{"id":1994,"date":"2026-09-02T07:23:11","date_gmt":"2026-09-02T00:23:11","guid":{"rendered":"https:\/\/vncybers.vn\/canh-bao-jfrog-artifactory-cve-2026-82329-chiem-quyen-quan-tri\/"},"modified":"2026-09-02T07:23:11","modified_gmt":"2026-09-02T00:23:11","slug":"canh-bao-jfrog-artifactory-cve-2026-82329-chiem-quyen-quan-tri","status":"publish","type":"post","link":"https:\/\/vncybers.vn\/en\/canh-bao-jfrog-artifactory-cve-2026-82329-chiem-quyen-quan-tri\/","title":{"rendered":"JFrog Artifactory Warning: Vulnerability CVE-2026-82329 is being exploited to gain administrative privileges"},"content":{"rendered":"

Nh\u1eefng k\u1ebb t\u1ea5n c\u00f4ng \u0111\u00e3 b\u1eaft \u0111\u1ea7u khai th\u00e1c m\u1ed9t l\u1ed7 h\u1ed5ng nghi\u00eam tr\u1ecdng trong JFrog Artifactory ch\u1ec9 v\u00e0i ng\u00e0y sau khi b\u1ea3n v\u00e1 \u0111\u01b0\u1ee3c c\u00f4ng b\u1ed1. Theo The Hacker News d\u1eabn ph\u00e2n t\u00edch c\u1ee7a watchTowr, l\u1ed7 h\u1ed5ng CVE-2026-82329<\/strong> c\u00f3 \u0111i\u1ec3m CVSS 9.8 v\u00e0 c\u00f3 th\u1ec3 cho ph\u00e9p k\u1ebb t\u1ea5n c\u00f4ng kh\u00f4ng c\u1ea7n x\u00e1c th\u1ef1c \u0111\u1ea1t quy\u1ec1n qu\u1ea3n tr\u1ecb tr\u00ean h\u1ec7 th\u1ed1ng Artifactory b\u1ecb \u1ea3nh h\u01b0\u1edfng.<\/p>\n

\"H\u1ea1<\/p>\n

L\u1ed7 h\u1ed5ng n\u1eb1m \u1edf c\u01a1 ch\u1ebf c\u1ea5p v\u00e0 x\u00e1c th\u1ef1c th\u00f4ng tin truy c\u1eadp<\/h2>\n

JFrog Artifactory l\u00e0 n\u1ec1n t\u1ea3ng qu\u1ea3n l\u00fd kho t\u1ea1o t\u00e1c ph\u1ea7n m\u1ec1m \u0111\u01b0\u1ee3c nhi\u1ec1u t\u1ed5 ch\u1ee9c s\u1eed d\u1ee5ng trong quy tr\u00ecnh CI\/CD \u0111\u1ec3 l\u01b0u tr\u1eef th\u01b0 vi\u1ec7n, g\u00f3i ph\u1ea7n m\u1ec1m, container image v\u00e0 c\u00e1c th\u00e0nh ph\u1ea7n ph\u1ee5c v\u1ee5 ph\u00e1t h\u00e0nh s\u1ea3n ph\u1ea9m. V\u00ec v\u1eady, quy\u1ec1n qu\u1ea3n tr\u1ecb Artifactory kh\u00f4ng ch\u1ec9 l\u00e0 quy\u1ec1n tr\u00ean m\u1ed9t m\u00e1y ch\u1ee7 \u0111\u01a1n l\u1ebb, m\u00e0 c\u00f2n c\u00f3 th\u1ec3 tr\u1edf th\u00e0nh \u0111i\u1ec3m ki\u1ec3m so\u00e1t quan tr\u1ecdng trong chu\u1ed7i cung \u1ee9ng ph\u1ea7n m\u1ec1m.<\/p>\n

Theo m\u00f4 t\u1ea3 tr\u00ean CVE.org \u0111\u01b0\u1ee3c The Hacker News tr\u00edch d\u1eabn, JFrog Artifactory ch\u1ee9a m\u1ed9t \u0111i\u1ec3m y\u1ebfu x\u00e1c th\u1ef1c trong c\u1ea5u h\u00ecnh m\u1eb7c \u0111\u1ecbnh, c\u00f3 th\u1ec3 cho ph\u00e9p k\u1ebb t\u1ea5n c\u00f4ng c\u00f3 kh\u1ea3 n\u0103ng truy c\u1eadp m\u1ea1ng gi\u00e0nh \u0111\u1eb7c quy\u1ec1n qu\u1ea3n tr\u1ecb. watchTowr cho bi\u1ebft v\u1ea5n \u0111\u1ec1 li\u00ean quan \u0111\u1ebfn JFrog Access, th\u00e0nh ph\u1ea7n ch\u1ecbu tr\u00e1ch nhi\u1ec7m ph\u00e1t h\u00e0nh v\u00e0 x\u00e1c th\u1ef1c th\u00f4ng tin \u0111\u1ecbnh danh.<\/p>\n

Trong m\u1ed9t s\u1ed1 tr\u01b0\u1eddng h\u1ee3p, c\u00e1c instance kh\u00f4ng c\u00f3 join key b\u1ed5 sung \u0111\u01b0\u1ee3c c\u1ea5u h\u00ecnh c\u00f3 th\u1ec3 nh\u1eadn m\u1ed9t join key d\u1ea1ng “phantom”. K\u1ebb t\u1ea5n c\u00f4ng c\u00f3 th\u1ec3 l\u1ee3i d\u1ee5ng \u0111i\u1ec1u n\u00e0y \u0111\u1ec3 gi\u1ea3 m\u1ea1o quy\u1ec1n truy c\u1eadp v\u00e0 t\u1ea1o th\u00f4ng tin x\u00e1c th\u1ef1c \u1edf c\u1ea5p qu\u1ea3n tr\u1ecb.<\/p>\n

Ph\u1ea1m vi phi\u00ean b\u1ea3n b\u1ecb \u1ea3nh h\u01b0\u1edfng<\/h2>\n

JFrog \u0111\u00e3 ph\u00e1t h\u00e0nh b\u1ea3n v\u00e1 trong Artifactory phi\u00ean b\u1ea3n 7.161.20 v\u00e0o ng\u00e0y 28\/08\/2026. C\u00e1c nh\u00e1nh phi\u00ean b\u1ea3n b\u1ecb \u1ea3nh h\u01b0\u1edfng g\u1ed3m 7.161.0 \u0111\u1ebfn 7.161.19, 7.146.0 \u0111\u1ebfn 7.146.36, 7.133.0 \u0111\u1ebfn 7.133.28, 7.125.0 \u0111\u1ebfn 7.125.19, 7.117.0 \u0111\u1ebfn 7.117.27 v\u00e0 7.111.4 \u0111\u1ebfn 7.111.21.<\/p>\n

\u0110i\u1ec3m \u0111\u00e1ng ch\u00fa \u00fd l\u00e0 l\u1ed7 h\u1ed5ng \u1ea3nh h\u01b0\u1edfng \u0111\u1ebfn c\u1ea5u h\u00ecnh m\u1eb7c \u0111\u1ecbnh, kh\u00f4ng y\u00eau c\u1ea7u x\u00e1c th\u1ef1c v\u00e0 kh\u00f4ng c\u1ea7n t\u01b0\u01a1ng t\u00e1c t\u1eeb ng\u01b0\u1eddi d\u00f9ng. \u0110i\u1ec1u n\u00e0y khi\u1ebfn r\u1ee7i ro \u0111\u1eb7c bi\u1ec7t cao \u0111\u1ed1i v\u1edbi c\u00e1c h\u1ec7 th\u1ed1ng Artifactory t\u1ef1 qu\u1ea3n l\u00fd \u0111ang m\u1edf ra Internet ho\u1eb7c n\u1eb1m trong v\u00f9ng m\u1ea1ng m\u00e0 k\u1ebb t\u1ea5n c\u00f4ng \u0111\u00e3 c\u00f3 ch\u1ed7 \u0111\u1ee9ng ban \u0111\u1ea7u.<\/p>\n

