CVE-2026-82329: listed in the CISA KEV catalog

CVE-2026-82329 · CVSS 9.8 CRITICAL · EPSS 8% · KEV 2026-09-02 · patch available

JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges.

Is CVE-2026-82329 exploited?

• Listed in the CISA KEV catalog on 2026-09-02.
• Federal remediation due 2026-09-05.
• Past that date by 18 days.
• EPSS puts exploitation in the next 30 days at 8%.
• Public exploit code: none found in monitored sources.
• Public detection rules exist.

Which products and versions are affected?

• JFrog · Artifactory · <7.146.38
• JFrog · Artifactory · <7.161.20
• JFrog · Artifactory · <7.133.29
• JFrog · Artifactory · <7.117.28
• JFrog · Artifactory · <7.125.20
• JFrog · Artifactory · <7.7.111.21
• jfrog · artifactory · >= 0, < 7.111.21, >= 7.117.0, < 7.117.28, >= 7.125.0, < 7.125.20, >= 7.133.0, < 7.133.29, >= 7.146.0, < 7.146.38, >= 7.161.0, < 7.161.20

Is there a patch?

• Artifactory 7.146.38
• Artifactory 7.161.20
• Artifactory 7.133.29
• Artifactory 7.117.28
• Artifactory 7.125.20
• Artifactory 7.7.111.21

What PlainSec published about CVE-2026-82329

• Wiz Finds Artifactory Admin Takeover in the Wild (2026-09-17)
• Artifactory Chaining Gave Attackers Admin Backdoors (2026-09-09)

Primary sources

• NVD record
• CISA KEV catalog
• Nuclei template

KEV and EPSS are re-checked daily. Record last updated 2026-09-17.