WID-SEC-W-2026-2808 - Vulnerability-Lookup

WID-SEC-W-2026-2808

Vulnerability from csaf_certbund - Published: 2026-08-12 22:00 - Updated: 2026-09-10 22:00

Summary

JFrog Artifactory: Mehrere Schwachstellen

Severity

Hoch

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: JFrog Artifactory ist eine universelle DevOps-Lösung.

Angriff: Ein Angreifer kann mehrere Schwachstellen in JFrog Artifactory ausnutzen, um die Authentifizierung zu umgehen, Berechtigungen zu erweitern, sich als Benutzer auszugeben, vertrauliche Informationen offenzulegen oder geschützte Daten zu manipulieren.

Betroffene Betriebssysteme: - Sonstiges - UNIX

CVE-2026-42018

Affected products

Known affected 2 products

Product	Identifier	Version	Remediation
JFrog Artifactory SaaS <7.164.0 JFrog / Artifactory		SaaS <7.164.0
JFrog Artifactory Self-Managed <7.161.16 JFrog / Artifactory		Self-Managed <7.161.16

CVE-2026-65926

Affected products

Known affected 2 products, the same list as for CVE-2026-42018

CVE-2026-66016

Affected products

Known affected 2 products, the same list as for CVE-2026-42018

CVE-2026-66375

Affected products

Known affected 2 products, the same list as for CVE-2026-42018

CVE-2026-66376

Affected products

Known affected 2 products, the same list as for CVE-2026-42018

CVE-2026-66377

Affected products

Known affected 2 products, the same list as for CVE-2026-42018

CVE-2026-66378

Affected products

Known affected 2 products, the same list as for CVE-2026-42018

CVE-2026-66379

Affected products

Known affected 2 products, the same list as for CVE-2026-42018

CVE-2026-66380

Affected products

Known affected 2 products, the same list as for CVE-2026-42018

CVE-2026-66381

Affected products

Known affected 2 products, the same list as for CVE-2026-42018

CVE-2026-66382

Affected products

Known affected 2 products, the same list as for CVE-2026-42018

CVE-2026-66384

Affected products

Known affected 2 products, the same list as for CVE-2026-42018

CVE-2026-68752

Affected products

Known affected 2 products, the same list as for CVE-2026-42018

CVE-2026-68753

Affected products

Known affected 2 products, the same list as for CVE-2026-42018

CVE-2026-68754

Affected products

Known affected 2 products, the same list as for CVE-2026-42018

CVE-2026-68755

Affected products

Known affected 2 products, the same list as for CVE-2026-42018

CVE-2026-68756

Affected products

Known affected 2 products, the same list as for CVE-2026-42018

CVE-2026-68757

Affected products

Known affected 2 products, the same list as for CVE-2026-42018

CVE-2026-68758

Affected products

Known affected 2 products, the same list as for CVE-2026-42018

CVE-2026-68759

Affected products

Known affected 2 products, the same list as for CVE-2026-42018

CVE-2026-68760

Affected products

Known affected 2 products, the same list as for CVE-2026-42018

CVE-2026-69105

Affected products

Known affected 2 products, the same list as for CVE-2026-42018

CVE-2026-69106

Affected products

Known affected 2 products, the same list as for CVE-2026-42018

CVE-2026-69107

Affected products

Known affected 2 products, the same list as for CVE-2026-42018

CVE-2026-70547

Affected products

Known affected 2 products, the same list as for CVE-2026-42018

References

29 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://github.com/advisories/GHSA-3q94-gprh-7pwm	external
https://github.com/advisories/GHSA-4hqf-vjqg-r5mp	external
https://github.com/advisories/GHSA-4m9c-v4gj-j8h4	external
https://github.com/advisories/GHSA-592j-rr27-g7v3	external
https://github.com/advisories/GHSA-5hcg-vq85-36gr	external
https://github.com/advisories/GHSA-658v-qxp8-f8jg	external
https://github.com/advisories/GHSA-6f7v-qw6v-g527	external
https://github.com/advisories/GHSA-8p4r-xhj4-hcxq	external
https://github.com/advisories/GHSA-8qxj-ppp3-wj5q	external
https://github.com/advisories/GHSA-972j-37fp-4fxj	external
https://github.com/advisories/GHSA-9pg7-45vf-fg47	external
https://github.com/advisories/GHSA-c4qm-8pgx-8w9v	external
https://github.com/advisories/GHSA-fwvx-mgc3-hfxw	external
https://github.com/advisories/GHSA-g2mp-x73p-93xc	external
https://github.com/advisories/GHSA-g827-5jxh-c39h	external
https://github.com/advisories/GHSA-gx5w-3352-3hcw	external
https://github.com/advisories/GHSA-h9p5-mfwv-xgr3	external
https://github.com/advisories/GHSA-j8f7-jqv8-r34p	external
https://github.com/advisories/GHSA-jh2f-hwv7-p5g3	external
https://github.com/advisories/GHSA-p589-cm2m-mwpc	external
https://github.com/advisories/GHSA-p5w8-5mcx-xjqc	external
https://github.com/advisories/GHSA-pfc3-2f49-5cw6	external
https://github.com/advisories/GHSA-pqw8-h4c8-xg3j	external
https://github.com/advisories/GHSA-rm3v-36x6-mr48	external
https://github.com/advisories/GHSA-v7m3-mxh9-fx63	external
https://www.cisa.gov/known-exploited-vulnerabilit…	external
https://www.wiz.io/blog/artifactory-under-attack-…	external

