A critical authentication bypass vulnerability in JFrog Artifactory, identified as CVE-2026-82329, was exploited by threat actors on the same day it was publicly disclosed. The flaw, which carries a CVSS score of 9.8, allows an unauthenticated attacker with network access to gain administrative privileges on affected systems under default configurations.
The vulnerability was published on August 28, 2026, and was immediately added to commercial research vulnerability catalogs, with the first public exploitation evidence also reported on that date. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the European Union Agency for Cybersecurity (ENISA) subsequently added it to their respective Known Exploited Vulnerabilities (KEV) catalogs on September 2, 2026.
Multiple public reports of exploitation emerged shortly after disclosure, with several sources indicating active attacks by September 1, 2026. These reports confirm that attackers quickly moved to leverage the vulnerability to obtain administrator-level access.
JFrog Artifactory is a widely used universal repository manager. The vendor has released security advisories and self-managed release documentation detailing mitigations for the flaw. CISA has issued a directive requiring federal agencies to apply these mitigations by September 5, 2026, in accordance with their Binding Operational Directive 26-04, which prioritizes security updates based on risk. For cloud services or situations where mitigations are unavailable, CISA advises discontinuing product use.
The rapid exploitation of CVE-2026-82329 highlights the critical need for organizations to promptly apply security updates, especially for vulnerabilities that are publicly disclosed and immediately confirmed to be under active attack. The vulnerability's presence in multiple KEV catalogs underscores its severe risk and the urgency of patching.
