JFrog Patched Every Supported Artifactory Branch in a Day. The Exposure Is on the Ones It No Longer Supports.
The story every outlet is running is “critical Artifactory flaw, update now.” The half nobody is writing is who cannot. CVE-2026-82329 is, in JFrog's words, “an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges” in Artifactory. NVD scores it CVSS 9.8. JFrog published the advisory on August 28, 2026 and shipped fixed builds for all six supported branches the same day. CISA added the CVE to its Known Exploited Vulnerabilities catalog on September 2, 2026 with a federal due date of September 5, 2026, which is the catalog's confirmation that it is being used in attacks; JFrog's advisory describes the flaw and the fixes and does not itself describe exploitation.
Artifactory is the repository that holds an organisation's own build artifacts, container images and dependency caches, so administrative access to it is administrative access to the software supply chain behind it. That makes two lifecycle facts matter more than usual. First, JFrog supports self-managed Artifactory for 18 months from each minor version's initial release, and the branches past that line, 7.104 and older, appear in neither the affected list nor the fixed list. Second, the lowest branch that does have a fix, 7.111, reaches its own end of life on October 23, 2026.
What JFrog fixed, verbatim
| Branch | Affected range (JFrog) | Fixed version (JFrog) | Branch end of life |
|---|---|---|---|
| 7.161 | 7.161.0 > 7.161.19 | 7.161.20 | January 27, 2028 |
| 7.146 | 7.146.0 > 7.146.36 | 7.146.38 | October 16, 2027 |
| 7.133 | 7.133.0 > 7.133.28 | 7.133.29 | April 30, 2027 |
| 7.125 | 7.125.0 > 7.125.19 | 7.125.20 | April 30, 2027 |
| 7.117 | 7.117.0 > 7.117.27 | 7.117.28 | January 14, 2027 |
| 7.111 | 7.111.4 > 7.111.21 | 7.111.21 | October 23, 2026 |
The ranges and fixed versions are copied from JFrog's advisory as published; where a range boundary and a fixed version share a number (7.111.21), we print both as JFrog does rather than resolve it. JFrog adds that affected Cloud environments “have already been fortified” and need no action. The fixed builds appear in the Artifactory self-hosted release notes dated August 28, 2026.
What JFrog did not fix, and why that is the story
| Branch | Initial release | End of life (JFrog) | In the advisory? |
|---|---|---|---|
| 7.104 | January 29, 2025 | July 30, 2026 | No — neither affected nor fixed |
| 7.98 | October 29, 2024 | April 29, 2026 | No |
| 7.90 | July 25, 2024 | January 25, 2026 | No |
| 7.84 | May 12, 2024 | November 12, 2025 | No |
| 7.77 and older | all past end of life by July 24, 2025 | No | |
Two entries in a week
This is Artifactory's second appearance in the KEV catalog in six days. The first, added August 27, 2026, is CVE-2026-66384: “an authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions,” published by JFrog on August 12, 2026 as Medium severity, scored 5.3 by NVD, fixed in 7.146.35 and 7.161.16, due September 10. NVD's references for it include OpenAI's technical report on the Hugging Face incident, which is as much as the public record says about how it came to be exploited.
| CVE | Added to KEV | Federal due | What it is |
|---|---|---|---|
| CVE-2026-82329 | Sep 2, 2026 | Sep 5, 2026 | Authentication bypass to administrator under default configuration (CVSS 9.8, CWE-287) |
| CVE-2026-66384 | Aug 27, 2026 | Sep 10, 2026 | Authenticated write outside the Docker cache path (CVSS 5.3, CWE-22) |
Read together they say something about the product's position: an artifact repository is worth attacking at Medium severity, and a 9.8 on it was in the catalog within five days of disclosure. The EU Cyber Resilience Act reporting obligations that take effect this month add a second clock for any vendor whose product build depends on a compromised Artifactory.
What to do by Friday
On a supported branch: install the fixed build for your branch from the table above. If you are on 7.111, note that the branch itself ends on October 23, 2026, so 7.111.21 is a bridge, not a destination; the next move is to 7.161 or 7.146, whose runways reach into 2027 and 2028.
On 7.104 or older: there is no fixed build and JFrog's policy means there will not be one. Upgrade to a supported branch's fixed build; until that lands, keep the instance off the internet and treat its administrator credentials as something an unauthenticated attacker may be able to obtain, because JFrog's description of the flaw under default configuration says exactly that for the branches it did test. On JFrog Cloud: JFrog states the fix is already applied.
Whichever branch: after patching, review administrator accounts and access tokens created since late August, and audit what an administrator could have pulled or pushed, because a repository's job is to be trusted by every build that reads from it.
Frequently Asked Questions
Which Artifactory versions are affected by CVE-2026-82329 and which are fixed?
JFrog's advisory of August 28, 2026 lists the affected ranges as 7.161.0 to 7.161.19, 7.146.0 to 7.146.36, 7.133.0 to 7.133.28, 7.125.0 to 7.125.19, 7.117.0 to 7.117.27 and 7.111.4 to 7.111.21, and the fixed versions as 7.161.20, 7.146.38, 7.133.29, 7.125.20, 7.117.28 and 7.111.21. JFrog states that affected Cloud environments were already fortified and need no action.
Is CVE-2026-82329 being exploited?
CISA added it to the Known Exploited Vulnerabilities catalog on September 2, 2026 with a federal due date of September 5, 2026, which is CISA's confirmation of exploitation. JFrog's advisory itself describes the flaw and the fixes and does not describe exploitation.
What about Artifactory 7.104 and older?
They appear in neither JFrog's affected list nor its fixed list. JFrog supports self-managed Artifactory for 18 months from the initial release of each minor version; 7.104 reached end of life on July 30, 2026, 7.98 on April 29, 2026, 7.90 on January 25, 2026 and 7.84 on November 12, 2025. No fixed build exists for any of them, and JFrog has not stated whether the flaw is present in them. The only vendor path is an upgrade to a fixed build on a supported branch.
How long does the lowest fixed branch, 7.111, stay supported?
Artifactory 7.111 reaches end of life on October 23, 2026. 7.117 runs to January 14, 2027, 7.125 and 7.133 to April 30, 2027, 7.146 to October 16, 2027 and 7.161 to January 27, 2028.
What is the second Artifactory entry in CISA's catalog?
CVE-2026-66384, added August 27, 2026 with a due date of September 10, 2026: an authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions. JFrog published it on August 12, 2026 as Medium severity, NVD scores it 5.3, and the fixed versions are 7.146.35 and 7.161.16.
Related
- JFrog Artifactory — every branch with live status and the 18-month clock
- Exploited & Unpatchable — the feed of exploited CVEs whose affected versions will never receive a fix, and why this one is not on it yet
- SonicWall SMA 1000 under active attack — the other September 5 deadline
- Building an EOL management program · End of support & the BOD 26-02 clock