CVE-2026-82329: JFrog Artifactory Auth Bypass Under Active Exploitation — Detection and Remediation Guide

---
title: JFrog Artifactory Suspicious Token API Access - CVE-2026-82329
id: 8f2c1d94-6a3b-4e17-b2c9-4d5e6f7a8b9c
status: experimental
description: Detects HTTP requests to JFrog Artifactory and JFrog Access token-minting endpoints associated with CVE-2026-82329 authentication bypass exploitation. Alert on unauthenticated or externally sourced requests hitting administrative security/token APIs.
references:
  - https://thehackernews.com/2026/09/attackers-exploit-critical-jfrog.html
  - https://attack.mitre.org/techniques/T1078/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.initial_access
  - attack.t1190
  - attack.t1078
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri-stem|contains:
      - '/artifactory/api/security/token'
      - '/artifactory/api/security/apiKey'
      - '/access/api/v1/tokens'
      - '/access/api/v1/users'
  filter_internal:
    c-ip|startswith:
      - '10.'
      - '192.168.'
      - '172.16.'
  condition: selection_uri and not filter_internal
falsepositives:
  - Legitimate CI/CD automation minting tokens from external build runners (baseline and allowlist known automation source IPs)
  - JFrog Platform federation between trusted instances
level: high
---
title: JFrog Artifactory Java Process Spawning Shell or Script Interpreter
id: 3b9e7a12-5c4d-4f68-9a1b-2c3d4e5f6a7b
status: experimental
description: Detects the Artifactory Java service spawning command shells, script interpreters, or system utilities. Strong post-exploitation signal for CVE-2026-82329 follow-on activity after administrative access is obtained.
references:
  - https://thehackernews.com/2026/09/attackers-exploit-critical-jfrog.html
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/java'
    ParentCommandLine|contains:
      - 'artifactory'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/curl'
      - '/wget'
      - '/python'
      - '/python3'
      - '/perl'
      - '/nc'
      - '/ncat'
      - '/socat'
      - '/base64'
  condition: selection_parent and selection_child
falsepositives:
  - Artifactory custom user plugins executing scripts (rare; review plugin inventory before tuning)
  - Health-check scripts explicitly configured by administrators
level: critical
---
title: Artifactory Admin Token Creation Followed by Repository Modification
id: 61c4f2a8-8d3e-4b79-a5c2-7f8e9d0a1b2c
status: experimental
description: Detects sequences consistent with attacker abuse of CVE-2026-82329 - token creation events followed by artifact deployment or repository configuration changes, visible in Artifactory access/request logs shipped to the SIEM.
references:
  - https://thehackernews.com/2026/09/attackers-exploit-critical-jfrog.html
  - https://attack.mitre.org/techniques/T1078.004/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.persistence
  - attack.t1078.004
  - attack.t1195
logsource:
  category: application
  product: jfrog
detection:
  selection_token:
    message|contains:
      - 'token created'
      - 'Created token'
      - 'CREATE TOKEN'
      - 'api/security/token'
  selection_deploy:
    message|contains:
      - 'PUT /artifactory/'
      - 'deploy'
      - 'SetRepositoryConfiguration'
      - 'CreateUser'
  condition: selection_token or selection_deploy
falsepositives:
  - Normal CI/CD publishing and admin operations - tune by source IP, service account name, and maintenance windows; investigate any such events outside known automation identity
level: medium

// Hunt 1: Requests to Artifactory token/security endpoints from non-baseline sources
// Covers Syslog/CEF-ingested reverse proxy or Artifactory request logs
let baseline_ips = dynamic(["10.20.30.40", "10.20.30.41"]); // known CI/CD automation IPs - customize
union isfuzzy=true
    (CommonSecurityLog
     | where TimeGenerated > ago(14d)
     | where RequestURL has_any ("/artifactory/api/security/token", "/access/api/v1/tokens", "/artifactory/api/security/apiKey")
     | extend SourceIP = SourceIP, Method = RequestMethod, Status = tostring(AdditionalExtensions)
     | project TimeGenerated, SourceIP, Method, RequestURL, DestinationHostName, DeviceProduct),
    (Syslog
     | where TimeGenerated > ago(14d)
     | where SyslogMessage has_any ("/artifactory/api/security/token", "/access/api/v1/tokens", "token created")
     | project TimeGenerated, Computer, ProcessName, SyslogMessage)
| where not(SourceIP in (baseline_ips)) or isempty(SourceIP)
| sort by TimeGenerated desc;

// Hunt 2: Artifactory java process spawning shells or download utilities (post-exploitation)
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName =~ "java" or InitiatingProcessCommandLine has "artifactory"
| where FileName in~ ("sh", "bash", "dash", "curl", "wget", "python", "python3", "nc", "ncat", "base64", "perl")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, AccountName
| sort by TimeGenerated desc;

