CVE-2026-66384

CVE-2026-66384 is a directory/path-restriction bypass (CWE-22) in JFrog Artifactory in which an authenticated user can write data outside the intended Docker cache path when specific remote-repository conditions are met. The attack is carried out over the network using valid low-privilege credentials and requires no user interaction, but the triggering conditions are specific enough that the CVSS vector rates exploit complexity as high. A successful attacker gains unauthorized modification of files outside the cache directory (integrity impact only per the CVSS vector, with no confidentiality or availability impact scored), potentially tampering with stored content or system files depending on the deployment. Any organization running JFrog Artifactory with Docker remote repositories is potentially affected. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-08-27, confirming exploitation in the wild; no public proof-of-concept is known and ransomware use is not confirmed.

What to do: Check JFrog's security advisory for CVE-2026-66384 and upgrade Artifactory to the fixed release it specifies (no version numbers are provided in the available data). Because the flaw is on the CISA KEV list (added 2026-08-27), federal agencies must remediate per BOD 26-04 timelines or discontinue use, and all operators should review Docker remote-repository configurations for the triggering conditions and audit for unexpected writes outside the Docker cache path. Restricting authenticated Artifactory access to trusted users and CI systems limits exposure while patching is completed.