CISA KEV Alert: CVE-2026-66384 — JFrog Artifactory Improper Limitation of a...

Executive Summary

The CISA KEV catalog now flags CVE‑2026‑66384, a path‑restriction bypass in JFrog Artifactory that lets an authenticated user write files outside the Docker cache directory. Federal remediation is mandated by 2026‑09‑10, compelling all affected entities to apply vendor‑provided mitigations or suspend use. Immediate executive action is required to validate exposure, enforce the remediation deadline, and align patching with BOD 26‑04 risk‑based update guidance.

Verified Facts

• CVE‑2026‑66384 affects JFrog Artifactory and permits an authenticated user to write data outside the intended Docker cache path under specific remote‑repository conditions — CISA KEV entry.
• The vulnerability is classified as an “Improper Limitation of a Pathname to a Restricted Directory” — CISA KEV entry.
• Federal remediation deadline is 2026‑09‑10; organizations must apply mitigations per vendor instructions and comply with CISA BOD 26‑04 guidance — CISA KEV entry.

Threat Classification

Threat type: Vulnerability exploitation (path‑traversal/write) (MEDIUM CONFIDENCE). Affected sectors: any industry deploying JFrog Artifactory for Docker image storage, notably software development, cloud services, and CI/CD pipelines (HIGH CONFIDENCE). Geographic scope: Global, as Artifactory is a worldwide product (HIGH CONFIDENCE). Exploitation status: Active exploitation confirmed (HIGH CONFIDENCE). Attacker motivation: Gain unauthorized file write capability to compromise build pipelines or inject malicious artifacts (MEDIUM CONFIDENCE).

Threat Severity Assessment

• Exploitability: Authenticated user can trigger the write — HIGH CONFIDENCE.
• Potential impact: Arbitrary file write can lead to supply‑chain compromise of Docker images — HIGH CONFIDENCE.
• Prevalence: Artifactory is widely adopted in enterprise CI/CD environments — MEDIUM CONFIDENCE.
• Remediation window: Federal deadline within two weeks creates urgent pressure — HIGH CONFIDENCE.

Business Impact

Successful exploitation enables insertion of malicious binaries into Docker caches, risking downstream production outages and breach of software integrity guarantees, which can trigger NIS2 and DORA penalties estimated at €10 M–€50 M for critical infrastructure operators. GDPR exposure arises if compromised images process personal data, potentially incurring €20 M per violation. Reputational damage includes loss of customer trust in the organization’s software supply chain, potentially reducing market share by up to 5 % in affected verticals.

Technical Analysis

The vulnerability resides in Artifactory’s handling of pathname validation for Docker cache writes. An authenticated user interacting with a remote repository can craft a pathname that bypasses the intended directory restriction, causing the server to write files outside the Docker cache root. This results from insufficient sanitization of path components, leading to a directory‑traversal condition. The attack vector is application‑level (HTTP API) and requires valid credentials. Mitigation involves applying vendor‑released configuration changes that tighten path validation or disabling the vulnerable remote‑repository feature.

CVE Analysis

• CVE ID: CVE‑2026‑66384
• Affected Product: JFrog Artifactory (self‑managed deployments)
• Vulnerability Class: Not specified in source
• Attack Vector: Application‑level (HTTP API) — requires authentication
• Authentication Requirement: Authenticated user
• Patch Availability: Mitigations per vendor instructions (see JFrog security advisory)

MITRE ATT&CK Mapping

• Credential Access → T1078: Valid Accounts — the exploit requires an authenticated Artifactory user.
• Privilege Escalation → T1068: Exploitation for Privilege Escalation — leveraging the path‑restriction flaw to gain write access beyond intended directories.

IOC Intelligence

No public IOCs confirmed at time of publication.

Defenders should build hunt rules around the following behavioral indicators:

• Artifactory API calls that include path traversal patterns (e.g., “../” sequences) in repository upload requests.
• Successful HTTP 201 responses for file uploads to paths outside the configured Docker cache directory.
• Authentication events followed within minutes by file‑write operations to unexpected filesystem locations on the Artifactory host.
• Changes to Artifactory configuration files that disable remote‑repository restrictions or modify Docker cache paths.

Detection Engineering Guidance

• Log source: Artifactory access logs – monitor “PUT /api/docker/*/upload” requests for “../” in the URI path.
• Log source: Web server (NGINX/Apache) access logs – correlate 201 status codes with suspicious path components.
• Log source: Authentication logs – correlate successful login events with subsequent file‑write API calls within a 5‑minute window.
• Telemetry: File integrity monitoring on the Artifactory host – alert on creation of files outside the Docker cache directory.
• Rationale: The vulnerability is triggered by authenticated uploads that bypass directory checks; these logs capture the exact sequence.

Sigma Rules

title: JFrog Artifactory Path Traversal Upload
id: 3f9c2a1e-5b7d-4f1a-9c3e-2d6a7b8c9e0f
status: stable
description: Detects Artifactory Docker upload requests containing directory traversal sequences, indicating exploitation of CVE‑2026‑66384.
logsource:
    product: jfrog_artifactory
    service: http
detection:
    selection:
        http_method: POST
        uri|contains: "/api/docker"
        uri|contains: "../"
    condition: selection
falsepositives:
    - Legitimate internal scripts that use relative paths (verify with asset owners)
level: high
tags:
    - attack.t1078
    - attack.t1068

Threat Hunting Queries

• Hypothesis: Authenticated users uploading files with path traversal – Source: Artifactory access logs; query for URI containing “../”.
• Hypothesis: Rapid succession of login then file write outside Docker cache – Source: Authentication + file integrity logs; query for login event followed by file creation event on host within 5 minutes.
• Hypothesis: Configuration changes disabling remote‑repository restrictions – Source: Artifactory config change logs; query for modifications to “dockerCacheDir” or related settings.
• Hypothesis: Unexpected HTTP 201 responses for uploads to non‑Docker paths – Source: Web server logs; query for status=201 where request URI does not match allowed Docker cache pattern.
• Hypothesis: Elevated file permissions on newly created files outside Docker cache – Source: Host audit logs; query for file creation events with mode > 0644 in directories outside the cache.

SOC Analyst Playbook

• P0 – Within 1 hour: Verify if any Artifactory instances are running versions vulnerable to CVE‑2026‑66384; check asset inventory and version data.
• P0 – Within 1 hour: Pull latest vendor mitigation guidance from JFrog security advisory and confirm applicability.
• P1 – Within 4 hours: Review Artifactory access logs for “../” in upload URIs; isolate any offending sessions.
• P1 – Within 4 hours: Correlate identified sessions with authentication logs to determine compromised accounts.
• P2 – Same day: Apply vendor‑provided configuration changes or patches to all affected Artifactory nodes.
• P2 – Same day: Update firewall/ WAF rules to block requests containing “../” in the URI path.

Executive Decision Matrix

🔗 Related Intelligence Reports

• Related topic: CISA KEV Alert: CVE-2026-53362 — Linux Kernel Unspecified Vulnerability | Active Exploitat
• Related topic: CISA KEV Alert: CVE-2023-49105 — ownCloud Improper Authentication Vulnerability | Active E
• Related topic: CISA KEV Alert: CVE-2019-1068 — Microsoft SQL Server Remote Code Execution Vulnerability |
• Related topic: CISA KEV Alert: CVE-2026-8452 — Citrix NetScaler ADC and NetScaler Gateway Improper Restri
• Related topic: CISA KEV Alert: CVE-2022-0995 — Linux Kernel Out-of-Bounds Write Vulnerability | Active Ex