CVE-2026-82329: listed in the CISA KEV catalog

CVE-2026-82329 · CVSS 9.8 CRITICAL · EPSS 14% · KEV 2026-09-02 · patch available

JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges.

Is CVE-2026-82329 exploited?

• Listed in the CISA KEV catalog on 2026-09-02.
• Federal remediation due 2026-09-05.
• Past that date by 69 days.
• EPSS puts exploitation in the next 30 days at 14%.
• Public exploit code: none found in monitored sources.
• Public detection rules exist.

Which products and versions are affected?

• jfrog · artifactory · >= 0, < 7.111.21, >= 7.117.0, < 7.117.28, >= 7.125.0, < 7.125.20, >= 7.133.0, < 7.133.29, >= 7.146.0, < 7.146.38, >= 7.161.0, < 7.161.20

Is there a patch?

Yes. Update to one of these or later:

From jfrog's CVE record · jfrog advisory

What PlainSec published about CVE-2026-82329

• OpenInfra Europe Artifactory breach threatens downstream builds (2026-10-01)
• Artifactory login bypass hits supply-chain trust (2026-09-30)
• Wiz finds Artifactory admin takeover in the wild (2026-09-17)
• Artifactory chaining gave attackers admin backdoors (2026-09-09)

Primary sources

• NVD record
• CISA KEV catalog
• jfrog advisory
• Nuclei template

KEV and EPSS are re-checked daily. Record last updated 2026-10-22.