Threat Overview
CVE-2026-82329 is a critical authentication-bypass vulnerability in self-managed JFrog Artifactory. JFrog states an unauthenticated attacker with network access can potentially obtain administrative access under the default configuration. Fixes were published August 28, 2026 across supported 7.111, 7.117, 7.125, 7.133, 7.146, and 7.161 branches. JFrog Cloud environments were already protected.
BleepingComputer reported active exploitation based on watchTowr observations of attackers creating administrative tokens. JFrog’s advisory confirms the vulnerability, but JFrog had not publicly confirmed the reported attacks when contacted by BleepingComputer. This distinction matters: the vulnerability and affected versions are vendor-confirmed, while active exploitation is researcher-observed.
Administrative Artifactory access can expose or modify users, groups, tokens, security configuration, federation relationships, repositories, and trusted software artifacts. An attacker-created token may remain valid after the vulnerable software is patched until that token is revoked or expires.
References
- JFrog Security Advisory CVE-2026-82329 – August 28, 2026: https://docs.jfrog.com/releases/docs/jfrog-security-advisories
- BleepingComputer – September 2, 2026: https://www.bleepingcomputer.com/news/security/hackers-exploit-critical-jfrog-artifactory-flaw-to-forge-admin-tokens/
- Dark Reading – September 1, 2026: https://www.darkreading.com/application-security/attackers-pounce-critical-artifactory-flaw-disclosure
Impacted Systems
- Vendor/product: JFrog Artifactory self-managed.
- Vulnerability: CVE-2026-82329, authentication bypass leading to administrative access.
- Configuration: exploitable in default configuration according to JFrog.
- Attacker prerequisite: unauthenticated network access.
- 7.161 affected: 7.161.0 through 7.161.19; fixed in 7.161.20.
- 7.146 affected: 7.146.0 through 7.146.36; fixed in 7.146.38.
- 7.133 affected: 7.133.0 through 7.133.28; fixed in 7.133.29.
- 7.125 affected: 7.125.0 through 7.125.19; fixed in 7.125.20.
- 7.117 affected: 7.117.0 through 7.117.27; fixed in 7.117.28.
- 7.111 affected: 7.111.4 through 7.111.20; fixed in 7.111.21.
- Deployment: self-managed Artifactory.
- Explicitly remediated environment: JFrog states Cloud environments were already protected.
- Researcher-observed behavior: minting administrative access tokens.
Why This Hunt Was Performed
Artifactory sits directly in trusted software-distribution and CI/CD paths. Administrative compromise can expose secrets, poison trusted artifacts, or create persistent access through valid tokens.
Criticality
Critical. Unauthenticated administrative access under default configuration with researcher-observed active exploitation and significant downstream supply-chain impact.
Exploitation Status / Threat Activity
Active exploitation has been reported by watchTowr and covered by BleepingComputer. JFrog publicly confirms the vulnerability but had not publicly confirmed the observed attacks at the time of reporting.
Scope and Visibility
All hunting and review statements in this report are limited to telemetry ingested into Microsoft Sentinel and the retention available for those data sources. Absence of matching activity in available Sentinel data does not confirm absence of activity on systems that are not monitored, in logs that are not ingested, or outside the retained time window. This daily intelligence package was not executed against a specific customer Microsoft Sentinel workspace, so no customer-specific finding is asserted.
Hunt Scope / What Was Reviewed
Available Microsoft Sentinel telemetry can be reviewed for token-related HTTP/API activity, new external Artifactory sources, state-changing requests, Artifactory/Java child processes, suspicious file creation, new outbound destinations, artifact write/delete bursts, and Linux Syslog fallback where relevant sources are ingested.
