CVE-2026-66014CWE-287

CVE-2026-66014

High · published July 28, 2026

CVSS v3.1
8.8
EPSS
1%
Percentile
50.0
In the wild
Unconfirmed
What it is

JFrog Artifactory contains an authentication handling weakness in internal request processing that, under specific conditions, may allow an attacker to escalate privileges beyond the intended access level.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00640 · 50.0th percentile
Weakness
CWE-287 · Improper Authentication
Published
2026-07-28T00:16Z
Affected products (6)
ProductVersionsFixed in
jfrog/artifactory< 7.111.187.111.18
jfrog/artifactory≥ 7.117.0, < 7.117.257.117.25
jfrog/artifactory≥ 7.125.0, < 7.125.187.125.18
jfrog/artifactory≥ 7.133.0, < 7.133.277.133.27
jfrog/artifactory≥ 7.146.0, < 7.146.347.146.34
jfrog/artifactory≥ 7.161.0, < 7.161.157.161.15
References (2)
https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases · [email protected]https://docs.jfrog.com/releases/docs/jfrog-security-advisories · [email protected]
EPSS history
Timeline
  • 27 JUL 19:29Z
    Potential authentication bypass leading to privilege escalation in Artifactory
    cvelistv5