---
schema: 1
kind: vulnerability
title: "JFrog Artifactory: authenticated Docker-cache path traversal (CVE-2026-66384) added to CISA KEV — a CI/CD artifact-store write primitive with no published exploitation narrative"
headline: "A Medium-severity Artifactory write bug just became a confirmed-exploited CI/CD supply-chain concern via KEV listing alone"
summary: >
  CISA added CVE-2026-66384 to its KEV catalog on 2026-08-27. JFrog's own advisory (CVSS 3.1 5.3
  Medium) describes an authenticated user writing data outside the intended Docker cache path
  under specific remote-repository conditions in Artifactory below 7.146.35 and 7.161.0–7.161.16.
  Fixed in 7.146.35 / 7.161.16; cloud environments were already remediated. Neither JFrog's
  advisory nor the KEV listing describes the exploitation activity that justified the addition.
discovered_at: "2026-08-28T05:50:00Z"
updated_at: null
event_date: "2026-08-12"
run_id: 2026-08-28T0409Z-intel
priority: notable
immediate_action: null
tags: [vulnerabilities, path-traversal, cisa-kev, actively-exploited, patch-available, supply-chain]
regions: [global]
sectors: [public-sector, technology]
entities: []
techniques: [T1195.002]
affected_products: ["JFrog Artifactory"]
cves:
  - id: CVE-2026-66384
    cvss: "5.3"
    epss: null
    type: path-traversal
    vector: user-interaction
    auth: post-auth
    status: [exploited, cisa-kev, patch-available]
    affected: "Artifactory self-hosted <7.146.35; 7.161.0–7.161.16"
    fixed: "7.146.35; 7.161.16 (cloud already remediated)"
sources:
  - url: "https://docs.jfrog.com/releases/docs/jfrog-security-advisories"
    publisher: "JFrog (Security Advisories)"
    date: "2026-08-12"
    role: primary
  - url: "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"
    publisher: "CISA Known Exploited Vulnerabilities Catalog (JSON feed)"
    date: "2026-08-27"
    role: primary
closed_sources: []
evidence:
  - quote: "An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions."
    publisher: "JFrog (Security Advisories)"
verification: multi-source
sourcing_note: >
  JFrog's own advisory is the technical primary describing the flaw's mechanism; the CISA KEV
  listing is an independent primary confirming active exploitation, a distinct fact neither
  source alone establishes (JFrog's advisory does not itself claim exploitation, and CISA's
  listing carries no technical detail). No independent researcher write-up or exploitation
  narrative was located this run beyond the KEV catalog listing itself. The KEV addition is
  treated as jurisdiction-agnostic confirmation of
  exploitation regardless of the Medium base score and authentication requirement, but the
  specific activity that triggered it is not established by any source read this run.
confidence: medium
references: []
deep_dive: false
deep_dive_category: null
org_triage: null
classification:
  reliability: A
  credibility: 2
watchlist_hit: false
actions:
  - "Upgrade self-hosted JFrog Artifactory to 7.146.35 or 7.161.16 or later — CISA's KEV addition confirms active exploitation regardless of the Medium CVSS score, and Artifactory's role as a CI/CD artifact repository makes an out-of-scope write primitive a software-supply-chain concern for any downstream build or deployment that consumes its cache."
updates:
  - at: "2026-08-28T15:00:00Z"
    run_id: 2026-08-28T1500Z-audit
    type: improvement
    internal: true
    summary: >
      Operator-directed editorial pass (v4.2): removed composition-rationale narration and 
      pipeline-internal jargon from reader-facing text; tightened or cut paragraphs that 
      restated the summary or padded without responder value. No factual claim changed.
    fields: [sourcing_note, body]
migrated_from: null
---

CISA added CVE-2026-66384 to its Known Exploited Vulnerabilities catalog on 2026-08-27. Per JFrog's own advisory, published 2026-08-12 with a CVSS 3.1 base score of 5.3 Medium (CWE-22, Improper Limitation of a Pathname to a Restricted Directory): "an authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions" ([JFrog Security Advisories, 2026-08-12](https://docs.jfrog.com/releases/docs/jfrog-security-advisories)) in Artifactory self-hosted below 7.146.35 and 7.161.0 through 7.161.16. Fixed in 7.146.35 and 7.161.16; JFrog states cloud environments were already remediated with no customer action required.

Neither JFrog's advisory nor CISA's KEV entry describes the exploitation activity that justified the addition — the listing itself is the only exploitation evidence. Given Artifactory's role as a binary/artifact repository inside CI/CD release pipelines, a write primitive that escapes the intended cache path is a software-supply-chain concern despite the Medium base score and authentication requirement: an attacker able to plant or overwrite files outside the sandboxed cache location could influence what a downstream build or deployment consumes.

**Triage:** no exploitation mechanism has been described publicly, so there is no honest benign-lookalike discriminator to offer. The durable step is the upgrade itself and, where the environment allows it, reviewing Docker-cache directory contents for files outside their expected repository paths as a general compromise-assessment measure.