JFrog Artifactory unauth admin on default config
Direct answer
JFrog Artifactory unauth admin on default config, also tracked as CVE-2026-82329 / Artifactory unauth admin default is a critical-severity threat campaign HOL Guard tracked from Aug 28, 2026 to Sep 2, 2026, verified against 3 primary sources and last reviewed Sep 22, 2026. Active tracking has ended and the record remains published as a permanent historical research record.
Self-hosted JFrog Artifactory on vulnerable trains can allow unauthenticated administrative access under default configuration conditions. CISA marked CVE-2026-82329 as actively exploited and added it to KEV on 2026-09-02. Upgrade to the fixed build for your train.
Also tracked as CVE-2026-82329 · Artifactory unauth admin default
- First observed
- Aug 28, 2026
- Last observed
- Sep 2, 2026
- Last reviewed
- Sep 22, 2026
- Tracking ended
- Sep 2, 2026
Record exports
Uncertainty and limitations
Read the evidence limits before acting on this record.
Confirm the exact fixed build against live JFrog guidance for your minor train. KEV status establishes known exploitation of this CVE, not exploitation of every affected deployment.
- Distinct from CVE-2026-42018 anonymous-token KEV chain.
- Fixed builds come from the cited current CVE/JFrog evidence.
- CISA KEV and SSVC establish active exploitation of CVE-2026-82329, not exploitation of every affected deployment.
- HOL blog is operator guidance.
Guard coverage and policy
What Guard's reviewed assertions do and do not claim for this campaign, and the reviewed starting points for defense.
No Guard coverage mapping or campaign-specific policy guidance is published for this record.
Safe next step. Campaign guidance is defensive context. It does not auto-apply policy or claim universal campaign coverage.
Timeline
Reviewed events, oldest first, each tied to a verified source.
- Disclosure
CVE-2026-82329 Artifactory unauth admin on default config disclosed.
- Update
CISA marked exploitation active and added CVE-2026-82329 to the Known Exploited Vulnerabilities Catalog.
Source:CVE Record CVE-2026-82329
Publication clock: 601.0 hours from reviewed disclosure timestamp to HOL publication; 12-hour critical target; historical backfill outside target.
Reviewed artifacts
The specific artifacts this record concerns, as reviewed. Names and versions are shown as text; a registry link is not recorded here.
JFrog Artifactory@vulnerable trains before 7.111.21 / 7.117.28 / 7.125.20+jfrogpackage
Sources
Every claim on this record is traceable to the sources below.
Campaign questions, answered
Self-hosted JFrog Artifactory on vulnerable trains can allow unauthenticated administrative access under default configuration conditions. CISA marked CVE-2026-82329 as actively exploited and added it to KEV on 2026-09-02. HOL Guard tracked the campaign from Aug 28, 2026 to Sep 2, 2026.
No. Active tracking ended Sep 2, 2026; this page remains as a labeled historical research record and does not imply the threat is currently active.
The record cites 3 primary sources, names 1 reviewed artifact, and was last fully reviewed Sep 22, 2026 by HOL Guard Security Publishing. Its uncertainty and limitations are stated on the record itself.
Campaign guidance is defensive context. It does not auto-apply policy or claim universal campaign coverage.
The permalink above is permanent. The full record can be downloaded from this page as JSON, an artifact CSV, and a STIX 2.1 bundle, and corrections can be requested through the published correction path on the record. Confirm the exact fixed build against live JFrog guidance for your minor train. KEV status establishes known exploitation of this CVE, not exploitation of every affected deployment.
Reviewed in full by HOL Guard Security Publishing.
- Published
- Last full review
- Last modified
Record HGTC-2026-ABB0491B