Attackers Exploit Critical JFrog Artifactory Flaw to Mint Admin Tokens Days After Disclosure
Attackers Exploit Critical JFrog Artifactory Flaw to Mint Admin Tokens Days After Disclosure — Ravie LakshmananSep 01, 2026Vulnerability / Supply Chain Atta
What’s new: Attackers are actively exploiting a critical vulnerability (CVE-2026-82329, CVSS score: 9.8) in JFrog Artifactory that allows unauthenticated access to administrative privileges. This flaw was disclosed on August 28, 2026, and patched in version 7.161.20. Exploitation has been observed as of September 1, 2026, with threat actors generating admin tokens and probing for sensitive information.
Who’s affected
Organizations using self-managed versions of JFrog Artifactory, specifically versions 7.161.0 to 7.161.19, 7.146.0 to 7.146.36, 7.133.0 to 7.133.28, 7.125.0 to 7.125.19, 7.117.0 to 7.117.27, and 7.111.4 to 7.111.21, are at risk.
What to do
- Immediately apply the patch to all internet-exposed JFrog Artifactory systems.
- Inspect audit logs for any unauthorized access or changes.
- Rotate any exposed credentials to mitigate potential risks.
- Review connected systems for any malicious changes or backdoor access.