KQL Hunting Content
Hunt 1 – First-Pass: Artifactory Token-Creation Activity
CommonSecurityLog
| where TimeGenerated >= ago(30d)
| extend Url=tostring(column_ifexists("RequestURL",""))
| where Url has_any ("/api/security/token","/access/api/v1/tokens","/api/v1/tokens")
| where tostring(column_ifexists("RequestMethod","")) in~ ("POST","PUT")
| project TimeGenerated, SourceIP, DestinationIP, DestinationHostName, RequestMethod=tostring(column_ifexists("RequestMethod","")), Url, RequestClientApplication=tostring(column_ifexists("RequestClientApplication","")), DeviceAction, Message
| sort by TimeGenerated ascHunt 2 – New External Sources Reaching Artifactory
let Baseline = CommonSecurityLog
| where TimeGenerated between (ago(30d) .. ago(7d))
| where tostring(column_ifexists("RequestURL","")) has_any ("/artifactory/","/ui/","/api/","/access/")
| summarize by SourceIP, DestinationHostName;
CommonSecurityLog
| where TimeGenerated >= ago(7d)
| where tostring(column_ifexists("RequestURL","")) has_any ("/artifactory/","/ui/","/api/","/access/")
| join kind=leftanti Baseline on SourceIP, DestinationHostName
| summarize Requests=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), URLs=make_set(tostring(column_ifexists("RequestURL","")),50), Methods=make_set(tostring(column_ifexists("RequestMethod","")),10) by SourceIP, DestinationHostName
| sort by FirstSeen descHunt 3 – Rare State-Changing Artifactory Requests
CommonSecurityLog
| where TimeGenerated >= ago(30d)
| extend Url=tostring(column_ifexists("RequestURL",""))
| extend Method=tostring(column_ifexists("RequestMethod",""))
| where Url has_any ("/artifactory/","/api/","/access/")
| where Method in~ ("POST","PUT","PATCH","DELETE")
| summarize Requests=count(), URLs=make_set(Url,50), Methods=make_set(Method,10), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by SourceIP, DestinationHostName
| where Requests <= 20
| sort by LastSeen descHunt 4 – Artifactory or Java Spawning Shells and Utilities
DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where InitiatingProcessFileName in~ ("java","java.exe","artifactory","artifactory.exe")
| where FileName in~ ("bash","sh","cmd.exe","powershell.exe","pwsh.exe","curl","curl.exe","wget","wget.exe","python","python3","nc","ncat")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| sort by TimeGenerated ascHunt 5 – Executable Artifacts Written by Artifactory or Java
DeviceFileEvents
| where TimeGenerated >= ago(30d)
| where InitiatingProcessFileName in~ ("java","java.exe","artifactory","artifactory.exe")
| where ActionType in ("FileCreated","FileModified","FileRenamed")
| where FileName endswith ".sh" or FileName endswith ".ps1" or FileName endswith ".py" or FileName endswith ".jar" or FileName endswith ".exe" or FileName endswith ".dll" or FileName endswith ".so"
| project TimeGenerated, DeviceName, ActionType, FileName, FolderPath, SHA256, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by TimeGenerated ascHunt 6 – New Public Destinations From Artifactory or Java
let Baseline = DeviceNetworkEvents
| where TimeGenerated between (ago(30d) .. ago(7d))
| where InitiatingProcessFileName in~ ("java","java.exe","artifactory","artifactory.exe")
| where RemoteIPType == "Public"
| summarize by DeviceId, RemoteIP, RemotePort;
DeviceNetworkEvents
| where TimeGenerated >= ago(7d)
| where InitiatingProcessFileName in~ ("java","java.exe","artifactory","artifactory.exe")
| where RemoteIPType == "Public"
| join kind=leftanti Baseline on DeviceId, RemoteIP, RemotePort
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort, ActionType
| sort by TimeGenerated descHunt 7 – Artifact Repository Write or Delete Bursts
CommonSecurityLog
| where TimeGenerated >= ago(30d)
| extend Url=tostring(column_ifexists("RequestURL",""))
| extend Method=tostring(column_ifexists("RequestMethod",""))
| where Url has "/artifactory/"
| where Method in~ ("PUT","DELETE")
| summarize Requests=count(), UniqueObjects=dcount(Url), SampleURLs=make_set(Url,50), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by SourceIP, DestinationHostName, bin(TimeGenerated,15m)
| where Requests >= 25 or UniqueObjects >= 20
| sort by Requests descHunt 8 – Linux Syslog Fallback for Artifactory Privilege or Persistence Activity
Syslog
| where TimeGenerated >= ago(30d)
| where SyslogMessage has_any ("artifactory","jfrog")
| where SyslogMessage has_any ("token","admin","sudo","session opened for user root","systemctl","crontab","authorized_keys","curl ","wget ")
| project TimeGenerated, Computer, HostIP, ProcessName, SeverityLevel, SyslogMessage
| sort by TimeGenerated ascDetection Notes
- No reliable exploit request path for CVE-2026-82329 has been published. Token/API hunts are behavioral follow-up hunts, not exploit signatures.
- Highest-value signals are unexpected administrative tokens, unusual token-creation activity, and rare external sources performing state-changing operations.
- Artifactory is automation-heavy; POST, PUT, and DELETE activity must be baselined by source and identity.
- Attacker-created tokens may remain valid after patching until revoked or expired.
- Broad Java process hunting can be noisy; scope to known Artifactory hosts.
- Missing Artifactory access/audit logs, reverse-proxy/WAF telemetry, or endpoint coverage materially reduces Sentinel visibility.
Killian Sherer 