Hackers exploit critical JFrog Artifactory flaw to forge admin tokens

CVE-2026-82329

September 2, 2026 · BleepingComputer · Severity: CRITICAL

This article details CVE-2026-82329, a critical authentication bypass vulnerability in JFrog Artifactory that allows unauthenticated attackers to gain admin privileges. The flaw is actively exploited, enabling token generation and enumeration of sensitive data. Organizations using self-hosted Artifactory must upgrade to the fixed release immediately. 📌 **Analyst Note:** Given Artifactory's privileged position in software supply chains, this vulnerability poses severe risks including data theft and supply-chain manipulation. Immediate patching and monitoring for unauthorized admin tokens are critical.

Key Takeaways

A critical authentication bypass vulnerability in JFrog Artifactory, tracked as CVE-2026-82329, is being actively exploited to create administrative tokens.
The flaw allows unauthenticated attackers to gain administrator-level privileges, enabling them to enumerate users, groups, and credentials within the Artifactory instance.
Organizations using self-hosted Artifactory must upgrade to the fixed release immediately to prevent unauthorized access and potential supply-chain attacks.