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "JFrog Artifactory ist eine universelle DevOps-L\u00f6sung.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein Angreifer kann mehrere Schwachstellen in JFrog Artifactory ausnutzen, um die Authentifizierung zu umgehen, Berechtigungen zu erweitern, sich als Benutzer auszugeben, vertrauliche Informationen offenzulegen oder gesch\u00fctzte Daten zu manipulieren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges\n- UNIX",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-2808 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-2808.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-2808 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2808"
      },
      {
        "category": "external",
        "summary": "GitHub Advisory Database vom 2026-08-12",
        "url": "https://github.com/advisories/GHSA-3q94-gprh-7pwm"
      },
      {
        "category": "external",
        "summary": "GitHub Advisory Database vom 2026-08-12",
        "url": "https://github.com/advisories/GHSA-4hqf-vjqg-r5mp"
      },
      {
        "category": "external",
        "summary": "GitHub Advisory Database vom 2026-08-12",
        "url": "https://github.com/advisories/GHSA-4m9c-v4gj-j8h4"
      },
      {
        "category": "external",
        "summary": "GitHub Advisory Database vom 2026-08-12",
        "url": "https://github.com/advisories/GHSA-592j-rr27-g7v3"
      },
      {
        "category": "external",
        "summary": "GitHub Advisory Database vom 2026-08-12",
        "url": "https://github.com/advisories/GHSA-5hcg-vq85-36gr"
      },
      {
        "category": "external",
        "summary": "GitHub Advisory Database vom 2026-08-12",
        "url": "https://github.com/advisories/GHSA-658v-qxp8-f8jg"
      },
      {
        "category": "external",
        "summary": "GitHub Advisory Database vom 2026-08-12",
        "url": "https://github.com/advisories/GHSA-6f7v-qw6v-g527"
      },
      {
        "category": "external",
        "summary": "GitHub Advisory Database vom 2026-08-12",
        "url": "https://github.com/advisories/GHSA-8p4r-xhj4-hcxq"
      },
      {
        "category": "external",
        "summary": "GitHub Advisory Database vom 2026-08-12",
        "url": "https://github.com/advisories/GHSA-8qxj-ppp3-wj5q"
      },
      {
        "category": "external",
        "summary": "GitHub Advisory Database vom 2026-08-12",
        "url": "https://github.com/advisories/GHSA-972j-37fp-4fxj"
      },
      {
        "category": "external",
        "summary": "GitHub Advisory Database vom 2026-08-12",
        "url": "https://github.com/advisories/GHSA-9pg7-45vf-fg47"
      },
      {
        "category": "external",
        "summary": "GitHub Advisory Database vom 2026-08-12",
        "url": "https://github.com/advisories/GHSA-c4qm-8pgx-8w9v"
      },
      {
        "category": "external",
        "summary": "GitHub Advisory Database vom 2026-08-12",
        "url": "https://github.com/advisories/GHSA-fwvx-mgc3-hfxw"
      },
      {
        "category": "external",
        "summary": "GitHub Advisory Database vom 2026-08-12",
        "url": "https://github.com/advisories/GHSA-g2mp-x73p-93xc"
      },
      {
        "category": "external",
        "summary": "GitHub Advisory Database vom 2026-08-12",
        "url": "https://github.com/advisories/GHSA-g827-5jxh-c39h"
      },
      {
        "category": "external",
        "summary": "GitHub Advisory Database vom 2026-08-12",
        "url": "https://github.com/advisories/GHSA-gx5w-3352-3hcw"
      },
      {
        "category": "external",
        "summary": "GitHub Advisory Database vom 2026-08-12",
        "url": "https://github.com/advisories/GHSA-h9p5-mfwv-xgr3"
      },
      {
        "category": "external",
        "summary": "GitHub Advisory Database vom 2026-08-12",
        "url": "https://github.com/advisories/GHSA-j8f7-jqv8-r34p"
      },
      {
        "category": "external",
        "summary": "GitHub Advisory Database vom 2026-08-12",
        "url": "https://github.com/advisories/GHSA-jh2f-hwv7-p5g3"
      },
      {
        "category": "external",
        "summary": "GitHub Advisory Database vom 2026-08-12",
        "url": "https://github.com/advisories/GHSA-p589-cm2m-mwpc"
      },
      {
        "category": "external",
        "summary": "GitHub Advisory Database vom 2026-08-12",
        "url": "https://github.com/advisories/GHSA-p5w8-5mcx-xjqc"
      },
      {
        "category": "external",
        "summary": "GitHub Advisory Database vom 2026-08-12",
        "url": "https://github.com/advisories/GHSA-pfc3-2f49-5cw6"
