Affected Systems
JFrog Artifactory versions 7.161.0-7.161.19, 7.146.0-7.146.36, 7.133.0-7.133.28, 7.125.0-7.125.19, 7.117.0-7.117.27, and 7.111.4-7.111.21. Affects default configurations of self-managed instances. JFrog Access component specifically vulnerable.
Exploitation Status
Active exploitation confirmed as of September 1, 2026. Attackers observed generating admin tokens, enumerating users, groups, and credential sets. Exploitation began within days of August 28, 2026 patch release.
Business Impact
CVSS 9.8 critical authentication bypass allows unauthenticated attackers with network access to obtain administrative privileges and mint admin tokens. Enables supply chain attacks through binary poisoning, build pipeline tampering, lateral movement to production systems, and downstream malicious code distribution to customers. No authentication or user interaction required under default configurations.
Urgency
🔴 Immediate
Recommended Actions
- Immediately upgrade self-managed JFrog Artifactory instances to version 7.161.20 or later, prioritizing internet-exposed systems
- Review JFrog Access audit logs for unauthorized admin token generation, user enumeration, and suspicious authentication attempts since August 28, 2026
- Rotate all Artifactory credentials, API keys, and access tokens, especially those with administrative privileges
- Configure additional join keys in JFrog Access to prevent exploitation of the phantom join key vulnerability
- Inspect connected CI/CD pipelines, build artifacts, and downstream systems for tampering, backdoors, or malicious code injection