CVE-2026-66380

MEDIUM 4.3CVE-2026-66380 · Published 12/08/2026 · updated 24/10/2026

In short

CVE-2026-66380 is a MEDIUM (CVSS 4.3) vulnerability affecting artifactory (jfrog).
Chance of exploitation in the next 30 days (EPSS): 0.30%, higher than 22.8% of all vulnerabilities.
Fix: update to 7.161.16, 7.146.35 or later.

Package	Affected versions	Patched versions
artifactory jfrog	`≥ 7.161.0, < 7.161.16< 7.146.35`	`7.161.167.146.35`

An authenticated user without repository read permission may access private OCI referrer metadata under specific conditions.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

≥ 7.161.0, < 7.161.16< 7.146.35

7.161.167.146.35

More vulnerabilities in artifactory

See all →