CVE-2026-82329

critical

Description

JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges.

References

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-82329

https://docs.jfrog.com/releases/docs/jfrog-security-advisories

https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases

https://www.securityweek.com/three-jfrog-artifactory-flaws-exploited-for-backdoor-deployment/

https://securityaffairs.com/199032/security/u-s-cisa-adds-gitlab-jfrog-artifactory-and-connectwise-screenconnect-flaws-to-its-known-exploited-vulnerabilities-catalog.html

https://www.theregister.com/security/2026/09/11/more-jfrog-artifactory-bugs-under-attack-and-all-3-have-patches/5295943

https://www.bleepingcomputer.com/news/security/artifactory-flaws-chained-in-attacks-deploying-backdoor-malware/

https://thehackernews.com/2026/09/attackers-chain-jfrog-artifactory-flaws.html

https://www.wiz.io/blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201

https://thehackernews.com/2026/09/cisa-adds-seven-exploited-flaws-as.html

https://www.cisa.gov/news-events/alerts/2026/09/02/cisa-adds-seven-known-exploited-vulnerabilities-catalog

https://www.bleepingcomputer.com/news/security/hackers-exploit-critical-jfrog-artifactory-flaw-to-forge-admin-tokens/

https://www.theregister.com/security/2026/09/01/another-artifactory-cve-under-attack-by-ai-agents-or-humans/5293769

https://www.securityweek.com/critical-jfrog-artifactory-vulnerability-reportedly-exploited-in-the-wild/

https://thehackernews.com/2026/09/attackers-exploit-critical-jfrog.html

https://www.darkreading.com/application-security/attackers-pounce-critical-artifactory-flaw-disclosure

https://github.com/forgepair/artifactory-phantom-token-hunter

https://github.com/ynsmroztas/CVE-2026-82329-JFrog-Artifactory-Auth-Bypass

https://github.com/realalexandergeorgiev/artifactory-CVE-2026-82329-poc.py

Details

Source: Mitre, NVD

Published: 2026-08-28

Updated: 2026-09-03

Known Exploited Vulnerability (KEV)

Risk Information

CVSS v2

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Severity: Critical

CVSS v3

Base Score: 9.8

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity: Critical

Vulnerability Watch

Tenable Research has classified this CVE under the following Vulnerability Watch classification, which includes active and historical (inactive) classifications. You can learn more about these classifications on our blog.

Vulnerability of Interest

Detections

Analytics