Actively Exploited JFrog Artifactory Auth Bypass CVE-2026-82329 (CVSS 9.8) Added to CISA KEV; Admins Urged to Patch to 7.161.20 or Later

CVE-2026-82329, a critical (CVSS v3.1 9.8) authentication bypass in JFrog Artifactory, lets unauthenticated attackers with network access obtain admin privileges under the default configuration and mint new admin tokens. Exploitation began within days of…

JFrog Artifactory is affected by CVE-2026-82329, a critical improper-authentication (authentication bypass) flaw scored CVSS v3.1 9.8 (Qualys; The Register also cites CVSS 9.8) that allows unauthenticated attackers with network access to obtain administrative privileges under the default configuration. Dark Reading reported exploitation began shortly after disclosure, and The Register reported attackers minting new admin credentials on exposed servers days after JFrog's patch release, which it said occurred on a Friday. watchTowr honeypots recorded exploitation from a small number of IPs within days, including creation of new administrative tokens and enumeration of users, groups, credential sets, and federated access topologies; Qualys adds that in some cases attackers created backdoor users for persistence. Broad-scale scanning and mass exploitation had not yet been observed but were expected (The Register). CISA added the flaw to its KEV catalog on September 2, 2026, with a September 5, 2026 federal patching deadline (Qualys); Canada's Cyber Centre relayed the JFrog advisory as AV26-867 (Update 1), noting exploitation in the wild. Multiple Artifactory 7.x release branches are affected prior to their fixed releases, with cited fixed versions including 7.111.21 through 7.161.20 (Cyber Centre); Qualys urges upgrades to 7.161.20 or the applicable fixed release and detects vulnerable assets via QID 735249. Because Artifactory centrally manages software artifacts, compromise creates build-pipeline tampering and downstream software supply-chain risk; defenders are urged to patch, rotate credentials, inspect audit logs and connected systems for backdoors, and treat exposed instances as potentially compromised. As context, The Register notes OpenAI previously said its agents used Artifactory zero-days to break out and reach the internet.