Reported by 13 outlets
JFrog Artifactory Vulnerabilities Actively Exploited in the Wild to Gain Administrative Control Indicators extracted from public reporting.
Why this score
- Breadth
- 2.00 / 2.0 · 13 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 5.00 / 5.0 · CVSS + KEV signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.01 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.40 / 1.5 · reddit signal
- Score
- 0.4 / 10 = base × recency + community
Desk analysis
JFrog Artifactory vulnerabilities are being actively exploited in the wild to gain administrative control. The CVEs involved include CVE-2026-4201, CVE-2026-42016, CVE-2026-42018, CVE-2026-82329, and CVE-2026-84869. JFrog's security advisory lists affected self-hosted versions prior to 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, and 7.161.20, with patched releases available. The advisory confirms a critical authentication-bypass vulnerability (CWE-287) that allows an unauthenticated attacker with network access to obtain administrative privileges under the default configuration, and notes that JFrog Cloud environments have already been fortified.
CISA has added multiple JFrog-related flaws to its Known Exploited Vulnerabilities catalog, confirming in-the-wild exploitation. The story has 21 events spanning multiple sources including Wiz, BleepingComputer, and government advisories, with a current score of 8.6. The attack allows unauthenticated remote attackers to gain admin privileges on vulnerable Artifactory instances. Organizations running self-hosted Artifactory should apply the patched releases immediately and review access logs for signs of unauthorized administrative access.
Timeline
-
original reporting
JFrog Artifactory Vulnerabilities Actively Exploited in the Wild to Gain Administrative Control Indicators extracted from public reporting.
www.wiz.io · 32d ago · September 11th, 2026
JFrog Artifactory Vulnerabilities Actively Exploited in the Wild to Gain Administrative Control Indicators extracted from public reporting.
via Mastodon https://www.wiz.io/blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201
-
update from docs.jfrog.com
JFrog Security Advisory for CVE-2026-82329 (Potential authentication bypass leading to administrative access in Artifactory)
docs.jfrog.com · 47d ago · August 28th, 2026
JFrog published its security advisory for CVE-2026-82329 on 28 August 2026, listing affected self-hosted Artifactory versions (prior to 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, and 7.161.20) and patched releases. The advisory confirms the critical authentication-bypass vulnerability (CWE-287) that can allow an unauthenticated attacker with network access to obtain administrative privileges under the default configuration, and states that JFrog Cloud environments have already been fortified.
-
update from securityweek.com
Critical JFrog Artifactory Vulnerability Reportedly Exploited in the Wild
securityweek.com · 42d ago · September 1st, 2026
A critical vulnerability in JFrog Artifactory is reportedly being exploited in the wild just days after its public disclosure. JFrog Artifactory is a widely used solution for managing the full lifecycle of software artifacts, binaries, AI models, containers, and packages. The company said the patches have already been rolled out to cloud instances, but customers using Artifactory in a self-hosted environment have been advised to update to one of the patched versions, including 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, or 7.161.20. Exposure management firm WatchTowr reported on Tuesday that it has already seen in-the-wild exploitation of CVE-2026-82329, “with attackers minting themselves admin tokens”. “Data from watchTowr’s global Attacker Eye honeypot network shows attackers minting administrator tokens and enumerating users, groups, credential sets and federated access topologies,” said Yordan Ganchev, principal threat intelligence specialist at WatchTowr. “When attackers gain admin level access of a central software supply chain system, they can do what every engineering
-
update from cyberpress.org
Critical JFrog Artifactory Authentication Bypass Exploited in the Wild
cyberpress.org · 42d ago · September 1st, 2026
