CVE-2026-82329
JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges.
Actively exploited
- In the CISA exploited-vulnerabilities catalogue since Sep 2, 2026
- US federal agencies must remediate it by Sep 5, 2026 (BOD 22-01)
- First attack observed 3 days after disclosure
- Confirmed by sensors, not only by reports
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Source: CISA KEV · Oct 21, 2026 Oct 20, 2026 Oct 19, 2026 Sep 10, 2026 Sep 7, 2026 Sep 4, 2026
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HAffected products
| Vendors | Product | Versions |
|---|---|---|
| jfrog | artifactory | < 7.111.21 |
Related articles
Attackers Chain JFrog Artifactory Flaws to Deploy Rust Backdoor
Attackers chain JFrog Artifactory flaws CVE-2026-42018 and CVE-2026-42016 to gain admin access, install Groovy plugins and Rust backdoor. Patch now.
Actively Exploited N-able N-central Flaw Enables Pre-Authentication Remote Code Execution
CISA warns CVE-2026-86218 in N-able N-central is actively exploited, enabling pre-auth RCE. Update to 2026.3 Hotfix 4 immediately.
PostgreSQL Logical Decoding Flaw Allows Code Execution as the `postgres` User
PostgreSQL CVE-2026-6471 lets REPLICATION users load arbitrary libraries via logical decoding to execute code as postgres. See affected versions and fix.
Sangoma Switchvox Under Attack: Critical SQL Injection Enables Remote Code Execution
CVE-2026-9586 in Sangoma Switchvox exploited via unauthenticated SQL injection at /pa enabling RCE. Update to 8.4.0.2 and hunt for compromise.
JFrog Artifactory Critical Flaw Allows Unauthenticated Creation of Administrative Tokens
JFrog Artifactory CVE-2026-82329 (CVSS 9.8) allows unauthenticated admin token creation. Patch self-hosted instances to prevent supply chain compromise.
This product uses the NVD API but is not endorsed or certified by the NVD.