CVE-2026-82329: Critical JFrog Artifactory Authentication Bypass Exploited in the Wild

CVE-2026-82329 is a critical (CVSS 9.8) authentication-bypass in JFrog Artifactory’s JFrog Access component that allows unauthenticated remote attackers to generate administrator-level tokens; exploitation was observed in the wild days after disclosure with actors enumerating users, tokens, federated access, and in some cases creating backdoor accounts. JFrog patched cloud instances and released fixed self-hosted versions (7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, 7.161.20); the report urges immediate patching of internet-facing instances, audit-log review, credential rotation, artifact integrity checks, and threat hunting across connected CI/CD infrastructure.