Jfrog · AUTOMATIC DISCOVERY
Artifactory is tracked by BlackTree as a server-side software product. Its lifecycle page separates release identity, maintenance and security boundaries using the publisher's registered source.
This record passed BlackTree's automatic primary-source checks with a confidence score of 96. It is returned for operational research without requiring routine manual approval. Confirm edition and deployment applicability before acting.
Artifactory is tracked by BlackTree as a server-side software product. Its lifecycle page separates release identity, maintenance and security boundaries using the publisher's registered source.
Used to provide application, infrastructure or operational services to other systems and users.
Deployed on servers, virtual machines, containers or managed infrastructure.
This category-level context is generated from the registered product identity. Confirm exact product capabilities on the publisher's page .
| Product | Artifactory |
|---|---|
| Release | Product policy |
| End of Support | 27 January 2028 |
| Date precision | Day |
These are product-family matches in the CISA Known Exploited Vulnerabilities catalogue. Confirm the affected product version in the vendor advisory.
JFrog Artifactory contains an improper authentication vulnerability that could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.
CISA entryJFrog Artifactory contains an incorrect authorization vulnerability that leads to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope.
CISA entryJFrog Artifactory contains an improper authentication vulnerability that under default configuration can allow an unauthenticated attacker with network access to obtain administrative privileges.
CISA entryJFrog Artifactory contains an improper limitation of a pathname to a restricted directory vulnerability. This can allow an authenticated user to write data outside the intended Docker cache path under specific remote-repository conditions.
CISA entryOSV advisories are matched through the registered package URL. A package-family match does not prove that the installed release is affected. Check the affected and fixed versions before remediation.
No package advisories have been linked for this product identity.
This is not evidence that the product has no vulnerabilities.
JFrog supports self-managed versions of Artifactory for 18 months from the release of the initial minor version. This page lists Artifactory self-managed versions and their End of Life (EoL) dates. | To see legacy release notes and decomissiond versions, visit the Legacy Docs archive . | This page is updated periodically and may not reflect the latest information. | EoL 27 January 2028 | The following table lists Artifactory Self-Managed versions with an EoL date of 27 January 2028. | EoL 16 October 2027 | The following table lists Artifactory Self-Managed versions with an EoL date of 16 October 2027.
Publisher identity used by product-specific official-source collectors.
Open official vendor source