# JFrog Artifactory vulnerabilities Source: https://junglewise.ai/threats/technologies/artifactory Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 11 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/artifactory.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 35 vulnerabilities in JFrog Artifactory: 0 in the last 7 days and 5 in the last 90 days, 4 of them critical and 4 exploited in the wild. The most recent, CVE-2026-82329, was published on 28 August 2026. Nothing was published in the last eight weeks. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 5 - All time: 35 (4 critical, 4 exploited in the wild) ## About JFrog Artifactory Artifactory is a repository management platform for software artifacts and dependencies. ## Latest JFrog Artifactory vulnerabilities - [CVE-2026-82329: JFrog Artifactory improper authentication vulnerability](https://junglewise.ai/threats/cve-2026-82329-jfrog-artifactory-improper-authentication-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 28 Aug 2026) - [CVE-2026-70550: JFrog Artifactory authorization bypass in Composer repository handling](https://junglewise.ai/threats/cve-2026-70550-jfrog-artifactory-authorization-bypass-in-composer-repository) (medium, CVSS 6.5, published 25 Aug 2026) - [CVE-2026-70548: JFrog Artifactory external dependency information disclosure in CocoaPods](https://junglewise.ai/threats/cve-2026-70548-jfrog-artifactory-external-dependency-information-disclosure-in) (low, CVSS 3.5, published 25 Aug 2026) - [CVE-2026-70551: JFrog Artifactory SSRF in VCS remote download](https://junglewise.ai/threats/cve-2026-70551-jfrog-artifactory-ssrf-in-vcs-remote-download) (high, CVSS 8.5, published 25 Aug 2026) - [CVE-2026-69104: JFrog Artifactory privilege escalation in repository migration](https://junglewise.ai/threats/cve-2026-69104-jfrog-artifactory-privilege-escalation-in-repository-migration) (high, CVSS 7.6, published 25 Aug 2026) - [CVE-2026-69106: A low-privileged user may poison cached artifact metadata under specific conditions, potentially causing consumers to…](https://junglewise.ai/threats/cve-2026-69106-a-low-privileged-user-may-poison-cached-artifact-metadata-under) (high, CVSS 8.8, published 12 Aug 2026) - [CVE-2026-42018: JFrog Artifactory improper authentication vulnerability](https://junglewise.ai/threats/cve-2026-42018-jfrog-artifactory-improper-authentication-vulnerability) (critical, exploited in the wild, CVSS 7.5, published 12 Aug 2026) - [CVE-2026-70547: JFrog Artifactory unauthorized package metadata access](https://junglewise.ai/threats/cve-2026-70547-jfrog-artifactory-unauthorized-package-metadata-access) (medium, CVSS 4.3, published 12 Aug 2026) - [CVE-2026-69107: JFrog Artifactory unauthenticated artifact access](https://junglewise.ai/threats/cve-2026-69107-jfrog-artifactory-unauthenticated-artifact-access) (medium, CVSS 5.9, published 12 Aug 2026) - [CVE-2026-69105: JFrog Artifactory untrusted package caching vulnerability](https://junglewise.ai/threats/cve-2026-69105-jfrog-artifactory-untrusted-package-caching-vulnerability) (high, CVSS 8.1, published 12 Aug 2026) - [CVE-2026-68759: JFrog Artifactory integration credential impersonation](https://junglewise.ai/threats/cve-2026-68759-jfrog-artifactory-integration-credential-impersonation) (high, CVSS 7.2, published 12 Aug 2026) - [CVE-2026-68758: JFrog Artifactory information disclosure in support data](https://junglewise.ai/threats/cve-2026-68758-jfrog-artifactory-information-disclosure-in-support-data) (medium, CVSS 6.5, published 12 Aug 2026) - [CVE-2026-66384: An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions.](https://junglewise.ai/threats/cve-2026-66384-jfrog-artifactory-path-traversal-in-docker-cache) (critical, exploited in the wild, CVSS 5.3, published 12 Aug 2026) - [CVE-2026-66016: JFrog Artifactory TLS private key exposure in Helm manifests](https://junglewise.ai/threats/cve-2026-66016-jfrog-artifactory-tls-private-key-exposure-in-helm-manifests) (medium, CVSS 6.7, published 12 Aug 2026) - [CVE-2026-65926: JFrog Artifactory Release Bundle information disclosure](https://junglewise.ai/threats/cve-2026-65926-jfrog-artifactory-release-bundle-information-disclosure) (low, CVSS 3.1, published 12 Aug 2026) - [CVE-2026-68760: An unauthenticated user may bypass authentication under specific cache conditions.](https://junglewise.ai/threats/cve-2026-68760-an-unauthenticated-user-may-bypass-authentication-under-specific) (medium, CVSS 5.3, published 12 Aug 2026) - [CVE-2026-68757: A user with access to a valid SAML response may impersonate another user under specific conditions.](https://junglewise.ai/threats/cve-2026-68757-a-user-with-access-to-a-valid-saml-response-may-impersonate) (high, CVSS 7.5, published 12 Aug 2026) - [CVE-2026-68756: A party with write access to stored session data may affect JFrog Artifactory under specific conditions.](https://junglewise.ai/threats/cve-2026-68756-a-party-with-write-access-to-stored-session-data-may-affect-jfrog) (medium, CVSS 