🟡 CVE-2026-66384

CVE-2026-66384 is a path traversal (CWE-22) vulnerability in JFrog Artifactory allowing an authenticated user to write data outside the intended Docker cache path under specific remote-repository conditions. The flaw provides server-side file-write capability (integrity impact HIGH), is confirmed actively exploited, and is listed in CISA KEV. Because it requires valid authentication and high attack complexity, and Artifactory is often deployed internally, the internet-exploitability is MEDIUM_RISK rather than HIGH.

← Back to Overview
MEDIUM_RISK
Risk Level
5.3
CVSS Score
NETWORK
Attack Vector
Initial Access
ATT&CK Tactic
T1190 — Exploit Public-Facing Application
ATT&CK Technique
MEDIUM
Deployment Risk
No
Ransomware

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-08-12

Added to CISA KEV: 2026-08-27 15 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

🔍 Web Intelligence (Kagi · 2026-09-14)

Summary

CVE-2026-66384 is a path traversal vulnerability (CWE-22) affecting JFrog Artifactory that allows an authenticated user to write data outside the intended Docker cache directory under specific remote-repository conditions [2][3]. This flaw is significant because it enables unauthorized modification of files outside restricted directories, potentially allowing an attacker to tamper with or replace critical repository artifacts, thereby compromising the integrity of software supply chain components managed by the platform [1].

Exploitation

  • Active Exploitation: The vulnerability is confirmed to be actively exploited in the wild and has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog [2][5].
  • Threat Actors/Campaigns: While the specific threat actors or ransomware campaigns utilizing this exploit are currently unknown, its presence in the CISA KEV highlights the urgency of remediation [4].
  • PoC/Exploit Availability: Proof-of-concept or exploit tools are implied to be available given the documented active exploitation [2].
  • Attack Prerequisites: Exploitation requires the attacker to be an authenticated user and involves specific remote-repository configurations [1][3].

Affected Products & Patches

  • Affected Product: JFrog Artifactory [2][7].
  • Patch/Hotfix Availability: Users are advised to upgrade to Artifactory version 7.161.16 or later to address the vulnerability [6].
  • Mitigations: Organizations should review their remote-repository configurations and ensure the software is updated; specific detection rules may also be available from security vendors [2].

Impact

  • Access/Capabilities: Successful exploitation grants an attacker the ability to write files to unintended locations on the server file system, circumventing directory restrictions [1].
  • Business Risk: For internet-facing deployments, the primary risk is the corruption or replacement of critical repository artifacts, which could lead to supply chain poisoning or unauthorized code execution within the organization's development and production pipelines [1].

Sources

  1. CVE-2026-66384 - Vulnerability Details - OpenCVE

    An authenticated user can write data outside the intended Docker cache path when using specific remote-repository settings, which is a classic path traversal flaw (CWE-22). The vulnerability allows unauthorized modification of files that should be restricted to the cache directory, potentially enabl…

  2. CVE-2026-66384: Jfrog Artifactory path traversal — actively exploited

    In CISA KEV · Patch: docs.jfrog.com · Path traversal in Jfrog Artifactory · detection rules · CVSS 5.3 MEDIUM. An authenticated user may write data outside…

  3. CVE Record: CVE-2026-66384

    An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions.

  4. CVE-2026-66384 — Analyst Brief

    CVE-2026-66384: exploitation likelihood, recommended mitigation, affected industries, and full technical detail. Known ransomware use Unknown…

  5. CVE-2026-66384 on CISA KEV - SARA Open - SIRP

    CVE-2026-66384 — newly added to CISA KEV. An authenticated user may write data outside the intended Docker cache path under specific remote- ...

Generated by PatchNow Intelligence System

Analysis based on CIRCL.LU data, Claude AI assessment, and MITRE ATT&CK framework

📄 Download JSON Data | 📡 RSS Feed