[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fsmheq0lJQXhHuiI7bcFVYNzYqPjj_u-4Pg5RPF2g8So":3},{"article":4,"iocs":44,"watch_terms":49,"solutions":50,"lesson":150},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"d3888b9c-7954-4499-bc75-0ac24c932680","Hackers exploit critical JFrog Artifactory flaw to forge admin tokens","hackers-exploit-critical-jfrog-artifactory-flaw-to-forge-admin-tokens-2a5f36","A critical authentication bypass vulnerability (CVE-2026-82329) in JFrog Artifactory is being exploited in attacks to create tokens that provide administrative access. [...]","A critical authentication bypass vulnerability in JFrog Artifactory (CVE-2026-82329) is being actively exploited by attackers to forge administrative tokens. This flaw, present in default configurations of self-managed instances, allows unauthenticated attackers to gain administrative privileges, potentially leading to the compromise of trusted software artifacts and downstream systems. JFrog has released patches for affected versions.","Critical JFrog Artifactory flaw (CVE-2026-82329) allows attackers to forge admin tokens.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fhackers-exploit-critical-jfrog-artifactory-flaw-to-forge-admin-tokens\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F03\u002F24\u002Fhacker_box.jpg","2026-09-02T15:47:08+00:00","2026-09-02T16:00:05.018766+00:00",9,[17,20,23],{"name":18,"type":19},"JFrog Artifactory","product",{"name":21,"type":22},"JFrog","vendor",{"name":24,"type":25},"authentication bypass","technology","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":26,"icon":28,"name":29,"slug":30},null,"Vulnerabilities","vulnerabilities",[32,37,39],{"category":33},{"id":34,"icon":28,"name":35,"slug":36},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":38},{"id":26,"icon":28,"name":29,"slug":30},{"category":40},{"id":41,"icon":28,"name":42,"slug":43},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[45],{"type":46,"value":47,"context":48},"cve","CVE-2026-82329","Critical authentication bypass vulnerability in JFrog Artifactory",[21,18],{"controls":51,"vendors":138},[52,80,109],{"slug":53,"name":54,"problem":55,"products":56},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[57,65,73],{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":61,"product_name":62,"url":63,"description":64},"delinea","Delinea","\u002Fvendor-logos\u002Fdelinea.png","secret-server","Delinea Secret Server","https:\u002F\u002Fdelinea.com\u002Fproducts\u002Fsecret-server","Vault for privileged credentials with discovery, rotation and session recording.",{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":53,"product_name":77,"url":78,"description":79},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","Privileged Access Management","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fprivileged-access-management","Gives elevated rights to specific applications only where needed, so users do not need local admin accounts.",{"slug":81,"name":82,"problem":83,"products":84},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[85,93,101],{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"slug":110,"name":111,"problem":112,"products":113},"patch-management","Automated patch management","Known holes get closed in days, not months.",[114,122,130],{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",[139,144],{"slug":140,"name":21,"logo_path":141,"roles":142},"jfrog","\u002Fvendor-logos\u002Fjfrog.png",[143],"affected",{"slug":145,"name":146,"logo_path":147,"roles":148},"watchtowr","watchTowr","\u002Fvendor-logos\u002Fwatchtowr.png",[149],"reported_by",{"slug":151,"title":152,"body":153,"framework_refs":154,"framework_notes":166},"critical-jfrog-artifactory-auth-bypass-enables-admin-token-forgery","Critical JFrog Artifactory Auth Bypass Enables Admin Token Forgery","A critical authentication bypass flaw (CVE-2026-82329) in JFrog Artifactory's default configuration allowed unauthenticated attackers to forge administrative tokens without any credentials, exposing self-managed instances to full compromise. Because Artifactory serves as a central repository for software artifacts and build dependencies, administrative access hands attackers the ability to inject malicious code into trusted packages, poisoning downstream software supply chains. The fact that this flaw exists in default configurations means organizations that never hardened their deployment were silently vulnerable from the moment of installation. This incident underscores that artifact repository platforms are high-value targets requiring the same rigorous patch and configuration discipline as perimeter-facing systems.",[155,156,157,158,159,160,161,162,163,164,165],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 7: Continuous Vulnerability Management","CIS Control 4: Secure Configuration of Enterprise Assets and Software","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 AC-2: Account Management","NIST SP 800-53 CM-6: Configuration Settings","NIST SP 800-161: Cybersecurity Supply Chain Risk Management","NIST CSF ID.RA-1: Asset vulnerabilities are identified and documented","NIST CSF PR.IP-12: A vulnerability management plan is developed and implemented","ITIL Change Management: Emergency Change procedures for critical patches","SLSA Supply Chain Security Framework: Artifact integrity and provenance verification",{}]