Critical JFrog Artifactory Auth Bypass Exploited in the Wild, Admin Rights at Risk

Security researchers have confirmed that a critical authentication bypass flaw in JFrog Artifactory, identified as CVE-2026-82329, is being leveraged by threat actors to obtain full administrative control of affected installations.

Artifactory is a widely deployed binary repository manager that underpins modern continuous‑integration and continuous‑delivery pipelines. Organizations across software development, DevOps, and enterprise IT rely on it to store and distribute packages, container images, and other artifacts, making the platform a high‑value target for attackers seeking to disrupt or hijack software supply chains.

The vulnerability allows an unauthenticated user with basic network connectivity to the Artifactory service to bypass its login mechanisms altogether. Once the bypass is successful, the attacker can issue any API call that requires administrator privileges, including the creation of new users, alteration of access policies, and extraction of stored artifacts. The flaw is classified as critical due to the combination of its ease of exploitation and the breadth of privileges it confers.

WatchTowr’s intelligence team reported seeing active exploitation of the bug in the wild. According to its monitoring, compromised servers exhibited unusual API traffic patterns and the creation of privileged accounts that were not associated with any known internal user. While the firm did not disclose specific indicators of compromise, it warned that the activity appears to be coordinated and that attackers are focusing on environments where Artifactory is exposed to the public internet or insufficiently segmented internal networks.

JFrog responded by acknowledging the issue and publishing a security advisory that includes mitigation steps and a timeline for a forthcoming patch release. The company recommends that administrators immediately apply any available updates, enforce strict network zoning, and enable additional authentication layers such as LDAP or SAML wherever possible. Users are also urged to rotate credentials and review audit logs for signs of unauthorized activity.

The incident underscores the growing scrutiny of software‑supply‑chain components as a vector for sophisticated attacks. Experts say that organizations should treat repository managers as critical assets, regularly audit their exposure, and adopt a zero‑trust approach to internal services. As patches roll out, continuous monitoring will be essential to detect any lingering exploitation attempts and to protect the integrity of downstream development workflows.