Authentication Weakness in JFrog Artifactory Affects Unauthenticated Access
CVE-2026-82329

9.8CRITICAL

Key Information:

Vendor: Jfrog
Status: Artifactory
Vendor: CVE Published:; 28 August 2026

Badges

🥇 Trended No. 1📈 Trended📈 Score: 39,600👾 Exploit Exists🟡 Public PoC🦅 CISA Reported📰 News Worthy

What is CVE-2026-82329?

CVE-2026-82329 is a vulnerability identified within JFrog Artifactory, a widely used repository management tool designed to store, manage, and distribute software binaries and artifacts. This vulnerability presents an authentication weakness that, under default configuration settings, permits unauthorized users with network access to gain administrative privileges. Such a flaw could enable malicious actors to manipulate or exfiltrate sensitive data, potentially compromising the integrity of software development processes within an organization. Given that JFrog Artifactory is integral to DevOps workflows and CI/CD pipelines, the exploitation of this vulnerability could lead to significant disruptions and security breaches.

Potential impact of CVE-2026-82329

Unauthorized Access to Sensitive Data: The vulnerability allows unauthenticated attackers to obtain elevated privileges, enabling them to access, alter, or steal sensitive artifacts and metadata stored within the repository, potentially leading to intellectual property theft.
Disruption of Development Processes: An attacker exploiting this weakness could modify or delete crucial build components, disrupting software development and deployment cycles. This could result in downtime, decreased productivity, and potential financial losses for organizations relying on JFrog Artifactory for their software delivery pipelines.
Increased Risk of Data Breaches: The ability to gain administrative access may facilitate further attacks, such as planting backdoors, spreading malware, or using compromised repositories for supply chain attacks, thereby amplifying the risk of comprehensive data breaches across the affected organization's systems and networks.

CISA has reported CVE-2026-82329

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2026-82329 as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace

The CISA's recommendation is: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Affected Version(s)

artifactory 0 < 7.111.21

artifactory 7.117.0 < 7.117.28

artifactory 7.125.0 < 7.125.20

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

cve-2026-82329-jfrog-artifactory
Created by dinosn

CVE-2026-82329-JFrog-Artifactory-Auth-Bypass
Created by ynsmroztas

CVE-2026-82329
Created by HORKimhab

News Articles

Techtimes

CVE-2026-42016 CVE-2026-82329

JFrog Artifactory Hacked in 24-Day Campaign; Rust Backdoors Survive Patching

JFrog Artifactory vulnerabilities CVE-2026-42016, CVE-2026-42018, and CVE-2026-82329 were chained by multiple threat actors to hack build servers and plant Rust backdoors between August 15 and

1 week ago