CISA added CVE-2026-82329 to the KEV catalog on September 2, 2026 with a September 5 due date — five days earlier than the deadline on an Artifactory CVE listed a week before it, whose fixed build sits inside the new one’s affected range.
What happened
On September 1, 2026 this site reported that JFrog Artifactory’s unauthenticated administrative bypass, CVE-2026-82329, was being exploited on a single firm’s say-so and was not in the KEV catalog. Both halves of that have changed.
The NVD record now carries CISA’s fields: cisaExploitAdd of 2026-09-02, cisaActionDue of 2026-09-05, and a cisaVulnerabilityName of “JFrog Artifactory Improper Authentication Vulnerability.” The record’s status moved to Analyzed, NVD attached CPE ranges to it, and it was last modified at 1:06 p.m. UTC on September 3, 2026. The CVE Program record’s CISA-ADP block, updated September 2, carries SSVC values of Exploitation: active, Automatable: yes, and Technical Impact: total, at SSVC version 2.0.3.
That is the government confirming exploitation. Until September 2 the only public claim was watchTowr’s, made on September 1, that it was “already seeing exploitation of the JFrog Artifactory Auth Bypass (CVE-2026-82329), with attackers minting themselves admin tokens.” JFrog has still published no in-the-wild statement of its own; the vendor advisory description remains the single sentence it was on August 28: “JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges.” CVSS 3.1 base score 9.8, CWE-287, scored by JFrog as its own CNA. NVD has not added a primary score of its own.
The federal deadline is Saturday, September 5, 2026. Three days from listing.
The two deadlines are now in the wrong order
Artifactory already had a KEV entry. CVE-2026-66384 — “An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions,” CWE-22, CVSS 3.1 base score 5.3, again scored by JFrog — was added to the catalog on August 27, 2026 with a cisaActionDue of 2026-09-10.
So the medium-severity path traversal, listed first, is due last. The critical unauthenticated bypass, listed six days later, is due five days sooner. Nothing about that is an error. BOD 26-04 derives deadlines from internet exposure, KEV listing, exploit automation, and technical impact rather than from listing order, and a flaw CISA marks as actively exploited, automatable, and total in impact lands in a shorter band than one requiring authentication and specific repository conditions. But an agency working a queue sorted by date added is working it in the wrong order, and the compliance artifact will not say so.
The version numbers make it worse than a scheduling nuisance. JFrog fixed CVE-2026-66384 in 7.146.35 and 7.161.16. It fixed CVE-2026-82329 in 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, and 7.161.20. NVD’s CPE ranges for the newer CVE now encode that: 7.146.0 to below 7.146.38, and 7.161.0 to below 7.161.20. So 7.146.35 and 7.146.36 and 7.146.37 are all inside the affected range of the September 5 vulnerability. An administrator who upgrades to 7.146.35 to satisfy the September 10 deadline has moved onto a build that is unauthenticated-admin-bypassable, and has done it four days after the deadline for the flaw that makes it so.
This site flagged that gap on September 1, when it was a severity argument. It is now a conflict between two federal deadlines on the same product.
Why it matters
There is a second, quieter problem in how the two records model versions, and it decides what “patched” means for anyone not on the newest branch.
NVD gives CVE-2026-82329 six per-branch ranges, one for each supported release line. It gives CVE-2026-66384 something different: a single open-ended range with no lower bound, everything below 7.146.35, plus 7.161.0 to below 7.161.16. Read literally, that says an Artifactory instance on 7.133.29 — a build JFrog names as fixed for the critical bypass — is still affected by the older path traversal, because 7.133.29 is less than 7.146.35. And it is not obviously wrong: JFrog shipped the 66384 fix on two branches only. There is no 7.133 build that closes it.
Put the two together and the arithmetic has exactly one answer. An organization on the 7.133 line cannot satisfy both KEV entries on its own branch at all. It has to move to 7.146, and if it moves to 7.146.35 it lands inside the range of the CVE due first. 7.146.38 and 7.161.20 are the only builds that clear both deadlines. Every other combination leaves one of the two open, and a vulnerability scanner keyed to CPE will report it honestly if you ask it about both CVEs and misleadingly if you ask it about either one.
This is the second time in six days that Artifactory has produced this shape, and it is worth naming as a general test rather than a JFrog complaint. A product that supports six release branches concurrently will, sooner or later, ship two advisories days apart whose fix levels differ on the same branch. When the older advisory is the one that reaches the KEV catalog first, its named fix version becomes a remediation target that was already superseded. The check is mechanical: whenever a KEV entry names a fixed version, look for any later advisory against the same branch before you set that version as the target. Ivanti, Fortinet, and Citrix all ship parallel branches and are all capable of the same thing.
One more thing worth watching on this record. JFrog’s own CNA data lists the lowest affected range as version 0 up to 7.111.21 — everything below that build, with no floor. NVD’s CPE for the same branch starts at 7.111.4. That narrowing is NVD’s transcription, not a JFrog statement, and it excludes older 7.111 builds that the vendor’s own record describes as affected. If you are on a 7.111 build below 7.111.4, trust the vendor record over the CPE.
What to do
- Upgrade to 7.146.38 or 7.161.20. These are the only builds that satisfy both KEV entries. 7.111.21, 7.117.28, 7.125.20, and 7.133.29 close CVE-2026-82329 but leave CVE-2026-66384 open per NVD’s range for it.
- Federal agencies: CVE-2026-82329 is due Saturday, September 5, 2026, and its required action pairs remediation with CISA’s forensic triage obligation. CVE-2026-66384 is due September 10. Work them in deadline order, not listing order.
- Do not treat 7.146.35 or 7.161.16 as a remediation target. Both are inside the affected range of the September 5 CVE.
- Configure a join key. watchTowr’s account of the mechanism is that instances without an additional join key configured receive a “phantom” join key an attacker can use to forge access. That is one firm’s description of the bug, not JFrog’s, and JFrog’s advisory names no workaround — but it is the only mitigation description in public.
- Assume compromise on any internet-reachable instance that was unpatched after August 28. Look for administrator tokens you did not create, then for enumeration of users, groups, credential sets, and federated access topologies — the post-exploitation behavior watchTowr described.
Sourcing note
The KEV fields, CVSS scores, CWE, status, and CPE ranges for both CVEs were read from the NVD API records (CVE-2026-82329 lastModified 2026-09-03T13:06:15.630; CVE-2026-66384 lastModified 2026-08-28T12:21:47.053). The CNA record for CVE-2026-82329 was read from the CVE Program API — assigner JFROG, updated September 2, 2026, with the CISA-ADP SSVC block quoted above. cisa.gov returns HTTP 403 to automated fetching from this container, so the catalog page and the September 2 alert were not read directly; CISA’s fields come from NIST’s republication of them in NVD.
The exploitation mechanism and the post-exploitation description are watchTowr’s, published September 1, 2026, and remain single-sourced. What is new since our September 1 story is that CISA has independently listed the CVE as exploited and attached the ADP values; that is corroboration of the fact of exploitation, not of watchTowr’s account of how it works. JFrog has not published an in-the-wild statement and did not respond to press inquiries reported on September 1.
Unresolved: whether JFrog intends to backport the CVE-2026-66384 fix to branches below 7.146, which would give 7.111, 7.117, 7.125, and 7.133 users a way to clear both deadlines without a branch move. Its advisory names no such build. Also unresolved, and carried over from our September 1 story: JFrog’s advisory notation for affected ranges does not state whether the right-hand build is inclusive, so 7.146.36 and 7.146.37 are described by the vendor as neither affected nor fixed. NVD resolves it conservatively. Act on NVD’s reading.