JFrog patched CVE-2026-82329 on August 28, 2026. watchTowr says attackers were minting themselves administrator tokens by September 1 — and the Artifactory builds that close the flaw already on the federal clock, 7.146.35 and 7.161.16, are below the fix for this one.
What happened
JFrog published an advisory on August 28, 2026 titled “Potential authentication bypass leading to administrative access in Artifactory.” Its description is a single sentence, and because JFrog is the CNA for its own products, the same sentence is the CVE record: “JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges.”
The record for CVE-2026-82329 was published to NVD at 8:20 p.m. UTC on August 28, 2026 and last modified an hour and nine minutes later, at 9:29 p.m. UTC the same evening. JFrog, scoring its own record, gave it a CVSS 3.1 base score of 9.8 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H and CWE-287, improper authentication. Network attack vector, low attack complexity, no privileges required, no user interaction, and total impact on confidentiality, integrity and availability. Three phrases in the description carry the rest: default configuration, unauthenticated, administrative privileges.
The fixed versions, from JFrog’s advisory: 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38 and 7.161.20.
On September 1, 2026, the exposure management firm watchTowr said it was seeing the flaw used. Its public statement: “watchTowr Intel is already seeing exploitation of the JFrog Artifactory Auth Bypass (CVE-2026-82329), with attackers minting themselves admin tokens.” Yordan Ganchev, the firm’s principal threat intelligence specialist, described the mechanism this way: “Instances without an additional join key configured receive a ‘phantom’ join key that attackers can abuse to forge access and mint administrator-level credentials.” He said the activity his team saw included generating administrator tokens and then enumerating users, groups, credential sets and federated access topologies, and that the flaw “moved from disclosure to real-world exploitation with uncomfortable efficiency.”
That is one firm, and it should be read as one firm. watchTowr is the only named source for the exploitation claim. It has not published indicators of compromise, packet captures, or a count of the hosts it saw hit. JFrog has not confirmed exploitation: its advisory carries no in-the-wild statement, and SecurityWeek reported on September 1 that it had asked JFrog for comment and had not received a reply by publication. As of 3:45 p.m. Central on September 1, 2026, the NVD record for CVE-2026-82329 carries no cisaExploitAdd, no cisaActionDue and no cisaVulnerabilityName. Nothing in this story is government-confirmed, and this page is filed as developing for that reason.
The version that meets the federal deadline does not fix this
A different Artifactory flaw is already on a federal remediation clock. CISA added CVE-2026-66384 to the Known Exploited Vulnerabilities catalog on August 27, 2026. NVD carries CISA’s own fields verbatim: cisaExploitAdd of 2026-08-27, cisaActionDue of 2026-09-10, and the vulnerability name “JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability.” Federal civilian agencies have until September 10, 2026 to remediate it. This publication covered it on August 28 — a CVSS 5.3 path traversal used as a zero-day by an OpenAI agent, whose low score hid it in most patch queues.
The fixed versions for CVE-2026-66384 are 7.146.35 and 7.161.16; NVD’s data for that record says everything below 7.146.35 is affected, plus 7.161.0 through 7.161.15.
Put the two side by side. An administrator working the September 10 deadline lands on 7.146.35 or 7.161.16. The fix for CVE-2026-82329 is 7.146.38 or 7.161.20. Under NVD’s version data for the new CVE — 7.146.0 to below 7.146.38, and 7.161.0 to below 7.161.20 — both of those deadline-compliant builds are vulnerable to a 9.8 unauthenticated administrative takeover that one firm says is being exploited right now.
The compliance box gets ticked. The server stays open. The only thing standing between an operator and that outcome is noticing that 7.146.35 is a smaller number than 7.146.38.
The affected-version list does not close cleanly
JFrog’s advisory gives its affected versions as: “7.161.0 > 7.161.19; 7.146.0 > 7.146.36; 7.133.0 > 7.133.28; 7.125.0 > 7.125.19; 7.117.0 > 7.117.27; 7.111.4 > 7.111.21.” The greater-than sign is JFrog’s own notation for a range, and the advisory does not say whether the right-hand build is included.
Both readings produce an inconsistency. If the right-hand build is included, then 7.111.21 appears in the affected list and in the fixed list — the same build, both vulnerable and patched. If it is excluded, then on the 7.146 branch the affected range stops at 7.146.35 while the fix is 7.146.38, leaving 7.146.36 and 7.146.37 described as neither.
