JFrog Artifactory CVE-2026-69104

Exploitation requires a valid authenticated session on the JFrog Artifactory instance with at minimum low-privilege credentials (CVSS PR:L); unauthenticated remote attackers cannot exploit this vulnerability. Network access to the Artifactory API endpoint is required (CVSS AV:N). No special non-default configuration, specific feature flag, or elevated system role is required beyond a basic authenticated account - the missing authorization check is in the migration API itself, not gated behind an optional configuration setting. Exploitation is therefore limited by the authentication barrier alone. What limits real-world risk: the attacker must possess valid credentials for the target Artifactory instance, and the availability impact (rated High) scales with the attacker's ability to trigger migration operations repeatedly or at volume.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H presents a consistent and credible risk picture: network-reachable, low complexity, low-privilege authentication sufficient, no interaction required. The High availability impact is the most operationally significant metric - an attacker who can repeatedly trigger migration operations could degrade or disrupt artifact delivery at scale, which in CI/CD-dependent environments can cascade into build and deployment failures. The confidentiality and integrity impacts are rated Low but are non-trivial: reading artifacts from repositories the user should not access represents a real data boundary violation, and unauthorized migration state changes can silently corrupt repository configurations. EPSS data is absent from the provided intelligence, limiting probabilistic exploitation modeling. The vulnerability is not in CISA KEV and no POC has been identified, which suggests exploitation remains theoretical at this time rather than opportunistic or mass-scale. The CWE-862 class is generally straightforward to exploit once credentials are in hand, meaning the primary barrier is authentication - a barrier that falls quickly under credential stuffing, phishing, or insider threat scenarios. Organizations running Artifactory as their central artifact hub should treat this as a priority patch given the potential for availability impact on delivery pipelines.

An attacker with a low-privileged Artifactory account - obtained via credential phishing, reuse, or an insider - crafts a REST API call to initiate a repository migration targeting a restricted repository. The missing authorization check allows the call to proceed, exposing artifact contents from the target repository and triggering migration state changes that disrupt other users' access to that repository. No public exploit code has been identified, but the attack requires only valid credentials and HTTP access to the Artifactory API, making it executable by any authenticated user familiar with the Artifactory REST API documentation.