CVE-2026-82329

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Sep 3, 2026

Description

JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
jfrog	artifactory	< 7.111.21; >= 7.117.0, < 7.117.28; >= 7.125.0, < 7.125.20; >= 7.133.0, < 7.133.29; >= 7.146.0, < 7.146.38; >= 7.161.0, < 7.161.20

References

https://docs.jfrog.com/releases/docs/artifactory-self-managed-releasesRelease Notes
https://docs.jfrog.com/releases/docs/jfrog-security-advisoriesVendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-82329Third Party Advisory, US Government Resource

Timeline

Published: Aug 28, 2026
Last modified: Sep 3, 2026
Added to CISA KEV: Sep 2, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-82334.6A vulnerability was determined in Dotouch XproUPF 2.0.0-release-088aa7c4. Affected is an unknown function of the component UPF. This manipul CVE-2026-823306.1A flaw was found in the file-pvr plugin in GIMP. When processing a specially crafted PVR image file, the VQ (compressed) decoder does not pr CVE-2026-823319.8Improper link resolution before file access ('link following') vulnerability in the `tar` source plugin of Apache BuildStream running on Pyt CVE-2026-823337.5multer is a middleware for handling multipart/form-data in Node.js. A small multipart request with two specially crafted text field names ca CVE-2026-823349.1IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable to a heap-based out-of-bounds read in the TDS7 LOGIN7 protocol parser. A remote CVE-2026-823359.8IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable to a heap-based buffer overflow in the MongoDB protocol parser. A remote attacke CVE-2026-82348.8A security vulnerability has been detected in EFM ipTIME A8004T 14.18.2. This vulnerability affects the function formWifiBasicSet of the fil CVE-2026-823409.8IBM Guardium Data Protection 12.2 is vulnerable to unauthenticated insecure deserialization and attacker-controlled reflective method dispat CVE-2026-823436.1A flaw was found in the file-psd plugin in GIMP. When processing a specially crafted PSD image file, the plugin does not properly validate t CVE-2026-823449.8IBM Guardium Data Protection 12.0, 12.1 is vulnerable to a heap-based buffer overflow in the S-TAP TrafficTap TDS login reassembly functiona CVE-2026-823467.0A potential security vulnerability has been identified in the HP ImageDiags for versions prior to 5.0.0.36. The vulnerability could potentia CVE-2026-823487.7Authorization Bypass Through User-Controlled Key in Apache Roller 6.1.5 allows an authenticated user with authoring rights on one weblog to