CVE-2026-66014
What it is
JFrog Artifactory contains an authentication handling weakness in internal request processing that, under specific conditions, may allow an attacker to escalate privileges beyond the intended access level.
At a glance
- Exploitability
- Can be exploited over the network with a low-privilege account. High risk of data exposure, data tampering, service disruption.
- Exploit odds
- 0.6% chance of exploitation in the next 30 days (EPSS).
- Fix
- A patch, advisory or fixed version is referenced. Upgrade or apply it.
Timeline
- PublishedDisclosed publicly on CVE.org and NVD
- Last updatedMost recent change to the record
Details
- Published
- Last modified
- Exploit probability
- 0.6% · EPSS, next 30 days
- Weakness
- CWE-287 · Improper authentication
- Record status
- Analyzed
Affected
- Jfrog Artifactory < 7.111.18
- Jfrog Artifactory < 7.117.25
- Jfrog Artifactory < 7.125.18
- Jfrog Artifactory < 7.133.27
- Jfrog Artifactory < 7.146.34
- Jfrog Artifactory < 7.161.15
Attack profile CVSS 3.1 · 8.8
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
