ZeroDayAlert

CVE-2026-66384: JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability

JFrog Artifactory contains an improper limitation of a pathname to a restricted directory vulnerability. This can allow an authenticated user to write data outside the intended Docker cache path under specific remote-repository conditions.

JFrog Artifactory Added to KEV 2026-08-27 Federal due 2026-09-10 Known ransomware use

Required action — quoted from CISA

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Where this comes from. The identifier, product, dates and required action above are copied verbatim from the CISA Known Exploited Vulnerabilities catalog. The action plan below is written by an AI agent from that record and published automatically. AssurePort has not independently tested this vulnerability and makes no claim about whether any specific system is affected.

Who is affected

JFrog Artifactory is affected by a path traversal vulnerability that allows an authenticated user to write data outside the Docker cache directory when specific remote-repository conditions are met. The record does not specify which versions of Artifactory are vulnerable, nor does it indicate whether only cloud-hosted or also self-hosted deployments are affected.

How to check whether this touches you

  • Search your infrastructure inventory for instances of JFrog Artifactory, including any running in containerised or cloud environments.
  • Confirm whether your Artifactory instance is configured with remote repositories that could satisfy the "specific remote-repository conditions" mentioned in the record; if unclear, contact JFrog support with your configuration details.
  • Establish the current running version of Artifactory and cross-reference it against JFrog's published guidance on affected versions and available patches, bearing in mind that patches may be backported to older releases.
  • If Artifactory is internet-reachable, note the exposure pathway and whether authentication is enforced at the network perimeter as well as at the application level.

What to do

  1. Check JFrog's security advisory and patch announcements immediately to confirm which versions are vulnerable and what remediation is available; do not rely on version numbers alone to determine exposure.
  2. If a patch is available and your change-control process permits, prioritise its application in accordance with CISA BOD 26-04 guidelines; if patching is not immediately possible, engage with your security and operations teams to document the delay and identify interim controls.
  3. Until patching is complete, restrict network access to Artifactory to trusted internal subnets only; review and tighten authentication controls, and audit user permissions to limit who can configure or manage remote repositories.
  4. Enable and retain application logs at DEBUG level, specifically capturing all authentication events, repository configuration changes, and write operations; configure alerting on any writes to paths outside expected Docker cache directories.
  5. If Artifactory is cloud-hosted and mitigations are not available or insufficient, escalate to your cloud operations and information security teams to discuss discontinuation of the service in accordance with BOD 26-04.

If you find you were exposed

Review application logs dating back at least 90 days (or as far as retention permits) for any authenticated write operations to unusual filesystem paths, particularly outside Docker cache directories. Cross-reference user accounts that performed such writes with your access records to establish whether the activity was legitimate; if anomalies are found, treat them as potential compromise and initiate your incident-response procedure, including forensic preservation and notification workflows.

Get these the morning they land.

One email, only when a vulnerability is newly confirmed as exploited — the CISA record plus our action plan. No more than one a day, and nothing on quiet days.

Knowing it exists is not the same as knowing you are exposed.

This page can tell you that CVE-2026-66384 is being exploited. It cannot tell you whether Artifactory is running somewhere of yours that is reachable. That question is what a scan answers.

Check your own surface →