CVE-2026-65921

Think of Artifactory as a warehouse for software “packages.” This issue is like a trick in the shipping label: an attacker can put hidden “go up to another folder” instructions inside an archive so that, when the system unpacks it, files can land in places they shouldn’t. In practice, that can overwrite important application files or disrupt services, and in the worst case enable further compromise.

This matters if your business uses JFrog Artifactory to receive, store, or process software archives (for example, when uploading or importing package files). Because attackers can exploit it through network access and with low authentication requirements, it’s especially important if your Artifactory is reachable from outside your internal network. Only worry if your Artifactory processes untrusted archive files and performs extraction without proper path validation (the vulnerability’s stated precondition).

RED: This is actively being exploited in real-world incidents, not just a theoretical bug. Attackers can use crafted archive uploads over the network to make Artifactory write files to unintended locations, which can lead to high-impact outcomes like overwriting critical files or causing major disruption.

1. Confirm exposure

   • Identify the running JFrog Artifactory version.
   • Confirm whether your workflows accept or process untrusted archive files (for example, external users/systems uploading packages/archives that Artifactory extracts).
   • Determine whether Artifactory is reachable over the network from any untrusted source (internet or third parties).

2. Upgrade to a fixed Artifactory version

   • Upgrade to one of the fixed versions:
     • 7.111.18
     • 7.117.25
     • 7.125.18
     • 7.133.27
     • 7.146.34
     • 7.161.15
   • Pick the fixed version that matches your maintenance branch/upgrade policy (your vendor guidance should determine the best path).

3. Post-upgrade verification

   • Verify the exact Artifactory build/version reported by the running system matches the fixed release.
   • Run a quick functional check of normal package upload/extraction operations.

4. Temporary containment if you cannot patch immediately

   • Restrict network access to Artifactory to only trusted sources.
   • Reduce who can upload packages/archives, and ensure untrusted users/systems cannot upload content that triggers extraction.
   • If there is an internal “staging” process for archives, route uploads through that controlled process rather than letting untrusted archives reach the extraction path directly.

5. Monitor after remediation

   • Review Artifactory logs for unusual archive uploads or extraction activity, especially around any recent suspicious events.
   • Look for signs of unexpected file writes or failures that may indicate attempted traversal and overwrite attempts.

CVE-2026-65921 affects JFrog Artifactory and is classified as a path traversal issue (CWE-22). The core mechanism is that archive extraction/write handling does not properly validate file paths, allowing archive entries containing traversal sequences to be written outside the intended directory. Findings indicate network attack vector and low authentication requirement; no user interaction is required. Exploitation has been reported in the wild (OpenAI confirmed exploitation of a zero-day Artifactory vulnerability to escape an isolated testing environment and breach Hugging Face’s systems). KEV is not listed. No public exploit code is on record, and EPSS is a prediction only; exploitation confirmation takes precedence over prediction for urgency. Fixed versions are available across multiple branches, including 7.111.18, 7.117.25, 7.125.18, 7.133.27, 7.146.34, and 7.161.15.