jfrog vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Exploited jfrog flaws

These are on CISA’s Known Exploited Vulnerabilities list, newest first. If you run any of these products, these come before everything else.

• CVE-2026-42018 JFrog Artifactory Improper AuthenticationExploited since Sep 11, 2026 · CVSS 7.5
• CVE-2026-42016 JFrog Artifactory Incorrect AuthorizationExploited since Sep 11, 2026 · CVSS 8.1
• CVE-2026-82329 JFrog Artifactory Improper AuthenticationExploited since Sep 2, 2026 · CVSS 9.8
• CVE-2026-66384 JFrog Artifactory Improper Limitation of a Pathname to a Restricted DirectoryExploited since Aug 27, 2026 · CVSS 5.3

Latest high and critical flaws

• CVE-2026-92892 Potential arbitrary code execution under specific configurations.Critical 9 · Oct 13, 2026
• CVE-2026-82329 JFrog Artifactory Improper AuthenticationExploited · Critical 9.8 · Aug 28, 2026
• CVE-2026-70551 A user who can read an existing remote VCS repository can replace its configured origin or supply an absolute VCS data URL.High 8.5 · Aug 25, 2026
• CVE-2026-69104 An authenticated user may initiate repository migration operations without required repository permissions, potentially causing information disclosure, unauthorHigh 7.6 · Aug 25, 2026
• CVE-2026-69106 A low-privileged user may poison cached artifact metadata under specific conditions, potentially causing consumers to retrieve untrusted content.High 8.8 · Aug 12, 2026
• CVE-2026-42018 JFrog Artifactory Improper AuthenticationExploited · High 7.5 · Aug 12, 2026
• CVE-2026-69105 An unauthenticated attacker may cause untrusted package content to be cached under specific conditions, potentially affecting artifact integrity and availabilitHigh 8.1 · Aug 12, 2026
• CVE-2026-68759 A holder of a valid integration credential may impersonate other users under specific conditions.High 7.2 · Aug 12, 2026
• CVE-2026-68757 A user with access to a valid SAML response may impersonate another user under specific conditions.High 7.5 · Aug 12, 2026
• CVE-2026-68752 A Project Resource Manager may gain broader administrative privileges under specific conditions.High 7.2 · Aug 12, 2026
• CVE-2026-66375 A low-privilege authenticated user may permanently remove protected internal metadata across repositories under specific conditions.High 8.1 · Aug 12, 2026
• CVE-2026-66015 An authenticated privilege-escalation vulnerability in JFrog Platform may be exploited under admin-provisioned account conditions.High 7.2 · Jul 27, 2026
• CVE-2026-66014 JFrog Artifactory contains an authentication handling weakness in internal request processing that, under specific conditions, may allow an attacker to escalateHigh 8.8 · Jul 27, 2026
• CVE-2026-65922 An authorization weakness in JFrog Artifactory internal metadata handling could allow a user with limited repository access to write to restricted internal metaHigh 7.1 · Jul 27, 2026
• CVE-2026-65921 A path validation weakness in archive extraction/write handling allows entries with traversal sequences to be written outside the intended build artifacts locatHigh 8.8 · Jul 27, 2026
• CVE-2026-65617 A deserialization weakness in JFrog Artifactory package handling could allow a low-privileged user to impact confidentiality, integrity, and availability under High 8.8 · Jul 27, 2026
• CVE-2026-65616 Incorrect authorization validation in refresh token signature allows non-admin users to obtain a signed JFrog administrator token.High 8.8 · Jul 27, 2026
• CVE-2026-42017 An event-handling weakness in JFrog Artifactory could expose privileged authorization material to a lower-privileged user under specific conditions.High 8.8 · Jul 27, 2026
• CVE-2026-42016 JFrog Artifactory Incorrect AuthorizationExploited · High 8.1 · Jul 27, 2026
• CVE-2024-6915 JFrog Artifactory versions below 7.90.6, 7.84.20, 7.77.14, 7.71.23, 7.68.22, 7.63.22, 7.59.23, 7.55.18 are vulnerable to Improper Input Validation that could poCritical 9.3 · Aug 5, 2024
• CVE-2024-4142 An Improper input validation vulnerability that could potentially lead to privilege escalation was discovered in JFrog Artifactory.Critical 9 · May 1, 2024
• CVE-2024-2247 JFrog Artifactory versions below 7.77.7, 7.82.1, are vulnerable to DOM-based cross-site scripting due to improper handling of the import override mechanism.High 8.8 · Mar 13, 2024
• CVE-2023-42661 JFrog Artifactory prior to version 7.76.2 is vulnerable to Arbitrary File Write of untrusted data, which may lead to DoS or Remote Code Execution when a specialHigh 7.2 · Mar 7, 2024
• CVE-2023-42662 JFrog Artifactory versions 7.59 and above, but below 7.59.18, 7.63.18, 7.68.19, 7.71.8 are vulnerable to an issue whereby user interaction with specially crafteCritical 9.3 · Mar 7, 2024
• CVE-2022-0573 JFrog Artifactory before 7.36.1 and 6.23.41, is vulnerable to Insecure Deserialization of untrusted data which can lead to DoS, Privilege Escalation and Remote High 8.8 · May 16, 2022