CVE-2026-68754
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
A repository publisher without delete permission may modify protected package content under specific conditions.
Risk Assessment
This could lead to unauthorized changes in packages, compromising repository integrity and potentially introducing malicious code.
Recommendation
Restrict publisher permissions and regularly audit package modification rights.
Other vulnerabilities in Artifactory
See all- CVE-2026-68753Medium
An unauthenticated user may access restricted Artifactory content when a credentialed remote repository is configured in a specific way.
- CVE-2026-66382Medium
An authenticated user may write files outside the intended Artifactory work directory under specific conditions.
- CVE-2026-66381Medium
A repository reader with cache-deploy permission may access content outside a configured upstream path under specific conditions.
- CVE-2026-66380Medium
An authenticated user without repository read permission may access private OCI referrer metadata under specific conditions.
- CVE-2026-66379Medium
An authenticated user may view private Puppet module metadata without repository read access.
- CVE-2026-66378Medium
An authenticated user without repository read permission may access private NuGet metadata under specific conditions.
- CVE-2026-66377Medium
An unauthenticated user may access restricted repository information under specific conditions.
Original NVD description (English source)
A repository publisher without delete permission may modify protected package content under specific conditions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS