Is CVE-2026-65921 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-65921 being exploited in the wild.

How severe is CVE-2026-65921?

High severity, with a CVSS score of 8.8, published 27 July 2026.

Which products and versions are affected?

JFrog Artifactory < 7.111.18, 7.117.0 to < 7.117.25, 7.125.0 to < 7.125.18, 7.133.0 to < 7.133.27, 7.146.0 to < 7.146.34, 7.161.0 to < 7.161.15.

Is there a fix for CVE-2026-65921?

A patch was published on 2026-07-27. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-65921 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-65921?

Check whether you run JFrog Artifactory at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-65921: JFrog Artifactory path traversal in archive extraction

Q: Which products and versions are affected?

JFrog Artifactory < 7.111.18, 7.117.0 to < 7.117.25, 7.125.0 to < 7.125.18, 7.133.0 to < 7.133.27, 7.146.0 to < 7.146.34, 7.161.0 to < 7.161.15.

Q: Is there a fix for CVE-2026-65921?

A patch was published on 2026-07-27. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-65921 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-65921?

Check whether you run JFrog Artifactory at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-65921 · Severity: high · CVSS 8.8 · Published 2026-07-27

JFrog Artifactory, a repository manager used to store and manage software build artifacts, is vulnerable to a security flaw in how it handles compressed archives. An attacker with low-level access could upload a malicious file that, when processed, writes data to unauthorized locations on the server's file system. This could lead to the corruption of system files, unauthorized data access, or a complete takeover of the application server.

Technologies: JFrog Artifactory. Vendors: JFrog.

Quick answers

Is CVE-2026-65921 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-65921 being exploited in the wild.
How severe is CVE-2026-65921?: High severity, with a CVSS score of 8.8, published 27 July 2026.
Which products and versions are affected?: JFrog Artifactory < 7.111.18, 7.117.0 to < 7.117.25, 7.125.0 to < 7.125.18, 7.133.0 to < 7.133.27, 7.146.0 to < 7.146.34, 7.161.0 to < 7.161.15.
Is there a fix for CVE-2026-65921?: A patch was published on 2026-07-27. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-65921 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-65921?: Check whether you run JFrog Artifactory at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path validation weakness (CWE-22) exists in the archive extraction and write handling components of JFrog Artifactory. The vulnerability is rooted in insufficient sanitization of archive entries containing traversal sequences (e.g., '../'). An authenticated attacker with low privileges can exploit this over the network by submitting a specially crafted archive, allowing them to write arbitrary files to locations outside the intended build artifacts directory. This can result in full system compromise, including remote code execution or data exfiltration. The issue is addressed in several maintenance releases including 7.111.18, 7.117.25, 7.125.18, 7.133.27, 7.146.34, and 7.161.15.

Affected products

JFrog Artifactory < 7.111.18, 7.117.0 to < 7.117.25, 7.125.0 to < 7.125.18, 7.133.0 to < 7.133.27, 7.146.0 to < 7.146.34, 7.161.0 to < 7.161.15

Timeline

2026-07-27: disclosed
2026-07-27: advisory
2026-07-27: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.