CVE-2026-82329: CWE-287 Improper Authentication in jfrog artifactory

CVE-2026-82329 is an improper authentication vulnerability (CWE-287) in JFrog Artifactory that allows unauthenticated access to administrative privileges. Attackers have chained this vulnerability with CVE-2026-42016 and CVE-2026-42018 to bypass authentication and escalate privileges. CVE-2026-42018 exposes internal anonymous-user tokens, and CVE-2026-42016 enables privilege escalation through insufficient token validation. Post-exploitation activities include creating persistent administrator accounts, deploying malicious Groovy plugins for remote code execution, and installing Rust-based backdoors. Exploitation was observed in the wild from August 15 to September 8, 2026, affecting a significant portion of organizations running vulnerable Artifactory versions. The CVSS v3.1 base score is 9.8, indicating critical severity.

Successful exploitation results in complete administrative compromise of JFrog Artifactory instances, allowing attackers to maintain persistent access, execute arbitrary code via malicious plugins, and install backdoors. This compromises confidentiality, integrity, and availability of the affected systems and potentially the broader environment relying on Artifactory.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Organizations should monitor vendor communications closely for official fixes. Until patches are available, restrict access to Artifactory instances and apply compensating controls to limit exposure. Given the active exploitation and critical impact, prioritize updates once vendor patches are released.