A critical vulnerability CVE-2026-82329 with a CVSS score of 9.8 has been discovered in JFrog Artifactory. It allows an unauthenticated attacker with network access to obtain administrative privileges in the default configuration. Organizations using self-managed Artifactory installations must immediately apply updates — prioritizing internet-exposed systems — review logs, and rotate credentials.
Technical characteristics of the vulnerability
According to the GitHub Advisory Database entry, the vulnerability is classified as CWE-287 (Improper Authentication). The attack vector is described by the formula CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which means: the attack is carried out over the network, requires neither privileges nor user interaction, and, if successfully exploited, results in complete compromise of confidentiality, integrity, and availability.
The description in the CVE registry states explicitly: the vulnerability allows an unauthenticated attacker with network access to obtain administrative privileges in the default configuration. This means that every Artifactory installation that has not undergone additional hardening is potentially vulnerable immediately after deployment.
Affected versions
According to the source material, the vulnerability affects the following Artifactory branches (these ranges require additional verification against the official JFrog guidance, since specific versions were not listed in the GitHub Advisory Database at the time of analysis):
- 7.161.0 — 7.161.19
- 7.146.0 — 7.146.36
- 7.133.0 — 7.133.28
- 7.125.0 — 7.125.19
- 7.117.0 — 7.117.27
- 7.111.4 — 7.111.21
According to the vendor, a fix is available in version 7.161.20, released on 28 August 2026.
Impact assessment
JFrog Artifactory occupies a key position in development infrastructure: it is the central repository of binary artifacts through which builds, dependencies, and releases pass. Administrative access to such a system opens up possibilities that go far beyond the compromise of a single service.
Vercel CEO Guillermo Rauch described the vulnerability as a potential “remote code execution bomb,” since Artifactory stores and distributes binary files. It should be emphasized: this is a risk assessment, not a confirmed instance of remote code execution or supply chain compromise. Nevertheless, the reasoning is sound: an Artifactory administrator can replace artifacts, modify build pipelines, move laterally into connected production systems, and potentially propagate malicious changes to end consumers of the software.
The highest risk is faced by:
- Organizations with self-managed Artifactory installations accessible from the internet
- Companies using the default configuration without additional security measures
- Environments where Artifactory is integrated into CI/CD pipelines with automatic deployment
Exploitation status
The company watchTowr reports that exploitation of the vulnerability began on 1 September 2026. However, this information is not confirmed by official sources — neither JFrog nor CISA nor other government entities. Inclusion of CVE-2026-82329 in the CISA KEV (Known Exploited Vulnerabilities) catalog has also not been confirmed at the time of analysis. Specific indicators of compromise — hashes, IP addresses, domains — are not provided in the available materials, and there is no attribution to any known threat group.
Nevertheless, the combination of factors — an extremely simple attack vector (network, no authentication, no user interaction), default configuration, CVSS score of 9.8 — makes exploitation highly likely and to be expected.
Response recommendations
The response priority is immediate for internet-exposed systems and high for internal installations:
- Install the update to version 7.161.20 or the corresponding fixed version for your branch. Consult the official JFrog guidance for the current list of fixes.
- Restrict network access to Artifactory until the update is complete: remove direct access from the internet, use a VPN or network segmentation.
- Review audit logs for the creation of new administrative tokens, unusual requests to user and group management APIs, and any changes to access configuration.
- Rotate credentials: access tokens, API keys, and service accounts associated with Artifactory.
- Verify the integrity of artifacts in the repository, especially if the installation was accessible from the internet. Compare checksums of critical binaries with reference values.
- Audit connected systems: CI/CD pipelines, deployment systems, federated installations — for unauthorized changes or implanted backdoors.
Given the critical CVSS score of 9.8, the lack of any authentication requirement, and the strategic position of Artifactory in the software supply chain, updating self-managed installations should be treated as a top-priority task. Organizations that cannot promptly apply the patch must at a minimum immediately cut off internet access to Artifactory and audit existing administrative accounts and tokens.
