JFrog Artifactory: known vulnerabilities by version
JFrog lists 384 Artifactory 7.x versions. 375 of them carry at least one known CVE, and 9 carry none. 63 CVEs are on record. Latest release: 7.161.32 (October 6, 2026).
A lookup, not a scan of your server. From NVD and JFrog's own records, pulled October 23, 2026. Artifactory 4, 5 and 6 are not covered.
Paste the version your server reports. Build suffixes such as -03 and a leading v are fine.
Tired of patching Artifactory yourself?
This is what we do. We host your Maven, npm, PyPI and Docker repositories, so there's no Artifactory server to upgrade or patch.
Our migration tool, free to use with CloudRepo, moves your Maven repositories off Artifactory and checks every file.
Every version, by end of life
Newest branch first. End of life is the date JFrog's end-of-life table gives each line, read as of October 23, 2026, the day the data was pulled. Each version links to its page and shows its known-CVE count. A version with no known CVE has no page.
Before end of life
5 branches, 87 versions| 7.161.x ends January 27, 2028 | |
|---|---|
| 7.146.x ends October 16, 2027 | |
| 7.133.x ends July 22, 2027 | |
| 7.125.x ends April 30, 2027 | |
| 7.117.x ends January 14, 2027 |
Past end of life
46 branches, 291 versions| 7.111.x ended October 23, 2026 | |
|---|---|
| 7.104.x ended July 30, 2026 | |
| 7.98.x ended April 29, 2026 | |
| 7.90.x ended January 25, 2026 | |
| 7.84.x ended November 12, 2025 | |
| 7.77.x ended July 24, 2025 |
Show 40 more branches, down to 7.0.x
| 7.71.x ended March 24, 2025 | |
|---|---|
| 7.68.x ended March 11, 2025 | |
| 7.63.x ended January 12, 2025 | |
| 7.59.x ended November 28, 2024 | |
| 7.58.x ended September 30, 2024 | |
| 7.55.x ended August 28, 2024 | |
| 7.49.x ended June 29, 2024 | |
| 7.47.x ended June 1, 2024 | |
| 7.46.x ended April 11, 2024 | |
| 7.41.x ended January 11, 2024 | |
| 7.39.x ended December 20, 2023 | |
| 7.38.x ended November 8, 2023 | |
| 7.37.x ended October 14, 2023 | |
| 7.35.x ended September 2, 2023 | |
| 7.33.x ended August 3, 2023 | |
| 7.31.x ended July 10, 2023 | |
| 7.29.x ended June 5, 2023 | |
| 7.27.x ended March 30, 2023 | |
| 7.25.x ended March 2, 2023 | |
| 7.24.x ended February 11, 2023 | |
| 7.23.x ended January 29, 2023 | |
| 7.21.x ended January 3, 2023 | |
| 7.19.x ended November 24, 2022 | |
| 7.18.x ended October 22, 2022 | |
| 7.17.x ended October 1, 2022 | |
| 7.16.x ended September 5, 2022 | |
| 7.15.x ended August 18, 2022 | |
| 7.12.x ended June 21, 2022 | |
| 7.11.x ended May 17, 2022 | |
| 7.10.x ended April 11, 2022 | |
| 7.9.x ended March 29, 2022 | |
| 7.8.x ended March 16, 2022 |
|
| 7.7.x ended January 29, 2022 | |
| 7.6.x ended December 28, 2021 | |
| 7.5.x ended November 19, 2021 | |
| 7.4.x ended October 6, 2021 | |
| 7.3.x ended September 23, 2021 | |
| 7.2.x ended August 23, 2021 | |
| 7.1.x ended August 17, 2021 |
|
| 7.0.x ended July 12, 2021 |
Sources and method
JFrog's policy: JFrog supports self-managed versions of Artifactory for 18 months from the release of the initial minor version.
Sources: NVD (exact CPE match and the published configurations), the CVE Program record (the vendor's CNA entry with its affected and fixed versions), JFrog's security advisories, release notes and end-of-life page. Pulled October 23, 2026. Every CVE row links to its NVD record and to the vendor's advisory.