Vigie VulnDBEuropean-hosted Vulnerability DB

CVE-2026-82329

Potential authentication bypass leading to administrative access in Artifactory

At a glance

Severity
CRITICAL 9.8
Exploitation
Known exploited (CISA KEV) · added 2026-09-02
Exploited per ENISA since 2026-09-02
EPSS
EPSS 14.37 % · percentile 97 (2026-10-27)
State
PUBLISHED
Published
Updated
Assigner
JFROG
NVD status
Analyzed

Description

JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges.

Scores

VersionScoreVectorScored by
CVSS 3.1CRITICAL 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HJFROG
CVSS 3.1CRITICAL 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HNVD · reefs@jfrog.com (Secondary)

Weaknesses (CWE)

European references

CERT-FR advisories

Affected configurations (NVD CPE)

Affected products

ProductVersions
jfrog · artifactoryaffected 0 < 7.111.21 ; affected 7.117.0 < 7.117.28 ; affected 7.125.0 < 7.125.20 ; affected 7.133.0 < 7.133.29 ; affected 7.146.0 < 7.146.38 ; affected 7.161.0 < 7.161.20

References

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
CISA Known Exploited VulnerabilitiesCC0 1.0
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD