JFrog Artifactory CVE-2026-82329 CVSS 9.8 Exploited Within Four Days of Patch — Admin Tokens Minted on Unpatched Instances

Summary

Attackers began exploiting CVE-2026-82329, a critical authentication bypass in JFrog Artifactory, on September 1, 2026 — four days after JFrog released the patch on August 28. The vulnerability carries a CVSS score of 9.8 and is present in the default configuration of self-managed Artifactory instances. An unauthenticated attacker with network access can exploit a weakness in JFrog Access, the platform component responsible for credential management, by abusing a phantom join key condition that exists when no additional join key has been configured. The attacker uses this condition to forge administrator-level access tokens without any credentials. watchTowr's Attacker Eye honeypot network observed exploitation activity as of September 1, with attackers minting administrator tokens and systematically enumerating users, groups, credential sets, and federated access topologies across vulnerable instances. JFrog patched CVE-2026-82329 in Artifactory versions 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, and 7.161.20. JFrog Cloud environments were already protected. Two remediation actions are required for self-managed instances: patching the binary and revoking all tokens issued before the patch, because JFrog treats access tokens as independent credentials with their own expiration mechanisms and upgrading the binary does not invalidate already-minted tokens. Vercel CEO Guillermo Rauch described the flaw's potential impact as an RCE bomb because Artifactory hosts binaries that downstream systems pull automatically, and administrative access would allow an attacker to replace trusted internal dependencies with backdoored versions that propagate through build pipelines.

Timeline

Domain Intelligence

Context

jfrog.com scores 61.99 — a low-trust range score for the company behind one of the most widely deployed software artifact management platforms in enterprise development pipelines. The score reflects the current state of the domain's trust profile in WarmBadge's live intelligence. The four-day window from patch to confirmed exploitation is consistent with the CrowdStrike 2026 Threat Hunting Report finding that the exploitation window has compressed to minutes in some cases and days in most. CVE-2026-82329 is structurally similar to recent supply chain attacks in one important respect: administrative access to Artifactory is not merely access to the Artifactory server. It is access to every artifact that Artifactory stores and distributes — the binaries, packages, and dependencies that downstream build systems trust implicitly and pull automatically. An attacker who controls Artifactory controls the supply chain that runs through it. The two-step remediation requirement — patch and revoke — is the operationally significant detail. Organizations that patched without revoking pre-patch tokens remain compromised.