Jfrog

CVE	Summary	Severity	CVSS	EPSS	Priority	Signals
CVE-2026-82329	Authentication bypass in JFrog Artifactory allows an unauthenticated, network-adjacent attacker to escalate to full administrative privileges against default-configuration instances (CWE-287, improper authentication). Because Artifactory is the central binary repository in many CI/CD pipelines, admin takeover exposes stored artifacts, credentials, and build integrity. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the 9.8 CVSS and self-reporting by JFrog mark it as a high-priority patch.	CRITICAL	9.8	0.4%	119	KEV PoC
CVE-2026-42016	Privilege escalation in JFrog Artifactory Self-Hosted before 7.133.11 lets a low-privileged authenticated user leverage a valid token beyond its intended permissions, because the platform validates the token's signature and issuer but never enforces the token's scope. An attacker holding any legitimately issued token can therefore access resources or perform actions the token was never authorized for, yielding high confidentiality, integrity, and availability impact. This was reported by JFrog and there is no public exploit identified at time of analysis (EPSS 0.21%, percentile 11%).	HIGH	8.8	0.2%	114	KEV PoC
CVE-2026-42018	JFrog Artifactory exposes an internal anonymous-user token to unauthenticated callers even when anonymous access is explicitly disabled. Any network-reachable attacker can obtain this token and use it to access resources that should be protected behind authentication controls. No public exploit has been identified at time of analysis, but the low attack complexity and zero authentication requirement make this a straightforward information-disclosure path against misconfigured or unpatched Artifactory instances.	HIGH	7.5	0.3%	108	KEV PoC
CVE-2026-66384	Path traversal in JFrog Artifactory (CWE-22) enables an authenticated low-privilege user to write data outside the intended Docker cache directory when specific remote-repository conditions are present. The CVSS 3.1 vector scores 5.3 Medium, reflecting a real but constrained integrity risk - arbitrary filesystem writes are possible, but high attack complexity and required authentication limit opportunistic abuse. No active exploitation or public exploit code has been identified at time of analysis.	MEDIUM	5.3	0.3%	97	KEV PoC
CVE-2026-65617	Low-privileged users can exploit a deserialization flaw in JFrog Artifactory's package handling to potentially execute arbitrary code, compromising system confidentiality, integrity, and availability. The vulnerability is triggered under specific repository conditions. At time of analysis, no public exploit or active exploitation has been confirmed.	HIGH	8.8	0.3%	64	PoC
CVE-2026-65923	Server-side request forgery in JFrog Artifactory Ansible repository handling allows authenticated users with repository access to trigger unintended server-side requests, leading to unauthorized access to internal resources and data manipulation. The flaw resides in URL validation and primarily impacts confidentiality and integrity; vendor-provided fixed versions address the issue. No active exploitation or public exploit code is known at this time.	MEDIUM	6.8	0.2%	54	PoC
CVE-2026-66018	Information disclosure in JFrog Artifactory allows authenticated users with read access to an ordinary repository to retrieve protected build environment secrets by manipulating repository parameters, exposing sensitive configuration data with high confidentiality impact. No integrity or availability impact is reported, and no active exploitation or public exploit code has been identified at this time. JFrog has published advisories but patch version details are not specified in the CVE record.	MEDIUM	6.5	0.2%	53	PoC
CVE-2026-66014	Privilege escalation in JFrog Artifactory stems from an authentication handling weakness in how the platform processes internal requests, allowing an attacker to gain access beyond their intended permission level under specific conditions. The flaw affects multiple self-managed release lines (7.117.x, 7.125.x, 7.133.x, 7.146.x, 7.161.x, and all releases prior to 7.111.18) and carries a vendor CVSS of 9.8. No public exploit identified at time of analysis, and EPSS remains low at 0.32% (24th percentile), while CISA SSVC currently marks exploitation as none but technical impact as total.	CRITICAL	9.8	0.3%	49
CVE-2026-65921	Authenticated low-privilege users of JFrog Artifactory can write arbitrary files outside the intended build artifacts location via a path traversal flaw in archive extraction. The vulnerability allows an attacker who has already obtained limited access to the application to overwrite critical files, potentially escalating to remote code execution. No public exploit or active exploitation has been identified at time of analysis, but the high CVSS score reflects the severe impact if leveraged.	HIGH	8.8	0.4%	44
CVE-2026-69106	Cache metadata poisoning in JFrog Artifactory enables a low-privileged authenticated user to corrupt cached artifact metadata entries, causing downstream consumers - including CI/CD pipelines and development toolchains - to silently retrieve untrusted or attacker-influenced content. All versions of Artifactory are listed as affected per the CPE wildcard, making this a broad supply chain integrity concern for organizations relying on Artifactory as a central repository manager. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis, though the high CVSS score of 8.8 and network-accessible attack vector warrant prompt patching.	HIGH	8.8	0.3%	44
CVE-2026-42017	Exposure of privileged authorization material in JFrog Artifactory allows an authenticated low-privileged user to obtain tokens or credentials, leading to full compromise of the instance. The flaw stems from an event-handling weakness and can be triggered under specific, undisclosed conditions. No public exploit or active exploitation has been reported.	HIGH	8.8	0.3%	44
CVE-2026-65616	Privilege escalation in JFrog Artifactory allows low-privileged authenticated users to forge administrator JWTs by exploiting missing signature validation on refresh tokens. An attacker with any user account can gain full admin control, rated CVSS 8.8. No active exploitation or public exploit is confirmed at this time.	HIGH	8.8	0.2%	44
CVE-2026-70551	Server-Side Request Forgery (SSRF) in JFrog Artifactory allows a low-privileged authenticated user with read access to a remote VCS repository to replace the repository's configured origin URL or supply an arbitrary absolute VCS data URL, causing Artifactory's server process to issue outbound HTTP requests to attacker-controlled destinations - including internal network services, cloud metadata endpoints, or other infrastructure inaccessible from the public internet. The scope-changed CVSS vector (S:C) confirms the impact extends beyond Artifactory itself to systems on its internal network segment. No public exploit identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.	HIGH	8.5	0.2%	43
CVE-2026-66375	Permanent deletion of protected internal metadata across repositories in JFrog Artifactory is possible by any low-privilege authenticated user under specific, undisclosed conditions. The flaw stems from CWE-862 (Missing Authorization), where the platform fails to enforce access controls on a metadata-deletion pathway that should be restricted to privileged roles. With a CVSS score of 8.1 (High), this represents a significant integrity and availability risk - an attacker with only a standard user account can irreversibly destroy protected repository metadata, with no confidentiality exposure. No public exploit code and no CISA KEV listing have been identified at time of analysis.	HIGH	8.1	0.3%	41
CVE-2026-69105	Cache poisoning in JFrog Artifactory 7.161.0-7.161.15 allows unauthenticated remote attackers to inject untrusted package content into the artifact cache under specific triggering conditions, compromising artifact integrity (I:H) and availability (A:H) with no confidentiality exposure. The vulnerability is rooted in CWE-345 (Insufficient Verification of Data Authenticity), meaning Artifactory fails to validate the authenticity of content before caching it from upstream remote repositories. No public exploit has been identified at time of analysis, and the CVSS UI:R component indicates some victim interaction is required, moderating but not eliminating risk given Artifactory's central role in software supply chains.	HIGH	8.1	0.1%	41

