CVE-2026-66014
Full vulnerability record from the local CVENow database.
Description
JFrog Artifactory contains an authentication handling weakness in internal request processing that, under specific conditions, may allow an attacker to escalate privileges beyond the intended access level.
Severity
HIGH
CVSS score
8.8
(v3.1)
Vulnerability status
Analyzed
Source identifier
Published
2026-07-27 20:16:41.790000
Last modified
2026-10-24 13:10:00.147000
View original CVE JSON
{
"id": "CVE-2026-66014",
"sourceIdentifier": "[email protected]",
"published": "2026-07-27T20:16:41.790",
"lastModified": "2026-10-24T13:10:00.147",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "JFrog Artifactory contains an authentication handling weakness in internal request processing that, under specific conditions, may allow an attacker to escalate privileges beyond the intended access level."
},
{
"lang": "es",
"value": "JFrog Artifactory contiene una debilidad en el manejo de la autenticación en el procesamiento de solicitudes internas que, bajo condiciones específicas, podría permitir a un atacante escalar privilegios más allá del nivel de acceso previsto."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "jfrog",
"product": "artifactory",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"lessThan": "7.111.18",
"versionType": "custom",
"status": "affected"
},
{
"version": "7.117.0",
"lessThan": "7.117.25",
"versionType": "custom",
"status": "affected"
},
{
"version": "7.125.0",
"lessThan": "7.125.18",
"versionType": "custom",
"status": "affected"
},
{
"version": "7.133.0",
"lessThan": "7.133.27",
"versionType": "custom",
"status": "affected"
},
{
"version": "7.146.0",
"lessThan": "7.146.34",
"versionType": "custom",
"status": "affected"
},
{
"version": "7.161.0",
"lessThan": "7.161.15",
"versionType": "custom",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-07-27T20:15:11.976218Z",
"id": "CVE-2026-66014",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-287"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:jfrog:artifactory:*:*:*:*:*:-:*:*",
"versionEndExcluding": "7.111.18",
"matchCriteriaId": "151CCEC4-A0A0-496D-A8B7-72506F01A35B"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:jfrog:artifactory:*:*:*:*:*:-:*:*",
"versionStartIncluding": "7.117.0",
"versionEndExcluding": "7.117.25",
"matchCriteriaId": "910195A3-A894-48FF-A34A-26DD34761B19"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:jfrog:artifactory:*:*:*:*:*:-:*:*",
"versionStartIncluding": "7.125.0",
"versionEndExcluding": "7.125.18",
"matchCriteriaId": "9D1868C0-C39A-48E2-B409-3695A4C5E42D"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:jfrog:artifactory:*:*:*:*:*:-:*:*",
"versionStartIncluding": "7.133.0",
"versionEndExcluding": "7.133.27",
"matchCriteriaId": "5AE54814-899E-4112-B109-13E37CBD22DF"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:jfrog:artifactory:*:*:*:*:*:-:*:*",
"versionStartIncluding": "7.146.0",
"versionEndExcluding": "7.146.34",
"matchCriteriaId": "E6A34476-6BAA-4A28-8224-7A1F994A0A07"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:jfrog:artifactory:*:*:*:*:*:-:*:*",
"versionStartIncluding": "7.161.0",
"versionEndExcluding": "7.161.15",
"matchCriteriaId": "584293DE-36E6-43DD-85BF-4AE115FBD415"
}
]
}
]
}
],
"references": [
{
"url": "https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases",
"source": "[email protected]",
"tags": [
"Release Notes"
]
},
{
"url": "https://docs.jfrog.com/releases/docs/jfrog-security-advisories",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
}
]
}