17,881 Artifactory Instances Are Observable Online: Turning the CVE-2026-82329 KEV Deadline into a Checkable Query

In early September 2026, CISA added JFrog Artifactory CVE-2026-82329, an authentication bypass in self-hosted instances before 7.161.20, to its Known Exploited Vulnerabilities catalog with a September 5 federal deadline, after watchTowr reported exploitation attempts on September 1. The flaw's mechanism is unusual: instances joined with the default empty join key can be made to issue admin tokens to an attacker. A supply-chain repository holding build artifacts and dependencies is close to the worst place for such a flaw, because code execution there can be laundered into software updates.
The practical question for most teams is simpler than the exploitation details: do we run Artifactory, and is any instance reachable from the internet? This article shows how an internet measurement query turns that question into a checkable answer, and what the observed count does and does not tell you.

Context and Method

Counts come from a ZoomEye search on September 18, 2026, using the all sub-type. Three candidate queries were tested:

| Dork | Role | Total |

| --- | --- | --- |

| app="JFrog Artifactory" | Product fingerprint | 17,881 |

| title="Artifactory" | Title match | 401 |

| product="Artifactory" | Component field | 1,526 |

The product fingerprint is the largest and the most specific: it identifies assets whose services were fingerprinted as the Artifactory application. The title count is smaller because some instances do not expose a title containing the product name. The product field sits between them. A defender should treat the fingerprint as the primary count and the others as cross-checks.

Analysis: Reading the 17,881

The 17,881 figure is an observation, not an indictment. Three boundaries matter.
First, exposure is not vulnerability. The KEV entry covers self-hosted instances below 7.161.20. A fingerprint record does not include the running version, so the count describes how many instances are observable, not how many are exploitable. Some of the 17,881 will be current builds behind authentication, and some will be older builds whose join-key behavior makes them directly abusable.
Second, observability is bounded. ZoomEye observes a sample of the internet, and an Artifactory instance that is reachable only from an internal network or behind a VPN does not appear. The real number of internet-facing instances is at least the observed count and very likely higher.
Third, the count is a floor for attacker attention. Public exploitation activity was reported in September 2026, and attackers reuse the same measurement services defenders do. An instance that is observable to ZoomEye is observable to anyone running the same query.
What the number does support is prioritization. An organization that runs Artifactory internally has a bounded task: enumerate the instances, check versions against 7.161.20, and confirm that none are internet-reachable. The fingerprint query is the same one an attacker would run, so running it first is cheap defense.

Implications for Defenders

• Run the fingerprint query against your own IP ranges and cloud accounts. Any returned record is an internet-facing Artifactory instance that needs a version check against 7.161.20.
• Treat an instance below 7.161.20 as exposed to the published bypass regardless of whether the default join key was changed, and verify the join-key configuration explicitly.
• Do not extrapolate exploitability from the 17,881 count. Version and configuration determine risk; the count only proves reachability of the surface.
• Supply-chain repositories deserve the same perimeter review as VPN gateways. An authentication bypass in a build-artifact store has a longer blast radius than its CVSS suggests.

ZoomEye's role in this incident is straightforward: it converts an advisory into a query that produces a count, a link, and a concrete perimeter check. The alternative, waiting for an internal CMDB to confirm whether Artifactory exists anywhere in the estate, is slower and less reliable than running the same dork the attackers run.

References

• CISA Known Exploited Vulnerabilities catalog update, September 2, 2026. https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• watchTowr reporting on CVE-2026-82329 exploitation attempts, September 1, 2026. https://www.ithome.com.tw/news/178650
• KEV addition coverage including CVE-2026-82329, CVE-2026-83548, and CVE-2026-83549. https://www.ithome.com.tw/news/178657
• 2026-09-05 daily intelligence report summarizing the JFrog Artifactory default join-key bypass (CVE-2026-82329, CVSS 9.8). https://blog.csdn.net/weixin_45635831/article/details/164379461