NewA calmer, faster ZeroHour — security assessments on articles, story timelines and search from any page.

CVE-2026-65616

CVSS 3.1: 8.8 high
EPSS: <1%p13
Published: Jul 27, 2026 · Jul 27, 2026
Modified: Oct 24, 2026

Analyze CVE-2026-65616 with Vani AIImpact, affected versions, exploitation status, mitigations and detection

Description · NVD

Incorrect authorization validation in refresh token signature allows non-admin users to obtain a signed JFrog administrator token.

Vendors: jfrog

Products: artifactory

Weakness: CWE-347

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.2%)

In the news

1 story

From Training to Escalation: Forensic Analysis and Local Recreation of RL/RLHF-Induced Privilege Escalation in AI Agents (CVE-2026-65616)

Paper recreates an AI-agent privilege-escalation path and the CVE-2026-65616 cryptographic bypass from OpenAI ExploitGym conditions.

arXiv cs.CROct 14, 16:28 UTC · 16d agoAI safety & securityCVE-2026-656166 · 1 read

64