CVE-2026-82329

Authentication bypass in JFrog Artifactory allows an unauthenticated, network-adjacent attacker to escalate to full administrative privileges against default-configuration instances (CWE-287, improper authentication). Because Artifactory is the central binary repository in many CI/CD pipelines, admin takeover exposes stored artifacts, credentials, and build integrity. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the 9.8 CVSS and self-reporting by JFrog mark it as a high-priority patch.

CRITICAL

9.8

0.4%

119

KEV PoC

CVE-2026-42016

Privilege escalation in JFrog Artifactory Self-Hosted before 7.133.11 lets a low-privileged authenticated user leverage a valid token beyond its intended permissions, because the platform validates the token's signature and issuer but never enforces the token's scope. An attacker holding any legitimately issued token can therefore access resources or perform actions the token was never authorized for, yielding high confidentiality, integrity, and availability impact. This was reported by JFrog and there is no public exploit identified at time of analysis (EPSS 0.21%, percentile 11%).

HIGH

8.8

0.2%

114

KEV PoC

CVE-2026-42018

JFrog Artifactory exposes an internal anonymous-user token to unauthenticated callers even when anonymous access is explicitly disabled. Any network-reachable attacker can obtain this token and use it to access resources that should be protected behind authentication controls. No public exploit has been identified at time of analysis, but the low attack complexity and zero authentication requirement make this a straightforward information-disclosure path against misconfigured or unpatched Artifactory instances.

HIGH

7.5

0.3%

108

KEV PoC

CVE-2026-66384

Path traversal in JFrog Artifactory (CWE-22) enables an authenticated low-privilege user to write data outside the intended Docker cache directory when specific remote-repository conditions are present. The CVSS 3.1 vector scores 5.3 Medium, reflecting a real but constrained integrity risk - arbitrary filesystem writes are possible, but high attack complexity and required authentication limit opportunistic abuse. No active exploitation or public exploit code has been identified at time of analysis.

MEDIUM

5.3

0.3%

97

KEV PoC

CVE-2026-65617

Low-privileged users can exploit a deserialization flaw in JFrog Artifactory's package handling to potentially execute arbitrary code, compromising system confidentiality, integrity, and availability. The vulnerability is triggered under specific repository conditions. At time of analysis, no public exploit or active exploitation has been confirmed.

