CVE-2026-65617: JFrog Artifactory Information Disclosure

CVE-2026-65617 Overview

CVE-2026-65617 is a deserialization weakness in JFrog Artifactory's package handling logic. An authenticated low-privileged user can leverage the flaw under specific repository configurations to compromise confidentiality, integrity, and availability of the Artifactory instance. The issue is tracked under CWE-502: Deserialization of Untrusted Data and affects self-managed JFrog Artifactory deployments. Because Artifactory functions as a central artifact repository for software supply chains, exploitation can cascade into downstream build systems and consumers of hosted packages.

Critical Impact
A low-privileged authenticated attacker can trigger unsafe deserialization over the network to compromise the Artifactory server and the packages it distributes.

Affected Products

JFrog Artifactory (self-managed) — see the JFrog Security Advisories for the fixed version list
Artifactory package handling components processing serialized objects
Repositories configured to accept package uploads or metadata from authenticated users

Discovery Timeline

2026-07-27 - CVE-2026-65617 published to the National Vulnerability Database (NVD)
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-65617

Vulnerability Analysis

The flaw resides in how JFrog Artifactory deserializes package-related data during repository operations. When Artifactory reconstructs objects from attacker-influenced input, it fails to enforce strict type constraints on the deserialization path. This allows an authenticated attacker with low privileges to submit crafted serialized payloads that instantiate unintended classes or invoke gadget chains during object reconstruction.

Exploitation requires network access to the Artifactory API and valid credentials with permission to interact with an affected repository. The attack requires no user interaction and can be executed with low complexity. Successful exploitation grants the attacker control over the affected Artifactory process, enabling code execution, data theft, or manipulation of stored artifacts.

Root Cause

The root cause is unsafe deserialization of untrusted data in package handling routines. The affected code paths accept serialized objects tied to package metadata or repository operations without validating the object graph against an allowlist of expected types. Deserialization frameworks that permit arbitrary type instantiation expose gadget chains present in Artifactory's classpath, transforming a data-parsing operation into arbitrary logic execution.

Attack Vector

The attack vector is network-based and authenticated. An attacker with low-privileged repository access sends a crafted request to a package handling endpoint containing a malicious serialized payload. When Artifactory deserializes the payload, chained method invocations execute within the server process. This can lead to remote code execution on the Artifactory host, tampering with hosted packages, and disruption of artifact distribution to downstream consumers. See the JFrog Security Advisories for endpoint-specific detail.

Detection Methods for CVE-2026-65617

Indicators of Compromise

Unexpected outbound network connections originating from the Artifactory service account, particularly to unfamiliar hosts shortly after package upload activity
New or modified files in the Artifactory installation or data directories that do not correlate with legitimate deployments or upgrades
Anomalous child processes spawned by the Artifactory JVM, such as shell interpreters, curl, wget, or scripting runtimes
Repository audit log entries showing package operations from low-privileged accounts followed by service errors or restarts

Detection Strategies

Inspect Artifactory request.log and artifactory.log for stack traces referencing deserialization classes such as ObjectInputStream, readObject, or gadget-related libraries
Alert on package upload requests with abnormally large payloads or non-standard content types targeting repository REST endpoints
Correlate authentication events for low-privileged accounts with subsequent process creation or file write events on the Artifactory host

Monitoring Recommendations

Forward Artifactory application logs, system logs, and process telemetry into a centralized analytics platform for correlation
Baseline normal package upload volumes and content types per user, and alert on statistically significant deviations
Monitor Java process behavior on Artifactory servers for unexpected reflection, class loading, or network egress patterns

How to Mitigate CVE-2026-65617

Immediate Actions Required

Upgrade JFrog Artifactory to the fixed release listed in the JFrog Security Advisories as soon as possible
Audit all low-privileged accounts with repository upload or deploy permissions and revoke access that is not strictly required
Rotate credentials, API keys, and access tokens for any account that could have interacted with a vulnerable Artifactory instance
Review recent package uploads and repository configuration changes for signs of tampering

Patch Information

JFrog has published fixed releases through its release channels. Consult the JFrog Artifactory Release Notes for the specific versions containing the patch and follow the vendor's upgrade procedure. Cloud-hosted JFrog customers should confirm patch status with JFrog support.

Workarounds

Restrict network access to Artifactory administrative and API endpoints so that only trusted networks and identities can reach them
Limit repository write and deploy permissions to a minimal set of service accounts, and disable anonymous or self-service registration where feasible
Place a web application firewall or reverse proxy in front of Artifactory to inspect and rate-limit package upload requests
If upgrading immediately is not possible, disable or isolate repository types identified in the vendor advisory as affected until the patch is applied

bash

# Example: restrict Artifactory API access at the network layer using iptables
iptables -A INPUT -p tcp --dport 8081 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 8082 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 8081 -j DROP
iptables -A INPUT -p tcp --dport 8082 -j DROP