JFrog Artifactory CVE-2026-82329

What happened: JFrog disclosed CVE-2026-82329 on 28 August 2026 as a Critical authentication weakness in self-managed Artifactory, and the Canadian Centre for Cyber Security and Tenable subsequently reported exploitation in the wild. Under the affected default behavior, a network-reachable unauthenticated caller may gain administrative privileges. JFrog lists vulnerable ranges across the 7.111, 7.117, 7.125, 7.133, 7.146, and 7.161 release branches and published a first-fixed release for each; affected cloud environments were already fortified by the vendor.

How the technical chain works: independent reproduction against Artifactory JCR 7.146.25 reached unauthenticated JFrog Access registry-join routes and received a service-level administrative token. The reproduced sequence then enumerated users, reset the built-in administrator, created an additional administrative token, and read system information. The researchers attribute the behavior to acceptance of a blank additional join key and report that fixed 7.146.38 rejects it. Those mechanics are laboratory evidence, not a claim that every observed attacker followed the same sequence; no public victim record, actor, payload, or atomic indicator was available during this run.

Why detection must span the application and host: the two registry-join paths, service-token scope, user changes, and token creation live in reverse-proxy and JFrog Access logs, not portable Falcon endpoint events. The four CQL queries therefore do not pretend to detect the HTTP exploit itself. Q01 inventories likely Artifactory servers for version-owner review. Q02 and Q04 hunt for unusual service-child execution and execution from Artifactory-writable paths. Q03 builds a noisy Java egress baseline that becomes useful only after it is restricted to confirmed Artifactory hosts and approved destinations. IPv6, wrapper depth, application-log schemas, artifact provenance, and legitimate cluster joins remain explicit coverage limits.

Operational consequence: Artifactory sits inside build and release trust. Administrative takeover can expose identities, alter permissions or tokens, and undermine repository integrity even when no host malware is visible. Detection is therefore secondary to immediate fixed-version verification, controlled exposure reduction, preservation of request and security-audit logs, review of administrative identities, and artifact integrity checks before normal release activity resumes.

Eight current-run sanitized snapshots preserve vendor, government, independent reproduction, detection, logging, network, token, and software-supply-chain guidance. Source text was treated as untrusted data and no executable proof material was retained.

Claim ledger

The hunt model separates vulnerable-product inventory, exploit-specific application evidence, administrative identity changes, and post-compromise endpoint behavior. Important missing telemetry remains a named gap rather than an invented Falcon field.

Hypotheses

Affected surface and telemetry

The affected surface is self-managed JFrog Artifactory and its Access service, reverse proxy, administrative identity plane, repository storage, and downstream CI/CD consumers. Portable coverage assumes process and IPv4 network events where populated. HTTP URI, token scope, user/permission changes, artifact promotion, IPv6, wrapper lineage, and deployment-specific paths require owner and tenant validation.

No atomic IOCs were published by the accessible primary, government, or independent technical sources as of 2026-09-02. CVE-2026-82329 is not an IOC, and the registry-join URI paths are defensive application-log pivots rather than attacker infrastructure. No IP address, domain, payload hash, certificate, username, or token value is included.

Mappings are analyst inferences from source-backed behavior. Product inventory and patching are intentionally unmapped, and the laboratory sequence is not represented as universal in-the-wild tradecraft.

The exploit-specific review belongs in JFrog and reverse-proxy records. These native hunts should be completed before interpreting generic Java or file-path endpoint results.

All queries are STATIC-ONLY. Start with a one-hour manual window in the intended repository, confirm fields and result semantics, then expand to each card's lookback.