      },
      {
        "category": "external",
        "summary": "GitHub Advisory Database vom 2026-08-12",
        "url": "https://github.com/advisories/GHSA-pqw8-h4c8-xg3j"
      },
      {
        "category": "external",
        "summary": "GitHub Advisory Database vom 2026-08-12",
        "url": "https://github.com/advisories/GHSA-rm3v-36x6-mr48"
      },
      {
        "category": "external",
        "summary": "GitHub Advisory Database vom 2026-08-12",
        "url": "https://github.com/advisories/GHSA-v7m3-mxh9-fx63"
      },
      {
        "category": "external",
        "summary": "CISA KEV CVE-2026-66384 vom 2026-08-27",
        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-66384"
      },
      {
        "category": "external",
        "summary": "Exploit CVE-2026-42016, CVE-2026-42018, CVE-2026-82329",
        "url": "https://www.wiz.io/blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201"
      }
    ],
    "source_lang": "en-US",
    "title": "JFrog Artifactory: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2026-09-10T22:00:00.000+00:00",
      "generator": {
        "date": "2026-09-11T11:46:33.436+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.6.0"
        }
      },
      "id": "WID-SEC-W-2026-2808",
      "initial_release_date": "2026-08-12T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-08-12T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2026-08-27T22:00:00.000+00:00",
          "number": "2",
          "summary": "CVE-2026-66384 wird ausgenutzt"
        },
        {
          "date": "2026-09-10T22:00:00.000+00:00",
          "number": "3",
          "summary": "Exploit aufgenommen CVE-2026-42016, CVE-2026-42018 und CVE-2026-82329"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "Self-Managed \u003c7.161.16",
                "product": {
                  "name": "JFrog Artifactory Self-Managed \u003c7.161.16",
                  "product_id": "T058054"
                }
              },
              {
                "category": "product_version",
                "name": "Self-Managed 7.161.16",
                "product": {
                  "name": "JFrog Artifactory Self-Managed 7.161.16",
                  "product_id": "T058054-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:jfrog:artifactory:self-managed__7.161.16"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "SaaS \u003c7.164.0",
                "product": {
                  "name": "JFrog Artifactory SaaS \u003c7.164.0",
                  "product_id": "T058055"
                }
              },
              {
                "category": "product_version",
                "name": "SaaS 7.164.0",
                "product": {
                  "name": "JFrog Artifactory SaaS 7.164.0",
                  "product_id": "T058055-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:jfrog:artifactory:saas__7.164.0"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Artifactory"
          }
        ],
        "category": "vendor",
        "name": "JFrog"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-42018",
      "product_status": {
        "known_affected": [
          "T058055",
          "T058054"
        ]
      },
      "release_date": "2026-08-12T22:00:00.000+00:00",
      "title": "CVE-2026-42018"
    },
    {
      "cve": "CVE-2026-65926",
      "product_status": {
        "known_affected": [
          "T058055",
          "T058054"
        ]
      },
      "release_date": "2026-08-12T22:00:00.000+00:00",
      "title": "CVE-2026-65926"
    },
    {
      "cve": "CVE-2026-66016",
      "product_status": {
        "known_affected": [
          "T058055",
          "T058054"
        ]
      },
      "release_date": "2026-08-12T22:00:00.000+00:00",
      "title": "CVE-2026-66016"
    },
    {
      "cve": "CVE-2026-66375",
      "product_status": {
        "known_affected": [
          "T058055",
          "T058054"
        ]
      },
      "release_date": "2026-08-12T22:00:00.000+00:00",
      "title": "CVE-2026-66375"
    },
    {
      "cve": "CVE-2026-66376",
      "product_status": {
        "known_affected": [
          "T058055",
          "T058054"
        ]
      },
      "release_date": "2026-08-12T22:00:00.000+00:00",
      "title": "CVE-2026-66376"
    },
    {
      "cve": "CVE-2026-66377",
      "product_status": {
        "known_affected": [
          "T058055",
          "T058054"
        ]
      },
      "release_date": "2026-08-12T22:00:00.000+00:00",
      "title": "CVE-2026-66377"
    },
    {
      "cve": "CVE-2026-66378",
