SECURITY_THREAT_PULSE
LIVE
LAST UPDATED
FIRST SEEN
3 SOURCES ON THIS EVENT
▲ ACT NOWCVE-2026-66384 · CVSS 5.3

JFrog Artifactory: attackers can read or change files

AFFECTSJFrog Artifactory

OFFICIAL NAME: JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability

WHAT IT IS · DEVELOPER TOOLSIt holds source code and the keys used to build and ship software.

DO THIS FIRSTPatch it. If it faced the internet, change the keys and passwords stored in it. Not sure if you use it? Send this page to your IT provider or security lead and ask.

TECHNICAL SUMMARY JFrog Artifactory contains an improper limitation of a pathname to a restricted directory vulnerability. This can allow an authenticated user to write data outside the intended Docker cache path under specific remote-repository conditions.

WHY THIS VERDICT Attacks are confirmed. The vulnerability is 75 days old, so current versions are being attacked.

HIGHEST CONFIRMED RUNG
EXPLOITED
CISA KEV
LISTED
EXPLOIT CODE
PROOF OF CONCEPT CLAIMED
// EVIDENCE LADDER

How far has it climbed?

CONFIRMED
REPORTED
NO EVIDENCE

  1. 01 TALK

    □ NO EVIDENCE YET
    NEWEST EVIDENCE NONE YET

    No evidence yet.

    SRC: NONE YET

  2. 02 EXPOSED

    □ NOT TRACKED YET
    NO SOURCE FOR THIS STEP YET

    We have no source that counts exposed systems yet. Internet scan data needs a partnership we do not have. No evidence here does not mean nothing is exposed.

  3. 03 TRIED

    ■ CONFIRMED
    NEWEST EVIDENCE · 2 INDEPENDENT SOURCES

    Attacks that worked are confirmed (step 4), so attempts count as confirmed too.

  4. 04 EXPLOITED

    ■ CONFIRMED
    NEWEST EVIDENCE · 2 INDEPENDENT SOURCES

    JFrog Artifactory contains an improper limitation of a pathname to a restricted directory vulnerability. This can allow an authenticated user to write data outside the intended Docker cache path under specific remote-repository conditions. CISA Vulnrichment marks CVE-2026-66384 as actively exploited.

  5. 05 DAMAGE

    □ NOT TRACKED YET
    NO SOURCE FOR THIS STEP YET

    Breach notices and filings rarely name the flaw that was used, so we cannot link them to this event yet. No evidence here does not mean no harm.

// THE CLOCK

When each thing happened

  1. DISCLOSED
    CVE-2026-66384 published
  2. EXPLOIT CODE PUBLIC
    CLAIMED
  3. FIRST ATTACK REPORT
    CISA Known Exploited Vulnerabilities
  4. CISA KEV LISTING
    CISA KEV listing
  5. US FEDERAL DEADLINE
    CISA deadline for US federal agencies
Attacks were reported 15 days after disclosure. CISA listed it 15 days after disclosure.

THE FIX

CISA's instruction: apply the vendor's fix, or stop using the product if no fix exists. The deadline CISA set for US federal agencies, Sep 10, 2026, has passed. It is a US government deadline; use it as a guide.

// ASK YOUR TEAM

Questions to ask this week

// TIMELINE · PACIFIC TIME

How it unfolded

  1. Attack activity. AUG 12, 2026
    CISA Vulnrichment marks CVE-2026-66384 as actively exploited
  2. Attack activity. AUG 26, 2026
    JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability
  3. AUG 28, 2026
    1 public GitHub repository claims a proof of concept for CVE-2026-66384

SOURCES

  1. [1] PoC-in-GitHub: 1 public GitHub repository claims a proof of concept for CVE-2026-66384, AUG 28
  2. [2] CISA Known Exploited Vulnerabilities: JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability, AUG 26
  3. [3] CVE List V5 and CISA Vulnrichment: CISA Vulnrichment marks CVE-2026-66384 as actively exploited, AUG 12