Critical · published August 29, 2026
CVSS calls it critical at 9.8. It is confirmed in active exploitation. It sits in the 96.6th percentile for exploit probability.
JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges.
| Product | Versions | Fixed in |
|---|---|---|
| jfrog/artifactory | ≥ 7.111.4, < 7.111.21 | 7.111.21 |
| jfrog/artifactory | ≥ 7.117.0, < 7.117.28 | 7.117.28 |
| jfrog/artifactory | ≥ 7.125.0, < 7.125.20 | 7.125.20 |
| jfrog/artifactory | ≥ 7.133.0, < 7.133.29 | 7.133.29 |
| jfrog/artifactory | ≥ 7.146.0, < 7.146.38 | 7.146.38 |
| jfrog/artifactory | ≥ 7.161.0, < 7.161.20 | 7.161.20 |