      "product_status": {
        "known_affected": [
          "T058055",
          "T058054"
        ]
      },
      "release_date": "2026-08-12T22:00:00.000+00:00",
      "title": "CVE-2026-66378"
    },
    {
      "cve": "CVE-2026-66379",
      "product_status": {
        "known_affected": [
          "T058055",
          "T058054"
        ]
      },
      "release_date": "2026-08-12T22:00:00.000+00:00",
      "title": "CVE-2026-66379"
    },
    {
      "cve": "CVE-2026-66380",
      "product_status": {
        "known_affected": [
          "T058055",
          "T058054"
        ]
      },
      "release_date": "2026-08-12T22:00:00.000+00:00",
      "title": "CVE-2026-66380"
    },
    {
      "cve": "CVE-2026-66381",
      "product_status": {
        "known_affected": [
          "T058055",
          "T058054"
        ]
      },
      "release_date": "2026-08-12T22:00:00.000+00:00",
      "title": "CVE-2026-66381"
    },
    {
      "cve": "CVE-2026-66382",
      "product_status": {
        "known_affected": [
          "T058055",
          "T058054"
        ]
      },
      "release_date": "2026-08-12T22:00:00.000+00:00",
      "title": "CVE-2026-66382"
    },
    {
      "cve": "CVE-2026-66384",
      "product_status": {
        "known_affected": [
          "T058055",
          "T058054"
        ]
      },
      "release_date": "2026-08-12T22:00:00.000+00:00",
      "title": "CVE-2026-66384"
    },
    {
      "cve": "CVE-2026-68752",
      "product_status": {
        "known_affected": [
          "T058055",
          "T058054"
        ]
      },
      "release_date": "2026-08-12T22:00:00.000+00:00",
      "title": "CVE-2026-68752"
    },
    {
      "cve": "CVE-2026-68753",
      "product_status": {
        "known_affected": [
          "T058055",
          "T058054"
        ]
      },
      "release_date": "2026-08-12T22:00:00.000+00:00",
      "title": "CVE-2026-68753"
    },
    {
      "cve": "CVE-2026-68754",
      "product_status": {
        "known_affected": [
          "T058055",
          "T058054"
        ]
      },
      "release_date": "2026-08-12T22:00:00.000+00:00",
      "title": "CVE-2026-68754"
    },
    {
      "cve": "CVE-2026-68755",
      "product_status": {
        "known_affected": [
          "T058055",
          "T058054"
        ]
      },
      "release_date": "2026-08-12T22:00:00.000+00:00",
      "title": "CVE-2026-68755"
    },
    {
      "cve": "CVE-2026-68756",
      "product_status": {
        "known_affected": [
          "T058055",
          "T058054"
        ]
      },
      "release_date": "2026-08-12T22:00:00.000+00:00",
      "title": "CVE-2026-68756"
    },
    {
      "cve": "CVE-2026-68757",
      "product_status": {
        "known_affected": [
          "T058055",
          "T058054"
        ]
      },
      "release_date": "2026-08-12T22:00:00.000+00:00",
      "title": "CVE-2026-68757"
    },
    {
      "cve": "CVE-2026-68758",
      "product_status": {
        "known_affected": [
          "T058055",
          "T058054"
        ]
      },
      "release_date": "2026-08-12T22:00:00.000+00:00",
      "title": "CVE-2026-68758"
    },
    {
      "cve": "CVE-2026-68759",
      "product_status": {
        "known_affected": [
          "T058055",
          "T058054"
        ]
      },
      "release_date": "2026-08-12T22:00:00.000+00:00",
      "title": "CVE-2026-68759"
    },
    {
      "cve": "CVE-2026-68760",
      "product_status": {
        "known_affected": [
          "T058055",
          "T058054"
        ]
      },
      "release_date": "2026-08-12T22:00:00.000+00:00",
      "title": "CVE-2026-68760"
    },
    {
      "cve": "CVE-2026-69105",
      "product_status": {
        "known_affected": [
          "T058055",
          "T058054"
        ]
      },
      "release_date": "2026-08-12T22:00:00.000+00:00",
      "title": "CVE-2026-69105"
    },
    {
      "cve": "CVE-2026-69106",
      "product_status": {
        "known_affected": [
          "T058055",
          "T058054"
        ]
      },
      "release_date": "2026-08-12T22:00:00.000+00:00",
      "title": "CVE-2026-69106"
    },
    {
      "cve": "CVE-2026-69107",
      "product_status": {
        "known_affected": [
          "T058055",
          "T058054"
        ]
      },
      "release_date": "2026-08-12T22:00:00.000+00:00",
      "title": "CVE-2026-69107"
    },
    {
      "cve": "CVE-2026-70547",
      "product_status": {
        "known_affected": [
          "T058055",
          "T058054"
        ]
      },
      "release_date": "2026-08-12T22:00:00.000+00:00",
      "title": "CVE-2026-70547"
    }
  ]
}

