CVE-2026-82329
Description
CVE-2026-82329 is a critical 9.8 CVSS vulnerability in JFrog Artifactory allowing unauthenticated administrative access; immediate patching is required.
CPE
| Product | Version Start | Version End (excl.) | Status |
|---|---|---|---|
| artifactory | 7.111.4 | 7.111.21 | vulnerable |
| artifactory | 7.117.0 | 7.117.28 | vulnerable |
| artifactory | 7.125.0 | 7.125.20 | vulnerable |
| artifactory | 7.133.0 | 7.133.29 | vulnerable |
| artifactory | 7.146.0 | 7.146.38 | vulnerable |
| artifactory | 7.161.0 | 7.161.20 | vulnerable |
Related weakness (CWE)
Remediation plan
Apply official patches
JFrog has released security updates to address this authentication weakness. Administrators should immediately consult the JFrog Security Advisory portal for the specific patch corresponding to their deployment model, whether Self-Managed or Cloud.
Update affected systems
Upgrade Artifactory instances to the latest non-vulnerable versions. Specifically, move beyond the affected ranges: 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, and 7.161.20 or higher as recommended by the vendor.
Restrict access
Since the attack vector is network-based, place Artifactory instances behind a VPN or firewall. Limit access to the management interface to trusted internal IP addresses only and audit configurations to ensure unauthenticated access is disabled.
Monitor for exploitation
Conduct a forensic triage of Artifactory logs for unusual administrative logins or unauthorized configuration changes. Review audit logs for account creations or permission escalations that do not align with authorized change management records.
Detection Guidance
"To detect potential exploitation of CVE-2026-82329, monitor Artifactory access logs for successful logins from unexpected external IP addresses, particularly those targeting administrative endpoints. Look for log entries indicating the creation of new administrative users or modifications to security settings by unauthenticated sessions. Network-level signatures should flag unusual POST requests to authentication APIs. Implement alerting for any deviation from standard administrative behavior within the CI/CD environment."