Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

JFrog Artifactory can grant admin rights to unauthenticated users

CVE-2026-82329 · published 6 days ago · actively exploited
Summary

The default setup of JFrog Artifactory lets anyone on the network log in without credentials and gain full administrative control. This could let attackers change settings, delete data, or install malicious software. Change the configuration to require proper authentication and restrict network access to trusted users.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
jfrog artifactory >= 7.111.4, < 7.111.21
>= 7.117.0, < 7.117.28
>= 7.125.0, < 7.125.20
>= 7.133.0, < 7.133.29
>= 7.146.0, < 7.146.38
>= 7.161.0, < 7.161.20
< 7.111.21
Original advisory text
JFrog Artifactory Improper Authentication Vulnerability
JFrog Artifactory contains an improper authentication vulnerability that under default configuration can allow an unauthenticated attacker with network access to obtain administrative privileges.
References
Severity
9.8 Critical
CVSS 3.1: 9.8 (NVD)
Exploitation
Known exploited
Listed in the CISA KEV catalogue - exploitation confirmed in the wild.
EPSS 8%
Type
CWE-287Improper Authentication
Timeline
Published28 Aug 2026
Updated3 Sep 2026
First seen28 Aug 2026
Sources
CVE-2026-82329 · NVD
CVE-2026-82329 · MITRE
CVE-2026-82329 · CISA KEV
Monitor software like this
Free during beta