CVE-2026-42018 (GCVE-0-2026-42018)

Vulnerability from cvelistv5 – Published: 2026-08-12 17:43 – Updated: 2026-10-01 18:06

Title

Anonymous user token generation exposure in JFrog Artifactory

Summary

JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: active Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-01 18:06 UTC

CWE

CWE-287 - Improper Authentication

Assigner

JFROG mitre root

References

4 references

URL	Tags
https://docs.jfrog.com/releases/docs/jfrog-securi…	vendor-advisory
https://docs.jfrog.com/releases/docs/artifactory-…	vendor-advisory
https://www.wiz.io/blog/artifactory-under-attack-…	third-party-advisory
https://www.cisa.gov/known-exploited-vulnerabilit…	government-resource

Impacted products

1 product

Vendor	Product	Version
jfrog	artifactory	Affected: 0 , < 7.111.20 (custom) Affected: 7.117.0 , < 7.117.27 (custom) Affected: 7.125.0 , < 7.125.19 (custom) Affected: 7.133.0 , < 7.133.28 (custom) Affected: 7.146.0 , < 7.146.8 (custom)

Credits

Daniil Vylegzhanin (NetSPI)

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-42018",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-01T18:06:12.895893Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2026-09-11",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42018"
              },
              "type": "kev"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-01T18:06:26.138Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "third-party-advisory"
            ],
            "url": "https://www.wiz.io/blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201"
          },
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42018"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "artifactory",
          "vendor": "jfrog",
          "versions": [
            {
              "lessThan": "7.111.20",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "7.117.27",
              "status": "affected",
              "version": "7.117.0",
              "versionType": "custom"
            },
            {
              "lessThan": "7.125.19",
              "status": "affected",
              "version": "7.125.0",
              "versionType": "custom"
            },
            {
              "lessThan": "7.133.28",
              "status": "affected",
              "version": "7.133.0",
              "versionType": "custom"
            },
            {
              "lessThan": "7.146.8",
              "status": "affected",
              "version": "7.146.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Daniil Vylegzhanin (NetSPI)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eJFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.\u003c/p\u003e"
            }
          ],
          "value": "JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287 Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-18T18:14:10.646Z",
        "orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
        "shortName": "JFROG"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://docs.jfrog.com/releases/docs/jfrog-security-advisories"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Anonymous user token generation exposure in JFrog Artifactory",
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
    "assignerShortName": "JFROG",
    "cveId": "CVE-2026-42018",
    "datePublished": "2026-08-12T17:43:21.289Z",
    "dateReserved": "2026-04-23T13:41:13.755Z",
    "dateUpdated": "2026-10-01T18:06:26.138Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-65926 (GCVE-0-2026-65926)

Vulnerability from cvelistv5 – Published: 2026-08-12 15:14 – Updated: 2026-08-12 18:41

Title

Private Release Bundle versions may be disclosed under specific configurations

Summary

An anonymous caller when anonymous access is enabled, or a low-privilege authenticated user, may learn private Release Bundle names and versions when the bundle name is known.

Severity

3.1 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-12 18:41 UTC

CWE

CWE-862 - Missing Authorization

Assigner

JFROG mitre root

References

2 references

URL	Tags
https://docs.jfrog.com/releases/docs/jfrog-securi…	vendor-advisory
https://docs.jfrog.com/releases/docs/artifactory-…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
jfrog	artifactory	Affected: 0 , < 7.146.35 (custom) Affected: 7.161.0 , < 7.161.16 (custom)

Credits

Khai Tran | OpenAI

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-65926",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-12T18:41:44.422900Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-12T18:41:54.602Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "artifactory",
          "vendor": "jfrog",
          "versions": [
            {
              "lessThan": "7.146.35",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "7.161.16",
              "status": "affected",
              "version": "7.161.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Khai Tran | OpenAI"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAn anonymous caller when anonymous access is enabled, or a low-privilege authenticated user, may learn private Release Bundle names and versions when the bundle name is known.\u003c/p\u003e"
            }
          ],
          "value": "An anonymous caller when anonymous access is enabled, or a low-privilege authenticated user, may learn private Release Bundle names and versions when the bundle name is known."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-12T15:14:42.857Z",
        "orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
        "shortName": "JFROG"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://docs.jfrog.com/releases/docs/jfrog-security-advisories"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases"
        }
      ],
      "title": "Private Release Bundle versions may be disclosed under specific configurations"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
    "assignerShortName": "JFROG",
    "cveId": "CVE-2026-65926",
    "datePublished": "2026-08-12T15:14:42.857Z",
    "dateReserved": "2026-07-23T13:34:38.372Z",
    "dateUpdated": "2026-08-12T18:41:54.602Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-66016 (GCVE-0-2026-66016)

Vulnerability from cvelistv5 – Published: 2026-08-12 15:16 – Updated: 2026-08-12 18:40

Title

Rendered Artifactory Helm manifests may contain generated TLS private keys

Summary

Under specific self-hosted Helm configurations, generated TLS private keys may be retained in rendered manifests accessible to highly privileged local users.

