JFrog Artifactory CVE-2026-65618

Exploitation requires authenticated access to JFrog Artifactory (PR:L from CVSS), meaning the attacker must have valid user credentials (may be low-privilege). Additionally, the description notes 'under certain conditions', which likely involve Artifactory being configured to handle specific URLs, such as when using remote repository proxies or custom URL handlers. Limiting factors include the need for authentication and possibly non-default configuration; the vulnerability is not exploitable by unauthenticated attackers.

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N indicates a network-accessible vulnerability with low attack complexity but requiring authenticated access (PR:L). There is no EPSS score, no CISA KEV listing, and no public exploit identified, suggesting low immediate exploitation risk. However, SSRF in a central repository manager like Artifactory can be serious if an attacker with valid credentials can pivot to internal services. The high confidentiality impact is offset by the authentication requirement, making this a moderate priority for environments where Artifactory is exposed to many users.

An authenticated attacker with low privileges sends a crafted request to Artifactory that triggers an SSRF to an internal metadata service (e.g., AWS EC2 metadata endpoint). The server then returns the cached response or directly exposes internal service data, leading to information disclosure. While no public exploit is known, the attack is straightforward if the required conditions are met.