[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"all-banners":3,"SkipToContent_34xgpJIRRkpiT6ls6jE4NHf7VpvQCQBEwi69exi4oT0":57,"FooterNav_JsYsxvLufb1W12aeknKZ89on0MD0bNDTiB5EYxyxmU":64,"vulnerability-29942":70,"FooterSocial_u16tCafBUeGMoDrdLfTINytP2JB5msc6iB3VDUutAoU":103},[4,13,23,35,43,50],{"title":5,"slug":6,"text":7,"link":8,"external":9,"targets":10,"cta":8,"variant":12,"priority":12,"campaign_id":6},"PHP2Shell, Node2Shell, *sshole detections - pricing page","node2shell-exploit","Detect PHP2Shell, Node2Shell & *sshole with every paid plan.",null,false,[11],"\u002Fpricing","secondary",{"title":14,"slug":15,"text":16,"link":17,"external":18,"targets":19,"cta":22,"variant":12,"priority":12,"campaign_id":15},"Office Hours #15","office-hours-15","[Live Office Hours, Wed Nov 18] Behind the login, beyond the scan","https:\u002F\u002Fzoom.us\u002Fwebinar\u002Fregister\u002F5117815316917\u002FWN_BUp1qET2THa_5h65whpx9g",true,[20,21],"\u002Fwebinars\u002Foffice-hours","\u002Fwebinars","Save your spot",{"title":24,"slug":25,"text":26,"link":27,"external":9,"targets":28,"cta":34,"variant":12,"priority":12,"campaign_id":25},"*sshole, PHP2Shell & Node2Shell - HP, Vuln DB, product page","sshole-detect-exploit","🚨 Detect *sshole & Node2Shell with any paid plan. Get proof with our Sniper exploit","https:\u002F\u002Fpentest-tools.com\u002Fpricing",[29,30,31,32,33],"\u002F","\u002Fvulnerabilities-exploits","\u002Fvulnerabilities-exploits\u002Fopenssh-musl-authentication-bypass-cve-2026-123158-sshole_29981","\u002Fvulnerabilities-exploits\u002Fnode2shell-http2shell-brotli-decoder-remote-code-execution_29896","\u002Fproduct","See pricing options",{"title":36,"slug":37,"text":38,"link":27,"external":9,"targets":39,"cta":41,"variant":12,"priority":12,"campaign_id":42},"*sshole - Exploit on Sniper: Auto-Exploiter page","sshole-exploit-sniper","🚨 Exclusive exploit for *sshole now live",[40],"\u002Fexploit-helpers\u002Fsniper","Use it with the Exploit plan","sshole-exploit",{"title":44,"slug":45,"text":46,"link":27,"external":18,"targets":47,"cta":49,"variant":12,"priority":12,"campaign_id":42},"*sshole exploit - Exploit on the NS page","sshole-exploit-ns","🚨 Go beyond *sshole detection: get proof of exploitation",[48],"\u002Fnetwork-vulnerability-scanning\u002Fnetwork-security-scanner-online","Pick the Exploit plan",{"title":51,"slug":52,"text":53,"link":27,"external":18,"targets":54,"cta":34,"variant":12,"priority":12,"campaign_id":42},"*sshole exploit - WS, free tools","sshole-exploit-mainpw","Detect *sshole with every paid plan. Prove it with Exploit.",[55,56],"\u002Fwebsite-vulnerability-scanning\u002Fwebsite-scanner","\u002Ffor\u002Ffree",["Island",58],{"key":59,"params":60,"result":62},"SkipToContent_34xgpJIRRkpiT6ls6jE4NHf7VpvQCQBEwi69exi4oT0",{"props":61},"{}",{"head":63},{},["Island",65],{"key":66,"params":67,"result":68},"FooterNav_JsYsxvLufb1W12aeknKZ89on0MD0bNDTiB5EYxyxmU",{"props":61},{"head":69},{},{"id":71,"detectable_with":72,"vuln_details":78,"vuln_id":100,"name":101,"published":102,"updated":102},29942,{"tool":73,"engine":76},{"id":74,"name":75},1,"Network Scanner",{"id":74,"name":77},"Sniper",{"id":71,"codename":8,"description":79,"severity":80,"risk_description":81,"public_description":82,"public_recommendation":83,"recommendation":84,"references":85,"cvssv3":89,"epss_score":90,"epss_percentile":91,"cve":92,"in_cisa_catalog":18,"date":94,"software_type":95,"vendor":96,"product":97,"ptt_exploit_capabilities":98},"We found that the target server is vulnerable to CVE-2026-82329, an authentication bypass affecting self-hosted JFrog Artifactory. The root cause of this vulnerability is that the Access service signs cluster-join tokens with the cluster join key, which is blank by default. The empty key is padded to 32 bytes of 0x20, making the HMAC secret attacker-derivable. We managed to confirm this vulnerability by forging an HS256 join token signed with the blank join key and submitting it to the unauthenticated \u002Faccess\u002Fapi\u002Fv1\u002Fregistry\u002Fjoin endpoint, which returned an admin-scoped service token that we then used to enumerate the Access users.","critical","The risk exists that a remote unauthenticated attacker can gain administrative privileges over the Artifactory installation, enabling them to steal confidential artifacts and credentials, tamper with stored packages to poison the software supply chain, or pivot to the internal network.","JFrog Artifactory is affected by an authentication bypass vulnerability. Under the default configuration, the Access service signs cluster-join tokens with a blank cluster join key, which is padded to a fixed, attacker-derivable value. An unauthenticated attacker with network access can forge a valid join token and submit it to the Access join endpoint to obtain an administrative service token, gaining full control over repositories, configurations and stored artifacts.","Update JFrog Artifactory to a patched version (7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38 or 7.161.20) and configure a non-empty cluster join key.","We recommend to update JFrog Artifactory to the latest available version and ensure that a non-empty cluster join key is configured and enforced. Additionally, rotate existing keys and secrets, and restrict network access to the Access join endpoint to trusted hosts only.",[86,87,88],"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-82329","https:\u002F\u002Fjfrog.com\u002Fhelp\u002Fr\u002Fjfrog-release-information\u002Fartifactory-security-fixes","https:\u002F\u002Fwww.pruva.dev\u002Freproductions\u002FREPRO-2026-00341",9.8,0.14372,0.96645,[93],"CVE-2026-82329","2026-08-28T00:00:00Z","Artifact Repository Manager","JFrog","Artifactory",[99],"CUSTOM","NETSCAN-SNIPER-CVE-2026-82329","JFrog Artifactory - Authentication Bypass","2026-10-09T00:00:00Z",["Island",104],{"key":105,"params":106,"result":108},"FooterSocial_u16tCafBUeGMoDrdLfTINytP2JB5msc6iB3VDUutAoU",{"props":107},"{\"text-color\":\"gray\"}",{"head":109},{}]