by Kastro
Paper/Archive/CVE-2026-92892

CVE-2026-92892

jfrog jfrog-cli — Potential command execution on the host running JFrog CLI.

EPSS 0.3%CVSS 9.0
critical.is priorityof 100
33
CVSS 9.0 (CNA)9.0 / 10 × 3027.0Not in CISA KEV+300.0EPSS percentile 27.5.275 × 205.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Potential arbitrary code execution under specific configurations. Updated October 22, 2026: Affected versions now include JFrog CLI v2.127.0. For remediation, update to v2.128.0 or later.

Affected

ProductAffectedFixed inSource
jfrog-cli< 2.128.02.128.0CNA

Scores by source

JFROG (CNA)9.0CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

advisorydocs.jfrog.com/releases/docs/jfrog-security-advisoriesadvisorygithub.com/jfrog/jfrog-cli/releases