CVE-2026-82329: JFrog Artifactory — Admin Bypass Enables Supply Chain Risk (September 2026)

CVE-2026-82329 — JFrog Artifactory

CVE-2026-82329 is a critical authentication bypass vulnerability in JFrog Artifactory, currently under active exploitation. Attackers leveraged this flaw to gain administrative access to OpenInfra Europe’s self-hosted Artifactory instance between August 28 and September 15, 2026. The vulnerability allows unauthenticated attackers to escalate privileges and control artifact repositories, with a CVSS score expected to be in the critical range.

Attack Vector

Attackers exploited CVE-2026-82329 to bypass authentication controls and obtain admin-level access to the Artifactory instance. This enabled full manipulation of stored packages, including the potential to insert, modify, or exfiltrate artifacts. The attack required network access to the exposed Artifactory service but did not require valid credentials. No specific IOCs have been released as the investigation is ongoing, but any anomalous admin logins or package modifications during the breach window should be scrutinized.

Who Is at Risk

All organizations running self-hosted JFrog Artifactory instances are at risk, especially those exposed to the internet without additional access controls. OpenInfra Europe is confirmed compromised, and any users who have downloaded packages from their repository between August 28 and September 15, 2026, should treat those artifacts as potentially untrusted. The full scope of affected packages is not yet known.

Patch & Mitigate

• Patch: Apply the vendor-provided fix for CVE-2026-82329 immediately. If a patch is not yet available, restrict public access to Artifactory instances.
• Workaround: Disable external access and enforce strict network segmentation until patched.
• Detect: Review Artifactory logs for unauthorized admin logins, configuration changes, or unexplained artifact modifications between August 28 and September 15, 2026.

MITRE ATT&CK

• T1078 — Valid Accounts: Attackers gained admin access by bypassing authentication mechanisms.
• T1195 — Supply Chain Compromise: Compromised repository artifacts may impact downstream users.

Source: https://www.helpnetsecurity.com/2026/09/30/openinfra-jfrog-artifactory-instance-compromised/