Critical JFrog Artifactory Flaw Allows Unauthenticated Admin Access, Exploited in Wild

A critical authentication bypass vulnerability, CVE-2026-82329, has been discovered in JFrog Artifactory's default configuration, allowing unauthenticated remote attackers to generate administrator tokens without any credentials. The flaw was reportedly exploited in the wild within days of its public disclosure, as confirmed by SecurityWeek on September 1, 2026. Successful exploitation grants attackers full administrative control over repositories, artifacts, users, and CI/CD credentials, posing a serious software supply chain risk. JFrog has released a patched version, and administrators are urged to update immediately and restrict management interface access via VPN or authentication proxy. Organizations should also enable strict auditing and alerting for administrator token creation and unexpected repository modifications to detect potential compromise.