A newly disclosed active exploitation of a JFrog Artifactory authentication bypass warns that attackers are minting administrator tokens on vulnerable internet-accessible instances. The vulnerability carries a CVSS v3.1 score of 9.8 and is classified as critical. Its vector, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicates that exploitation is remotely reachable, requires low complexity, requires no existing account, and requires no user interaction. Administrative access to such an environment could give an intruder control over repository settings, identities, access tokens, and the artifacts consumed by developers and automated build systems. That makes the incident a significant software supply chain risk , rather than simply an exposed management console issue. watchTowr’s observation that attackers are creating their own admin tokens is particularly concerning. Security teams should treat the compromise of an affected instance as a possible identity and artifact-integrity incident: determine whether new administrative principals or tokens were created, identify their scopes and expiry dates, and establish whether repositories. JFrog release
-
update from gbhackers.com
Critical JFrog Artifactory Authentication Bypass Exploited in the Wild
gbhackers.com · 42d ago · September 1st, 2026
This vulnerability allows the generation of administrator-level access tokens. According to a post from the security research firm watchTowr dated September 1, its threat intelligence team has already observed exploitation activities targeting this flaw. […] The post Critical JFrog Artifactory Authentication Bypass Exploited in the Wild appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from malware.news
JFrog security advisory (AV26-867)
malware.news · 42d ago · September 1st, 2026
Serial number: AV26-867 Date: September 1, 2026 As of August 28, 2026, JFrog is affected by a vulnerability in the following product: Artifactory Prior to 7.111.21 Prior to 7.117.28 Prior to 7.125.20 Prior to 7.133.29 Prior to 7.146.38 Prior to 7.161.20 Open-source reporting indicates that CVE-2026-82329 related to JFrog Artifactory is being exploited in the wild. The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Artifactory Self-Managed Releases JFrog Security Advisories Article Link: JFrog security advisory (AV26-867) - Canadian Centre for Cyber Security
-
update from socprime.com
CVE-2026-82329: Critical JFrog Artifactory Authentication Bypass Exploited in the Wild
socprime.com · 41d ago · September 2nd, 2026
The Critical JFrog Artifactory Vulnerability is particularly dangerous because Artifactory frequently occupies a privileged position in software development and delivery pipelines. Organizations use it to store and distribute binaries, containers, packages, AI models, and other software artifacts. Administrative compromise can therefore create opportunities not only for data theft but also for software supply-chain manipulation and lateral movement into production infrastructure. Organizations operating self-hosted Artifactory deployments must upgrade to the fixed release corresponding to their current branch. JFrog’s advisory states that “JFrog Artifactory contains an authentication weakness” that, unde
-
update from bleepingcomputer.com
Hackers exploit critical JFrog Artifactory flaw to forge admin tokens
bleepingcomputer.com · 41d ago · September 2nd, 2026
Researchers at offensive security company watchTowr observed the flaw being exploited by "attackers minting themselves admin tokens." Details about the flaw are scarce, and JFrog’s advisory does not share many details beyond that the flaw is exploitable in Artifactory’s default configuration. Vercel CEO Guillermo Rauch warned that the flaw’s impact could extend beyond compromising Artifactory itself. "Administrative access to Artifactory reaches released artifacts that downstream systems already trust and pull automatically," Collin Hogue-Spears, Senior Director of Solution Management at application security company Black Duck, told BleepingComputer. Rauch also speculated that the vulnerability might be connected to recent research involving autonomous AI agents. JFrog addressed the issue on A
-
mentioned by docs.jfrog.com
Threat Actors exploit critical JFrog Artifactory Flaw to forge Admin Tokens. A critical authentication bypass vulnerability [CVE-2026-82329]
docs.jfrog.com · 35d ago · September 8th, 2026
-
update from securityonline.info
Wiz detected JFrog Artifactory vulnerabilities exploited in the wild. Patch JFrog Artifactory vulnerabilities now to stop remote administrat
securityonline.info · 33d ago · September 11th, 2026
