Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-82329 |
| Alert Source | GitHub Advisory - Critical vulnerability |
| CVE Year | 2026 |
| Publication Date | 2026-08-28 |
| Vendor | JFrog |
| Product | Artifactory (Self-Managed) |
| CVSS Score | 9.8 (Critical) |
| EPSS Score | No data |
| CISA KEV | No |
| Ransomware | Not confirmed |
Vulnerability Description
Source: NVD / JFrog Security Advisories
JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges.
The phrase “under default configuration” matters here. This is not an exotic setting somebody had to deliberately enable — the vulnerable state is an installation left at factory settings, which is the most common deployment state.
The impact extends beyond Artifactory itself. An artifact repository is where CI/CD pipelines pull the libraries and container images used to build production software. Administrative control over it allows an attacker to swap an artifact that will be automatically drawn into the next release — the classic software supply chain attack, executed from inside the organisation.
Required Actions
- Upgrade Artifactory Self-Managed to the version indicated in JFrog’s security advisories.
- Verify whether the Artifactory instance is reachable from the internet. An artifact repository usually does not need to be publicly available, yet is often exposed for the convenience of external contractors and cloud pipelines.
- After patching, review administrative accounts and API tokens for entries you cannot attribute to a specific person or system.
- Check access logs for administrative operations performed without a preceding login.
Who Is Affected?
The vulnerability affects JFrog Artifactory Self-Managed installations left in default configuration.
Artifactory is the standard artifact repository wherever software is built in-house or for sale — software houses, fintechs, banks and large organisations with internal development teams. Self-managed instances are especially common where code cannot leave the organisation’s own infrastructure.
If your organisation is preparing for NIS2 supply chain security requirements, this vulnerability is a good checkpoint: the artifact repository is exactly the kind of component those obligations address directly.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
