JFrog Artifactory auth bypass under active exploit, patch now

JFrog has patched a critical authentication flaw in Artifactory, tracked as CVE-2026-82329, and security researchers now say attackers are exploiting it in the wild. The fix and the impact come from JFrog's security advisory, published on August 28. The active-exploitation claims come from watchTowr and trade-press reporting in the days after, not from the advisory's own wording.

The advisory rates the bug Critical and classes it as improper authentication (CWE-287). Under a default Artifactory configuration, it can let an unauthenticated attacker who can reach the server over the network gain administrative privileges. No login is required, and the payoff is admin on the artifact repository, which for many teams is the spine of the software supply chain.

The patched self-hosted builds are 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, and 7.161.20. The fix is the matching build on each release branch. A build that only cleared an earlier Artifactory issue can still sit below this fix.

For example, 7.146.35 and 7.161.16 closed a separate path-traversal bug Cyberpresso covered when CISA added it to KEV, and both are older than the builds that fix this authentication flaw. A listing that names 7.146.37 is not the line that closes CVE-2026-82329. The fixed build on that branch is 7.146.38.

JFrog says the affected cloud environments are already fortified, so JFrog Cloud customers have no action to take. The remaining exposure is self-hosted Artifactory.

Some offers on this page may be paid placements or contain affiliate links.