Patch JFrog Artifactory vulnerabilities now to stop remote administrat
via Mastodon https://securityonline.info/jfrog-artifactory-vulnerabilities-exploited/?utm_source=mastodon&utm_medium=jetpack_social
-
update from cyberpress.org
Hackers Exploit JFrog Artifactory Flaws to Bypass Authentication and Gain Admin Access
cyberpress.org · 32d ago · September 11th, 2026
The attacks pose a significant supply-chain risk because Artifactory commonly stores proprietary software packages, build artifacts, access tokens, repository credentials, and integrations used across development environments. Attackers with administrator access can tamper with software artifacts, steal credentials, deploy server-side plugins, and establish durable persistence. Hackers Exploit JFrog Artifactory Flaws Wiz observed attackers chaining CVE-2026-42018 and CVE-2026-42016 against self-hosted Artifactory deployments between August 15 and September 8. CVE-2026-42018 is an authentication flaw that can expose an internal anonymous-user token to unauthenticated remote requests, even when anonymous access is disabled. The attackers first sent a POST request to /access/api/v1/aws/token/ , including the trailing slash, to obtain an anonymous-user JWT with an HTTP 200 response. The flaw allows a valid but low-privileged token to be exchanged for an administrator-scoped token because Artifactory does not properly enforce the token’s intended authorization scope. Although the resulting credential retains the a
-
mentioned by gbhackers.com
Hackers Exploit JFrog Artifactory Flaws to Bypass Authentication and Gain Admin Access
gbhackers.com · 32d ago · September 11th, 2026
-
update from dev.to
TL;DR what: Attackers chained CVE-2026-42018 and CVE-2026-42016 in self-hosted JFrog... # cybersecurity # infosec # security # software # co
dev.to · 32d ago · September 11th, 2026
cybersecurity # infosec # security # software # co
via Mastodon https://dev.to/etairos/attackers-chain-two-jfrog-artifactory-flaws-to-mint-admin-tokens-and-plant-rust-backdoors-155m
-
mentioned by threat-intelligence.redeyesecurity.com
Two JFrog Artifactory flaws, chained: mint admin tokens, plant Rust backdoors. Artifactory sits upstream of your builds. Admin there is cont
threat-intelligence.redeyesecurity.com · 32d ago · September 11th, 2026
-
update from bleepingcomputer.com
Artifactory flaws chained in attacks deploying backdoor malware
bleepingcomputer.com · 32d ago · September 11th, 2026
Then they increase permissions to admin level by exploiting CVE-2026-42016, caused by insufficient token validation. The researchers note that in some cases the attacker took less than five minutes to create an administrator account. After creating admin accounts and generating long-lived access tokens, the attackers installed malicious Groovy plugins to execute arbitrary commands and established persistence by deploying a Rust-based backdoor.
-
mentioned by www.bleepingcomputer.com
🤖 JFrog Artifactory under active attack: attackers chain CVE-2026-42018 and CVE-2026-42016 to bypass auth, gain admin control and deploy a R
www.bleepingcomputer.com · 32d ago · September 11th, 2026
-
update from go.dhs.gov
We added JFrog Artifactory vulnerabilities CVE-2026-42016 & CVE-2026-42018 and ConnectWise ScreenConnect vulnerability CVE-2026-84869 to our
go.dhs.gov · 32d ago · September 11th, 2026
We added JFrog Artifactory vulnerabilities CVE-2026-42016 & CVE-2026-42018 and ConnectWise ScreenConnect vulnerability CVE-2026-84869 to our
via X https://go.dhs.gov/Z3Q
-
mentioned by threatnoir.com
⚠️ CRITICAL: Attackers Chain JFrog Artifactory Flaws to Gain Admin Control and Plant Backdoors Attackers are chaining multiple JFrog Artifac
threatnoir.com · 32d ago · September 12th, 2026
-
mentioned by www.bleepingcomputer.com
🤖 JFrog Artifactory auth bypass chain (CVE-2026-42018 + CVE-2026-42016) exploited in the wild. Attackers mint JWT for the internal anonymous
www.bleepingcomputer.com · 32d ago · September 12th, 2026
-
mentioned by www.bleepingcomputer.com
🤖 Threat actors are chaining critical and high-severity vulnerabilities in JFrog Artifactory to bypass authentication, gain administrative p
www.bleepingcomputer.com · 31d ago · September 12th, 2026
-
mentioned by dev.to
JFrog Artifactory CVE-2026-82329: The Default Join Key as an Authentication Bypass ... # cybersecurity # devops # security # software # codi
dev.to · 18d ago · September 25th, 2026