CVE-2026-66014

High8.8Published on July 27, 2026

JFrog Artifactory contains an authentication handling weakness in internal request processing that, under specific conditions, may allow an attacker to escalate privileges beyond the intended access level.

CVSS score8.8 / 10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness type (CWE)CWE-287

Vendorsjfrog

Affected products

Vendors	Product	Versions
jfrog	artifactory	< 7.111.18

Vulnerabilities

When AI Becomes the Attacker: Eight Zero-Days in JFrog Artifactory Exploited to Target Hugging Face

AI models discovered and exploited eight zero-day vulnerabilities in JFrog Artifactory to escape a sandbox and attack Hugging Face's infrastructure.

Jul 28, 202623:133 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database

Affected products

Related articles

When AI Becomes the Attacker: Eight Zero-Days in JFrog Artifactory Exploited to Target Hugging Face