Software Supply Chains Have an Address: Mapping Exposed Artifact Repositories with ZoomEye

The JFrog Artifactory authentication bypass disclosed in August 2026 was rated CVSS 9.8 and exploited within four days. Whether that matters to a specific organization depends on a question that is answerable with measurement: is the repository reachable?

The queries

Two queries describe the Artifactory footprint from different angles.

app="JFrog Artifactory"

On the combined dataset, this returned 17,884 records. Restricted to the web dataset, which covers websites and domains, the same fingerprint returned 1,150 records.
A free-text search for JFrog Artifactory across all data types returned 13,010 records.
The three figures differ because they measure different things. The combined fingerprint count includes IPv4 services and web properties that present an identifiable Artifactory interface. The web-only count is smaller because it excludes non-HTTP services. The free-text count depends on string matching rather than fingerprinting.
For exposure assessment, the fingerprint query on the combined dataset is the most complete starting point.

Where the exposure sits

Adding a country facet to the fingerprint query returns a distribution that is worth reading carefully.
| Country | Records |
|---|---|
| United States | 8,237 |
| Germany | 2,097 |
| China | 1,543 |
| Ireland | 980 |
| India | 527 |
| United Kingdom | 512 |
| The Netherlands | 477 |
| France | 466 |
| Singapore | 334 |
| Russia | 296 |
The United States accounts for just under half of the identified footprint. Ireland's position at fourth is notable and consistent with the concentration of cloud and software infrastructure hosted there.
These are observed services, not confirmed vulnerable instances. A fingerprint identifies the product; it does not report the version. Version confirmation requires a separate step, and the count should never be presented as a count of vulnerable systems.

Why repository exposure is different

Most exposure discussions treat internet-facing services as a uniform category. Artifact repositories do not fit that model neatly.
A repository's purpose is to serve packages to build systems. In many organizations, that traffic originates from CI runners in cloud networks, which means the repository is reachable from outside the corporate perimeter by design. Locking it down completely is not an option; the build pipeline depends on it.
That constraint is exactly why the authentication bypass was severe. The vulnerable interface could not simply be firewalled off, because the same service legitimately accepts connections from build infrastructure. The fix had to be a patch, and the interim risk had to be managed through network policy that distinguishes build traffic from everything else.

A measurement-driven workflow

1. Establish the footprint. Run the fingerprint query to see whether Artifactory instances appear in internet-facing data at all.
2. Add facets. Country, organization, and port facets narrow the population to the ones relevant to your environment.
3. Reconcile with inventory. Compare the observed footprint against your own asset records. Instances that appear in the measurement but not in inventory are the priority.
4. Check versions separately. A fingerprint does not reveal whether an instance runs a fixed build. Version confirmation requires authenticated access or a different detection method.
5. Re-measure after remediation. Confirm the exposure changed.

Reading the number honestly

17,884 Artifactory instances visible to a cyberspace search engine is a large number, and it is easy to overstate what it means. It does not mean 17,884 vulnerable systems. It means that roughly that many services present an identifiable Artifactory interface on the public internet, and that the population is large enough that the August 2026 flaw had a substantial pool of potential targets.
That is a defensible conclusion, and it is the one the data supports. Stating anything more would go beyond what the measurement shows.

References

• ZoomEye, fingerprint query app="JFrog Artifactory", combined dataset, collected 2026-09-20. Total: 17,884 records, with country facet distribution.
• ZoomEye, fingerprint query app="JFrog Artifactory", web dataset, collected 2026-09-20. Total: 1,150 records.
• ZoomEye, free-text query JFrog Artifactory, combined dataset, collected 2026-09-20. Total: 13,010 records.
• NVD, CVE-2026-82329. https://nvd.nist.gov/vuln/detail/CVE-2026-82329
• CISA, Known Exploited Vulnerabilities Catalog, additions dated September 2, 2026. https://www.cisa.gov/known-exploited-vulnerabilities-catalog