CVE-2026-65616Active Exploitation(jfrog / artifactory)

LOWCVSS 8.8 · HIGH

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

Prioritize remediation for jfrog artifactory systems immediately
Assume compromise if assets are exposed
Track advisory updates for patch or workaround availability

Recommended action window: Immediate (within 24h)

NVD description

Incorrect authorization validation in refresh token signature allows non-admin users to obtain a signed JFrog administrator token.

jfrog CVEs Back to dashboard

3.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://docs.jfrog.com/releases/docs/jfrog-security-advisories

Other references

https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases

Weakness type (CWE)

CWE-347

Priority

LOW

Exploitation

ACTIVE

PoC

NONE

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

artifactory

Threat summary

Active exploitation appears in 1 classified signals
3 mentions across 3 observed days
Momentum state: stable

What's happening

Active exploitation reported across 1 signal
Technical details provided in 2 signals
Disclosure: 1 classified signal
General: 1 classified signal
Peaked 2d ago at 1 mentions (2026-08-07); latest day: 1
3 total mentions across 3 days

Affected systems

Vendors

jfrog

Products

artifactory

Deep dive

Activity timeline3 mentions / 3d

Signal classification3 categories

Active Exploitation

133.3%

Disclosure

133.3%

General

133.3%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-08-07	1	Active Exploitation1
2026-08-10	1	Disclosure1
2026-08-26	1	General1

Full discourse3 posts

leivaburto@leivaburto27d
General
Despite several vulnerabilities being mentioned in the report, only one is explicitly referenced: CVE-2026-66384, which is attributed to OpenAI's Kostya Kortchinsky. Going through JFrog's security advisories, there are at least 20 other CVEs by OpenAI in the last few months, including the types described in the report: SSRF, privilege escalation, arbitrary file write, etc. Some of them are: CVE-2026-70551, CVE-2026-42016, CVE-2026-66014, CVE-2026-66015, CVE-2026-65616, CVE-66375, CVE-2026-69104, CVE-2026-69105.
Post summary
The message enumerates several CVE identifiers and hints at their general vulnerability types, but it provides no specific PoC, exploit code, patch, or evidence of active exploitation.
10000142
21 followersView on X
T1erOne@tieroneforum43d
Disclosure
Цепочка эксплуатации JFrog Artifactory: от trailing slash до pre-auth RCE (CVE-2026-65616) https://tier1.life/thread/483 http://tieronemkfevyizxcnt355agysp2iemvhon6iyclwrc7yuc7oszgzrid.onion/thread/483 #articles @0xEdra
Post summary
The post announces a chain of exploitation for CVE-2026-65616 in JFrog Artifactory, detailing a pre‑authentication remote code execution path but provides no PoC code or evidence of active attacks.
00001394
300 followersView on X
Charles Swiger@chswiger46d
Active Exploitation
looks like the clever chaps exploited this artifactory vulnerability https://www.sentinelone.com/vulnerability-database/cve-2026-65616/. .
Post summary
The post highlights that CVE‑2026‑65616, an Artifactory vulnerability, is being actively exploited, referencing a SentinelOne database entry but offering no deeper technical or mitigation information.
1000047
309 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	jfrog	artifactory	-	-	-

Explore more

Back to dashboard jfrog CVEs artifactory vulnerabilities