๐ฅ This vulnerability is being actively exploited in the wild (CISA Known Exploited Vulnerabilities catalog)
CVE-2026-66384: JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability
Summary
JFrog Artifactory has a vulnerability where authenticated users can write data outside the intended Docker cache path (a directory where temporary files are stored) under certain conditions with remote repositories. This is a path traversal issue (a security flaw that lets attackers access files outside where they're supposed to) that is currently being exploited by attackers in real attacks.
Solution / Mitigation
Apply mitigations in accordance with vendor instructions from JFrog's security advisories (https://docs.jfrog.com/releases/docs/jfrog-security-advisories) and follow CISA's BOD 26-04 patching guidelines. If mitigations are unavailable, discontinue use of the product.
Vulnerability Details
EPSS: 0.3%
Yes
๐ฅ Actively Exploited
August 26, 2026
Classification
Affected Vendors
Related Issues
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-66384
First tracked: August 27, 2026 at 02:01 PM
Classified by LLM (prompt v3) ยท confidence: 72%