// Hunt 3: New admin users or tokens in Artifactory audit data forwarded via Syslog
Syslog
| where TimeGenerated > ago(14d)
| where SyslogMessage has_any ("CreateUser", "token created", "security.apiKey", "admin")
| where SyslogMessage has_any ("artifactory", "access")
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by Computer, SyslogMessage
| sort by LastSeen desc;

-- Artifact: SecurityArsenal.Artifactory.CVE-2026-82329-Triage
-- Identify Artifactory java service, suspicious child processes, and exposed listeners

-- Artifactory processes and any non-java children they spawned
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ 'artifactory'
   OR (Ppid IN (SELECT Pid FROM pslist() WHERE CommandLine =~ 'artifactory')
       AND NOT Name =~ 'java')

-- Listening sockets on default Artifactory ports (8081/8082) to confirm exposure
SELECT Pid, Name, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status
FROM netstat()
WHERE LocalPort IN (8081, 8082, 8040, 8046, 8047, 8048)
   AND Status =~ 'LISTEN'

-- Artifactory access/security log artifacts for token creation review
SELECT FullPath, Size, Mtime
FROM glob(globs=['/opt/jfrog/artifactory/var/log/**access**', '/opt/jfrog/artifactory/var/log/**request**', '/var/opt/jfrog/artifactory/log/**'])
WHERE Mtime > ago(14d)
ORDER BY Mtime DESC

#!/bin/bash
# CVE-2026-82329 Artifactory triage and hardening helper
# Run on the Artifactory host as a user with log read access.
set -euo pipefail

JFROG_HOME="${JFROG_HOME:-/opt/jfrog/artifactory/var}"
ART_URL="${ART_URL:-http://localhost:8082}"
LOG_DIR="${JFROG_HOME}/log"

# Note: JFrog requires an existing admin token to query the Access API.
# Generate a short-lived one ONLY from a known-good admin session, or run these queries in the UI.
ADMIN_TOKEN="${ADMIN_TOKEN:-}"

echo "=== [1] Confirm Artifactory version (compare against the fixed version in the JFrog advisory) ==="
curl -s "${ART_URL}/artifactory/api/system/version" || echo "Version endpoint unreachable"
echo

echo "=== [2] Exposure check: listeners on Artifactory ports ==="
ss -tlnp 2>/dev/null | grep -E ':(8081|8082|8040|8046|8047|8048)\b' || echo "No Artifactory listeners found"
echo

echo "=== [3] Hunt: unauthenticated hits on token/security endpoints in request logs (last 14 days) ==="
find "${LOG_DIR}" -name '*request*' -mtime -14 2>/dev/null | while read -r f; do
  grep -EH '(api/security/token|access/api/v1/tokens|api/security/apiKey)' "$f" 2>/dev/null
 done | grep -vE '\b(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.)' | tail -n 200 || echo "No external token-endpoint requests found"
echo

echo "=== [4] Hunt: token creation + suspicious deployments in access/audit logs ==="
find "${LOG_DIR}" -type f -mtime -14 2>/dev/null | while read -r f; do
  grep -EHi 'token created|CreateUser|SetRepositoryConfiguration' "$f" 2>/dev/null
 done | tail -n 200 || echo "No token creation or repo reconfiguration events found"
echo

echo "=== [5] Suspicious child processes of the Artifactory java service (live) ==="
ART_PIDS=$(pgrep -f 'artifactory' || true)
for p in ${ART_PIDS}; do
  ps --ppid "$p" -o pid,ppid,user,comm,args 2>/dev/null | grep -Ev '\bjava\b' || true
done
echo

if [ -n "${ADMIN_TOKEN}" ]; then
  echo "=== [6] List Access tokens for revocation review (sort by created date, revoke anything unrecognized) ==="
  curl -s -H "Authorization: Bearer ${ADMIN_TOKEN}" "${ART_URL}/access/api/v1/tokens" | head -c 5000
  echo
else
  echo "=== [6] Skipped token listing (set ADMIN_TOKEN env var to enumerate tokens via Access API) ==="
fi

echo
echo "=== NEXT STEPS ==="
echo "1. PATCH: upgrade to the fixed Artifactory version per the official JFrog security advisory for CVE-2026-82329."
echo "2. REVOKE all admin and service tokens created since disclosure; re-issue only to verified automation."
echo "3. REMOVE direct internet exposure: place Artifactory behind a reverse proxy/VPN and restrict token APIs to CI/CD CIDRs."
echo "4. REVIEW deployed artifacts since first disclosure for tampering (checksum drift vs. source builds)."