Attackers Exploit Critical JFrog Artifactory Flaw to Mint Admin Tokens Days After Disclosure

Threat actors are exploiting a newly patched critical security flaw impacting JFrog Artifactory merely days after public disclosure, according to watchTowr . The vulnerability in question is CVE-2026-82329 (CVSS score: 9.8), a case of authentication bypass that could lead to administrative access in Artifactory. "JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges," according to a description of the flaw on CVE.org. The vulnerability was patched by JFrog with Artifactory version 7.161.20 released on August 28, 2026. It affects the following versions - 7.161.0 > 7.161.19 7.146.0 > 7.146.36 7.133.0 > 7.133.28 7.125.0 > 7.125.19 7.117.0 > 7.117.27 7.111.4 > 7.111.21 "It affects default configs, requires no auth, no user interaction," Vercel CEO Guillermo Rauch said in a post on LinkedIn. "It's an RCE bomb because Artifactory hosts binaries, so you can basically poison everything, but an admin escalation can cause damage even beyond that." The issue resides in JFrog Access, which is designed to issue and validate credentials. "Instances without an additional join key configured receive a 'phantom' join key that attackers can abuse to forge access and mint administrator-level credentials," Yordan Ganchev, principal threat intelligence specialist at watchTowr, said in a statement shared with The Hacker News. Ganchev also pointed out that threat actors have begun to weaponize the flaw as of September 1, 2026, to generate admin tokens and enumerate users, groups, credential sets and federated access topologies. "This moved from disclosure to real-world exploitation with uncomfortable efficiency," Ganchev added. "Anyone following along knows what comes next: things will get worse." "When attackers gain admin level access to a central software supply chain system, they can do what every engineering team does best build, ship and distribute software fast. From there, they could tamper with build pipelines, move laterally into production systems and potentially push malicious changes downstream to customers." Ganchev said exploitation efforts targeting watchtower's honeypots have originated from a small number of IP addresses from varying geographies, although there is no evidence of broad-scale scanning or mass exploitation at this stage. "Some observed activity showed evidence of CVE verification only, where the vulnerability was successfully exploited and then stopped. Other attempts successfully exploited the vulnerability and then probed or enumerated the JFrog Artifactory instances to determine whether the environment was worth further exploitation," Ganchev added. "In limited cases, threat actors created backdoor users and enumerated existing Artifactory users, their groups, tokens, and the system's federated access topologies." Organizations that are running self-managed versions of JFrog Artifactory are recommended to apply patches to internet-exposed systems with immediate effect, as well as inspect audit logs, rotate exposed credentials, and review connected systems for malicious changes or backdoor access. Found this article interesting? Follow us on Google News , Twitter and LinkedIn to read more exclusive content we post.