Is CVE-2026-66015 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-66015 being exploited in the wild.

How severe is CVE-2026-66015?

High severity, with a CVSS score of 7.2, published 27 July 2026.

Which products and versions are affected?

JFrog Artifactory Self-Managed 7.146.0 to 7.146.33, 7.161.0 to 7.161.14.

Is there a fix for CVE-2026-66015?

A patch was published on 2026-07-27: Fix released in Artifactory 7.161.15 and 7.146.34. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-66015 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-66015?

Check whether you run JFrog Artifactory Self-Managed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-66015: JFrog Artifactory privilege escalation in Platform Access

CVE-2026-66015 · Severity: high · CVSS 7.2 · Published 2026-07-27

JFrog Artifactory, a platform used by organizations to manage and distribute software packages, contains a security vulnerability that allows certain users to gain unauthorized administrative control. An attacker with an existing account provisioned by an administrator could exploit this flaw to temporarily elevate their permissions to full platform administrator status. This could allow an unauthorized user to modify system settings, access sensitive software artifacts, or disrupt development operations.

Technologies: JFrog Artifactory Self-Managed. Vendors: JFrog.

Quick answers

Is CVE-2026-66015 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-66015 being exploited in the wild.
How severe is CVE-2026-66015?: High severity, with a CVSS score of 7.2, published 27 July 2026.
Which products and versions are affected?: JFrog Artifactory Self-Managed 7.146.0 to 7.146.33, 7.161.0 to 7.161.14.
Is there a fix for CVE-2026-66015?: A patch was published on 2026-07-27: Fix released in Artifactory 7.161.15 and 7.146.34. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-66015 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-66015?: Check whether you run JFrog Artifactory Self-Managed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An improper privilege management vulnerability (CWE-269) exists in the JFrog Platform, specifically affecting Artifactory Self-Managed deployments. The flaw allows an authenticated user, under specific admin-provisioned account conditions, to escalate their privileges to a temporary platform administrator. The attack vector is network-based and requires high privileges (PR:H) to initiate, but does not require user interaction. The vulnerability has been addressed in Artifactory versions 7.146.34 and 7.161.15.

Affected products

JFrog Artifactory Self-Managed 7.146.0 to 7.146.33, 7.161.0 to 7.161.14

Timeline

2026-07-27: advisory: Initial advisory published by JFrog and NVD record created.
2026-07-27: patched: Fix released in Artifactory 7.161.15 and 7.146.34.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.