Quick answers
- Is CVE-2026-65922 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-65922 being exploited in the wild.
- How severe is CVE-2026-65922?
- High severity, with a CVSS score of 7.1, published 27 July 2026.
- Which products and versions are affected?
- JFrog Artifactory Self-Managed < 7.111.18, 7.117.0 to < 7.117.25, 7.125.0 to < 7.125.18, 7.133.0 to < 7.133.27, 7.146.0 to < 7.146.34, 7.161.0 to < 7.161.15.
- Is there a fix for CVE-2026-65922?
- A patch was published on 2026-07-27. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-65922 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-65922?
- Check whether you run JFrog Artifactory Self-Managed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A missing authorization vulnerability (CWE-862) exists in JFrog Artifactory's internal metadata handling. The flaw allows an authenticated attacker with low-level repository permissions to bypass intended access controls and write to restricted internal metadata areas. The attack is network-reachable and requires no user interaction, though it does require valid credentials. Exploitation primarily impacts the integrity of the metadata and the availability of the service, while data confidentiality remains unaffected. JFrog has released several patched versions across different release branches, including 7.111.18, 7.117.25, 7.125.18, 7.133.27, 7.146.34, and 7.161.15.
Affected products
- JFrog Artifactory Self-Managed < 7.111.18, 7.117.0 to < 7.117.25, 7.125.0 to < 7.125.18, 7.133.0 to < 7.133.27, 7.146.0 to < 7.146.34, 7.161.0 to < 7.161.15
Timeline
- 2026-07-27: disclosed
- 2026-07-27: advisory
- 2026-07-27: patched