Khai th\u00e1c th\u1ef1c t\u1ebf \u0111\u00e3 b\u1eaft \u0111\u1ea7u<\/h2>\n

watchTowr cho bi\u1ebft ho\u1ea1t \u0111\u1ed9ng khai th\u00e1c \u0111\u00e3 \u0111\u01b0\u1ee3c ghi nh\u1eadn t\u1eeb ng\u00e0y 01\/09\/2026. K\u1ebb t\u1ea5n c\u00f4ng \u0111ang s\u1eed d\u1ee5ng l\u1ed7 h\u1ed5ng \u0111\u1ec3 t\u1ea1o token qu\u1ea3n tr\u1ecb, li\u1ec7t k\u00ea ng\u01b0\u1eddi d\u00f9ng, nh\u00f3m, b\u1ed9 th\u00f4ng tin x\u00e1c th\u1ef1c v\u00e0 c\u1ea5u tr\u00fac truy c\u1eadp li\u00ean k\u1ebft.<\/p>\n

V\u1edbi quy\u1ec1n qu\u1ea3n tr\u1ecb tr\u00ean m\u1ed9t h\u1ec7 th\u1ed1ng trung t\u00e2m c\u1ee7a chu\u1ed7i cung \u1ee9ng ph\u1ea7n m\u1ec1m, k\u1ebb t\u1ea5n c\u00f4ng c\u00f3 th\u1ec3 ti\u1ebfn xa h\u01a1n vi\u1ec7c \u0111\u1ecdc th\u00f4ng tin c\u1ea5u h\u00ecnh. R\u1ee7i ro th\u1ef1c t\u1ebf bao g\u1ed3m can thi\u1ec7p v\u00e0o pipeline build, thay \u0111\u1ed5i g\u00f3i ph\u00e1t h\u00e0nh, di chuy\u1ec3n ngang sang m\u00f4i tr\u01b0\u1eddng s\u1ea3n xu\u1ea5t ho\u1eb7c \u0111\u1ea9y thay \u0111\u1ed5i \u0111\u1ed9c h\u1ea1i xu\u1ed1ng c\u00e1c h\u1ec7 th\u1ed1ng ph\u1ee5 thu\u1ed9c.<\/p>\n

Khuy\u1ebfn ngh\u1ecb cho t\u1ed5 ch\u1ee9c \u0111ang v\u1eadn h\u00e0nh Artifactory<\/h2>\n

C\u00e1c t\u1ed5 ch\u1ee9c \u0111ang d\u00f9ng JFrog Artifactory t\u1ef1 qu\u1ea3n l\u00fd c\u1ea7n \u01b0u ti\u00ean c\u1eadp nh\u1eadt l\u00ean phi\u00ean b\u1ea3n \u0111\u00e3 v\u00e1, \u0111\u1eb7c bi\u1ec7t v\u1edbi nh\u1eefng h\u1ec7 th\u1ed1ng c\u00f3 th\u1ec3 truy c\u1eadp t\u1eeb Internet. Vi\u1ec7c tr\u00ec ho\u00e3n v\u00e1 l\u1ed7i trong tr\u01b0\u1eddng h\u1ee3p n\u00e0y l\u00e0m t\u0103ng \u0111\u00e1ng k\u1ec3 nguy c\u01a1 b\u1ecb khai th\u00e1c v\u00ec th\u00f4ng tin k\u1ef9 thu\u1eadt v\u00e0 d\u1ea5u hi\u1ec7u t\u1ea5n c\u00f4ng \u0111\u00e3 xu\u1ea5t hi\u1ec7n c\u00f4ng khai.<\/p>\n