Severity

6.7 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-12 18:39 UTC

CWE

CWE-312 - Cleartext Storage of Sensitive Information

Assigner

JFROG mitre root

References

2 references

URL	Tags
https://docs.jfrog.com/releases/docs/jfrog-securi…	vendor-advisory
https://docs.jfrog.com/releases/docs/artifactory-…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
jfrog	artifactory	Affected: 0 , < 7.146.35 (custom) Affected: 7.161.0 , < 7.161.16 (custom)

Credits

Matthew Bryant | OpenAI

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-66016",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-12T18:39:25.421312Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-12T18:40:04.455Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "artifactory",
          "vendor": "jfrog",
          "versions": [
            {
              "lessThan": "7.146.35",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "7.161.16",
              "status": "affected",
              "version": "7.161.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Matthew Bryant | OpenAI"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eUnder specific self-hosted Helm configurations, generated TLS private keys may be retained in rendered manifests accessible to highly privileged local users.\u003c/p\u003e"
            }
          ],
          "value": "Under specific self-hosted Helm configurations, generated TLS private keys may be retained in rendered manifests accessible to highly privileged local users."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-312",
              "description": "CWE-312 Cleartext Storage of Sensitive Information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-12T15:16:39.640Z",
        "orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
        "shortName": "JFROG"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://docs.jfrog.com/releases/docs/jfrog-security-advisories"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases"
        }
      ],
      "title": "Rendered Artifactory Helm manifests may contain generated TLS private keys"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
    "assignerShortName": "JFROG",
    "cveId": "CVE-2026-66016",
    "datePublished": "2026-08-12T15:16:39.640Z",
    "dateReserved": "2026-07-23T19:59:51.588Z",
    "dateUpdated": "2026-08-12T18:40:04.455Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-66375 (GCVE-0-2026-66375)

Vulnerability from cvelistv5 – Published: 2026-08-12 15:11 – Updated: 2026-08-12 18:46

Title

Low-privilege users may remove protected Artifactory metadata

Summary

A low-privilege authenticated user may permanently remove protected internal metadata across repositories under specific conditions.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-12 18:44 UTC

CWE

CWE-862 - Missing Authorization

Assigner

JFROG mitre root

References

2 references

URL	Tags
https://docs.jfrog.com/releases/docs/jfrog-securi…	vendor-advisory
https://docs.jfrog.com/releases/docs/artifactory-…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
jfrog	artifactory	Affected: 0 , < 7.146.35 (custom) Affected: 7.161.0 , < 7.161.16 (custom)

Credits

Khai Tran | OpenAI

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-66375",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-12T18:44:25.246814Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-12T18:46:03.918Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "artifactory",
          "vendor": "jfrog",
          "versions": [
            {
              "lessThan": "7.146.35",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "7.161.16",
              "status": "affected",
              "version": "7.161.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Khai Tran | OpenAI"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eA low-privilege authenticated user may permanently remove protected internal metadata across repositories under specific conditions.\u003c/p\u003e"
            }
          ],
          "value": "A low-privilege authenticated user may permanently remove protected internal metadata across repositories under specific conditions."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-12T15:11:35.807Z",
        "orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
        "shortName": "JFROG"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://docs.jfrog.com/releases/docs/jfrog-security-advisories"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases"
        }
      ],
      "title": "Low-privilege users may remove protected Artifactory metadata"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
    "assignerShortName": "JFROG",
    "cveId": "CVE-2026-66375",
    "datePublished": "2026-08-12T15:11:35.807Z",
    "dateReserved": "2026-07-25T11:29:31.974Z",
    "dateUpdated": "2026-08-12T18:46:03.918Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-66376 (GCVE-0-2026-66376)

Vulnerability from cvelistv5 – Published: 2026-08-12 14:55 – Updated: 2026-08-12 16:15

Title

Deleted users may temporarily retain access to JFrog Artifactory

Summary

Credentials for a deleted user may remain valid for a short period under specific conditions.

Severity

4.2 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-12 16:14 UTC

CWE

CWE-613 - Insufficient Session Expiration

Assigner

JFROG mitre root

References

2 references

URL	Tags
https://docs.jfrog.com/releases/docs/jfrog-securi…	vendor-advisory
https://docs.jfrog.com/releases/docs/artifactory-…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
jfrog	artifactory	Affected: 0 , < 7.146.35 (custom) Affected: 7.161.0 , < 7.161.16 (custom)

