CVE-2026-66384: active vulnerability in JFrog Artifactory

CVE-2026-66384: active vulnerability in JFrog Artifactory

In short

CVE-2026-66384 is a path traversal vulnerability in JFrog Artifactory that allows an already authenticated user to write data outside the intended Docker cache path, under specific remote repository conditions [1]. It affects organizations that use Artifactory as an artifact repository, particularly those with remote Docker repositories configured [1]. It is included in the CISA KEV catalog of vulnerabilities with confirmed active exploitation [2], making it a management priority even though its official CVSS score is "medium" [1]. What to do today: check whether your organization uses JFrog Artifactory, review the permissions of authenticated users with access to Docker repositories, and apply the security update as soon as the vendor confirms it.

What it is and why it matters

According to the official description registered in NVD, an authenticated user can write data outside the intended Docker cache directory, under specific remote repository conditions [1]. This is not, therefore, anonymous access from outside: whoever exploits the flaw already has a valid account within the platform, and the issue allows them to break out of the storage boundaries they should be confined to.

NVD scores the vulnerability with a CVSS of 5.3 and classifies it as "medium" severity [1]. However, it is listed in the Known Exploited Vulnerabilities (KEV) catalog maintained by CISA [2], confirming that active exploitation has already been detected in the real world, regardless of the base score. It is precisely this combination —technical impact rated as moderate on paper, but exploitation already confirmed— that causes our internal OCIRIA intelligence radar, which analyzes this same public information from NVD and CISA KEV, to flag it as a critical management priority within the "path traversal / file access" category. This classification is an internal OCIRIA prioritization criterion, not an additional independent source or a separate official score from NVD's.

This type of flaw matters especially because Artifactory often acts as the central artifact repository (Docker images, packages, binaries) within a company's development pipeline. If an authenticated user manages to write to unintended locations, the integrity of the artifacts flowing through that repository is put at risk.

Who is affected

It affects organizations using JFrog Artifactory, the only vendor identified in the verified data [1]. The official description notes that exploitation depends on remote repositories being configured and on the attacker having an authenticated account on the platform [1]. The verified data does not specify which particular versions are affected, nor the size or sector of the organizations impacted, so any additional assessment of the victim profile should be treated with caution until the exact version installed in your environment is confirmed.

How to know if you are vulnerable

• Confirm whether your organization uses JFrog Artifactory and, specifically, whether it has remote Docker-type repositories configured, which is the condition stated in the official description of the flaw [1].
• Review which authenticated users have write permissions on those repositories, since the flaw requires a valid account, not anonymous access [1].
• Check whether the Artifactory instance is accessible from outside the corporate network: the more exposed it is externally, the more potential accounts could attempt the exploitation described.
• Review activity logs for writes to unusual paths outside the usual cache folders.

How to protect yourself

• Apply the JFrog Artifactory security update as soon as the vendor confirms it for your installed version.
• Audit and restrict the permissions of authenticated users on Docker repositories, limiting who can write to them.
• Since the vulnerability is already listed as actively exploited [2], treat it with the same urgency as if it had a higher CVSS score, rather than relying solely on NVD's "medium" label [1].
• Maintain a periodic review of which administration panels and services in your organization remain accessible from the internet, as part of basic security hygiene.

Frequently asked questions

Is it a critical vulnerability?

NVD scores it with CVSS 5.3 and classifies it as "medium" severity [1]. However, since it is in the CISA KEV catalog of actively exploited vulnerabilities [2], the practical risk is higher than that score suggests, which is why we track it with high priority.

Which product is affected?

JFrog Artifactory, according to the vendor identified in the verified data [1]. The sources consulted do not confirm specific affected versions.

Does the attacker need prior credentials?

Yes. The official description specifies that it must be an authenticated user [1].

Is there evidence of real-world exploitation?

Yes, the vulnerability is included in the CISA KEV catalog, which only lists flaws with evidence of confirmed active exploitation [2].

Sources

• [1] https://nvd.nist.gov/vuln/detail/CVE-2026-66384
• [2] https://raw.githubusercontent.com/cisagov/kev-data/develop/known_exploited_vulnerabilities.json