CISA Added JFrog Artifactory Vulnerability to its Known Exploited Vulnerabilities Catalog (CVE-2026-82329)
CISA added the actively exploited JFrog Artifactory flaw CVE-2026-82329 (CVSS 9.8) to its KEV catalog; unauthenticated attackers gain admin access.
CISA added CVE-2026-82329, a critical improper authentication flaw in JFrog Artifactory, to its Known Exploited Vulnerabilities Catalog with a September 5, 2026 patch deadline. The CVSS v3.1 9.8 flaw allows unauthenticated attackers with network access to obtain administrative privileges under the default configuration. WatchTowr honeypot data shows attackers minting administrator tokens, enumerating users, groups, and federated access topologies, and in some cases creating backdoor users for persistence. Users must upgrade to Artifactory 7.161.20 or the applicable fixed release; Qualys detects vulnerable assets via QID 735249.
- CISA KEV addition sets a federal patching deadline of September 5, 2026
- CVSS 9.8 improper authentication flaw grants admin rights under default configuration
- WatchTowr observed token minting, environment enumeration, and backdoor user creation
- Fixed versions include 7.161.20; multiple 7.x release branches affected
- CVEs
- CVE-2026-82329
- Products
- JFrog Artifactory
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-82329 | Improper Authentication in JFrog Artifactory Allows Unauthenticated Admin Access | 9.8 | 14% | KEVPoC ×2 | KEV |
From the original article
1 min read at threatprotect.qualys.comThe U. S. Cybersecurity and Infrastructure Security Agency (CISA) warns users about the active exploitation of a vulnerability impacting JFrog Artifactory, tracked as CVE-2026-82329.
By Diksha Ojha · threatprotect.qualys.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.