Vendor

JFrog

4 of 5 JFrog CVEs in Patchfirst (80%) are in of vulnerabilities exploited in the wild.

CVEs: 5
In CISA KEV: 480%
Known ransomware use: 0
Median days to KEV: 22; from publication
Latest KEV listing: 11 Sep 2026

Watch JFrog Subscribe (RSS) JSON Feed All feeds

Products

In KEVOther CVEs

ProductKEVCVEs
Artifactory In KEV: 4 CVEs: 5

Top ATT&CK techniques

What attackers do with JFrog CVEs

TechniqueCVEs
T1190Exploit Public-Facing Application CVEs: 3
T1078Valid Accounts CVEs: 2
T1528Steal Application Access Token CVEs: 1
T1565Data Manipulation CVEs: 1

Open in ATT&CK Navigator

A layer for MITRE’s ATT&CK Navigator: techniques scored by the highest Patchfirst priority among their CVEs, neutral to red, with the CVE ids in each comment. “Open in Navigator” loads https://patchfirst.co/navigator/vendor/jfrog.json. Or download it and in Navigator choose Open Existing Layer → Upload from local.

Counts are JFrog CVEs linked to the technique. Each link’s provenance is on the CVE page.

JFrog CVEs

5 CVEs, by priority

CVE-2026-82329JFrog Artifactory Improper Authentication Vulnerability
JFrog · ArtifactoryKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1078Valid Accounts
14.4%Top 3.4%
79.2priority
CVE-2026-42018JFrog Artifactory Improper Authentication Vulnerability
JFrog · ArtifactoryKEVPublic exploitHigh · 7.5T1190Exploit Public-Facing Application T1528Steal Application Access Token
9.8%Top 4.5%
77.4priority
CVE-2026-42016JFrog Artifactory Incorrect Authorization Vulnerability
JFrog · ArtifactoryKEVHigh · 8.8T1078Valid Accounts
8.6%Top 4.9%
73.2priority
CVE-2026-66384JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability
JFrog · ArtifactoryKEVPublic exploitMedium · 5.3T1190Exploit Public-Facing Application T1565Data Manipulation
0.7%Top 48%
67.1priority
CVE-2019-17444JFrog Artifactory does not enforce default admin password change
Jfrog · ArtifactoryPublic exploitCritical · 9.8
69.4%Top 0.64%
31.7priority