CISA Adds JFrog Artifactory Authentication Bypass (CVE-2026-82329) to KEV Catalog

CISA has added CVE-2026-82329, an improper authentication vulnerability in JFrog Artifactory, to its Known Exploited Vulnerabilities (KEV) catalog, indicating confirmed active exploitation. Per JFrog's advisory, under default configuration the flaw can allow an unauthenticated attacker with network access to obtain administrative privileges on the affected Artifactory instance.

Why It Matters

Artifactory is a widely deployed artifact repository manager sitting at the center of many organizations' build and release pipelines, storing packages, container images, and build artifacts. Administrative compromise of an Artifactory instance is a supply-chain risk: an attacker with admin access could potentially read, modify, or poison artifacts consumed downstream by CI/CD systems and production deployments, in addition to exposing credentials and configuration stored within the platform. Because exploitation reportedly requires no authentication and only network access under default settings, internet-exposed or loosely segmented Artifactory deployments are at immediate risk.

What Defenders Should Do Now

• Identify all Artifactory instances in your environment, including shadow/dev deployments, and confirm their exposure (internet-facing vs. internal-only).
• Consult JFrog's advisory for affected versions and apply patches or the vendor's recommended configuration changes as soon as possible.
• Until patched, restrict network access to Artifactory admin interfaces to trusted networks/VPN only, and review authentication configuration for deviations from hardened defaults.
• Review Artifactory access and admin-action logs for anomalous administrative logins, privilege changes, or new admin accounts created without a corresponding change-management record.
• Audit recently published or modified artifacts for unauthorized changes, especially in pipelines that auto-consume from Artifactory without integrity verification.
• Given KEV status, treat this as a priority patching item per CISA Binding Operational Directive timelines if applicable to your organization.

Developing Intel

This is a fresh KEV addition and details are still emerging; CVSS scoring was not yet available at time of writing. Defenders should monitor JFrog's advisory directly for updates on affected versions, indicators of compromise, and remediation guidance: https://docs.jfrog.com/releases/docs/jfrog-security-advisories.