# CVE-2026-65616: JFrog Artifactory privilege escalation via refresh token signature validation

Source: https://junglewise.ai/threats/cve-2026-65616-jfrog-artifactory-privilege-escalation-via-refresh-token  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-27. Updated: 2026-07-27  
License: CC BY 4.0 with a link back

CVE-2026-65616 · Severity: high · CVSS 8.8 · Published 2026-07-27

A security vulnerability in JFrog Artifactory allows standard users to escalate their privileges to a full administrator. By exploiting a flaw in how the system validates security tokens, an attacker can gain unauthorized control over the platform, potentially leading to the theft of sensitive software artifacts or disruption of the development pipeline. Organizations using self-managed versions of Artifactory should upgrade immediately to prevent unauthorized administrative access.

Technologies: [JFrog Artifactory Self-Managed](https://junglewise.ai/threats/technologies/artifactory-self-managed). Vendors: [JFrog](https://junglewise.ai/threats/vendors/jfrog).

## Quick answers

**Is CVE-2026-65616 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-65616 being exploited in the wild.

**How severe is CVE-2026-65616?** High severity, with a CVSS score of 8.8, published 27 July 2026.

**Which products and versions are affected?** JFrog Artifactory Self-Managed < 7.146.27.

**Is there a fix for CVE-2026-65616?** A patch was published on 2026-07-27: Fixed in version 7.146.27 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-65616 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-65616?** Check whether you run JFrog Artifactory Self-Managed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is classified as an improper verification of cryptographic signatures (CWE-347) within the refresh token mechanism. Due to incorrect authorization validation during the token signature process, an authenticated user with low privileges can generate or obtain a validly signed administrator-level token. This is a network-based attack that requires basic user authentication but no user interaction. Successful exploitation results in full privilege escalation to the administrator role, granting the attacker complete control over the JFrog Platform. The issue is addressed in Artifactory version 7.146.27 and later.

## Affected products

- JFrog Artifactory Self-Managed < 7.146.27

## Timeline

- 2026-07-27: disclosed
- 2026-07-27: advisory
- 2026-07-27: patched: Fixed in version 7.146.27

## References

- [https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases](https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases)
- [https://docs.jfrog.com/releases/docs/jfrog-security-advisories](https://docs.jfrog.com/releases/docs/jfrog-security-advisories)

## Related threats

- [JFrog Artifactory information disclosure in environment properties](https://junglewise.ai/threats/cve-2026-66018-jfrog-artifactory-information-disclosure-in-environment)
- [JFrog Artifactory privilege escalation in Platform Access](https://junglewise.ai/threats/cve-2026-66015-jfrog-artifactory-privilege-escalation-in-platform-access)
- [JFrog Artifactory privilege escalation in internal request processing](https://junglewise.ai/threats/cve-2026-66014-jfrog-artifactory-privilege-escalation-in-internal-request)
- [JFrog Artifactory missing authorization in internal metadata handling](https://junglewise.ai/threats/cve-2026-65922-jfrog-artifactory-missing-authorization-in-internal-metadata)
- [JFrog Artifactory SSRF via improper URL validation](https://junglewise.ai/threats/cve-2026-65618-jfrog-artifactory-ssrf-via-improper-url-validation)