[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fwtHwEYK7tcFUaq1yFRCZipvjWtzNcfD6IbLk9LlmHJE":3},{"article":4,"iocs":41,"watch_terms":46,"solutions":47,"lesson":141},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"0362e519-fe01-4247-abce-0f25250fc1b2","Attackers Pounce on Critical Artifactory Flaw Following Disclosure","attackers-pounce-on-critical-artifactory-flaw-following-disclosure-a73d4a","CVE-2026-82329 is an authentication bypass flaw in JFrog's repository manager that enables bad actors to gain admin-level access on affected systems.","A critical authentication bypass vulnerability, tracked as CVE-2026-82329, has been discovered in JFrog's Artifactory repository manager. This flaw allows threat actors to gain administrative-level access to affected systems. Attackers are reportedly actively exploiting this vulnerability following its public disclosure, posing a significant risk to organizations relying on Artifactory for managing their software development artifacts.","Critical Artifactory flaw CVE-2026-82329 allows attackers admin access post-disclosure.","https:\u002F\u002Fwww.darkreading.com\u002Fapplication-security\u002Fattackers-pounce-critical-artifactory-flaw-disclosure","https:\u002F\u002Feu-images.contentstack.com\u002Fv3\u002Fassets\u002Fblt6d90778a997de1cd\u002Fblte71738f751de1daa\u002F6a97388d5d30863e09d86b97\u002Fjfrog-hapabapa-Getty-1273253225.jpg?width=720&quality=80&disable=upscale","2026-09-01T21:05:53+00:00","2026-09-01T22:00:28.71475+00:00",9,[17,20],{"name":18,"type":19},"Artifactory","product",{"name":21,"type":22},"JFrog","vendor","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":23,"icon":25,"name":26,"slug":27},null,"Vulnerabilities","vulnerabilities",[29,34,36],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":35},{"id":23,"icon":25,"name":26,"slug":27},{"category":37},{"id":38,"icon":25,"name":39,"slug":40},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[42],{"type":43,"value":44,"context":45},"cve","CVE-2026-82329","Critical authentication bypass vulnerability in JFrog Artifactory",[21,18],{"controls":48,"vendors":135},[49,78,107],{"slug":50,"name":51,"problem":52,"products":53},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[54,62,70],{"vendor_slug":55,"vendor_name":56,"vendor_logo":57,"product_slug":58,"product_name":59,"url":60,"description":61},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"slug":79,"name":80,"problem":81,"products":82},"patch-management","Automated patch management","Known holes get closed in days, not months.",[83,91,99],{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":40,"name":108,"problem":109,"products":110},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[111,119,127],{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",[136],{"slug":137,"name":21,"logo_path":138,"roles":139},"jfrog","\u002Fvendor-logos\u002Fjfrog.png",[140],"affected",{"slug":142,"title":143,"body":144,"framework_refs":145,"framework_notes":158},"critical-artifactory-auth-bypass-exploited-within-days-of-disclosure","Critical Artifactory Auth Bypass Exploited Within Days of Disclosure","CVE-2026-82329 represents a severe authentication bypass vulnerability in JFrog Artifactory that grants attackers administrative-level access without valid credentials, exposing the entire software artifact pipeline. The rapid exploitation following public disclosure highlights a dangerously short window between vulnerability announcement and active attacks — a pattern known as 'patch lag exploitation.' Organizations that treat Artifactory as an internal or low-risk tool often delay patching, underestimating its role as a critical node in the software supply chain. Compromise of a repository manager can enable attackers to inject malicious code into build artifacts, potentially cascading downstream into production environments and affecting all consumers of those packages.",[146,147,148,149,150,151,152,153,154,155,156,157],"CIS Control 7: Continuous Vulnerability Management","CIS Control 4: Secure Configuration of Enterprise Assets","CIS Control 12: Network Infrastructure Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 AC-2: Account Management","NIST SP 800-53 AC-17: Remote Access","NIST SP 800-53 RA-5: Vulnerability Monitoring and Scanning","NIST CSF ID.RA-1: Asset vulnerabilities are identified and documented","NIST CSF RS.RP-1: Response plan is executed during or after an incident","SSDF (NIST SP 800-218) PW.4: Reuse existing, well-secured software for artifact integrity","ITIL Change Management: Emergency Change procedures for critical patches","SLSA Supply Chain Framework: Artifact integrity verification",{}]