EUVD-2026-67861
GHSA-c5pf-6p5j-gj87
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Artifactory network endpoint
-
DeliverySend crafted auth-bypass request
-
ExploitObtain administrative session
-
ExecutionAccess artifacts and credentials
-
ImpactTamper with stored builds
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The target must be a JFrog Artifactory instance running under its default configuration and be reachable over the network by the attacker; no valid credentials and no user interaction are required (CVSS PR:N/UI:N/AV:N/AC:L). The primary limiting factor is the 'default configuration' qualifier from the description - deployments that have already been hardened with a non-default authentication setup or an external identity provider may not be exploitable, and network segmentation that prevents the attacker from reaching the Artifactory HTTP/API port also blocks the attack. Exact version boundaries were not provided, so operators should confirm whether their specific release is in scope. |
| Impact | All quantitative signals point to high severity: the CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H yields 9.8, meaning remote, low-complexity, unauthenticated exploitation with total confidentiality, integrity, and availability impact. However the qualitative exploitation signals are currently weaker than the score alone: there is no public exploit identified at time of analysis, the CVE is not in CISA KEV, and no EPSS score was supplied in the input, so probability-of-exploitation cannot be independently quantified. This is a genuine priority because of the low barrier to exploitation and the sensitivity of the asset (supply-chain repository), but the absence of confirmed in-the-wild activity means it is currently a pre-emptive patch rather than an active-incident scenario. No conflicting signals were found - the network vector in CVSS is consistent with the description's 'unauthenticated attacker with network access.' |
| Exploit ScenarioDerived | An attacker who can reach an internet-exposed or internally-reachable Artifactory instance running its default configuration sends crafted requests to the authentication or API layer and is granted administrative access without valid credentials. With admin rights the attacker can read and tamper with stored artifacts, exfiltrate embedded credentials/tokens, or poison build outputs to compromise downstream consumers. No public exploit is identified at time of analysis, but the low attack complexity means weaponization would be straightforward once details are public. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 28, 2026
Authentication bypass in JFrog Artifactory allows an unauthenticated, network-adjacent attacker to escalate to full administrative privileges against default-configuration instances (CWE-287, improper authentication). Because Artifactory is the central binary repository in many CI/CD pipelines, admin takeover exposes stored artifacts, credentials, and build integrity. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the 9.8 CVSS and self-reporting by JFrog mark it as a high-priority patch.
RemediationAI
Upgrade JFrog Artifactory to the fixed release identified on the JFrog security advisories page (https://docs.jfrog.com/releases/docs/jfrog-security-advisories) and the self-managed releases page (https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases); the exact patched version number was not provided in the available data and must be read directly from those advisories before deploying. Until patched, reduce exposure by restricting network reachability of the Artifactory web/API endpoints to trusted management networks or behind a VPN/reverse proxy with its own authentication, which limits the unauthenticated network vector at the cost of breaking any external agents or clients that need direct access; also review whether the default configuration referenced in the advisory can be hardened (for example enforcing stricter access-control or an external authentication provider) per JFrog guidance, and audit admin accounts and access tokens for signs of misuse. Do not rely on these controls as a substitute for the vendor patch.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JFrog Artifactory is a universal artifact repository manager used to store, proxy, and distribute build packages (Maven, npm, Docker, PyPI, etc.) across development pipelines. The affected component per CPE is cpe:2.3:a:jfrog:artifactory across all listed versions. The root cause maps to CWE-287 (Improper Authentication): a weakness in how the application validates identity permits an actor to be treated as an authenticated administrator without presenting valid credentials. In practice such weaknesses stem from flawed session/token validation, default trust of certain request headers, or a logic gap in the login/authorization flow rather than a memory-safety bug.
Know when Artifactory gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description confirms remote unauthenticated network access with no user interaction under default config, and admin takeover implies full C/I/A loss, so all metrics stay at maximum.
Primary rating from Vendor (JFROG).
CVSS VectorVendor: JFROG
Lifecycle Timeline
3DescriptionCVE.org
JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges.
Articles & Coverage 1
Technical POC Analysis
The supplied evidence does not contain a vulnerable function name, file path, or patch diff.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Latest POC
2 public PoC links from github, nuclei
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
JFrog Artifactory instances are vulnerable to unauthenticated administrative account takeover, exposing organizations' central software repository, embedded credentials, and build pipeline integrity to complete compromise. For enterprises using Artifactory as the backbone of CI/CD pipelines, this represents a direct path to supply chain attack capable of poisoning all downstream software deployments and customer deliverables.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) implement network-level access controls restricting Artifactory access to authorized IP ranges and authenticated users; (2) enable comprehensive audit logging and monitor for unauthorized admin account creation or privilege escalation; (3) rotate all credentials embedded in artifacts and used by CI/CD systems to access Artifactory; (4) implement Web Application Firewall rules to block exploitation attempts; (5) establish daily integrity validation of critical artifacts.
Threat Model
4 threats: Elevation of Privilege, Information Disclosure, Tampering and 1 more
5-step attack chain with trust boundaries and controls
Full threat model - attack chain, trust boundaries, controls per stage and evidence - is part of the Pro and Business plans.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Artifactory
View allPrivilege escalation in JFrog Artifactory Self-Hosted before 7.133.11 lets a low-privileged authenticated user leverage
JFrog Artifactory exposes an internal anonymous-user token to unauthenticated callers even when anonymous access is expl
Path traversal in JFrog Artifactory (CWE-22) enables an authenticated low-privilege user to write data outside the inten
An issue was discovered in JFrog Artifactory 6.7.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
Low-privileged users can exploit a deserialization flaw in JFrog Artifactory's package handling to potentially execute a
In JFrog Artifactory 5.x and 6.x, insecure FreeMarker template processing leads to remote code execution, e.g., by modif
JFrog Artifactory version since 5.11 contains a Cross ite Request Forgery (CSRF) vulnerability in UI rest endpoints that
Server-side request forgery in JFrog Artifactory Ansible repository handling allows authenticated users with repository
Information disclosure in JFrog Artifactory allows authenticated users with read access to an ordinary repository to ret
JFrog Artifactory before 4.11 allows remote attackers to execute arbitrary code via an LDAP attribute with a crafted ser
Authenticated low-privilege users of JFrog Artifactory can write arbitrary files outside the intended build artifacts lo
Cache metadata poisoning in JFrog Artifactory enables a low-privileged authenticated user to corrupt cached artifact met
Exploit-DB