What is the CVSS score of CVE-2026-68759?

CVE-2026-68759 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of JFrog Artifactory are affected by CVE-2026-68759?

JFrog Artifactory contains a JWT token handling vulnerability that allows any holder of a valid integration credential-including CI/CD service accounts-to impersonate administrative users and assume…. A patch is available.

How to fix or mitigate CVE-2026-68759?

Within 24 hours, conduct a complete audit of all Artifactory integration credentials and CI/CD service accounts, documenting their privilege levels and current distribution; immediately disable or rotate any credentials that are unnecessary or exceed least-privilege requirements. Within 7 days, implement enhanced logging and alerting on JWT token events and authentication context changes within Artifactory, configure alerts to detect token-based impersonation attempts, and review role-based access control (RBAC) settings to eliminate unnecessary admin-level integrations. Within 30 days, contact JFrog for patch timeline and enterprise support options; if patching is delayed, evaluate air-gapping critical repositories, implementing network segmentation to restrict Artifactory access, and transitioning non-critical integrations to certificate-based authentication where available.

JFrog Artifactory CVE-2026-68759

EUVD-2026-57258 HIGH

Improper Verification of Cryptographic Signature (CWE-347)

2026-08-12 JFROG

GHSA-g827-5jxh-c39h

Information Disclosure Jwt Attack Artifactory Jfrog

7.2

CVSS 3.1 · Vendor: JFROG

Severity by source

Vendor (JFROG) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

6.6 MEDIUM

AC upgraded to H from vendor's AC:L because description explicitly states exploitation requires 'specific conditions'; all other metrics retained as vendor-assessed.

3.1 AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (JFROG).

CVSS VectorVendor: JFROG

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Aug 12, 2026 - 16:02 EUVD

Analysis Generated

Aug 12, 2026 - 16:02 vuln.today

CVE Published

Aug 12, 2026 - 15:15 cve.org

HIGH 7.2

DescriptionCVE.org

A holder of a valid integration credential may impersonate other users under specific conditions.

AnalysisAI

JFrog Artifactory's JWT handling allows a holder of a valid integration credential to impersonate arbitrary users under specific conditions, exploiting an improper cryptographic signature verification flaw (CWE-347). Any actor in possession of a legitimate integration token - such as a CI/CD service account - can craft or manipulate JWT tokens to assume the identity of other users, including privileged ones, gaining their full access to repositories and administrative functions. No public exploit has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog; however, the full C:H/I:H/A:H CVSS impact profile warrants prompt patching in environments where integration credentials are broadly distributed.

Technical ContextAI

JFrog Artifactory (CPE: cpe:2.3:a:jfrog:artifactory:*:*:*:*:*:*:*:*) is an enterprise binary repository manager widely used in CI/CD pipelines. It supports integration credentials - machine-level tokens used by build systems, scanners, and automation tools - which authenticate via JWT (JSON Web Tokens). CWE-347 (Improper Verification of Cryptographic Signature) indicates the server fails to adequately validate the cryptographic integrity of JWT tokens presented by integration credential holders. In a correct implementation, a JWT signed with one identity's private material cannot be accepted as another user's token; however, a flaw in signature verification logic - such as accepting unsigned tokens (the 'alg:none' attack), failing to bind the token to the originating identity, or improperly trusting user-controlled claims - allows token forgery or substitution. The 'JWT Attack' tag in the source intelligence confirms this is the exploit class.

RemediationAI

Consult the JFrog Security Advisories page (https://docs.jfrog.com/releases/docs/jfrog-security-advisories) and the Artifactory self-managed release notes (https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases) to identify the specific fixed release and apply the vendor patch immediately - no exact fix version was provided in available intelligence and cannot be independently confirmed without reviewing those pages. As a compensating control prior to patching, audit and rotate all integration credentials, applying least-privilege scoping so that each service account is bound to a single repository or operation set; this limits the blast radius if a credential is used to impersonate another user. Additionally, enable Artifactory audit logging for authentication events and alert on any access token used from an unexpected IP, user agent, or at an unusual time, as impersonation will produce anomalous access patterns. Restricting integration credential permissions to read-only where write access is not required reduces the integrity and availability impact of exploitation. Note that credential rotation alone does not fix the underlying JWT verification flaw and must be combined with patching.