CVE-2026-66384: JFrog Artifactory Path Traversal Added to CISA KEV

Overview

CISA has added CVE-2026-66384, a path traversal vulnerability in JFrog Artifactory, to its Known Exploited Vulnerabilities (KEV) catalog on August 27, 2026, confirming active in-the-wild exploitation. The flaw stems from an improper limitation of a pathname to a restricted directory (CWE-22) in how Artifactory handles Docker cache operations for remote repositories.

Although the CVSS score (5.3, Medium) is modest, its inclusion on the KEV catalog means defenders should treat it as an active, confirmed threat rather than a theoretical one — CISA only adds vulnerabilities with documented evidence of exploitation.

Technical Details

How It Works

The vulnerability lies in how Artifactory constructs filesystem paths when caching Docker artifacts pulled through remote repositories. Under specific remote-repository configurations, path input used to determine the cache location isn't properly normalized against traversal sequences (../), allowing an authenticated user with the right permissions to redirect where cached files are written on disk.

Exploitation requires network access and an authenticated, low-privileged account, plus specific remote-repository and Docker-cache conditions — the attack complexity is high, and there's no impact on confidentiality or availability. The impact is limited to integrity: an attacker can place or overwrite files outside the intended cache path on the Artifactory host.

Affected Versions

• Self-hosted JFrog Artifactory before 7.146.35
• Self-hosted JFrog Artifactory 7.161.0 through 7.161.16

JFrog cloud (SaaS) instances are already patched — this advisory applies to self-hosted deployments only.

Timeline

This advisory was published alongside two other KEV additions the same day — flaws in ownCloud and the Linux kernel — as part of a broader CISA update.

Mitigation

Immediate Actions

• Upgrade self-hosted Artifactory to 7.161.19 or 7.146.36 (JFrog's current fixed releases per its security advisory), or at minimum the versions above cited by CISA (7.146.35 / 7.161.16)
• Audit Docker remote-repository configurations for unusual cache paths or unexpected files outside the intended cache directory
• Review user permissions on remote repositories — the flaw requires an authenticated account, so tightening write access reduces exposure
• Federal agencies must remediate by September 10, 2026 per BOD 22-01; private organizations should treat the same deadline as a strong benchmark

Detection Opportunities

• Unexpected files or binaries appearing outside configured Docker cache directories
• Anomalous authenticated API activity against remote-repository cache endpoints
• File integrity monitoring alerts on Artifactory host paths outside /var/opt/jfrog/artifactory (or your configured data directory)

Why This Matters

Artifactory sits at the center of many organizations' build and deployment pipelines, making it a high-value target even for "medium" severity flaws. A path traversal bug that lets an attacker write files to unexpected locations on a CI/CD artifact server can be a stepping stone toward supply chain compromise — particularly if the written file lands somewhere that gets executed or trusted downstream. Combined with confirmed active exploitation, this is a patch-now situation regardless of the CVSS number.

References

• CISA — Known Exploited Vulnerabilities Catalog
• CISA — CISA Adds Three Known Exploited Vulnerabilities to Catalog
• Security Affairs — CISA adds ownCloud, Linux Kernel, and JFrog Artifactory flaws to its KEV catalog
• JFrog Security Advisories