JFrog Artifactory Vulnerabilities Enable Rapid Admin Access Exploitation

• •Three critical vulnerabilities in JFrog Artifactory allow rapid admin access.
• •Attackers can exploit these flaws in under five minutes, posing a significant risk.
• •Organizations must patch affected versions and investigate potential compromises.

Attackers are exploiting three vulnerabilities in self-hosted JFrog Artifactory to gain administrator access in under five minutes. The vulnerabilities, CVE-2026-42018, CVE-2026-42016, and CVE-2026-82329, allow for authentication bypass and privilege escalation. Attackers can chain these flaws to create persistent admin accounts, steal credentials, and execute arbitrary code. The flaws are rated high to critical severity, with CVE-2026-82329 being critical. Security firm Wiz.io reported that the attack method involves sending unauthenticated HTTP requests to exploit these vulnerabilities. Organizations with exposed Artifactory instances are urged to assume compromise and investigate for signs of exploitation. Patching the vulnerabilities is necessary to close the entry points but does not remove any existing intruders. The vulnerabilities were added to CISA's KEV catalog due to active exploitation.