Exploited JFrog Artifactory bug puts software supply chain on alert

The bug is already being exploited in the wild, allowing attackers to generate admin tokens and gain access to Artifactory, the platform that powers many organization’s software supply chains. A critical authentication bypass in JFrog Artifactory is now being exploited in the wild, with attackers observed generating administrator tokens and probing the software supply-chain platform’s sensitive data. The flaw, tracked as CVE-2026-82329, was disclosed by JFrog on August 28 and can, under default configuration, allow an unauthenticated attacker with network access to obtain administrative privileges. By September 1, watchTowr said its Attacker Eye honeypot was already seeing threat actors exploit internet-exposed systems. The activity included attackers minting administrator tokens and enumerating users, groups, credential sets and federated access topologies. “This moved from disclosure to real-world exploitation with uncomfortable efficiency,” said Yordan Ganchev, principal threat intelligence specialist at watchTowr. “When attackers gain admin level access to a central software supply chain system, they can do what every engineering team does best – build, ship and distribute software fast.” A ‘Phantom’ key for administrator access The bug comes from JFrog Access, the component responsible for issuing and validating credentials. According to Ganchev, affected instances without an additional join key configured receive a “phantom” join key that attackers can abuse to forge access and create administrator-level credentials. JFrog’s advisory describes the issue as an authentication weakness that may allow an unauthenticated attacker with network access to obtain administrative privileges under default configuration. The vulnerability was assigned a critical severity (CVSS 9.8) and affects several self-hosted Artifactory release branches. JFrog has released fixes for affected self-hosted versions, while affected cloud environments have already been fortified. Users are advised to upgrade to versions 7.111.21,7.117.28, 7.125.20, 7.133.29, 7.146.38, or 7.161.20, depending on their release branch. “Admin on Artifactory means admin on its own checks,” said Collin Hogue-Spears, senior director of Solution Management at Black Duck. “CVE-2026-82329 delivers an intrusion. Administrative control of the repository turns that intrusion into a substitution.” An attacker with administrator control of a central artifact repository could potentially tamper with build pipelines, move laterally into production systems, and push malicious changes to downstream customers, Ganchev said. Patching fixed the door, but not what walked through it The immediate advice is to patch affected self-hosted Artifactory systems, particularly those exposed to the internet. “Systems exposed while vulnerable should be treated with suspicion of being potentially compromised,” Ganchev warned. “Defenders should inspect audit logs, rotate exposed credentials and investigate connected systems for malicious changes or backdoor access.” Hogue-Spears made a similar point about administrator tokens. Because a token created before remediation may remain valid until revoked, organizations should revoke and reissue administrator tokens on vulnerable instances rather than assuming a software upgrade alone erases the attacker’s access, he said. Hogue-Spears also argued that integrity checks should extend beyond the repository itself. Production systems should pin container images to immutable digests and verify signatures and provenance at deployment. “A signature stored beside an artifact is evidence,” he said. “A signature checked at deployment time is enforcement.”