B\u00ean c\u1ea1nh c\u1eadp nh\u1eadt ph\u1ea7n m\u1ec1m, \u0111\u1ed9i ng\u0169 v\u1eadn h\u00e0nh n\u00ean r\u00e0 so\u00e1t audit log, ki\u1ec3m tra ho\u1ea1t \u0111\u1ed9ng t\u1ea1o token b\u1ea5t th\u01b0\u1eddng, xoay v\u00f2ng th\u00f4ng tin x\u00e1c th\u1ef1c c\u00f3 kh\u1ea3 n\u0103ng b\u1ecb l\u1ed9 v\u00e0 \u0111\u00e1nh gi\u00e1 l\u1ea1i c\u00e1c h\u1ec7 th\u1ed1ng k\u1ebft n\u1ed1i v\u1edbi Artifactory. Nh\u1eefng thay \u0111\u1ed5i trong artifact, repository, pipeline v\u00e0 quy\u1ec1n ng\u01b0\u1eddi d\u00f9ng c\u1ea7n \u0111\u01b0\u1ee3c \u0111\u1ed1i chi\u1ebfu v\u1edbi l\u1ecbch s\u1eed thay \u0111\u1ed5i h\u1ee3p l\u1ec7.<\/p>\n

S\u1ef1 c\u1ed1 n\u00e0y ti\u1ebfp t\u1ee5c cho th\u1ea5y c\u00e1c n\u1ec1n t\u1ea3ng qu\u1ea3n l\u00fd chu\u1ed7i cung \u1ee9ng ph\u1ea7n m\u1ec1m c\u1ea7n \u0111\u01b0\u1ee3c b\u1ea3o v\u1ec7 nh\u01b0 t\u00e0i s\u1ea3n tr\u1ecdng y\u1ebfu. Khi kho t\u1ea1o t\u00e1c b\u1ecb chi\u1ebfm quy\u1ec1n, t\u00e1c \u0111\u1ed9ng c\u00f3 th\u1ec3 lan t\u1eeb m\u00f4i tr\u01b0\u1eddng ph\u00e1t tri\u1ec3n sang s\u1ea3n ph\u1ea9m, kh\u00e1ch h\u00e0ng v\u00e0 ni\u1ec1m tin c\u1ee7a to\u00e0n b\u1ed9 h\u1ec7 sinh th\u00e1i.<\/p>\n

VNCyberS<\/strong> t\u1ed5ng h\u1ee3p t\u1eeb The Hacker News, watchTowr, CVE.org v\u00e0 JFrog<\/em><\/p>","protected":false},"excerpt":{"rendered":"

Nh\u1eefng k\u1ebb t\u1ea5n c\u00f4ng \u0111\u00e3 b\u1eaft \u0111\u1ea7u khai th\u00e1c m\u1ed9t l\u1ed7 h\u1ed5ng nghi\u00eam tr\u1ecdng trong JFrog Artifactory ch\u1ec9 v\u00e0i ng\u00e0y sau khi b\u1ea3n v\u00e1 \u0111\u01b0\u1ee3c c\u00f4ng b\u1ed1. Theo The Hacker News d\u1eabn ph\u00e2n t\u00edch c\u1ee7a watchTowr, l\u1ed7 h\u1ed5ng CVE-2026-82329 c\u00f3 \u0111i\u1ec3m CVSS 9.8 v\u00e0 c\u00f3 th\u1ec3 cho ph\u00e9p k\u1ebb t\u1ea5n c\u00f4ng kh\u00f4ng c\u1ea7n x\u00e1c th\u1ef1c […]<\/p>\n","protected":false},"author":2,"featured_media":1993,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[1],"tags":[755,370,758,566,754,753,757,752,756,438],"class_list":["post-1994","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-tin-tuc","tag-admin-token","tag-authentication-bypass","tag-bao-mat-phan-mem","tag-chuoi-cung-ung-phan-mem","tag-ci-cd","tag-cve-2026-82329","tag-devsecops","tag-jfrog-artifactory","tag-lo-hong-nghiem-trong","tag-watchtowr"],"_links":{"self":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1994","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/comments?post=1994"}],"version-history":[{"count":0,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1994\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media\/1993"}],"wp:attachment":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media?parent=1994"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/categories?post=1994"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/tags?post=1994"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}