More JFrog Artifactory Bugs Are Under Attack, and All Three Have Patches
Attackers are actively exploiting three JFrog Artifactory flaws, exposing how slow patching can turn artifact repositories into software supply chain attack paths.
Three critical vulnerabilities have been found in JFrog Artifactory, a repository manager for binaries, containers, and packages used in build pipelines. These vulnerabilities allow attackers to gain administrative control over the Artifactory instance, putting downstream products at risk. While patches are available for all three bugs, they have been slow to be applied.
The most serious flaw, CVE-2026-82329, lets unauthenticated attackers gain administrative access. The other two flaws, CVE-2026-42018 and CVE-2026-42016, enable attackers to authenticate as if they belonged in the repository and escalate their privileges. Researchers found that attackers are combining these vulnerabilities to achieve full control.
The exploitation of these patched bugs continues, with 49% of instances still vulnerable to CVE-2026-82329 two weeks after the fix. Experts suggest treating repository managers like internet-facing systems, patching them with the same urgency.
Written by urgent.news from DevOps.com's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
