CVE-2026-65617

Analyzed Analyzed - Analysis Complete

Deserialization Flaw in JFrog Artifactory

Publication date: 2026-07-27

Last updated on: 2026-07-30

Assigner: JFrog

Description

A deserialization weakness in JFrog Artifactory package handling could allow a low-privileged user to impact confidentiality, integrity, and availability under specific repository conditions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-27

Last Modified

2026-07-30

Generated

2026-08-17

AI Q&A

2026-07-27

EPSS Evaluated

2026-08-15

NVD

CVE-2026-65617

EUVD

EUVD-2026-49579

Affected Vendors & Products

Vendor	Product	Version / Range
jfrog	artifactory	From 7.161.0 (inc) to 7.161.15 (exc)
jfrog	artifactory	to 7.111.18 (exc)
jfrog	artifactory	From 7.117.0 (inc) to 7.117.25 (exc)
jfrog	artifactory	From 7.125.0 (inc) to 7.125.18 (exc)
jfrog	artifactory	From 7.133.0 (inc) to 7.133.27 (exc)
jfrog	artifactory	From 7.146.0 (inc) to 7.146.34 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-502	The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

Executive Summary

This vulnerability is a deserialization weakness in JFrog Artifactory's package handling. It allows a low-privileged user to exploit specific repository conditions to impact confidentiality, integrity, and availability of the system.

Impact Analysis

A low-privileged attacker could exploit this to gain unauthorized access, modify data, or disrupt services, potentially leading to data breaches or system outages.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's confidentiality requirements or HIPAA's integrity and availability standards, potentially resulting in compliance violations.

Mitigation Strategies

Update JFrog Artifactory to the latest patched version immediately. Review repository permissions to ensure low-privileged users cannot modify package handling. Monitor for unusual activity in package repositories.

Hi! I’m here to help you understand CVE-2026-65617. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70