CVE-2026-66014: artifactory before 7.111.18 (exclusive), from 7.117.0 (inclusive), before 7.117.25 (exclusive), from 7.125.0…

Affected technology

artifactory · before 7.111.18 (exclusive)
jfrog

artifactory · from 7.117.0 (inclusive), before 7.117.25 (exclusive)
jfrog

artifactory · from 7.125.0 (inclusive), before 7.125.18 (exclusive)
jfrog

artifactory · from 7.133.0 (inclusive), before 7.133.27 (exclusive)
jfrog

artifactory · from 7.146.0 (inclusive), before 7.146.34 (exclusive)
jfrog

artifactory · from 7.161.0 (inclusive), before 7.161.15 (exclusive)
jfrog

artifactory · 0 to before 7.111.18, 7.117.0 to before 7.117.25, 7.125.0 to before 7.125.18, 7.133.0 to before 7.133.27, 7.146.0 to before 7.146.34, 7.161.0 to before 7.161.15
jfrog

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

Attack conditions (NVD, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

The source says jFrog Artifactory contains an authentication handling weakness in internal request processing that, under specific conditions, may allow an attacker to escalate privileges beyond the intended access level. Vendor/CNA’s CVSS 3.1 assessment (base score 8.8/10) rates confidentiality, integrity and availability impact as high. NVD’s CVSS 3.1 assessment (base score 8.8/10) rates confidentiality, integrity and availability impact as high.