// HUNT: Artifactory service inventory and version leads
// HYPOTHESIS: H01
// USE: inventory
// MITRE: N/A — inventory
// CONF: high
// FP: low
// COST: low
// TIMEFRAME: 7d — current server inventory with bounded process volume
// REQUIRES: Falcon endpoint event repository; ProcessRollup2; FileName, ImageFileName, CommandLine, ParentBaseFileName, aid, ComputerName, @timestamp
// FALSE POSITIVES: Every legitimate self-managed Artifactory service is an expected result
// TUNING: Add approved Artifactory host groups and packaging-specific service paths after owner verification
// VALIDATION: STATIC-ONLY
#event_simpleName = ProcessRollup2
| (ImageFileName = /(?:jfrog|artifactory)/i OR CommandLine = /(?:jfrog|artifactory)/i)
| groupBy([aid, ComputerName, FileName, ImageFileName, CommandLine, ParentBaseFileName], function=[count(as=Executions), min(@timestamp, as=FirstSeen), max(@timestamp, as=LastSeen)], limit=1000)
| sort(LastSeen, order=desc, limit=1000)

// HUNT: Shell or interpreter launched by an Artifactory service
// HYPOTHESIS: H02
// USE: hunt
// MITRE: T1059
// CONF: medium
// FP: medium
// COST: low
// TIMEFRAME: 30d — retrospective window spanning disclosure and reported exploitation
// REQUIRES: Falcon endpoint event repository; ProcessRollup2; FileName, ImageFileName, CommandLine, ParentBaseFileName, ParentCommandLine, aid, ComputerName, UserName, TargetProcessId, @timestamp
// FALSE POSITIVES: Approved plugins, backup hooks, repository maintenance, upgrades, and support diagnostics
// TUNING: Exclude only owner-approved wrapper, account, path, and command combinations after a 30-day baseline
// VALIDATION: STATIC-ONLY
#event_simpleName = ProcessRollup2
| ParentBaseFileName = /^(?:java|javaw|artifactory|jfrog)(?:\.exe)?$/i
| FileName = /^(?:cmd|powershell|pwsh|sh|bash|dash|zsh|python|python3|perl|curl|wget|certutil|bitsadmin)(?:\.exe)?$/i
| table([@timestamp, aid, ComputerName, UserName, FileName, ImageFileName, ParentBaseFileName, ParentCommandLine, CommandLine, TargetProcessId])
| sort(@timestamp, order=desc, limit=1000)

// HUNT: Java egress baseline for Artifactory hosts
// HYPOTHESIS: H03
// USE: hunt
// MITRE: T1071
// CONF: low
// FP: high
// COST: medium
// TIMEFRAME: 14d — recent destination baseline with bounded aggregation
// REQUIRES: Falcon endpoint event repository; NetworkConnectIP4; ContextBaseFileName, RemoteAddressIP4, RemotePort, LocalAddressIP4, aid, ComputerName, @timestamp; restrict results to confirmed Artifactory hosts
// FALSE POSITIVES: Remote package repositories, proxies, license checks, webhooks, replication, backups, and monitoring
// TUNING: Restrict to confirmed Artifactory host groups and exclude owner-approved destinations, internal ranges, and proxies
// VALIDATION: STATIC-ONLY
#event_simpleName = NetworkConnectIP4
| ContextBaseFileName = /^(?:java|javaw)(?:\.exe)?$/i
| groupBy([aid, ComputerName, ContextBaseFileName, RemoteAddressIP4, RemotePort], function=[count(as=Connections), min(@timestamp, as=FirstSeen), max(@timestamp, as=LastSeen)], limit=1000)
| sort(Connections, order=desc, limit=1000)

