JFrog's 28 August 2026 advisory rates CVE-2026-82329 Critical (CVSS 3.1 9.8): under default configuration, an unauthenticated attacker with network access may obtain administrative privileges on self-managed Artifactory.

BleepingComputer reported on 2 September 2026 that researchers at watchTowr observed the flaw being exploited by "attackers minting themselves admin tokens"; BleepingComputer says an attacker forging their own admin tokens can enumerate users, groups and federated topologies, read artifacts, change security configurations and poison existing packages (source: BleepingComputer). Self-hosted patches: 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, 7.161.20; JFrog says cloud was already fortified.

Access tokens are independent credentials — upgrading the binary does not by itself revoke minted tokens, so rotate/revoke tokens and hunt anomalous admin activity after patching. CISA added CVE-2026-82329 to the KEV catalog on 2 September 2026.

UPDATE 10–11 September 2026 (Wiz): Wiz also saw CVE-2026-82329 abused in the wild alongside a separate 42018→42016 chain (15 Aug–8 Sep) that yields admin and drops Rust C2 / Groovy plugins.

Correction (29 Oct 2026): exploitation details are now credited to BleepingComputer's linked report; removed details that only SecurityWeek gave (backdoor users, a small set of IPs, no mass scanning, a 'phantom' join key), internal cross-references and a duplicate JFrog link. (sources: JFrog; BleepingComputer)

Correction (02 Nov 2026): removed The Hacker News as a source. (source: Wiz)