Potential authentication bypass leading to administrative access in Artifactory (CVE-2026-82329)

What is affected, what to do

JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges.

The vulnerability is being actively exploited; treat it as a priority. Update JFrog Artifactory to version 7.111.21, JFrog Artifactory to version 7.117.28, JFrog Artifactory to version 7.125.20. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• JFrog Artifactory lt *..7.111.21
• JFrog Artifactory lt 7.117.0..7.117.28
• JFrog Artifactory lt 7.125.0..7.125.20
• JFrog Artifactory lt 7.133.0..7.133.29
• JFrog Artifactory lt 7.146.0..7.146.38
• JFrog Artifactory lt 7.161.0..7.161.20

Fixed in

• JFrog Artifactory 7.111.21
• JFrog Artifactory 7.117.28
• JFrog Artifactory 7.125.20
• JFrog Artifactory 7.133.29
• JFrog Artifactory 7.146.38
• JFrog Artifactory 7.161.20

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Cut exposure first: Restrict any Artifactory instance reachable from the internet or from untrusted segments to known build and admin networks at the firewall or reverse proxy. Check the default ports 8081/tcp (Artifactory) and 8082/tcp (router/UI), plus any fronting 443/tcp proxies.
   • Patch: Upgrade to the fixed release in your branch: 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38 or 7.161.20. For branches not listed, a patch is available from the vendor — look up the exact version in the vendor advisory. In HA clusters, upgrade every node before reopening access.
   • Compromise check before reopening: Review users, groups, permission targets, access tokens, webhooks and user plugins ($JFROG_HOME/artifactory/var/etc/artifactory/plugins/) for unknown or recently modified entries. An attacker with admin rights can drop Groovy plugins to execute code on the server.
   • Rotate secrets: Treat everything stored in Artifactory as exposed. This covers admin passwords, access/identity tokens, API keys, LDAP/SAML/OIDC bind credentials, remote-repository credentials and CI/CD service accounts. If you find signs of compromise, also rotate the join key.
   • Verify artifact integrity: Compare checksums of critical release artifacts (container images, internal packages) against build records or signatures. Freeze deployments from affected repositories until they are verified. The supply-chain blast radius outweighs the host-level impact.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: Expose Artifactory only through an authenticating reverse proxy (mTLS or a VPN/ZTNA gateway). Use ACLs to block direct access to 8081/8082 from client VLANs, and restrict server egress to the upstream registries you actually need.
   • WAF/reverse-proxy rules: Allow the admin API paths (/artifactory/api/security/*, /access/api/v1/*, /artifactory/api/system/*, /artifactory/api/plugins/*) only from the admin network. Return 403 and log the request for every other source.
   • Configuration hardening: The advisory states that the default configuration is affected. Disable anonymous access, rename or disable the default admin account, and enforce SSO with MFA for administration. Disable user plugin loading unless it is strictly required.
   • IAM/least privilege: Keep admin rights to a small set of named accounts. Scope CI tokens to individual repositories with short lifetimes, and revoke any tokens that never expire.
   • Endpoint hardening: Run Artifactory under a dedicated, unprivileged service account. Configure an EDR policy that blocks, or at least alerts on, the Java process spawning shells or LOLBins.
3. 03

   Runbook step 3

   Detection rules

   • Access/request logs: Search artifactory-request.log and access-request.log for successful (2xx) calls to admin endpoints from external or unknown IPs, or with no preceding login. Example SPL: index=artifactory (uri_path="*/api/security/*" OR uri_path="*/access/api/v1/tokens*") status=2* NOT src_ip IN (admin_nets)
   • Audit events: In access-security-audit.log, look for new users with the admin flag, token creation with admin scopes, admin password changes and new permission targets. A Sigma rule should match event in (user_created, token_created, admin_flag_set) outside change windows.
   • EDR process ancestry: Flag java (Artifactory/Tomcat) spawning sh, bash, curl, wget, python or nc, or cmd.exe/powershell.exe on Windows (Sysmon EID 1). Example KQL: DeviceProcessEvents | where InitiatingProcessFileName =~ "java.exe" and InitiatingProcessCommandLine has "artifactory" and FileName in~ ("cmd.exe","powershell.exe")
   • File system: Alert on new .groovy files in the plugin directory and on changes to system.yaml or artifactory.config.xml (auditd: -w $JFROG_HOME/artifactory/var/etc -p wa -k jfrog_cfg; Sysmon EID 11 on Windows).
   • Network telemetry: In Zeek/Suricata HTTP logs, watch for external sources hitting admin APIs. Also flag unusually large outbound transfers (bulk artifact downloads) and newly configured remote-repository targets.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges.

Source: BSI WID Portal, BSI CSAF, NVD (NIST), CISA KEV Catalog, pwn.watch, cvelistv5

Vendors and products

• JFrog JFrog Artifactory

Weakness classes (CWE)

• CWE-287Improper Authentication

  Class

  When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

  Entry at MITRE CWE-287

References & sources

• docs.jfrog.comJFrog Artifactory — CVE-2026-82329Vendor advisory, pwn-watch
• docs.jfrog.comreleases/docs/artifactory-self-managed-releasesVendor advisory
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2026-82329government-resource
• pwn.watchpwn.watch: JFrog Artifactory: JFrog Artifactory Improper Authentication Vulnerabilitypwn-watch
• NVD (NIST)NVD: CVE-2026-82329pwn-watch
• cisa.govCISA Known Exploited Vulnerabilities Catalogpwn-watch

Changes to this CVE

Who changed this CVE and when: NVD (analysis, affected products, CVSS), the CVE publisher (CNA) and additional providers such as CISA (ADP).

1. 03.09.2026Record modifiedCISA ADP

   CISA assessment (SSVC): exploitation: active, automatable: yes

   Show the original change

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   SSVC assessment	changed	{"id":"CVE-2026-82329","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-09-02T17:44:21.886219Z"}	{"id":"CVE-2026-82329","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-09-02T00:00:00+00:00"}

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

2. 02.09.2026CISA KEV entry updated9119a7d8…

   4 individual changes: Date Added, Due Date, Required Action, Vulnerability Name

   Show 4 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Date Added	added	—	2026-09-02
   Due Date	added	—	2026-09-02
   Required Action	added	—	2026-09-02
   Vulnerability Name	added	—	2026-09-02

   Source identifier: 9119a7d8-5eab-497f-8521-727c672e3725

3. 02.09.2026Record modifiedCISA ADP

   CISA assessment (SSVC): exploitation: active, automatable: yes

   New references:

   • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-82329
   Show 2 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Reference	added	—	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-82329
   SSVC assessment	changed	{"id":"CVE-2026-82329","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-08-31T18:45:27.400176Z"}	{"id":"CVE-2026-82329","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-09-02T17:44:21.886219Z"}

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Linked advisories

• Hackers exploit critical JFrog Artifactory flaw to forge admin tokensBleepingComputer02.09.2026
• Exploited JFrog Artifactory bug puts software supply chain on alertCSO Online02.09.2026
• Attackers Pounce on Critical Artifactory Bug Following DisclosureDark Reading01.09.2026
• Attackers Exploit Critical JFrog Artifactory Flaw to Mint Admin Tokens Days After DisclosureThe Hacker News01.09.2026
• Critical JFrog Artifactory Vulnerability Reportedly Exploited in the WildSecurityWeek01.09.2026