Attackers Exploit Critical JFrog Artifactory Auth-Bypass Flaw Within Days of Patch

Overview

Attackers began exploiting a critical authentication-bypass flaw in JFrog Artifactory within days of the vendor patching it, according to The Register. The vulnerability, tracked as CVE-2026-82329, carries a CVSS score of 9.8 and was published on August 28, 2026, according to the National Vulnerability Database. The Cybersecurity and Infrastructure Security Agency added the flaw to its Known Exploited Vulnerabilities catalog on September 2, 2026, independently confirming that exploitation is underway.

What We Know

• The flaw is described by NVD as an authentication weakness that, “under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges,” according to the National Vulnerability Database. CISA’s catalog entry uses nearly identical language, describing an “improper authentication vulnerability that under default configuration can allow an unauthenticated attacker with network access to obtain administrative privileges,” as listed by CISA’s Known Exploited Vulnerabilities catalog.
• Artifactory is, in The Register’s description, “a widely used tool for managing software artifacts, packages, binaries, and AI models,” according to The Register.
• JFrog disclosed the vulnerability on Friday, and by Tuesday attackers had already begun exploiting internet-exposed systems, according to exposure-management firm watchTowr’s threat-intel team, as reported by The Register. watchTowr reported “attackers minting themselves admin tokens.”
• Beyond creating administrative credentials, watchTowr’s honeypot network caught intruders “enumerating users, groups, credential sets and federated” topologies, Yordan Ganchev, principal threat intelligence specialist at watchTowr, told The Register.
• “Right now, we’re observing exploitation from a small number of IP addresses from varying geographies exploiting multiple of our honeypots,” Ganchev said. “Broad-scale scanning and mass exploitation has not been observed, but that is unlikely to stay the case for long,” he told The Register.
• Ganchev urged organizations running vulnerable versions to “urgently patch” internet-exposed systems and to treat them as potentially compromised — inspecting audit logs, rotating credentials, and checking connected systems for unusual changes or backdoor implants, according to The Register.
• “When attackers gain admin level access to a central software supply chain system, they can do what every engineering team does best - build, ship and distribute software fast,” Ganchev said. “From there, they could tamper with build pipelines, move laterally into production systems and potentially push malicious changes downstream to customers,” he told The Register.
• Multiple Artifactory 7.x release lines are affected, per version ranges listed in the National Vulnerability Database record for the flaw.
• CISA’s catalog entry sets a remediation due date of September 5, 2026, and requires agencies to apply mitigations “in accordance with vendor instructions,” per CISA’s Known Exploited Vulnerabilities catalog.
• JFrog did not immediately respond to The Register’s inquiries, according to The Register.

What We Don’t Know

• The scale of exploitation beyond watchTowr’s own honeypot network is unclear; watchTowr has said broad, mass-scanning activity has not yet been observed, according to The Register.
• JFrog has not issued a public response to press inquiries about the exploitation, according to The Register, so the vendor’s own account of remediation guidance and scope of impact is not yet available beyond the CVE record itself.
• Whether any specific organizations have confirmed a breach tied to this exploitation has not been reported.

Analysis

Artifactory sits at the center of many organizations’ build pipelines, storing and distributing the packages and binaries that flow into production software. Ganchev’s warning to The Register frames the stakes plainly: administrative access to a system like Artifactory hands attackers the same capabilities engineering teams rely on to ship software, but pointed at tampering with build pipelines and pushing malicious changes downstream to customers, according to The Register. The four-day gap between JFrog’s Friday disclosure and confirmed exploitation by the following Tuesday — and CISA’s decision to add the flaw to its Known Exploited Vulnerabilities catalog just one day after that — illustrates how quickly attackers now move against newly disclosed vulnerabilities in software supply-chain infrastructure.