Loading story…
JFrog disclosed CVE-2026-65921, a high-severity path traversal vulnerability in Artifactory that can let an authenticated attacker write files outside the intended build artifacts directory. The flaw stems from improper path validation during archive extraction and related write handling, allowing traversal sequences to escape the expected destination path. The issue is tracked as CWE-22 and carries a CVSS v3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
JFrog said multiple Artifactory version ranges are affected and published patched releases at the upper bounds of those ranges, along with a security advisory and release references for remediation. The vulnerability can impact confidentiality, integrity, and availability, and the CVE record credits discovery to Matthew Bryant of OpenAI. Organizations running Artifactory should identify affected deployments and apply JFrog’s fixes to prevent unauthorized file writes via crafted archive contents or write operations.
See real exploitation activity before you spend the cycle.
1 event from the most recent confirmed update back to the earliest known activity.
JFrog published CVE-2026-65921, a high-severity path traversal vulnerability in Artifactory caused by improper path validation during archive extraction or write handling. The issue can allow unauthorized file writes outside the intended build artifacts directory, and patched versions were identified for affected release ranges.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
JFrog disclosed **CVE-2026-66014**, a high-severity vulnerability in **Artifactory** caused by improper authentication in internal request processing. The flaw, classified as **`CWE-287`**, can allow an authenticated attacker with low privileges to bypass intended authorization boundaries and escalate privileges under specific conditions. The issue carries a **CVSS v3.1 score of 8.8** with vector **`AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`**, indicating high potential impact on confidentiality, integrity, and availability. Multiple Artifactory version ranges are affected, and JFrog has published release and security advisory information identifying remediated versions outside those ranges. The CVE record credits **Amy Burnett of OpenAI** with reporting the issue, and organizations running Artifactory are being directed to review JFrog’s advisory and upgrade guidance to prevent privilege escalation through the vulnerable internal request handling path.
Jul 29, 2026
JFrog disclosed **CVE-2026-42016**, a high-severity privilege-escalation vulnerability in **Artifactory Self-Hosted** caused by incorrect authorization validation of user tokens. The flaw affects versions **before 7.133.11** and stems from token checks that validate the signature and issuer but do **not** verify the token scope, allowing an authenticated user with low privileges to gain elevated access. The issue is tracked as **CWE-863** and carries a **CVSS v3.1** vector of `AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N`, indicating high confidentiality and integrity impact with no direct availability impact. JFrog’s self-managed release documentation lists **7.133.11** as the fixed version for affected deployments, and organizations running on-premises Artifactory are expected to prioritize upgrades. Because exploitation requires only valid low-privilege access and no user interaction, the vulnerability raises the risk of unauthorized access to repositories, artifacts, and administrative functions in environments that have not yet patched.
Jul 28, 2026
JFrog disclosed **CVE-2026-65617**, a high-severity deserialization vulnerability in Artifactory package handling that could allow **potential remote code execution** on an Artifactory package service container. The flaw, classified as **`CWE-502`**, is reachable over the network and requires only **low privileges** under specific repository conditions, with impact to confidentiality, integrity, and availability. The CVE record assigns the issue a **CVSS v3.1 score of 8.8** with vector **`AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`**. Multiple Artifactory version ranges are affected, and JFrog has published advisory and release documentation identifying patched versions across supported branches for remediation.
Jul 29, 2026