CVE-2026-82329

CRITICAL9.8Published on August 28, 2026

JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges.

Early warning: exploitation observed

Exploitation observed since Sep 1, 2026
Not yet in the official CISA catalogue
First attack observed 3 days after disclosure

Source: VulnCheck KEV · Sep 1, 2026 Sep 1, 2026 Sep 1, 2026

CVSS score9.8 / 10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness type (CWE)CWE-287

JFrog Artifactory, falla critica consente di creare token amministrativi senza autenticazione

Vulnerabilities

JFrog Artifactory Critical Flaw Allows Unauthenticated Creation of Administrative Tokens

JFrog Artifactory CVE-2026-82329 (CVSS 9.8) allows unauthenticated admin token creation. Patch self-hosted instances to prevent supply chain compromise.

Sep 1, 20265 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database

Early warning: exploitation observed

Related articles

JFrog Artifactory Critical Flaw Allows Unauthenticated Creation of Administrative Tokens