Deserialization of Untrusted Data in Artifactory - CVE-2026-68756
Published: August 31, 2026
Vulnerability identifier: #VU146471
CSH Severity: Low
CVSS v4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-68756
CWE-ID: CWE-502
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to affect Artifactory session handling.
The vulnerability exists due to deserialization of untrusted data in stored session data handling when processing stored session data. A remote user can modify stored session data to affect Artifactory session handling.
Exploitation requires write access to stored session data and only occurs under specific conditions.
Affected software
Artifactory
How to mitigate CVE-2026-68756
Install security update from vendor's website.
Artifactory - addressed in versions 7.146.35, 7.161.16