CVE-2026-66014: JFrog Artifactory privilege escalation in internal request processing

CVE-2026-66014 · Severity: high · CVSS 8.8 · Published 2026-07-27

JFrog Artifactory, a platform used by organizations to manage and store software building blocks (artifacts), contains a security flaw in how it handles internal requests. An attacker with basic user access could exploit this weakness to gain higher-level administrative permissions. This could allow unauthorized individuals to access sensitive software code, modify production packages, or disrupt the software delivery pipeline.

Technologies: JFrog Artifactory Self-Managed. Vendors: JFrog.

Quick answers

Is CVE-2026-66014 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-66014 being exploited in the wild.
How severe is CVE-2026-66014?
High severity, with a CVSS score of 8.8, published 27 July 2026.
Which products and versions are affected?
JFrog Artifactory Self-Managed < 7.111.18, 7.117.0 to < 7.117.25, 7.125.0 to < 7.125.18, 7.133.0 to < 7.133.27, 7.146.0 to < 7.146.34, 7.161.0 to < 7.161.15.
Is there a fix for CVE-2026-66014?
A patch was published on 2026-07-27: Fixed in Artifactory 7.161.15 and other maintenance releases. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-66014 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-66014?
Check whether you run JFrog Artifactory Self-Managed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

JFrog Artifactory is vulnerable to improper authentication (CWE-287) within its internal request processing logic. The flaw allows a remote attacker with low-privileged credentials (PR:L) to bypass intended access controls and escalate their privileges to a higher level, potentially gaining administrative control over the platform. The vulnerability is reachable over the network without user interaction. JFrog has released several patched versions across different release branches, including 7.111.18, 7.117.25, 7.125.18, 7.133.27, 7.146.34, and 7.161.15.

Affected products

  • JFrog Artifactory Self-Managed < 7.111.18, 7.117.0 to < 7.117.25, 7.125.0 to < 7.125.18, 7.133.0 to < 7.133.27, 7.146.0 to < 7.146.34, 7.161.0 to < 7.161.15

Timeline

  • 2026-07-27: disclosed
  • 2026-07-27: advisory
  • 2026-07-27: patched: Fixed in Artifactory 7.161.15 and other maintenance releases.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.