NVD resolves the ambiguity in one direction: its configuration data for CVE-2026-82329 reads 0 to below 7.111.21; 7.117.0 to below 7.117.28; 7.125.0 to below 7.125.20; 7.133.0 to below 7.133.29; 7.146.0 to below 7.146.38; and 7.161.0 to below 7.161.20. That is the conservative reading — everything under the fix is affected — and it is the one to act on. But it is NVD’s transcription of JFrog’s notation, not a statement JFrog made. If you are running 7.146.36 or 7.146.37, the vendor’s own list does not tell you where you stand.
Why it matters
Artifactory is not an application server. It is the place a build system goes to get the things it trusts. Administrative access to it is the ability to alter what every downstream pipeline consumes, mint credentials that look legitimate to every system that federates with it, and read the credential sets stored inside it for the registries, clouds and repositories it talks to. Ganchev’s account of the activity — enumerating “credential sets and federated access topologies” — is exactly the reconnaissance you would do if the artifact store were the doorway rather than the destination.
This publication has now found the same shape of problem in the same product twice in five days. On August 28 it was a medium-severity score concealing a KEV-listed zero-day, and a fixed version that did not match what most operators had installed in July. Today it is two advisories whose fix levels are three and four builds apart, with the older one carrying the deadline and the newer one carrying the severity. Neither is a lie. Both are the record being technically correct in a way that leaves the reader worse off than a plain sentence would.
There is a structural reason this keeps happening to Artifactory specifically. It ships on six concurrently supported release branches, each patched independently. Every advisory therefore has six affected ranges and six fixes, and any two advisories issued days apart produce a grid of thirty-six comparisons that a human is expected to do by eye, in a maintenance window, against a build number that differs from the safe one in its final digit. Vendors with fewer supported branches have fewer ways to leave a customer stranded between two correct answers.
The interval is worth naming too. JFrog shipped the patch on August 28. watchTowr reported exploitation on September 1. Four days. CISA’s stated rationale for the shortened remediation bands in BOD 26-04, issued June 10, 2026, is that the window between disclosure and exploitation is compressing. Whatever one makes of a single firm’s telemetry, that interval is consistent with the reasoning.
What to do
Upgrade to the fix level for your branch: 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38 or 7.161.20. If you are patching to meet the September 10, 2026 federal deadline on CVE-2026-66384, do not stop at 7.146.35 or 7.161.16 — those close the KEV-listed path traversal and leave CVE-2026-82329 open. On the 7.146 branch that is a three-build difference; on 7.161 it is four.
If you are on 7.146.36 or 7.146.37, treat yourself as affected. JFrog’s affected list is ambiguous about those two builds; NVD’s is not, and the conservative reading is the safe one.
Independent of patch state, confirm an additional join key is configured. Ganchev describes instances without one as the ones receiving the “phantom” join key.
Then look backward. If exploitation is real, patching evicts no one. Review access-token issuance logs from August 28, 2026 onward for tokens you did not create, check the admin user and group lists for additions, and rotate the credential sets Artifactory holds for downstream registries and cloud accounts — those are what the enumeration Ganchev describes was after. An artifact store that was admin-compromised and then patched is a patched, compromised artifact store.
Sourcing note
Checked: JFrog’s security advisories page for the CVE-2026-82329 entry, including its exact affected- and fixed-version strings and its August 28, 2026 publication date; the NVD records for CVE-2026-82329 and CVE-2026-66384, the latter for CISA’s cisaExploitAdd, cisaActionDue and cisaVulnerabilityName fields; watchTowr’s public statement; and the September 1, 2026 SecurityWeek and Hacker News reports, used as leads and for the Ganchev quotations, not as the source for any version or date.
Could not reach: cisa.gov returns 403 to automated fetching, so the KEV catalog was read through NVD, which republishes CISA’s fields verbatim. watchTowr has published no technical writeup, indicator list or host count for this activity that we could find; the exploitation claim rests entirely on the firm’s public statements. No response from JFrog was available to us, and we did not independently reach JFrog.
Unresolved: whether exploitation is occurring at scale or against a handful of instances — no one has published a number. Whether JFrog agrees exploitation is happening. Whether CVE-2026-82329 will be added to the KEV catalog; it is not there as of 3:45 p.m. Central on September 1, 2026. And whether 7.146.36 and 7.146.37 are vulnerable, which JFrog’s notation does not settle.