Credits

Ben Morris in collaboration with Claude and Anthropic Research

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-66376",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-12T16:14:43.817446Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-12T16:15:13.664Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "artifactory",
          "vendor": "jfrog",
          "versions": [
            {
              "lessThan": "7.146.35",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "7.161.16",
              "status": "affected",
              "version": "7.161.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ben Morris in collaboration with Claude and Anthropic Research"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eCredentials for a deleted user may remain valid for a short period under specific conditions.\u003c/p\u003e"
            }
          ],
          "value": "Credentials for a deleted user may remain valid for a short period under specific conditions."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-613",
              "description": "CWE-613 Insufficient Session Expiration",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-12T14:55:59.321Z",
        "orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
        "shortName": "JFROG"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://docs.jfrog.com/releases/docs/jfrog-security-advisories"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases"
        }
      ],
      "title": "Deleted users may temporarily retain access to JFrog Artifactory"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
    "assignerShortName": "JFROG",
    "cveId": "CVE-2026-66376",
    "datePublished": "2026-08-12T14:55:59.321Z",
    "dateReserved": "2026-07-25T11:29:31.974Z",
    "dateUpdated": "2026-08-12T16:15:13.664Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-66377 (GCVE-0-2026-66377)

Vulnerability from cvelistv5 – Published: 2026-08-12 15:00 – Updated: 2026-08-13 15:14

Title

Anonymous users may access restricted Artifactory repository information

Summary

An unauthenticated user may access restricted repository information under specific conditions.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-13 15:13 UTC

CWE

CWE-862 - Missing Authorization

Assigner

JFROG mitre root

References

2 references

URL	Tags
https://docs.jfrog.com/releases/docs/jfrog-securi…	vendor-advisory
https://docs.jfrog.com/releases/docs/artifactory-…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
jfrog	artifactory	Affected: 0 , < 7.146.35 (custom) Affected: 7.161.0 , < 7.161.16 (custom)

Credits

Khai Tran | OpenAI

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-66377",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-13T15:13:53.223963Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-13T15:14:05.051Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "artifactory",
          "vendor": "jfrog",
          "versions": [
            {
              "lessThan": "7.146.35",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "7.161.16",
              "status": "affected",
              "version": "7.161.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Khai Tran | OpenAI"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAn unauthenticated user may access restricted repository information under specific conditions.\u003c/p\u003e"
            }
          ],
          "value": "An unauthenticated user may access restricted repository information under specific conditions."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-12T15:00:49.800Z",
        "orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
        "shortName": "JFROG"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://docs.jfrog.com/releases/docs/jfrog-security-advisories"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases"
        }
      ],
      "title": "Anonymous users may access restricted Artifactory repository information"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
    "assignerShortName": "JFROG",
    "cveId": "CVE-2026-66377",
    "datePublished": "2026-08-12T15:00:49.800Z",
    "dateReserved": "2026-07-25T11:29:31.974Z",
    "dateUpdated": "2026-08-13T15:14:05.051Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-66378 (GCVE-0-2026-66378)

Vulnerability from cvelistv5 – Published: 2026-08-12 15:02 – Updated: 2026-08-13 15:15

Title

Authenticated users may access private NuGet metadata

Summary

An authenticated user without repository read permission may access private NuGet metadata under specific conditions.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-13 15:15 UTC

CWE

CWE-862 - Missing Authorization

Assigner

JFROG mitre root

References

2 references

URL	Tags
https://docs.jfrog.com/releases/docs/jfrog-securi…	vendor-advisory
https://docs.jfrog.com/releases/docs/artifactory-…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
jfrog	artifactory	Affected: 0 , < 7.146.35 (custom) Affected: 7.161.0 , < 7.161.16 (custom)

Credits

Khai Tran | OpenAI

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-66378",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-13T15:15:03.696558Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-13T15:15:33.552Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "artifactory",
          "vendor": "jfrog",
          "versions": [
            {
              "lessThan": "7.146.35",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "7.161.16",
              "status": "affected",
              "version": "7.161.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Khai Tran | OpenAI"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAn authenticated user without repository read permission may access private NuGet metadata under specific conditions.\u003c/p\u003e"
            }
          ],
          "value": "An authenticated user without repository read permission may access private NuGet metadata under specific conditions."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-12T15:02:08.515Z",
        "orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
        "shortName": "JFROG"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://docs.jfrog.com/releases/docs/jfrog-security-advisories"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases"
        }
      ],
      "title": "Authenticated users may access private NuGet metadata"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
    "assignerShortName": "JFROG",
    "cveId": "CVE-2026-66378",
    "datePublished": "2026-08-12T15:02:08.515Z",
    "dateReserved": "2026-07-25T11:29:31.974Z",
    "dateUpdated": "2026-08-13T15:15:33.552Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-66379 (GCVE-0-2026-66379)

Vulnerability from cvelistv5 – Published: 2026-08-12 15:03 – Updated: 2026-08-13 15:16

Title

Authenticated users may view private Puppet module metadata

Summary

An authenticated user may view private Puppet module metadata without repository read access.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-13 15:16 UTC

CWE

CWE-862 - Missing Authorization

Assigner

JFROG mitre root

References

2 references

URL	Tags
https://docs.jfrog.com/releases/docs/jfrog-securi…	vendor-advisory
https://docs.jfrog.com/releases/docs/artifactory-…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
jfrog	artifactory	Affected: 0 , < 7.146.35 (custom) Affected: 7.161.0 , < 7.161.16 (custom)

