{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: JFrog vulnerabilities","home_page_url":"https://patchfirst.co/vendor/jfrog/","feed_url":"https://patchfirst.co/feed/vendor/jfrog.json","description":"New and newly exploited JFrog CVEs, with CISA KEV, EPSS and ATT&CK context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2026-42018#kev","url":"https://patchfirst.co/cve/CVE-2026-42018/","title":"[KEV] CVE-2026-42018: JFrog Artifactory Improper Authentication Vulnerability","content_text":"JFrog · Artifactory. In CISA KEV since 2026-09-11. ENISA EUVD lists it as exploited. EPSS 9.8% (higher than 95.5% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1528 Steal Application Access Token. Priority 77.4 of 100.","summary":"JFrog Artifactory Improper Authentication Vulnerability","date_published":"2026-09-11T00:00:00.000Z","date_modified":"2026-10-23T19:10:00.000Z","tags":["kev","public-exploit","T1190","T1528"],"_patchfirst":{"reason":"kev","priority":77.4,"kev":{"dateAdded":"2026-09-11","ransomware":false},"epss":{"score":0.09805,"percentile":0.9554},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"JFrog","product":"Artifactory","techniqueIds":["T1190","T1528"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-42016#kev","url":"https://patchfirst.co/cve/CVE-2026-42016/","title":"[KEV] CVE-2026-42016: JFrog Artifactory Incorrect Authorization Vulnerability","content_text":"JFrog · Artifactory. In CISA KEV since 2026-09-11. ENISA EUVD lists it as exploited. EPSS 8.6% (higher than 95.1% of CVEs). CVSS 8.8 HIGH. ATT&CK: T1078 Valid Accounts. Priority 73.2 of 100.","summary":"JFrog Artifactory Incorrect Authorization Vulnerability","date_published":"2026-09-11T00:00:00.000Z","date_modified":"2026-10-24T13:10:00.000Z","tags":["kev","T1078"],"_patchfirst":{"reason":"kev","priority":73.2,"kev":{"dateAdded":"2026-09-11","ransomware":false},"epss":{"score":0.08643,"percentile":0.95103},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"JFrog","product":"Artifactory","techniqueIds":["T1078"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2026-82329#kev","url":"https://patchfirst.co/cve/CVE-2026-82329/","title":"[KEV] CVE-2026-82329: JFrog Artifactory Improper Authentication Vulnerability","content_text":"JFrog · Artifactory. In CISA KEV since 2026-09-02. ENISA EUVD lists it as exploited. EPSS 14.4% (higher than 96.6% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts. Priority 79.2 of 100.","summary":"JFrog Artifactory Improper Authentication Vulnerability","date_published":"2026-09-02T00:00:00.000Z","date_modified":"2026-09-03T13:06:15.000Z","tags":["kev","public-exploit","T1190","T1078"],"_patchfirst":{"reason":"kev","priority":79.2,"kev":{"dateAdded":"2026-09-02","ransomware":false},"epss":{"score":0.14372,"percentile":0.96613},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"JFrog","product":"Artifactory","techniqueIds":["T1190","T1078"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-66384#kev","url":"https://patchfirst.co/cve/CVE-2026-66384/","title":"[KEV] CVE-2026-66384: JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability","content_text":"JFrog · Artifactory. In CISA KEV since 2026-08-27. ENISA EUVD lists it as exploited. EPSS 0.7% (higher than 51.8% of CVEs). CVSS 5.3 MEDIUM. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1565 Data Manipulation. Priority 67.1 of 100.","summary":"JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability","date_published":"2026-08-27T00:00:00.000Z","date_modified":"2026-10-24T16:10:00.000Z","tags":["kev","public-exploit","T1190","T1565"],"_patchfirst":{"reason":"kev","priority":67.1,"kev":{"dateAdded":"2026-08-27","ransomware":false},"epss":{"score":0.00665,"percentile":0.51756},"cvss":{"score":5.3,"severity":"MEDIUM","version":"3.1"},"vendor":"JFrog","product":"Artifactory","techniqueIds":["T1190","T1565"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2019-17444","url":"https://patchfirst.co/cve/CVE-2019-17444/","title":"CVE-2019-17444: JFrog Artifactory does not enforce default admin password change","content_text":"Jfrog · Artifactory. Not in CISA KEV. EPSS 69.4% (higher than 99.36% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. Priority 31.7 of 100.","summary":"JFrog Artifactory does not enforce default admin password change","date_published":"2020-10-12T00:00:00.000Z","date_modified":"2024-09-16T19:51:55.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":31.7,"kev":null,"epss":{"score":0.69445,"percentile":0.99359},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Jfrog","product":"Artifactory","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}}]}