// HUNT: Execution from Artifactory service-writable paths
// HYPOTHESIS: H04
// USE: hunt
// MITRE: T1204 — analyst-inferred post-compromise execution
// CONF: medium
// FP: medium
// COST: medium
// TIMEFRAME: 30d — retrospective window spanning disclosure and reported exploitation
// REQUIRES: Falcon endpoint event repository; ProcessRollup2; FileName, ImageFileName, CommandLine, ParentBaseFileName, aid, ComputerName, UserName, TargetProcessId, @timestamp
// FALSE POSITIVES: Approved maintenance scripts, repository hooks, support bundles, and upgrade tooling
// TUNING: Replace generic path terms with verified Artifactory service-writable paths and exclude signed owner-approved hooks
// VALIDATION: STATIC-ONLY
#event_simpleName = ProcessRollup2
| ImageFileName = /(?:jfrog|artifactory|access).{1,2}(?:var|data|work|cache|temp|tmp|run).{1,2}/i
| FileName != /^(?:java|javaw)(?:\.exe)?$/i
| table([@timestamp, aid, ComputerName, UserName, FileName, ImageFileName, ParentBaseFileName, CommandLine, TargetProcessId])
| sort(@timestamp, order=desc, limit=1000)

Every query remains hunt-only. No alert package or Custom IOA is produced because tenant parsing, positive tests, benign baselines, prevalence, scheduling, suppression, routing, ownership, and SLA evidence are absent.

Operational gate

Before scheduling anything, confirm the intended repo, execute safe positive and representative benign tests, define grouping and deduplication, measure result volume, preserve event-level triage fields, assign an owner and SLA, and record a disable/rollback procedure.

The appendix deliberately contains no operational indicator values. The three cards make the absence machine-copyable without fabricating hashes, addresses, or actor infrastructure.

No atomic IOCs were published by accessible sources as of 2026-09-02. No payload hashes are available.

No atomic IOCs were published by accessible sources as of 2026-09-02. No attacker IP addresses or domains are available.

POST /access/api/v1/registry/join
POST /access/api/v1/registry/join/router
Source: S03; defensive log pivots, not IOCs.

Deployable playbook · CTRL01 + CTRL02

1. Confirm owners, fixed-version target, backups, flow inventory, emergency access, maintenance window, and stop conditions.
2. Capture current versions, node topology, proxy/network policy, health, repository test hashes, and audit logs.
3. Upgrade the nonproduction pilot and apply reviewed proxy/backend restrictions.
4. Verify version, readiness, authentication, upload/download, replication/federation, approved/denied network paths, and log arrival.
5. Expand node by node only after the pilot remains healthy through the defined observation window.
6. On a stop condition, restrict external access, follow the approved restore procedure, verify repository consistency, and keep any vulnerable restored node isolated.
7. Retain approvals, hashes, health checks, network tests, and rollback evidence with named owners.

Deployable playbook · CTRL03 + CTRL04

1. Preserve request, Access, security-audit, proxy, identity, and repository records before credential changes.
2. Build a known-good inventory of administrators, service identities, token IDs/scopes/expiry, cluster nodes, and dependent jobs.
3. Validate log parsing with benign owner-approved changes and establish source-health monitoring.
4. Revoke one confirmed stale noncritical token and issue a least-privilege short-lived replacement through the secret manager.
5. Verify revoked-token denial, replacement scope, dependent job health, and complete audit trace.
6. Expand only for confirmed unknown, exposed, or unnecessary tokens under change authority.
7. Never restore a suspected token; use a time-bounded emergency replacement if rollback is required and retain full evidence.

Continuity rule: preserve evidence before revocation or repository changes. Do not isolate a critical artifact service, revoke every token, reset all administrators, delete artifacts, or restore snapshots without the incident commander, application owner, dependency map, and tested recovery path.

Validation state: STATIC REVIEW PASSED after local structure/safety, maintained-field, CQL heuristic, provenance, and duplicate gates. This is not Falcon parsing, canary testing, or evidence of deployment.

Recorded evidence and gaps

• All four queries remain tenant-unverified and were not executed against Falcon.
• The offline tenant-validation dry run records extraction and budget/profile readiness only; it does not contact a tenant or prove parsing.
• H05 and H06 carry the strongest exploit-specific detections but require JFrog Access and reverse-proxy schemas.
• No atomic IOC provenance was applicable because no atomic indicators were published.
• Next step: validate Q01 on an owner-confirmed server, then run Q02 and Q04 manually for one hour and map the JFrog audit fields before any alert design.