JFrog Artifactory Path Traversal Vulnerability (CVE-2026-66384)

Catalog analysis: CISA added this entry on August 27, 2026. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. This site’s publication date is shown separately. Check current vendor guidance before acting.

What the vulnerability is

CVE-2026-66384 is an improper limitation of a pathname to a restricted directory (CWE-22) within JFrog Artifactory. This vulnerability allows an authenticated user to write data outside the intended Docker cache path, provided specific remote-repository conditions are met.

Exposure and applicability

This vulnerability affects organizations utilizing JFrog Artifactory. The risk is applicable to environments where authenticated users have access to the system and where the specific remote-repository configurations required for this path traversal exist. Because CISA has added this CVE to its Known Exploited Vulnerabilities (KEV) catalog as of August 27, 2026, it should be treated as a high-priority exposure.

Remediation priorities

Our analysis suggests the following prioritization for vulnerability management teams:

1. Asset Identification: Identify all instances of JFrog Artifactory across the infrastructure, specifically noting those with remote-repository configurations that interact with Docker caches.
2. Vendor Mitigation: Apply mitigations as specified in official JFrog security advisories and release notes.
3. Access Review: Evaluate the permissions of authenticated users to ensure the principle of least privilege is applied, reducing the number of accounts capable of interacting with the affected paths.

How to validate remediation

To verify that exposure has been reduced, defenders should move beyond simple version checks:

• Configuration Audit: Verify that the specific remote-repository conditions required for the exploit are either mitigated via the vendor patch or adjusted through compensating controls.
• Write-Permission Testing: In a staged environment, authorized security personnel should attempt to write data outside the Docker cache path using an authenticated account to confirm the restriction is enforced.
• Log Analysis: Review system logs for unauthorized attempts to access or write to directories outside the designated cache paths, which may indicate attempted exploitation of the vulnerability prior to remediation.

Limits and open questions

It remains unknown whether this vulnerability has been utilized in ransomware campaigns. Additionally, while CISA has mandated a remediation deadline of September 10, 2026, for federal agencies, non-federal organizations must determine their own timelines based on internal risk tolerance.

Residual risk persists if authenticated users maintain excessive permissions or if the underlying filesystem allows path traversal despite application-level fixes. A deployed patch does not guarantee total immunity if other system-level misconfigurations exist.

Source and editorial note

CVE-2026-66384: JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability · Source date: August 27, 2026 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Request a Vulnerability Assessment