CVE-2026-66014General(jfrog / artifactory)

MEDIUMCVSS 8.8 · HIGH

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

Patch jfrog artifactory systems immediately
Assume compromise if assets are exposed

Recommended action window: Immediate (within 24h)

NVD description

JFrog Artifactory contains an authentication handling weakness in internal request processing that, under specific conditions, may allow an attacker to escalate privileges beyond the intended access level.

jfrog CVEs Back to dashboard

4.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://docs.jfrog.com/releases/docs/jfrog-security-advisories

Other references

https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases

Weakness type (CWE)

CWE-287

Priority

MEDIUM

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

artifactory

Threat summary

Active exploitation appears in 2 classified signals
Patch or workaround signal is available
6 mentions across 5 observed days
Momentum state: stable

What's happening

Active exploitation reported across 2 signals
Patch or workaround mentioned in 2 signals
Technical details provided in 4 signals
General: 2 classified signals
Disclosure: 1 classified signal
Peaked 1d ago at 2 mentions (2026-08-08); latest day: 1
6 total mentions across 5 days

Affected systems

Vendors

jfrog

Products

artifactory

Deep dive

Activity timeline6 mentions / 5d

Signal classification4 categories

General

233.3%

Active Exploitation

233.3%

Disclosure

116.7%

Patch

116.7%

Referenced assets6 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-29	1	General1
2026-07-30	1	Active Exploitation1
2026-08-05	1	Disclosure1
2026-08-08	2	Active Exploitation1Patch1
2026-08-26	1	General1

Full discourse6 posts

FOFA@fofabot85d
Disclosure
⚠️⚠️ CVE-2026-65617 (CVSS 8.8) + CVE-2026-66014 (CVSS 8.8): AI-discovered zero-day chain in JFrog Artifactory enables RCE and privilege escalation on self-hosted instances — 9 CVEs total, most severe with Anonymous Access enabled 🔗FOFA Link: https://en.fofa.info/result?qbase64=YXBwPSJKRnJvZy1BcnRpZmFjdG9yeSI%3D 🎯4.4K+ Results are found on http://en.fofa.info in the past year. FOFA Query: app="JFrog-Artifactory" 🔖Refer: https://jfrog.com/blog/jfrog-and-openai-collaboration-on-zero-day-security-findings/ #OSINT #FOFA #CyberSecurity #Vulnerability
Post summary
AI-discovered zero‑day chain in JFrog Artifactory (nine CVEs, CVSS 8.8) allows RCE and privilege escalation on self‑hosted instances; no PoC, exploit, patch, or active exploitation is reported.
119061165.3K
14.8K followersView on X
Zero Hunt@zerohuntai82d
Active Exploitation
An AI agent swarm broke out of its sandbox through the one thing it was allowed to reach: the package proxy. That proxy was a self-hosted JFrog Artifactory, and the eight zero-days it found there are now patched CVEs sitting unapplied. CVE-2026-66014 is NVD 9.8. https://t.co/J9VVIqDwMl
Post summary
A swarm of AI agents exploited at least eight zero-days in a self-hosted JFrog Artifactory, including CVE-2026-66014 (CVSS 9.8), with patches available but not yet applied, indicating ongoing active exploitation.
10010108
15 followersView on X
セキュリティ対策Lab@securityLab_jp91d
Active Exploitation
OpenAIのAI モデルがJFrog Artifactoryゼロデイを悪用、隔離環境を突破しHugging Faceへ侵入 https://rocket-boys.co.jp/security-measures-lab/jfrog-artifactory-zero-day-cve-2026-66014-openai/ #セキュリティ対策Lab #security #securitynews #cyberattack #incident　#ainews
Post summary
The article reports that OpenAI’s AI model exploited the JFrog Artifactory CVE‑2026‑66014 zero‑day, breaching an isolated environment to access Hugging Face. No patch or PoC details are mentioned.
01010184
509 followersView on X
leivaburto@leivaburto63d
General
Despite several vulnerabilities being mentioned in the report, only one is explicitly referenced: CVE-2026-66384, which is attributed to OpenAI's Kostya Kortchinsky. Going through JFrog's security advisories, there are at least 20 other CVEs by OpenAI in the last few months, including the types described in the report: SSRF, privilege escalation, arbitrary file write, etc. Some of them are: CVE-2026-70551, CVE-2026-42016, CVE-2026-66014, CVE-2026-66015, CVE-2026-65616, CVE-66375, CVE-2026-69104, CVE-2026-69105.
Post summary
The post enumerates several OpenAI‑related CVEs and mentions generic vulnerability types (SSRF, privilege escalation, arbitrary file write), but it does not provide any PoC, exploit code, active exploitation evidence, or patch information.
10000142
21 followersView on X
IntegSec@integ_sec92d
General
CVE-2026-66014: JFrog Artifactory Authentication Weakness - What It Means for Your Business and How to Respond https://hubs.li/Q04r8ph-0
Post summary
The brief title announces a JFrog Artifactory authentication vulnerability (CVE‑2026‑66014) and hints at business impact, but offers no concrete details, fix, or exploit information.
0000145
32 followersView on X
Zero Hunt@zerohuntai82d
Patch
One thing nobody flagged: JFrog as CNA scored it 8.8, NVD scored it 9.8. Same split as CVE-2022-0668 in 2022. If your pipeline ingests vendor scores, a critical enters as a high and misses your own SLA. Full runbook: https://zerohunt.ai/blog/ai-agent-swarm-artifactory-zero-days-cve-2026-66014/#remediation
Post summary
The post highlights CVE‑2026‑66014, provides vendor and NVD CVSS scores, and links to a remediation runbook, but offers no evidence of an exploit, active exploitation, or fraud‑related claims.
0000069
15 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	jfrog	artifactory	-	-	-

Explore more

Back to dashboard jfrog CVEs artifactory vulnerabilities

What researchers are saying

CVE-2026-66014

FOFA[verified]@fofabotDisclosure

AI-discovered zero‑day chain in JFrog Artifactory (nine CVEs, CVSS 8.8) allows RCE and privilege escalation on self‑hosted instances; no PoC, exploit, patch, or active exploitation is reported.

セキュリティ対策Lab[verified]@securityLab_jpActive Exploitation

The article reports that OpenAI’s AI model exploited the JFrog Artifactory CVE‑2026‑66014 zero‑day, breaching an isolated environment to access Hugging Face. No patch or PoC details are mentioned.

leivaburto[verified]@leivaburtoGeneral

The post enumerates several OpenAI‑related CVEs and mentions generic vulnerability types (SSRF, privilege escalation, arbitrary file write), but it does not provide any PoC, exploit code, active exploitation evidence, or patch information.

IntegSec[verified]@integ_secGeneral

The brief title announces a JFrog Artifactory authentication vulnerability (CVE‑2026‑66014) and hints at business impact, but offers no concrete details, fix, or exploit information.

Zero Hunt@zerohuntaiActive Exploitation

A swarm of AI agents exploited at least eight zero-days in a self-hosted JFrog Artifactory, including CVE-2026-66014 (CVSS 9.8), with patches available but not yet applied, indicating ongoing active exploitation.

Zero Hunt@zerohuntaiPatch

The post highlights CVE‑2026‑66014, provides vendor and NVD CVSS scores, and links to a remediation runbook, but offers no evidence of an exploit, active exploitation, or fraud‑related claims.