Full Report
JFrog security advisory (AV26-867)
Analysis Summary
# Vulnerability: JFrog Artifactory Remote Code Execution (RCE) via Unsafe Deserialization
## CVE Details
- **CVE ID:** CVE-2026-82329
- **CVSS Score:** 9.8 (Critical) - *Estimated based on exploitation status and typical Artifactory RCE impact.*
- **CWE:** CWE-502 (Deserialization of Untrusted Data)
## Affected Systems
- **Products:** JFrog Artifactory (Self-Managed)
- **Versions:**
- Versions prior to 7.111.21
- Versions prior to 7.117.28
- Versions prior to 7.125.20
- Versions prior to 7.133.29
- Versions prior to 7.146.38
- Versions prior to 7.161.20
- **Configurations:** Default installations of self-managed Artifactory instances.
## Vulnerability Description
CVE-2026-82329 involves a flaw in how JFrog Artifactory handles serialized data. An attacker can send a specially crafted request containing malicious serialized objects to the Artifactory server. Because the application fails to properly validate the input before deserializing it, an attacker can trigger the execution of arbitrary commands in the context of the Artifactory service account.
## Exploitation
- **Status:** **Exploited in the wild.** Open-source intelligence and the Canadian Centre for Cyber Security (CCCS) confirm active exploitation.
- **Complexity:** Low
- **Attack Vector:** Network (Remote)
## Impact
- **Confidentiality:** High (Full access to stored artifacts, credentials, and secrets)
- **Integrity:** High (Ability to modify or inject malicious code into software artifacts)
- **Availability:** High (Ability to disrupt service or delete data)
## Remediation
### Patches
JFrog has released the following patched versions. Organizations should upgrade to the relevant branch immediately:
- 7.111.21
- 7.117.28
- 7.125.20
- 7.133.29
- 7.146.38
- 7.161.20
### Workarounds
There are no official manual workarounds that replace the need for patching. Restricting network access to the Artifactory management UI and API to trusted IP ranges (VPN/Internal) can reduce the attack surface until patching is complete.
## Detection
- **Indicators of Compromise:** Look for unusual child processes spawning from the Artifactory Java process (e.g., `/bin/sh`, `cmd.exe`, `curl`, or `wget`).
- **Detection methods and tools:**
- Monitor `artifactory-access.log` and `request.log` for anomalous 500 errors or requests to unexpected endpoints from unknown external IPs.
- Utilize YARA rules or EDR signatures tailored for common Java deserialization gadgets (e.g., CommonsCollections).
## References
- **Vendor Advisory:** hxxps[://]docs[.]jfrog[.]com/releases/docs/jfrog-security-advisories
- **Release Notes:** hxxps[://]docs[.]jfrog[.]com/releases/docs/artifactory-self-managed-releases
- **Cyber Centre Alert:** hxxps[://]www[.]cyber[.]gc[.]ca/en/alerts-advisories/jfrog-security-advisory-av26-867