Skip to main content

JFrog Artifactory CVE-2026-82329

| EUVDEUVD-2026-67861 CRITICAL
Improper Authentication (CWE-287)
2026-08-28 JFROG GHSA-c5pf-6p5j-gj87
9.8
CVSS 3.1 · Vendor: JFROG
Share

Severity by source

Vendor (JFROG) PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
9.8 CRITICAL

Description confirms remote unauthenticated network access with no user interaction under default config, and admin takeover implies full C/I/A loss, so all metrics stay at maximum.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (JFROG).

CVSS VectorVendor: JFROG

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
POC Analysis Generated
Aug 30, 2026 - 23:20 vuln.today
Patch available
Aug 28, 2026 - 21:17 EUVD
Analysis Generated
Aug 28, 2026 - 20:17 vuln.today
CVE Published
Aug 28, 2026 - 18:27 cve.org
CRITICAL 9.8

DescriptionCVE.org

JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges.

AnalysisAI

Authentication bypass in JFrog Artifactory allows an unauthenticated, network-adjacent attacker to escalate to full administrative privileges against default-configuration instances (CWE-287, improper authentication). Because Artifactory is the central binary repository in many CI/CD pipelines, admin takeover exposes stored artifacts, credentials, and build integrity. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden

Vulnerability AssessmentAI

Exploitation The target must be a JFrog Artifactory instance running under its default configuration and be reachable over the network by the attacker; no valid credentials and no user interaction are required (CVSS PR:N/UI:N/AV:N/AC:L). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment All quantitative signals point to high severity: the CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H yields 9.8, meaning remote, low-complexity, unauthenticated exploitation with total confidentiality, integrity, and availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Upgrade JFrog Artifactory to the fixed release identified on the JFrog security advisories page (https://docs.jfrog.com/releases/docs/jfrog-security-advisories) and the self-managed releases page (https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases); the exact patched version number was not provided in the available data and must be read directly from those advisories before deploying. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Restrict network access to Artifactory to authorized teams and CI/CD systems only; audit admin access logs and user accounts for signs of unauthorized access. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

CVE-2026-66384 MEDIUM POC
5.3 Aug 12

Path traversal in JFrog Artifactory (CWE-22) enables an authenticated low-privilege user to write data outside the inten

CVE-2019-9733 CRITICAL POC
9.8 Apr 11

An issue was discovered in JFrog Artifactory 6.7.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely e

CVE-2026-65617 HIGH POC
8.8 Jul 27

Low-privileged users can exploit a deserialization flaw in JFrog Artifactory's package handling to potentially execute a

CVE-2020-7931 HIGH POC
8.8 Jan 23

In JFrog Artifactory 5.x and 6.x, insecure FreeMarker template processing leads to remote code execution, e.g., by modif

CVE-2018-1000206 HIGH POC
8.8 Jul 13

JFrog Artifactory version since 5.11 contains a Cross ite Request Forgery (CSRF) vulnerability in UI rest endpoints that

CVE-2026-65923 MEDIUM POC
6.8 Jul 27

Server-side request forgery in JFrog Artifactory Ansible repository handling allows authenticated users with repository

CVE-2026-66018 MEDIUM POC
6.5 Jul 27

Information disclosure in JFrog Artifactory allows authenticated users with read access to an ordinary repository to ret

CVE-2016-6501 CRITICAL
9.8 Dec 09

JFrog Artifactory before 4.11 allows remote attackers to execute arbitrary code via an LDAP attribute with a crafted ser

CVE-2026-66014 CRITICAL
9.8 Jul 27

Privilege escalation in JFrog Artifactory stems from an authentication handling weakness in how the platform processes i

CVE-2026-65921 HIGH
8.8 Jul 27

Authenticated low-privilege users of JFrog Artifactory can write arbitrary files outside the intended build artifacts lo

CVE-2026-69106 HIGH
8.8 Aug 12

Cache metadata poisoning in JFrog Artifactory enables a low-privileged authenticated user to corrupt cached artifact met

CVE-2026-42017 HIGH
8.8 Jul 27

Exposure of privileged authorization material in JFrog Artifactory allows an authenticated low-privileged user to obtain

Share

CVE-2026-82329 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy