wild. SecurityWeek reported on September 1 that active exploitation began within days of the vulnerability’s public disclosure on August 28. JFrog had a patch ready the same day it disclosed the flaw. That patch has been out for less than a week and attackers are already moving.
The vulnerability gives an unauthenticated attacker with network access to an Artifactory instance full administrative control under the software’s default configuration. No credentials required. Full admin. On a system that sits at the center of most serious software supply chains.
What to do right now:
Apply the patched Artifactory build. The fixed version is in JFrog’s release notes. That is step one and it is not optional.
After patching:
- Restrict network access. Artifactory should be reachable only from your build infrastructure, not from the broader corporate network or any internet-facing segment. Do this even after patching.
- Pull your access logs back to August 28. Look for anomalous admin-level activity, especially from unexpected source addresses or under default service account identities.
- Audit hosted artifacts. If an attacker reached your Artifactory instance before you patched, they had write access to every package, artifact, and dependency you store there. Check for unexpected modifications. This step matters because the risk does not stop at the Artifactory boundary: tampered artifacts flow downstream into builds, into production, into customer systems.
Active exploitation changes the priority tier. A patch for a 9.8 flaw is not a sprint item when attacks are confirmed. It is this week’s work, if not today’s.
For context on the underlying vulnerability and its supply-chain blast radius, see the August 30 analysis. For a similar pattern this week, CISA added two PaperCut flaws to its KEV catalog after confirming active intrusions: PaperCut Active Intrusions: CISA Adds Flaws to KEV.
- [ CRITICAL ]CVE-2026-82329JFrog Artifactory Default Authentication Weakness Grants Admin Access
Found this useful? Share it.
