[NEW] [high] JFrog Artifactory: Multiple vulnerabilities

highCVE-2026-69104 CVE-2026-70548 CVE-2026-70550 CVE-2026-70551

A remote, authenticated attacker can exploit multiple vulnerabilities in JFrog Artifactory to bypass security measures, perform SSRF attacks, manipulate data, disclose confidential information, or cause a denial-of-service condition.

CSIRTS triage

vendor: JFrog product: Artifactory Authentication bypass Server-side request forgery Information disclosure Denial of service

What: Multiple vulnerabilities in Artifactory allow authenticated attackers to bypass security, conduct SSRF attacks, manipulate data, disclose information, or cause denial of service.
Who is affected: JFrog Artifactory instances accessible to authenticated users are vulnerable.
Urgency: High priority; SSRF and authenticated bypass can lead to lateral movement and data exposure in artifact repositories.
Action: Apply JFrog Artifactory security patches for CVE-2026-69104, CVE-2026-70548, CVE-2026-70550, and CVE-2026-70551.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch Artifactory

Get an email when a new Artifactory advisory drops — max one per day, one-click unsubscribe.

Details

Source: CERT-Bund (BSI) Security Advisories (DE · national-cert · site)
Severity: high
Published: 2026-08-26
Exploitation: Not in CISA KEV at last sync
Language: Machine-translated to English — verify against the original

Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-3026

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-691040.18% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 7% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-705480.18% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 8% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-705500.21% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 11% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-705510.18% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 7% of all EPSS-scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-69104	coverage & exploitation status	NVD · CVE.org
CVE-2026-70548	coverage & exploitation status	NVD · CVE.org
CVE-2026-70550	coverage & exploitation status	NVD · CVE.org
CVE-2026-70551	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

Recent advisories for JFrog Artifactory

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

criticalexploited[NEW] [high] JFrog Artifactory: Vulnerability allows obtaining administrator privilegescert-bund · 2026-09-03
unknownexploitedNCSC-2026-0336 [1.00] [M/H] Vulnerability patched in JFrog Artifactoryncsc-nl · 2026-09-02
criticalexploitedCVE-2026-82329: JFrog Artifactory Improper Authentication Vulnerabilitycisa-kev · 2026-09-02
unknownexploitedMultiple vulnerabilities in JFrog Artifactory (September 01, 2026)cert-fr-avis · 2026-09-01
criticalexploitedCVE-2026-82329: JFrog Artifactory contains an authentication weakness that, under default configuration, may a…nvd · 2026-08-28
highexploited[NEW] [high] JFrog Artifactory: Multiple vulnerabilitiescert-bund · 2026-08-28