59
CVEs
4
Critical
21
High
4
KEV
12
PoC
4
Unpatched C/H
83.1%
Patch Rate
1.5%
Avg EPSS
Severity Breakdown
CRITICAL
4
HIGH
21
MEDIUM
32
LOW
2
Monthly CVE Trend
Affected Products (4)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-82329 | Authentication bypass in JFrog Artifactory allows an unauthenticated, network-adjacent attacker to escalate to full administrative privileges against default-configuration instances (CWE-287, improper authentication). Because Artifactory is the central binary repository in many CI/CD pipelines, admin takeover exposes stored artifacts, credentials, and build integrity. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the 9.8 CVSS and self-reporting by JFrog mark it as a high-priority patch. | CRITICAL | 9.8 | 0.4% | 119 |
KEV
PoC
|
| CVE-2026-42016 | Privilege escalation in JFrog Artifactory Self-Hosted before 7.133.11 lets a low-privileged authenticated user leverage a valid token beyond its intended permissions, because the platform validates the token's signature and issuer but never enforces the token's scope. An attacker holding any legitimately issued token can therefore access resources or perform actions the token was never authorized for, yielding high confidentiality, integrity, and availability impact. This was reported by JFrog and there is no public exploit identified at time of analysis (EPSS 0.21%, percentile 11%). | HIGH | 8.8 | 0.2% | 114 |
KEV
PoC
|
| CVE-2026-42018 | JFrog Artifactory exposes an internal anonymous-user token to unauthenticated callers even when anonymous access is explicitly disabled. Any network-reachable attacker can obtain this token and use it to access resources that should be protected behind authentication controls. No public exploit has been identified at time of analysis, but the low attack complexity and zero authentication requirement make this a straightforward information-disclosure path against misconfigured or unpatched Artifactory instances. | HIGH | 7.5 | 0.3% | 108 |
KEV
PoC
|
| CVE-2026-66384 | Path traversal in JFrog Artifactory (CWE-22) enables an authenticated low-privilege user to write data outside the intended Docker cache directory when specific remote-repository conditions are present. The CVSS 3.1 vector scores 5.3 Medium, reflecting a real but constrained integrity risk - arbitrary filesystem writes are possible, but high attack complexity and required authentication limit opportunistic abuse. No active exploitation or public exploit code has been identified at time of analysis. | MEDIUM | 5.3 | 0.3% | 97 |
KEV
PoC
|
| CVE-2019-9733 | An issue was discovered in JFrog Artifactory 6.7.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 53.9% | 69 |
PoC
No patch
|
| CVE-2026-65617 | Low-privileged users can exploit a deserialization flaw in JFrog Artifactory's package handling to potentially execute arbitrary code, compromising system confidentiality, integrity, and availability. The vulnerability is triggered under specific repository conditions. At time of analysis, no public exploit or active exploitation has been confirmed. | HIGH | 8.8 | 0.3% | 64 |
PoC
|
| CVE-2018-1000206 | JFrog Artifactory version since 5.11 contains a Cross ite Request Forgery (CSRF) vulnerability in UI rest endpoints that can result in Classic CSRF attack allowing an attacker to perform actions as. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available. | HIGH | 8.8 | 0.8% | 64 |
PoC
|
| CVE-2020-7931 | In JFrog Artifactory 5.x and 6.x, insecure FreeMarker template processing leads to remote code execution, e.g., by modifying a .ssh/authorized_keys file. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.8 | 5.5% | 64 |
PoC
No patch
|
| CVE-2026-65923 | Server-side request forgery in JFrog Artifactory Ansible repository handling allows authenticated users with repository access to trigger unintended server-side requests, leading to unauthorized access to internal resources and data manipulation. The flaw resides in URL validation and primarily impacts confidentiality and integrity; vendor-provided fixed versions address the issue. No active exploitation or public exploit code is known at this time. | MEDIUM | 6.8 | 0.2% | 54 |
PoC
|
| CVE-2026-66018 | Information disclosure in JFrog Artifactory allows authenticated users with read access to an ordinary repository to retrieve protected build environment secrets by manipulating repository parameters, exposing sensitive configuration data with high confidentiality impact. No integrity or availability impact is reported, and no active exploitation or public exploit code has been identified at this time. JFrog has published advisories but patch version details are not specified in the CVE record. | MEDIUM | 6.5 | 0.2% | 53 |
PoC
|
| CVE-2016-6501 | JFrog Artifactory before 4.11 allows remote attackers to execute arbitrary code via an LDAP attribute with a crafted serialized Java object, aka LDAP entry poisoning. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.8 | 1.7% | 51 |
No patch
|
| CVE-2026-66014 | Privilege escalation in JFrog Artifactory stems from an authentication handling weakness in how the platform processes internal requests, allowing an attacker to gain access beyond their intended permission level under specific conditions. The flaw affects multiple self-managed release lines (7.117.x, 7.125.x, 7.133.x, 7.146.x, 7.161.x, and all releases prior to 7.111.18) and carries a vendor CVSS of 9.8. No public exploit identified at time of analysis, and EPSS remains low at 0.32% (24th percentile), while CISA SSVC currently marks exploitation as none but technical impact as total. | CRITICAL | 9.8 | 0.3% | 49 |
|
| CVE-2026-65921 | Authenticated low-privilege users of JFrog Artifactory can write arbitrary files outside the intended build artifacts location via a path traversal flaw in archive extraction. The vulnerability allows an attacker who has already obtained limited access to the application to overwrite critical files, potentially escalating to remote code execution. No public exploit or active exploitation has been identified at time of analysis, but the high CVSS score reflects the severe impact if leveraged. | HIGH | 8.8 | 0.4% | 44 |
|
| CVE-2026-69106 | Cache metadata poisoning in JFrog Artifactory enables a low-privileged authenticated user to corrupt cached artifact metadata entries, causing downstream consumers - including CI/CD pipelines and development toolchains - to silently retrieve untrusted or attacker-influenced content. All versions of Artifactory are listed as affected per the CPE wildcard, making this a broad supply chain integrity concern for organizations relying on Artifactory as a central repository manager. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis, though the high CVSS score of 8.8 and network-accessible attack vector warrant prompt patching. | HIGH | 8.8 | 0.3% | 44 |
|
| CVE-2026-42017 | Exposure of privileged authorization material in JFrog Artifactory allows an authenticated low-privileged user to obtain tokens or credentials, leading to full compromise of the instance. The flaw stems from an event-handling weakness and can be triggered under specific, undisclosed conditions. No public exploit or active exploitation has been reported. | HIGH | 8.8 | 0.3% | 44 |
|