Credits

Khai Tran | OpenAI

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-66379",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-13T15:16:13.465489Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-13T15:16:44.396Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "artifactory",
          "vendor": "jfrog",
          "versions": [
            {
              "lessThan": "7.146.35",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "7.161.16",
              "status": "affected",
              "version": "7.161.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Khai Tran | OpenAI"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAn authenticated user may view private Puppet module metadata without repository read access.\u003c/p\u003e"
            }
          ],
          "value": "An authenticated user may view private Puppet module metadata without repository read access."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-12T15:03:03.158Z",
        "orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
        "shortName": "JFROG"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://docs.jfrog.com/releases/docs/jfrog-security-advisories"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases"
        }
      ],
      "title": "Authenticated users may view private Puppet module metadata"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
    "assignerShortName": "JFROG",
    "cveId": "CVE-2026-66379",
    "datePublished": "2026-08-12T15:03:03.158Z",
    "dateReserved": "2026-07-25T11:29:31.974Z",
    "dateUpdated": "2026-08-13T15:16:44.396Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-66380 (GCVE-0-2026-66380)

Vulnerability from cvelistv5 – Published: 2026-08-12 14:59 – Updated: 2026-08-12 17:26

Title

Authenticated users may access private OCI referrer metadata

Summary

An authenticated user without repository read permission may access private OCI referrer metadata under specific conditions.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-12 17:25 UTC

CWE

CWE-862 - Missing Authorization

Assigner

JFROG mitre root

References

2 references

URL	Tags
https://docs.jfrog.com/releases/docs/jfrog-securi…	vendor-advisory
https://docs.jfrog.com/releases/docs/artifactory-…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
jfrog	artifactory	Affected: 0 , < 7.146.35 (custom) Affected: 7.161.0 , < 7.161.16 (custom)

Credits

Khai Tran | OpenAI

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-66380",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-12T17:25:34.389204Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-12T17:26:45.038Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "artifactory",
          "vendor": "jfrog",
          "versions": [
            {
              "lessThan": "7.146.35",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "7.161.16",
              "status": "affected",
              "version": "7.161.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Khai Tran | OpenAI"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAn authenticated user without repository read permission may access private OCI referrer metadata under specific conditions.\u003c/p\u003e"
            }
          ],
          "value": "An authenticated user without repository read permission may access private OCI referrer metadata under specific conditions."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-12T14:59:24.584Z",
        "orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
        "shortName": "JFROG"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://docs.jfrog.com/releases/docs/jfrog-security-advisories"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases"
        }
      ],
      "title": "Authenticated users may access private OCI referrer metadata"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
    "assignerShortName": "JFROG",
    "cveId": "CVE-2026-66380",
    "datePublished": "2026-08-12T14:59:24.584Z",
    "dateReserved": "2026-07-25T11:29:31.974Z",
    "dateUpdated": "2026-08-12T17:26:45.038Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-66381 (GCVE-0-2026-66381)

Vulnerability from cvelistv5 – Published: 2026-08-12 15:07 – Updated: 2026-08-12 18:43

Title

Repository readers may access content outside configured upstream paths

Summary

A repository reader with cache-deploy permission may access content outside a configured upstream path under specific conditions.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-12 18:42 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory

Assigner

JFROG mitre root

References

2 references

URL	Tags
https://docs.jfrog.com/releases/docs/jfrog-securi…	vendor-advisory
https://docs.jfrog.com/releases/docs/artifactory-…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
jfrog	artifactory	Affected: 0 , < 7.146.35 (custom) Affected: 7.161.0 , < 7.161.16 (custom)

Credits

Khai Tran | OpenAI

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-66381",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-12T18:42:59.383185Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-12T18:43:38.116Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "artifactory",
          "vendor": "jfrog",
          "versions": [
            {
              "lessThan": "7.146.35",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "7.161.16",
              "status": "affected",
              "version": "7.161.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Khai Tran | OpenAI"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eA repository reader with cache-deploy permission may access content outside a configured upstream path under specific conditions.\u003c/p\u003e"
            }
          ],
          "value": "A repository reader with cache-deploy permission may access content outside a configured upstream path under specific conditions."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-12T15:07:01.937Z",
        "orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
        "shortName": "JFROG"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://docs.jfrog.com/releases/docs/jfrog-security-advisories"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases"
        }
      ],
      "title": "Repository readers may access content outside configured upstream paths"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
    "assignerShortName": "JFROG",
    "cveId": "CVE-2026-66381",
    "datePublished": "2026-08-12T15:07:01.937Z",
    "dateReserved": "2026-07-25T11:29:31.974Z",
    "dateUpdated": "2026-08-12T18:43:38.116Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Log in or create an account to share your comment.

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.