CVE-2026-65617

Published: Jul 27, 2026Modified: Oct 24, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: reefs@jfrog.com (Secondary)

Description

A deserialization weakness in JFrog Artifactory package handling could allow a low-privileged user to impact confidentiality, integrity, and availability under specific repository conditions.

Affected (6)

Products: Jfrog: Artifactory

Jfrog

1 product

Artifactory

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Jfrog Artifactory	version < 7.111.18
Jfrog Artifactory	7.117.0 ≤ version < 7.117.25
Jfrog Artifactory	7.125.0 ≤ version < 7.125.18
Jfrog Artifactory	7.133.0 ≤ version < 7.133.27
Jfrog Artifactory	7.146.0 ≤ version < 7.146.34
Jfrog Artifactory	7.161.0 ≤ version < 7.161.15

Related CWEs

CWE-502

Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (2)

https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases

Source: reefs@jfrog.com

Release Notes

https://docs.jfrog.com/releases/docs/jfrog-security-advisories

Source: reefs@jfrog.com

Vendor Advisory

Timeline

No history available yet.