EUVD-2026-57252
GHSA-rm3v-36x6-mr48
Severity by source
AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Write access to session store implies PR:H; undisclosed specific conditions justify AC:H; full control of deserialization yields C:H/I:H/A:H within the unchanged scope.
Primary rating from Vendor (JFROG).
CVSS VectorVendor: JFROG
Lifecycle Timeline
3DescriptionCVE.org
A party with write access to stored session data may affect JFrog Artifactory under specific conditions.
AnalysisAI
Unsafe deserialization of stored session data in JFrog Artifactory allows a party with write access to that session store to achieve full confidentiality, integrity, and availability compromise under specific conditions. All versions are affected per the wildcard CPE string, and exploitation requires both high privileges and high attack complexity. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Technical ContextAI
CWE-502 (Deserialization of Untrusted Data) describes a class of vulnerabilities where an application deserializes data from an untrusted or attacker-controlled source without sufficient validation, allowing malicious payloads (gadget chains) to execute arbitrary logic during the deserialization process. In JFrog Artifactory, the affected surface is the stored session data layer - a component responsible for persisting and restoring user session state. The CPE string cpe:2.3:a:jfrog:artifactory:*:*:*:*:*:*:*:* indicates all versions of the Artifactory application are in scope. JFrog Artifactory is a binary repository manager widely deployed in enterprise CI/CD pipelines, making its session infrastructure an attractive target for lateral movement or privilege escalation within DevOps environments.
RemediationAI
Consult the JFrog security advisory at https://docs.jfrog.com/releases/docs/jfrog-security-advisories and the Artifactory self-managed release notes at https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases for the exact patched version, as no specific fix version is confirmed in the available data. As a compensating control pending patching, restrict write access to the session data store to the minimum required service accounts, audit current accounts with that permission level, and consider enabling session storage encryption or integrity validation if supported by your deployment configuration. Additionally, monitor for anomalous deserialization activity or unexpected process spawning from the Artifactory service process. Note that restricting session store access may impact administrative tooling or backup processes that legitimately write to that layer.
More in Artifactory
View allAuthentication bypass in JFrog Artifactory allows an unauthenticated, network-adjacent attacker to escalate to full admi
Privilege escalation in JFrog Artifactory Self-Hosted before 7.133.11 lets a low-privileged authenticated user leverage
JFrog Artifactory exposes an internal anonymous-user token to unauthenticated callers even when anonymous access is expl
Path traversal in JFrog Artifactory (CWE-22) enables an authenticated low-privilege user to write data outside the inten
An issue was discovered in JFrog Artifactory 6.7.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
Low-privileged users can exploit a deserialization flaw in JFrog Artifactory's package handling to potentially execute a
In JFrog Artifactory 5.x and 6.x, insecure FreeMarker template processing leads to remote code execution, e.g., by modif
JFrog Artifactory version since 5.11 contains a Cross ite Request Forgery (CSRF) vulnerability in UI rest endpoints that
Server-side request forgery in JFrog Artifactory Ansible repository handling allows authenticated users with repository
Information disclosure in JFrog Artifactory allows authenticated users with read access to an ordinary repository to ret
JFrog Artifactory before 4.11 allows remote attackers to execute arbitrary code via an LDAP attribute with a crafted ser
Authenticated low-privilege users of JFrog Artifactory can write arbitrary files outside the intended build artifacts lo
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today