JFrog Artifactory vulnerabilities and fixes

CVEs that mention JFrog Artifactory, ranked by priority. 38 tracked.

JFrog Artifactory has 38 tracked vulnerabilities, 1 critical and 4 exploited in the wild (CISA KEV). A fixed release or vendor patch exists for 38. Most recent: 2026-08-28. Highest priority: CVE-2026-82329 (score 96/100).

• CVE-2026-82329 CRITICAL 9.8 EXPLOITED UPGRADE JFrog Artifactory Improper Authentication Vulnerability
• CVE-2026-42018 HIGH 7.5 EXPLOITED UPGRADE JFrog Artifactory Improper Authentication Vulnerability
• CVE-2026-42016 HIGH 8.1 EXPLOITED UPGRADE JFrog Artifactory Incorrect Authorization Vulnerability
• CVE-2026-66384 MEDIUM 5.3 EXPLOITED UPGRADE JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability
• CVE-2026-65617 HIGH 8.8 UPGRADE A deserialization weakness in JFrog Artifactory package handling could allow a low-privileged user to impact c
• CVE-2026-65921 HIGH 8.8 UPGRADE A path validation weakness in archive extraction/write handling allows entries with traversal sequences to be
• CVE-2026-66014 HIGH 8.8 UPGRADE JFrog Artifactory contains an authentication handling weakness in internal request processing that, under spec
• CVE-2026-42017 HIGH 8.8 UPGRADE An event-handling weakness in JFrog Artifactory could expose privileged authorization material to a lower-priv
• CVE-2026-69106 HIGH 8.8 UPGRADE A low-privileged user may poison cached artifact metadata under specific conditions, potentially causing consu
• CVE-2026-65616 HIGH 8.8 UPGRADE Incorrect authorization validation in refresh token signature allows non-admin users to obtain a signed JFrog
• CVE-2026-66015 HIGH 7.2 UPGRADE An authenticated privilege-escalation vulnerability in JFrog Platform may be exploited under admin-provisioned
• CVE-2026-66375 HIGH 8.1 UPGRADE A low-privilege authenticated user may permanently remove protected internal metadata across repositories unde
• CVE-2026-68752 HIGH 7.2 UPGRADE A Project Resource Manager may gain broader administrative privileges under specific conditions.
• CVE-2026-69107 MEDIUM 5.9 UPGRADE An unauthenticated user may access restricted artifacts in JFrog Artifactory under specific conditions.
• CVE-2026-68756 MEDIUM 6.6 UPGRADE A party with write access to stored session data may affect JFrog Artifactory under specific conditions.
• CVE-2026-68760 MEDIUM 5.3 UPGRADE An unauthenticated user may bypass authentication under specific cache conditions.
• CVE-2026-66018 MEDIUM 6.5 UPGRADE Build readers can access another repository's environment properties
• CVE-2026-65922 HIGH 7.1 UPGRADE An authorization weakness in JFrog Artifactory internal metadata handling could allow a user with limited repo
• CVE-2026-65923 MEDIUM 6.8 UPGRADE A URL validation weakness in JFrog Artifactory Ansible repository handling could allow a user, under specific
• CVE-2026-65924 MEDIUM 6.5 UPGRADE JFrog Artifactory support for Terraform remote repositories was found to be susceptible to Server-Side Request
• CVE-2026-65925 MEDIUM 6.5 UPGRADE A user with JFrog Artifactory Cargo remote repository read access could make Artifactory request unintended UR
• CVE-2026-66377 MEDIUM 5.3 UPGRADE An unauthenticated user may access restricted repository information under specific conditions.
• CVE-2026-68757 HIGH 7.5 UPGRADE A user with access to a valid SAML response may impersonate another user under specific conditions.
• CVE-2026-68759 HIGH 7.2 UPGRADE A holder of a valid integration credential may impersonate other users under specific conditions.
• CVE-2026-69105 HIGH 8.1 UPGRADE An unauthenticated attacker may cause untrusted package content to be cached under specific conditions, potent
• CVE-2026-65618 MEDIUM 6.5 UPGRADE Improper URL validation when handling specific URLs, allows an attacker, under certain conditions, to make una
• CVE-2026-68758 MEDIUM 6.5 UPGRADE A low-privileged authenticated user may access restricted support information under specific conditions.
• CVE-2026-68754 MEDIUM 6.5 UPGRADE A repository publisher without delete permission may modify protected package content under specific condition
• CVE-2026-66381 MEDIUM 5.3 UPGRADE A repository reader with cache-deploy permission may access content outside a configured upstream path under s
• CVE-2026-66016 MEDIUM 6.7 UPGRADE Under specific self-hosted Helm configurations, generated TLS private keys may be retained in rendered manifes
• CVE-2026-68753 MEDIUM 5.3 UPGRADE An unauthenticated user may access restricted Artifactory content when a credentialed remote repository is con
• CVE-2026-66382 MEDIUM 4.3 UPGRADE An authenticated user may write files outside the intended Artifactory work directory under specific condition
• CVE-2026-66378 MEDIUM 4.3 UPGRADE An authenticated user without repository read permission may access private NuGet metadata under specific cond
• CVE-2026-66379 MEDIUM 4.3 UPGRADE An authenticated user may view private Puppet module metadata without repository read access.
• CVE-2026-66380 MEDIUM 4.3 UPGRADE An authenticated user without repository read permission may access private OCI referrer metadata under specif
• CVE-2026-70547 MEDIUM 4.3 UPGRADE An authenticated user without repository read permission may access package metadata under specific conditions
• CVE-2026-68755 MEDIUM 4.3 UPGRADE A bundle writer may create misleading release promotion information under specific conditions.
• CVE-2026-66376 MEDIUM 4.2 UPGRADE Credentials for a deleted user may remain valid for a short period under specific conditions.

FAQ

How do I fix JFrog Artifactory vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is JFrog Artifactory being exploited right now?

Yes: 4 JFrog Artifactory CVEs are on the CISA Known Exploited Vulnerabilities list, so patch those first.

Which JFrog Artifactory CVE should I patch first?

CVE-2026-82329 currently ranks highest (96/100): JFrog Artifactory Improper Authentication Vulnerability.

← Back to latest CVEs