What’s Vulnerable › Products

jfrog artifactory vulnerabilities

78 known vulnerabilities, 4 confirmed exploited in the wild (CISA KEV), 43 published in the last 12 months.

Check whether your jfrog artifactory version is affected

Exploited jfrog artifactory vulnerabilities

• CVE-2026-42018 — JFrog Artifactory Improper Authentication Vulnerability
• CVE-2026-42016 — JFrog Artifactory Incorrect Authorization Vulnerability
• CVE-2026-82329 — JFrog Artifactory Improper Authentication Vulnerability
• CVE-2026-66384 — JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability

Latest jfrog artifactory vulnerabilities

• CVE-2026-82329 — JFrog Artifactory Improper Authentication Vulnerability (CVSS 9.8) — exploited
• CVE-2026-70550 — Potential unauthorized access to private Composer repository metadata in JFrog Artifactory (CVSS 6.5)
• CVE-2026-70548 — SSRF In CocoaPods Via JFrog Artifactory External Dependency (CVSS 3.5)
• CVE-2026-70551 — Server-Side Request Forgery Via VCS remote download in JFrog Artifactory (CVSS 8.5)
• CVE-2026-69104 — Potential unauthorized repository migration in JFrog Artifactory (CVSS 7.6)
• CVE-2026-69106 — Potential cache poisoning in JFrog Artifactory (CVSS 8.8)
• CVE-2026-42018 — JFrog Artifactory Improper Authentication Vulnerability (CVSS 7.5) — exploited
• CVE-2026-70547 — Potential unauthorized metadata exposure in JFrog Artifactory (CVSS 4.3)
• CVE-2026-69107 — Potential unauthorized artifact access in JFrog Artifactory (CVSS 5.9)
• CVE-2026-69105 — Potential package cache integrity issue in JFrog Artifactory (CVSS 8.1)
• CVE-2026-68759 — Integration credential holders may impersonate users in JFrog Access (CVSS 7.2)
• CVE-2026-68758 — Authenticated users may access restricted Artifactory support information (CVSS 6.5)
• CVE-2026-66384 — JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability (CVSS 5.3) — exploited
• CVE-2026-66016 — Rendered Artifactory Helm manifests may contain generated TLS private keys (CVSS 6.7)
• CVE-2026-65926 — Private Release Bundle versions may be disclosed under specific configurations (CVSS 3.1)
• CVE-2026-68760 — Potential remember-me authentication bypass in JFrog Artifactory (CVSS 5.3)
• CVE-2026-68757 — Potential improper SAML signature verification in JFrog Artifactory (CVSS 7.5)
• CVE-2026-68756 — Potential insecure deserialization in JFrog Artifactory (CVSS 6.6)
• CVE-2026-68755 — Bundle writers may alter trusted release information in JFrog Artifactory (CVSS 4.3)
• CVE-2026-68754 — Publishers without delete permission can overwrite docker layer information (CVSS 6.5)
• CVE-2026-68753 — Anonymous users may access restricted Artifactory content under specific configurations (CVSS 5.3)
• CVE-2026-68752 — Project Resource Managers may escalate privileges in JFrog Artifactory (CVSS 7.2)
• CVE-2026-66382 — Authenticated users may write files outside the intended Artifactory work directory (CVSS 4.3)
• CVE-2026-66381 — Repository readers may access content outside configured upstream paths (CVSS 5.3)
• CVE-2026-66380 — Authenticated users may access private OCI referrer metadata (CVSS 4.3)