JFrog Artifactory EUVD-2026-65518

The attacker must hold a valid Artifactory account with at minimum read-level permissions on at least one existing remote VCS repository - this is the critical gate. The VCS repository integration feature must be in use (remote VCS repositories must be configured in the Artifactory instance). Exploitation does not require administrator access, does not require a specific non-default configuration beyond having at least one remote VCS repository present, and does not require user interaction. What limits exploitation: (1) requires a valid authenticated session with PR:L - anonymous or unauthenticated users cannot exploit this; (2) SSRF blast radius is bounded by the network reach of the Artifactory server process - if Artifactory runs in a network segment isolated from sensitive internal services, impact is reduced; (3) exfiltrated data depends on what internal services are reachable from the Artifactory host.

The CVSS 8.5 base score is driven primarily by network vector (AV:N), low complexity (AC:L), low privilege requirement (PR:L), no user interaction (UI:N), a scope change (S:C), and high confidentiality impact (C:H). These signals indicate a serious but not unauthenticated vulnerability - an attacker must hold at least a low-privilege Artifactory account with read access to at least one remote VCS repository. The scope change is the most significant risk amplifier: a successful SSRF can pivot the Artifactory server to probe or exfiltrate data from internal services (e.g., AWS/GCP/Azure instance metadata at 169.254.169.254, internal APIs, or adjacent microservices) that would otherwise be unreachable from the internet. No EPSS score was provided in the input data. No CISA KEV listing is present, and no public exploit code has been identified at time of analysis. Despite the absence of active exploitation indicators, the low attack complexity and low privilege bar make this a realistic lateral-movement enabler in environments where Artifactory servers are co-located with sensitive internal services. Organizations with Artifactory exposed to broad internal user bases or federated identity systems should treat this as a high-priority item.

An attacker holding a low-privilege Artifactory account (e.g., a developer with read access to a shared remote VCS repository) modifies the repository's configured origin URL to target an internal cloud metadata service such as http://169.254.169.254/latest/meta-data/ or an internal administrative API. When Artifactory resolves the VCS repository, it fetches the attacker-supplied URL server-side, and the response - potentially containing IAM credentials, internal tokens, or sensitive service data - can be harvested by the attacker. No public POC code has been identified, but the attack pattern is well-understood for SSRF class vulnerabilities.