Fixing and finding

[Jump to remediation plan](#remediation)

CVE ID

# CVE-2026-82329

Published 2026-08-28

Updated 2 months ago

Vendor/s

JFrog

Product/s

Artifactory

Version/s

7.111.4 > 7.111.21

KEV Status

Active Exploitation

Listed in CISA's Known Exploited Vulnerabilities catalog. Active exploitation observed in the wild.

CVSS Score (v3.1)

9.8

/ 10

Critical

Severity Details

Base score

9.8 Critical

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Table of Contents

[Description ](#description)[Why this matters ](#why-this-matters)[CPE ](#cpe)[Related weakness (CWE) ](#cwe)[Remediation plan ](#remediation)[Detection Guidance ](#detection-guidance)[References ](#references)[Sources](#sources)

[Description ](#description)[Why this matters ](#why-this-matters)[CPE ](#cpe)[Related weakness (CWE) ](#cwe)[Remediation plan ](#remediation)[Detection Guidance ](#detection-guidance)[References ](#references)[Sources](#sources)

## Description

CVE-2026-82329 is a critical 9.8 CVSS vulnerability in JFrog Artifactory allowing unauthenticated administrative access; immediate patching is required.

## Why this matters

"CVE-2026-82329 is a critical vulnerability in JFrog Artifactory with a CVSS score of 9.8, indicating a severe risk to software supply chain security. This flaw involves an authentication weakness in default configurations that allows unauthenticated attackers to gain full administrative privileges over the repository manager. Because it is listed on CISA’s Known Exploited Vulnerabilities (KEV) catalog, security teams must treat this as an urgent threat. Administrative access to Artifactory could allow attackers to inject malicious code into build artifacts, steal proprietary source code, or disrupt CI/CD pipelines. Any organization using affected versions of Artifactory must prioritize remediation to prevent complete system compromise."

## CPE

JFrog

| Product     | Version Start | Version End (excl.) | Status     |
| ----------- | ------------- | ------------------- | ---------- |
| artifactory | 7.111.4       | 7.111.21            | vulnerable |
| artifactory | 7.117.0       | 7.117.28            | vulnerable |
| artifactory | 7.125.0       | 7.125.20            | vulnerable |
| artifactory | 7.133.0       | 7.133.29            | vulnerable |
| artifactory | 7.146.0       | 7.146.38            | vulnerable |
| artifactory | 7.161.0       | 7.161.20            | vulnerable |

## Related weakness (CWE)

CWE-287

## Remediation plan

1

### Apply official patches

JFrog has released security updates to address this authentication weakness. Administrators should immediately consult the JFrog Security Advisory portal for the specific patch corresponding to their deployment model, whether Self-Managed or Cloud.

2

### Update affected systems

Upgrade Artifactory instances to the latest non-vulnerable versions. Specifically, move beyond the affected ranges: 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, and 7.161.20 or higher as recommended by the vendor.

3

### Restrict access

Since the attack vector is network-based, place Artifactory instances behind a VPN or firewall. Limit access to the management interface to trusted internal IP addresses only and audit configurations to ensure unauthenticated access is disabled.

4

### Monitor for exploitation

Conduct a forensic triage of Artifactory logs for unusual administrative logins or unauthorized configuration changes. Review audit logs for account creations or permission escalations that do not align with authorized change management records.

## Detection Guidance

"To detect potential exploitation of CVE-2026-82329, monitor Artifactory access logs for successful logins from unexpected external IP addresses, particularly those targeting administrative endpoints. Look for log entries indicating the creation of new administrative users or modifications to security settings by unauthenticated sessions. Network-level signatures should flag unusual POST requests to authentication APIs. Implement alerting for any deviation from standard administrative behavior within the CI/CD environment."

## References

[https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases Release Notes ](https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases)[https://docs.jfrog.com/releases/docs/jfrog-security-advisories Vendor Advisory ](https://docs.jfrog.com/releases/docs/jfrog-security-advisories)[https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field\_cve=CVE-2026-82329 Third Party Advisory US Government Resource](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-82329)

## Sources

NIST National Vulnerability Database (NVD)

CISA Known Exploited Vulnerabilities (KEV)

Experience superior visibility and a simpler approach to cyber risk management

[Get a demo](https://www.upguard.com/contact-sales)

[Free trial](https://www.upguard.com/demo)