CVE-2026-66384: JFrog Artifactory path traversal in Docker cache path

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityCISA KEV listing confirms known exploitation with a near-term remediation deadline, but the CVSS score is only 5.3 and impact is integrity-only with no ransomware use documented.

What it is

An authenticated user can write data outside the intended Docker cache path under specific remote-repository conditions in JFrog Artifactory. The flaw is a path traversal (CWE-22) that breaks the intended directory restriction, allowing writes to locations the user should not control. It matters because integrity of files on the Artifactory host or shared storage can be altered by a low-privileged account, and CISA added it to KEV with a short remediation deadline.

Impact

An attacker with an authenticated account gains the ability to write files outside the Docker cache directory, corrupting or planting content on paths reachable by the Artifactory process. There is no confidentiality or availability impact per the CVSS vector; the effect is integrity-only.

Attack surface

Reached over the network through Artifactory's remote-repository handling, requiring a valid low-privileged authenticated account and specific remote-repository conditions. No user interaction is needed per the CVSS vector (UI:N).

Exploitation

CISA added this CVE to the Known Exploited Vulnerabilities catalog on 2026-08-27 with a 2026-09-10 due date, indicating known exploitation, though no ransomware campaign use is documented. EPSS is low (0.00579, 46th percentile), so the KEV listing is the stronger signal.

What to do

• Apply the vendor fix from the JFrog Artifactory release notes and security advisories as the first action.
• If patching cannot be completed before the CISA due date, restrict or disable remote-repository configurations that trigger the vulnerable Docker cache path handling.
• Limit authenticated accounts that can configure or use remote repositories, and review who holds those permissions.
• Follow CISA BOD 26-04 guidance for exposed or cloud-hosted instances, including discontinuing use if mitigations are unavailable.
• Monitor JFrog advisories for updated fixed versions and re-check exposure after upgrading.

Detection

• Audit Artifactory logs for writes to paths outside the configured Docker cache directory, especially traversal sequences in repository or path parameters.
• Alert on remote-repository configuration changes and on Docker cache operations from accounts that do not normally perform them.
• Use file integrity monitoring on Artifactory host and storage paths to catch unexpected file creation or modification.
• Correlate authenticated Artifactory activity with outbound or lateral movement from the Artifactory host after suspicious writes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.