HIGH

8.8

0.3%

64

PoC

CVE-2026-65923

Server-side request forgery in JFrog Artifactory Ansible repository handling allows authenticated users with repository access to trigger unintended server-side requests, leading to unauthorized access to internal resources and data manipulation. The flaw resides in URL validation and primarily impacts confidentiality and integrity; vendor-provided fixed versions address the issue. No active exploitation or public exploit code is known at this time.

MEDIUM

6.8

0.2%

54

PoC

CVE-2026-66018

Information disclosure in JFrog Artifactory allows authenticated users with read access to an ordinary repository to retrieve protected build environment secrets by manipulating repository parameters, exposing sensitive configuration data with high confidentiality impact. No integrity or availability impact is reported, and no active exploitation or public exploit code has been identified at this time. JFrog has published advisories but patch version details are not specified in the CVE record.

MEDIUM

6.5

0.2%

53

PoC

CVE-2026-66014

Privilege escalation in JFrog Artifactory stems from an authentication handling weakness in how the platform processes internal requests, allowing an attacker to gain access beyond their intended permission level under specific conditions. The flaw affects multiple self-managed release lines (7.117.x, 7.125.x, 7.133.x, 7.146.x, 7.161.x, and all releases prior to 7.111.18) and carries a vendor CVSS of 9.8. No public exploit identified at time of analysis, and EPSS remains low at 0.32% (24th percentile), while CISA SSVC currently marks exploitation as none but technical impact as total.

CRITICAL

9.8

0.3%

49

CVE-2026-65921

Authenticated low-privilege users of JFrog Artifactory can write arbitrary files outside the intended build artifacts location via a path traversal flaw in archive extraction. The vulnerability allows an attacker who has already obtained limited access to the application to overwrite critical files, potentially escalating to remote code execution. No public exploit or active exploitation has been identified at time of analysis, but the high CVSS score reflects the severe impact if leveraged.

HIGH

8.8

0.4%

44

CVE-2026-69106

Cache metadata poisoning in JFrog Artifactory enables a low-privileged authenticated user to corrupt cached artifact metadata entries, causing downstream consumers - including CI/CD pipelines and development toolchains - to silently retrieve untrusted or attacker-influenced content. All versions of Artifactory are listed as affected per the CPE wildcard, making this a broad supply chain integrity concern for organizations relying on Artifactory as a central repository manager. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis, though the high CVSS score of 8.8 and network-accessible attack vector warrant prompt patching.

HIGH

8.8

0.3%

44

CVE-2026-42017

Exposure of privileged authorization material in JFrog Artifactory allows an authenticated low-privileged user to obtain tokens or credentials, leading to full compromise of the instance. The flaw stems from an event-handling weakness and can be triggered under specific, undisclosed conditions. No public exploit or active exploitation has been reported.

HIGH

8.8

0.3%

44

CVE-2026-65616

Privilege escalation in JFrog Artifactory allows low-privileged authenticated users to forge administrator JWTs by exploiting missing signature validation on refresh tokens. An attacker with any user account can gain full admin control, rated CVSS 8.8. No active exploitation or public exploit is confirmed at this time.

HIGH

8.8

0.2%

44

CVE-2026-70551

Server-Side Request Forgery (SSRF) in JFrog Artifactory allows a low-privileged authenticated user with read access to a remote VCS repository to replace the repository's configured origin URL or supply an arbitrary absolute VCS data URL, causing Artifactory's server process to issue outbound HTTP requests to attacker-controlled destinations - including internal network services, cloud metadata endpoints, or other infrastructure inaccessible from the public internet. The scope-changed CVSS vector (S:C) confirms the impact extends beyond Artifactory itself to systems on its internal network segment. No public exploit identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

HIGH

8.5

0.2%

43

CVE-2026-66375

Permanent deletion of protected internal metadata across repositories in JFrog Artifactory is possible by any low-privilege authenticated user under specific, undisclosed conditions. The flaw stems from CWE-862 (Missing Authorization), where the platform fails to enforce access controls on a metadata-deletion pathway that should be restricted to privileged roles. With a CVSS score of 8.1 (High), this represents a significant integrity and availability risk - an attacker with only a standard user account can irreversibly destroy protected repository metadata, with no confidentiality exposure. No public exploit code and no CISA KEV listing have been identified at time of analysis.

HIGH

8.1

0.3%

41

CVE-2026-69105

Cache poisoning in JFrog Artifactory 7.161.0-7.161.15 allows unauthenticated remote attackers to inject untrusted package content into the artifact cache under specific triggering conditions, compromising artifact integrity (I:H) and availability (A:H) with no confidentiality exposure. The vulnerability is rooted in CWE-345 (Insufficient Verification of Data Authenticity), meaning Artifactory fails to validate the authenticity of content before caching it from upstream remote repositories. No public exploit has been identified at time of analysis, and the CVSS UI:R component indicates some victim interaction is required, moderating but not eliminating risk given Artifactory's central role in software supply chains.

HIGH

8.1

0.1%

41

Severity Breakdown

Monthly CVE Trend

Affected Products (4)

Top Risky CVEs