Arbitrary Code Execution Vulnerability in JFrog Artifactory by JFrog
CVE-2026-92892

9CRITICAL

Key Information:

Vendor

Jfrog

Status
Jfrog-cli
Vendor
CVE Published:
13 October 2026

What is CVE-2026-92892?

This vulnerability allows for potential arbitrary code execution when JFrog Artifactory is configured in a certain way. Malicious actors could exploit this flaw to execute unauthorized commands on the affected server, compromising the integrity and security of the application environment. It is crucial for users to apply any available mitigations or updates as recommended by the vendor.

Affected Version(s)

jfrog-cli 0 <= 2.126.0

References

https://docs.jfrog.com/releases/docs/jfrog-security-advis...
vendor-advisory
https://github.com/jfrog/jfrog-cli/releases
vendor-advisory

CVSS V3.1

Score:
9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

nadavgb (reported via HackerOne)
.