CVE-2026-82329

Potential authentication bypass leading to administrative access in Artifactory

State: Published
Severity: 9.8 Critical
Published: Aug 28, 2026
Updated: Sep 3, 2026
Reserved: Aug 28, 2026

Description

JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	JFROG

Weaknesses

CWE-287 Improper Authentication

Affected Products

Product	Versions
artifactoryjfrog	before 7.111.21Affected 7.117.0 to before 7.117.28Affected 7.125.0 to before 7.125.20Affected 7.133.0 to before 7.133.29Affected 7.146.0 to before 7.146.38Affected 7.161.0 to before 7.161.20Affected

References

https://docs.jfrog.com/releases/docs/jfrog-security-advisoriesvendor-advisory
https://docs.jfrog.com/releases/docs/artifactory-self-managed-releasesvendor-advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-82329government-resource

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.