CVE-2026-65925

MEDIUM

Server-Side Request Forgery (SSRF) via JFrog Artifactory Cargo remote repository

Title source: cna

A user with JFrog Artifactory Cargo remote repository read access could make Artifactory request unintended URLs and return the response.

Core 2

Core References

Vendor Advisory vendor-advisory

Vendor Advisory vendor-advisory

CVSS v3 6.5

EPSS 0.0021

EPSS Percentile 11.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

CWE

CWE-918

Status published

Products (6)

jfrog/artifactory < 7.111.18 (2 CPE variants)

jfrog/artifactory 7.117.0 - 7.117.25

jfrog/artifactory 7.125.0 - 7.125.18

jfrog/artifactory 7.133.0 - 7.133.27

jfrog/artifactory 7.146.0 - 7.146.34

jfrog/artifactory 7.161.0 - 7.161.15

Published Jul 27, 2026

Tracked Since Jul 28, 2026