EUVD-2026-57252
GHSA-rm3v-36x6-mr48
Severity by source
AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Write access to session store implies PR:H; undisclosed specific conditions justify AC:H; full control of deserialization yields C:H/I:H/A:H within the unchanged scope.
Primary rating from Vendor (JFROG).
CVSS VectorVendor: JFROG
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
A party with write access to stored session data may affect JFrog Artifactory under specific conditions.
AnalysisAI
Unsafe deserialization of stored session data in JFrog Artifactory allows a party with write access to that session store to achieve full confidentiality, integrity, and availability compromise under specific conditions. All versions are affected per the wildcard CPE string, and exploitation requires both high privileges and high attack complexity. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the attacker hold write access to the Artifactory session data store - this is the explicit gating condition stated in the description and reflected in PR:H. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H yields a base score of 6.6, which is a moderate-to-high rating whose real-world urgency is substantially qualified by its prerequisites. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has already obtained high-privileged access to the Artifactory session store - via a compromised admin account, a misconfigured storage backend, or insider access - crafts a malicious serialized Java object payload using a known gadget chain and writes it into the session data. When Artifactory deserializes this session object (e.g., during session restoration for an active user), the gadget chain executes arbitrary code in the Artifactory server process context, potentially achieving full system compromise. … |
| Remediation | Consult the JFrog security advisory at https://docs.jfrog.com/releases/docs/jfrog-security-advisories and the Artifactory self-managed release notes at https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases for the exact patched version, as no specific fix version is confirmed in the available data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Artifactory
View allAn issue was discovered in JFrog Artifactory 6.7.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
Low-privileged users can exploit a deserialization flaw in JFrog Artifactory's package handling to potentially execute a
In JFrog Artifactory 5.x and 6.x, insecure FreeMarker template processing leads to remote code execution, e.g., by modif
JFrog Artifactory version since 5.11 contains a Cross ite Request Forgery (CSRF) vulnerability in UI rest endpoints that
Server-side request forgery in JFrog Artifactory Ansible repository handling allows authenticated users with repository
Information disclosure in JFrog Artifactory allows authenticated users with read access to an ordinary repository to ret
JFrog Artifactory before 4.11 allows remote attackers to execute arbitrary code via an LDAP attribute with a crafted ser
Privilege escalation in JFrog Artifactory stems from an authentication handling weakness in how the platform processes i
Authenticated low-privilege users of JFrog Artifactory can write arbitrary files outside the intended build artifacts lo
Cache metadata poisoning in JFrog Artifactory enables a low-privileged authenticated user to corrupt cached artifact met
Exposure of privileged authorization material in JFrog Artifactory allows an authenticated low-privileged user to obtain
Privilege escalation in JFrog Artifactory Self-Hosted before 7.133.11 lets a low-privileged authenticated user leverage
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today