JFrog Artifactory CVE-2026-82329: admin in one request

If you self-host Artifactory, JFrog Artifactory CVE-2026-82329 turns an unauthenticated HTTP request into platform administrator. JFrog patched it on August 28. Attackers were exploiting it in the wild by September 1 — three days later — and CISA added it to the Known Exploited Vulnerabilities catalog on September 2. This is your build system's front door, and it is the kind of box that gets stood up once and then never looked at again.

What actually happened

CVE-2026-82329 is improper authentication, scored CVSS 9.8, affecting default configurations of self-managed Artifactory. No credentials, no user interaction, network access only. Per The Hacker News, the fixed builds are 7.161.20 plus backports across the maintained lines — 7.146.36, 7.133.28, 7.125.19, 7.117.27 and 7.111.21. If your version is below the fix on your line, you are affected.

The mechanism, as watchTowr described it: an instance without an additional join key configured gets handed a "phantom" join key that an attacker can abuse. watchTowr caught the exploitation in its own honeypots. What the attackers did once inside is the part worth reading twice — mint administrative tokens, enumerate users, groups, credentials and federated access relationships, map the topology, and in a subset of cases create backdoor user accounts for persistence after the patch lands.

That last one is why "we patched it" is not the end of this. A backdoor admin created on August 31 survives an upgrade on September 6.

Why your artifact registry matters for your business

Artifactory is not a website. It is the thing every build pulls from and every deploy pushes to. Admin on it means an attacker can replace a package your CI resolves tomorrow morning, and your pipeline will install it, sign off on it, and ship it — because that is precisely what your pipeline was built to do. The registry is trusted by design, which is what makes it worth taking.

Four things, and the order matters. Patch to your line's fixed build. Then audit the user list for accounts you did not create, and the token list for tokens you did not mint — the enumeration and backdoor-user activity was observed, not theoretical. Then rotate the credentials Artifactory holds and the ones that reach it: CI service accounts, deploy keys, anything in a federated trust relationship it enumerated. Then check whether it needs to be internet-reachable at all. Most self-managed registries end up on a public IP so a build runner or a remote contractor could reach it, and then nobody moved it behind a VPN.

If you are on JFrog's hosted platform rather than running your own, this specific flaw is a self-managed problem — but the lesson transfers. We keep writing the same post: Kestra, LiteLLM, now Artifactory. Self-hosted infrastructure is the right call for plenty of small teams. It just means the patch cadence became your job the day you installed it.

Sources: The Hacker News, SecurityWeek, CISA KEV alert, September 2.