MSRXCVE-2026-82329
CVE-2026-82329
JFrog Artifactory Improper Authentication Vulnerability
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CVSS 3.1 · CNA · jfrog.com
chance of exploitation in the next 30 days (EPSS; higher than 96% of CVEs)
JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges.
Scores
Affected products
- jfrog artifactory: ≥ 7.111.4, < 7.111.21; ≥ 7.117.0, < 7.117.28; ≥ 7.125.0, < 7.125.20; ≥ 7.133.0, < 7.133.29; ≥ 7.146.0, < 7.146.38; ≥ 7.161.0, < 7.161.20
Weakness: CWE-287
3 references (advisories, patches, write-ups)
- https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases · Release Notes
- https://docs.jfrog.com/releases/docs/jfrog-security-advisories · Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-82329 · Third Party Advisory, US Government Resource
Sources: NVD, CVE.org, FIRST EPSS. Missing ones did not answer or have no record yet.