CVE-2026-65617

HighCVSS 8.8/10Last modified Oct 24, 2026

Description

A deserialization weakness in JFrog Artifactory package handling could allow a low-privileged user to impact confidentiality, integrity, and availability under specific repository conditions.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

Vendor	Product	Versions
jfrog	artifactory	< 7.111.18; >= 7.117.0, < 7.117.25; >= 7.125.0, < 7.125.18; >= 7.133.0, < 7.133.27; >= 7.146.0, < 7.146.34; >= 7.161.0, < 7.161.15

References

https://docs.jfrog.com/releases/docs/artifactory-self-managed-releasesRelease Notes
https://docs.jfrog.com/releases/docs/jfrog-security-advisoriesVendor Advisory

Timeline

Published: Jul 27, 2026
Last modified: Oct 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-656186.5Improper URL validation when handling specific URLs, allows an attacker, under certain conditions, to make unauthorized requests from JFrog CVE-2026-65627.3A flaw has been found in dameng100 muucmf 1.9.5.20260309. Impacted is the function getListByPage of the file /index/Search/index.html. Execu CVE-2026-656238.7Inefficient Algorithmic Complexity vulnerability in mtrudel bandit allows unauthenticated remote denial of service via CPU exhaustion during CVE-2026-656246.9Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows an unauthenticated remote attacker to exhaust CVE-2026-656255.9The pure-Erlang AES-GCM fallback in jose_jwa_aes derives the number of verified authentication tag bits from the attacker-supplied tag itsel CVE-2026-656265.9The pure-Erlang RSAES-PKCS1-v1_5 decryption in the jose_jwa_pkcs1 module is a Bleichenbacher padding oracle. eme_pkcs1_decode/2 returns the CVE-2026-656276.9Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in potatosalad jose (erlang-jose) allows a remote attacker to CVE-2026-656285.9jose_jwk:shared_secret/2 (exposed in Elixir as JOSE.JWK.shared_secret/2) derives an ECDH shared secret from two JWKs. Its first function cla CVE-2026-656297.4Use of Password Hash With Insufficient Computational Effort in the jose library allows an attacker who obtains a password-encrypted private-CVE-2026-65638.8A vulnerability has been found in H3C Magic B1 up to 100R004. The affected element is the function SetAPWifiorLedInfoById of the file /gofor CVE-2026-656305.9Observable Timing Discrepancy vulnerability in potatosalad jose allows recovery of a long-term X25519 private key through a timing side chan CVE-2026-656316.9Inefficient Algorithmic Complexity in erlang-jose allows an unauthenticated remote attacker to cause a CPU-exhaustion denial of service by s