CVE-2026-82329

Potential authentication bypass leading to administrative access in Artifactory

JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges.

Affected

jfrog · artifactory

CVSS v3.1 JFROG

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

14.12% chance of exploitation in the next 30 days, 97th percentile

CISA KEV

added 2026-09-02

Nuclei

critical · CWE-287

Published

2026-08-28

Updated

2026-09-03

Proof-of-concept exploits (8)

• HORKimhab/CVE-2026-823290★ · 2026-09-01
• realalexandergeorgiev/artifactory-CVE-2026-82329-poc.py1★ · 2026-09-02
• 0xCyp1337/CVE-2026-823290★ · 2026-09-03
• gagaltotal/CVE-2026-82329-poc0★ · 2026-09-04
• 0xTerror/CVE-2026-82329-JFrog-Artifactory-2★ · 2026-09-07
• tc4dy/CVE-2026-82329-PoC-Exploit4★ · 2026-10-08
• Rubby2001/CVE-POCS5★ · 2026-10-10
• dinosn/cve-2026-82329-jfrog-artifactory/blob/9023c25c9fddccbc20eacb1cb3ee41b47b8bb6c4/poc…12★ · 2026-09-01

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-82329.yaml

Security advisories

• https://docs.jfrog.com/releases/docs/jfrog-security-advisories
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-82329
• https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases

References

• CVE Record
• NVD entry

Related

• CVE-2025-6440
• CVE-2026-10196
• CVE-2026-19598
• CVE-2026-44402
• CVE-2026-48907
• CVE-2026-57811