OpenInfra Europe’s Artifactory Instance Compromised Through Authentication Bypass

Summary

Attackers exploited CVE-2026-82329 to gain admin access to OpenInfra Europe’s Artifactory. Artifacts downloaded from artifactory[.]nordix[.]org between August 28 and September 15, 2026, should be treated as potentially compromised.

Key points

• Attackers exploited CVE-2026-82329, an authentication bypass, to gain admin-level access to OpenInfra Europe’s self-hosted JFrog Artifactory instance.
• OpenInfra Europe says the compromise occurred on August 31, 2026, and was discovered on September 15 after a legitimate user was denied access.
• Anyone who downloaded or installed artifacts from artifactory[.]nordix[.]org between August 28 and September 15 should stop using them, remove them from pipelines, and treat them as potentially compromised.
• Admin access could have enabled tampering with artifacts, credentials, and integrations managed by the instance.
• The affected system was isolated and an investigation began; the full scope and impact remain undetermined.

Indicators of compromise

MITRE ATT&CK

CVE

Products

Related Articles

• Attackers Exploit Critical JFrog Artifactory Flaw to Forge Admin Tokensbleepingcomputer.comCVE-2026-82329 · JFrog Artifactory · T1190
• Attackers Exploit Critical JFrog Artifactory Authentication Bypass Days After Patchthehackernews.comCVE-2026-82329 · JFrog Artifactory · T1190
• Recorded Future Reports 94 High-Impact Vulnerabilities in September 2026, Including 80 Actively Exploitedrecordedfuture.comCVE-2026-82329 · JFrog Artifactory
• CISA Adds Five Actively Exploited Artifactory, ScreenConnect and RouterOS Flaws to KEVthehackernews.comCVE-2026-82329 · JFrog Artifactory
• Attackers Exploit Three JFrog Artifactory Vulnerabilities to Gain Admin Access and Deploy Backdoorswiz.ioCVE-2026-82329 · T1190