CVE-2026-66384 · Moderate · CISA KEV

JFrog Artifactory Path Traversal: Authenticated Data Write Outside Intended Path

Threat Engine Auto-Feed · data current as of 2026-08-27

CVE-2026-66384 in JFrog Artifactory allows an authenticated user to write data outside the intended Docker cache path under specific remote-repository conditions. This vulnerability is listed in CISA KEV, indicating it has been exploited in the wild, with an EPSS score in the 18th percentile.

  • CVSS:
  • EPSS percentile: 0.17918
  • Exploitation pressure: 36/100 (Moderate)

Exploitation reality: listed in CISA KEV (exploited in the wild) · EPSS 18th percentile. Threat × Vulnerability from public signals — impact depends on your environment.

Weakness —

This vulnerability is an 'Improper Limitation of a Pathname to a Restricted Directory' (path traversal). It means that the software does not correctly restrict file system operations to the intended directory, allowing an attacker to manipulate file paths to access or write to unintended locations on the system.

Who's at risk

Exposure: unknown · Auth: unknown · unknown

Enterprise profiles most at risk

  • Organizations using JFrog Artifactory, especially those with multiple authenticated users or complex remote repository configurations.
  • Enterprises in Financial Services and Technology sectors, given the documented targeting by financially motivated and state-sponsored actors.

Misconfigurations that escalate it

  • Overly permissive user authentication settings within Artifactory.
  • Poorly configured remote repository settings that may enable path traversal conditions.

High-impact scenarios

  • An authenticated attacker could write malicious data to arbitrary locations on the Artifactory server, potentially leading to denial of service, data corruption, or further system compromise.
  • Compromise of the Artifactory instance could impact software supply chains, affecting the integrity of artifacts and potentially leading to broader organizational impact.

Likely adversaries

  • FIN7 — Financial services (Assessed)
  • LockBit affiliates — Financial services (Assessed)
  • APT38 (Lazarus) — Financial services (Assessed)
  • APT29 (Cozy Bear) — Technology (Assessed)
  • Scattered Spider — Technology (Assessed)

What to do (defensive)

Detect

  • Monitor JFrog Artifactory logs for unusual file write activities outside of expected Docker cache paths.
  • Implement robust file integrity monitoring on Artifactory server directories.

Contain

  • Restrict network access to JFrog Artifactory instances to only necessary internal systems and users.
  • Review and tighten authentication and authorization controls for Artifactory users.

Patch

  • Apply vendor-provided patches for JFrog Artifactory to address CVE-2026-66384 as soon as they become available.

Frontier verdict — Moderate

This is a high-priority vulnerability due to its presence in CISA KEV, indicating active exploitation, and the potential for an authenticated attacker to achieve significant impact within JFrog Artifactory environments.

For detection-engineering and awareness only · point-in-time · not security advice · sourced from NVD, FIRST EPSS, CISA KEV. Adversary mappings are assessments unless cited.