CVE-2026-69105: 
Artifactory vulnerability analysis and mitigation

CVE-2026-69105 is a package cache integrity vulnerability in JFrog Artifactory that allows an unauthenticated attacker to cause untrusted package content to be cached under specific conditions, potentially affecting artifact integrity and availability. It affects JFrog Artifactory Self-Managed versions 7.161.0 through 7.161.15 (fixed in 7.161.16), released on August 12, 2026. The vulnerability is classified as High severity with a CVSS v3.1 base score of 8.1 (GitHub Advisory, JFrog Security Advisories).

The root cause is classified as CWE-345 (Insufficient Verification of Data Authenticity), meaning Artifactory does not adequately verify the origin or authenticity of package data before caching it. The attack vector is network-based with low attack complexity and requires no privileges, but does require user interaction to trigger the caching of untrusted content. The vulnerability is categorized under the Packages component and is associated with CAPEC-141 (Cache Poisoning) and CAPEC-148 (Content Spoofing), suggesting the attacker can manipulate what content gets stored in Artifactory's package cache under specific conditions (GitHub Advisory, JFrog Self-Managed Releases).

Successful exploitation results in high integrity and high availability impact with no confidentiality impact. An unauthenticated attacker can cause untrusted or malicious package content to be cached in Artifactory, potentially poisoning the artifact repository used by downstream build pipelines and developers. This could lead to supply chain compromise if tampered packages are subsequently consumed by CI/CD systems, as well as service disruption if cached content causes availability issues (GitHub Advisory, JFrog Security Advisories).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The NVD SSVC assessment confirms exploitation status as "none" and the attack is not automatable due to the required user interaction precondition. The EPSS score is approximately 0.128% (3rd percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

JFrog has addressed this vulnerability in Artifactory Self-Managed version 7.161.16, released August 12, 2026. Self-hosted users should upgrade to version 7.161.16 or later immediately. As an interim measure, administrators should consider disabling anonymous access and restricting cache/deploy permissions for remote repositories for untrusted accounts, consistent with JFrog's general guidance for cache-related vulnerabilities. Cloud-hosted JFrog environments should be verified to confirm they are running a patched version (JFrog Self-Managed Releases, JFrog Security Advisories).

The vulnerability was disclosed by JFrog as part of a batch of security fixes in the Artifactory 7.161.16 release, which addressed over 20 CVEs simultaneously. No notable independent researcher commentary or significant media coverage beyond standard vulnerability tracking sites has been observed at this time (JFrog Self-Managed Releases).