vCDC Alert: JFrog Artifactory CVE-2026-82329 – critical authentication bypass

Management summary

JFrog disclosed CVE-2026-82329 as a critical Artifactory vulnerability that can bypass authentication and lead to administrative access. For self-hosted installations this is especially serious because Artifactory often stores software packages and build artefacts trusted by other systems.

What is the issue?

An unauthenticated attacker with network access to a vulnerable Artifactory instance may be able to bypass authentication and obtain administrative privileges. Several self-managed Artifactory branches are affected. JFrog Cloud environments are handled by the provider, while self-hosted installations must be assessed and updated by their operators.

Why is this dangerous and what can an attacker do?

Administrative control may allow access to confidential artefacts, creation or modification of users and tokens, changes to repositories or integrations and potentially manipulation of packages or artefacts. Actual package tampering should only be claimed where evidence exists, but the possibility means integrity checks are important after exposure.

Recommended action

Identify all self-hosted Artifactory nodes and exact versions. Upgrade immediately to a vendor-fixed supported release. The referenced fixed thresholds are 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38 and 7.161.20 depending on the branch; prefer the latest supported fixed release. Review administrator accounts, access tokens/API keys, permission targets, repositories, replication, webhooks and integrations. Investigate unexpected uploads, promotions, deletions or downloads and rotate high-value secrets if compromise is plausible.

vCDC assessment

Priority: IMMEDIATE for exposed self-hosted systems. Remediation should include both patching and a review for unauthorised administrative or artefact changes.