6.6, published 12 Aug 2026) - [CVE-2026-68755: A bundle writer may create misleading release promotion information under specific conditions.](https://junglewise.ai/threats/cve-2026-68755-a-bundle-writer-may-create-misleading-release-promotion) (medium, CVSS 4.3, published 12 Aug 2026) - [CVE-2026-68754: A repository publisher without delete permission may modify protected package content under specific conditions.](https://junglewise.ai/threats/cve-2026-68754-a-repository-publisher-without-delete-permission-may-modify) (medium, CVSS 6.5, published 12 Aug 2026) - [CVE-2026-68753: An unauthenticated user may access restricted Artifactory content when a credentialed remote repository is configured in a…](https://junglewise.ai/threats/cve-2026-68753-an-unauthenticated-user-may-access-restricted-artifactory-content) (medium, CVSS 5.3, published 12 Aug 2026) - [CVE-2026-68752: A Project Resource Manager may gain broader administrative privileges under specific conditions.](https://junglewise.ai/threats/cve-2026-68752-a-project-resource-manager-may-gain-broader-administrative) (high, CVSS 7.2, published 12 Aug 2026) - [CVE-2026-66382: An authenticated user may write files outside the intended Artifactory work directory under specific conditions.](https://junglewise.ai/threats/cve-2026-66382-an-authenticated-user-may-write-files-outside-the-intended) (medium, CVSS 4.3, published 12 Aug 2026) - [CVE-2026-66381: A repository reader with cache-deploy permission may access content outside a configured upstream path under specific…](https://junglewise.ai/threats/cve-2026-66381-a-repository-reader-with-cache-deploy-permission-may-access) (medium, CVSS 5.3, published 12 Aug 2026) - [CVE-2026-66380: An authenticated user without repository read permission may access private OCI referrer metadata under specific conditions.](https://junglewise.ai/threats/cve-2026-66380-an-authenticated-user-without-repository-read-permission-may) (medium, CVSS 4.3, published 12 Aug 2026) ## Most severe JFrog Artifactory vulnerabilities - [CVE-2026-82329: JFrog Artifactory improper authentication vulnerability](https://junglewise.ai/threats/cve-2026-82329-jfrog-artifactory-improper-authentication-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 28 Aug 2026) - [CVE-2026-42016: JFrog Artifactory privilege escalation via improper token scope validation](https://junglewise.ai/threats/cve-2026-42016-jfrog-artifactory-privilege-escalation-via-improper-token-scope) (critical, exploited in the wild, CVSS 8.1, published 27 Jul 2026) - [CVE-2026-42018: JFrog Artifactory improper authentication vulnerability](https://junglewise.ai/threats/cve-2026-42018-jfrog-artifactory-improper-authentication-vulnerability) (critical, exploited in the wild, CVSS 7.5, published 12 Aug 2026) - [CVE-2026-66384: An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions.](https://junglewise.ai/threats/cve-2026-66384-jfrog-artifactory-path-traversal-in-docker-cache) (critical, exploited in the wild, CVSS 5.3, published 12 Aug 2026) - [CVE-2026-69106: A low-privileged user may poison cached artifact metadata under specific conditions, potentially causing consumers to…](https://junglewise.ai/threats/cve-2026-69106-a-low-privileged-user-may-poison-cached-artifact-metadata-under) (high, CVSS 8.8, published 12 Aug 2026) - [CVE-2026-65921: JFrog Artifactory path traversal in archive extraction](https://junglewise.ai/threats/cve-2026-65921-jfrog-artifactory-path-traversal-in-archive-extraction) (high, CVSS 8.8, published 27 Jul 2026) - [CVE-2026-70551: JFrog Artifactory SSRF in VCS remote download](https://junglewise.ai/threats/cve-2026-70551-jfrog-artifactory-ssrf-in-vcs-remote-download) (high, CVSS 8.5, published 25 Aug 2026) - [CVE-2026-66375: A low-privilege authenticated user may permanently remove protected internal metadata across repositories under specific…](https://junglewise.ai/threats/cve-2026-66375-a-low-privilege-authenticated-user-may-permanently-remove) (high, CVSS 8.1, published 12 Aug 2026) - [CVE-2026-69105: JFrog Artifactory untrusted package caching vulnerability](https://junglewise.ai/threats/cve-2026-69105-jfrog-artifactory-untrusted-package-caching-vulnerability) (high, CVSS 8.1, published 12 Aug 2026) - [CVE-2026-69104: JFrog Artifactory privilege escalation in repository migration](https://junglewise.ai/threats/cve-2026-69104-jfrog-artifactory-privilege-escalation-in-repository-migration) (high, CVSS 7.6, published 25 Aug 2026) ## Vulnerabilities per week Nothing was published in the last eight weeks. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 5 | 1 | 1 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other JFrog technologies - [JFrog Artifactory Self-Managed](https://junglewise.ai/threats/technologies/artifactory-self-managed): 8 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "JFrog Artifactory vulnerabilities", https://junglewise.ai/threats/technologies/artifactory, 11 November 2026.