This vulnerability (CVE-2026-65617) involves a deserialization weakness in JFrog Artifactory's package handling functionality. Exploitation could allow an attacker with low privileges to compromise confidentiality, integrity, and availability of the system. The CVSS 3.1 base score is 8.8, indicating high severity, with network attack vector, low attack complexity, and no user interaction required. The affected versions explicitly include 7.117.0, 7.125.0, 7.133.0, 7.146.0, and 7.161.0. As of the published date, no patch or official remediation level has been provided by JFrog.

Successful exploitation could lead to full compromise of confidentiality, integrity, and availability of the affected Artifactory instances. This could allow unauthorized data access, data modification, or service disruption. The vulnerability requires only low privileges and no user interaction, increasing the risk in exposed environments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to Artifactory repositories to trusted users only and monitor for suspicious activity related to deserialization processes. Avoid exposing vulnerable versions to untrusted networks.