JFrog Artifactory contains an authentication weakness that, when the system is left in its default state, may permit an unauthenticated attacker with network connectivity to gain administrative privileges. The flaw is a bypass of the authentication mechanism (CWE‑287). Once exploited, the attacker can perform any action that an administrator can, including modifying configuration, accessing sensitive artifacts, and potentially executing arbitrary code on the host. This can compromise the confidentiality, integrity, and availability of the Artifactory instance and any data stored within it.

The vulnerability applies to JFrog Artifactory products when operating under the default configuration. The specific affected product is JFrog Artifactory; no particular version information is provided in the advisory.

The CVSS score of 9.8 indicates critical severity, meaning the vulnerability has a wide impact scope and high exploitation potential. The EPSS score of 8% indicates a high likelihood of exploitation, and its inclusion in the CISA KEV catalog confirms that this authentication weakness has been observed in the wild. The likely attack vector is an unauthenticated network attacker reaching any endpoint exposed by Artifactory, bypassing authentication checks, and escalating privileges to administrative level. Such an exploit requires no privileged credentials and can be carried out remotely in the presence of network access to the Artifactory instance.