CVE-2026-82329: JFrog Artifactory Default-Config Authentication Bypass (KEV)

CVE-2026-82329 is an improper-authentication vulnerability (CWE-287) in JFrog Artifactory that, under default configuration, lets an unauthenticated attacker with network access to the instance obtain administrative privileges, and it carries a KEV listing with CISA's mandatory forensic-triage flag because of the severity of handing over admin control of an organization's software-artifact repository without any credentials.

CVE-2026-82329 is an improper authentication (CWE-287) weakness in JFrog Artifactory, the self-hosted binary/package repository manager widely used in CI/CD pipelines. NVD's description states: "JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges" (NVD).

NVD lists only a Secondary CVSS submission from JFrog's own CNA (source [email protected]): CVSS v3.1 9.8 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-reachable, low attack complexity, no privileges or user interaction required, full impact to confidentiality, integrity and availability. NVD's own vulnerability status is "Analyzed," but no NVD Primary CVSS metric has been published for this CVE as of this run, so per our indexing policy the 9.8 figure is labelled not NVD-confirmed and attributed to JFrog rather than NVD itself (NVD).

NVD's configuration data lists the affected self-hosted Artifactory release lines as: 7.111.4 before 7.111.21, 7.117.0 before 7.117.28, 7.125.0 before 7.125.20, 7.133.0 before 7.133.29, 7.146.0 before 7.146.38, and 7.161.0 before 7.161.20 (NVD). JFrog's own security-advisories and self-managed-release-notes pages are listed by NVD as the vendor advisory and release-notes references, but both returned an access-restricted (HTTP 403) response when fetched directly for this page, so they are cited here as pointers rather than quoted; operators should consult JFrog's own documentation for confirmation of patched build numbers and any configuration-based mitigations (JFrog Security Advisories, JFrog Artifactory Self-Managed Releases).

CISA added CVE-2026-82329 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-09-02, with a required-action due date of 2026-09-05 (a 3-day window) and flagged it for mandatory forensic triage under CISA's directive guidance — both consistent with active exploitation of an unauthenticated path to full administrative control. Known ransomware-campaign use is listed as "Unknown" (catalog confirmed live this run, matched by exact cveID string against the raw KEV feed) (CISA KEV).

As of 2026-10-30, FIRST scores the probability of exploitation at 0.14372 (96.613th percentile) (FIRST EPSS).

Because an Artifactory instance running under default configuration can be fully taken over by an unauthenticated network attacker, any self-hosted Artifactory deployment on an affected build should be upgraded immediately; given the forensic-triage directive, operators should also assume compromise is possible on any internet-reachable instance that was running a vulnerable build and review admin accounts, API keys and repository permissions created since exposure.

• Authentication weakness under default configuration may allow an unauthenticated attacker with network access to obtain administrative privileges on JFrog Artifactory. — NVD
• Only a Secondary CVSS v3.1 score of 9.8 (critical) from JFrog's own CNA is published; no NVD Primary metric exists as of this run. — NVD
• Affects self-hosted Artifactory release lines 7.111.4-7.111.20, 7.117.0-7.117.27, 7.125.0-7.125.19, 7.133.0-7.133.28, 7.146.0-7.146.37, 7.161.0-7.161.19 (fixed in .21/.28/.20/.29/.38/.20 respectively). — NVD
• Added to the CISA KEV catalog on 2026-09-02, due date 2026-09-05, with mandatory forensic triage flagged; known ransomware-campaign use listed as Unknown. — CISA KEV
• EPSS score is 0.14372 (96.613th percentile) as of 2026-10-30. — FIRST EPSS