JFrog Artifactory: authenticated Docker-cache path traversal (CVE-2026-66384) added to CISA KEV, a CI/CD artifact-store write primitive with no published exploitation narrative

CISA added CVE-2026-66384 to its Known Exploited Vulnerabilities catalog on 2026-08-27. Per JFrog's own advisory, published 2026-08-12 with a CVSS 3.1 base score of 5.3 Medium (CWE-22, Improper Limitation of a Pathname to a Restricted Directory): "an authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions" (JFrog Security Advisories, 2026-08-12) in Artifactory self-hosted below 7.146.35 and 7.161.0 through 7.161.16. Fixed in 7.146.35 and 7.161.16; JFrog states cloud environments were already remediated with no customer action required.

Neither JFrog's advisory nor CISA's KEV entry describes the exploitation activity that justified the addition; the listing itself is the only exploitation evidence. Given Artifactory's role as a binary/artifact repository inside CI/CD release pipelines, a write primitive that escapes the intended cache path is a software-supply-chain concern despite the Medium base score and authentication requirement: an attacker able to plant or overwrite files outside the sandboxed cache location could influence what a downstream build or deployment consumes.

Triage: no exploitation mechanism has been described publicly, so there is no honest benign-lookalike discriminator to offer. The durable step is the upgrade itself and, where the environment allows it, reviewing Docker-cache directory contents for files outside their expected repository paths as a general compromise-assessment measure.