CVE-2026-82329

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-82329 9.8

JFrog · Artifactory · Added 2026-09-02 · Published 2026-08-28

3-Day Required PoC Available KEV Automatable Active Exploitation

Details

VulnerabilityJFrog Artifactory Improper Authentication Vulnerability

VendorJFrog

ProductArtifactory

Date added2026-09-02

Due date2026-09-05

CISA catalogView on CISA KEV catalog

Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CWECWE-287

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Descriptions

KEV: JFrog Artifactory contains an improper authentication vulnerability that under default configuration can allow an unauthenticated attacker with network access to obtain administrative privileges.

NVD: JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges.

Compliance SSVC + BOD 26-04

Automatableyes

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline3 days + forensic

Forensic (public)Required

Forensic (non-public)Required

Research metadata

Last researched2026-09-02 18:39 UTC

Component defaultyes

Sources https://docs.jfrog.com/releases/docs/jfrog-security-advisories
https://github.com/dinosn/cve-2026-82329-jfrog-artifactory
https://www.bleepingcomputer.com/news/security/hackers-exploit-critical-jfrog-artifactory-flaw-to-forge-admin-tokens/
https://www.securityweek.com/critical-jfrog-artifactory-vulnerability-reportedly-exploited-in-the-wild/
https://thehackernews.com/2026/09/attackers-exploit-critical-jfrog.html

QC notes

info precondition_contradiction: Preconditions don't mention deployment applicability (component/product version)

warn component_extraction: Component 'Artifactory authentication/token API endpoint' matches or contains product name 'Artifactory' — no specific component identified

Hunting hypothesis agent

Hunt Artifactory access logs for unauthenticated POST requests to token creation APIs (e.g. /artifactory/api/security/token) returning 200. Monitor for admin token issuance patterns from external IPs without prior auth.

Research details

ComponentArtifactory authentication/token API endpoint

PreconditionsNetwork reachability to self-hosted JFrog Artifactory instance; no authentication required; affects default configuration; patched versions include 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, and 7.161.20; JFrog Cloud instances already patched before disclosure agent

Public PoCyes

PoC URLs https://github.com/dinosn/cve-2026-82329-jfrog-artifactory Third-party repos; verify before use.

Advisoryhttps://docs.jfrog.com/releases/docs/jfrog-security-advisories

Exploit notesReproducible Docker lab + URL-parameter validator PoC available (watchTowr). Attackers observed minting admin tokens post-disclosure. The vulnerability allows unauthenticated attackers to forge admin tokens for user enumeration, artifact access, security config changes, and package poisoning. Existing tokens survive binary upgrade. CVSS attack complexity: LOW | CRITICAL severity (CVSS 9.8)

SummaryCVE-2026-82329 is a critical authentication bypass in JFrog Artifactory affecting self-hosted instances in default configuration. Unauthenticated attackers with network access can forge administrative tokens, enabling user enumeration, artifact exfiltration, security configuration changes, and supply-chain poisoning of trusted packages. Active exploitation began within days of the August 28 disclosure. Patched in versions 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, and 7.161.20. JFrog Cloud was already patched.

Tia coverage

First reported2026-07-29

First exploit report2026-09-02

Exploit report → KEV0 days before the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

active-exploitation-of-cisco-secure-firewall-management-center-v jfrog-artifactory-vulnerabilities-actively-exploited-in-the-wild

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.