Skip to content

CVE · Exploited · On CISA KEV

CVE-2026-66384

JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability

5.3
CVSS 3.1
1
story
AUG 27
added to KEV
Severity
5.3 Medium · vendor score
Vendor
JFrog
Product
Artifactory
Published
Aug 12, 2026
Added to KEV
Aug 27, 2026
KEV deadline
Sep 10, 2026
Ransomware use
Unknown
Weakness
CWE-22

What it is

JFrog Artifactory contains an improper limitation of a pathname to a restricted directory vulnerability. This can allow an authenticated user to write data outside the intended Docker cache path under specific remote-repository conditions.

From CISA's Known Exploited Vulnerabilities catalog

Decipher coverage · 1 story

Newest first ↑
  1. VulnerabilitiesCritical Artifactory Bug Under AttackCVE-2026-82329 is a simple authentication bypass that can allow an attacker to get admin privileges quite easilyDENNIS FISHER · 1 MIN

Official references

6 sources

Registries

RegistryNVDScore, weakness and every referenceRegistryCVE.orgThe official CVE recordRegistryCISA KEVKnown exploited, with the federal deadline

Advisories, fixes & analysis

Fixdocs.jfrog.com/releases/docs/artifactory-self-managed-releasesVendor advisorydocs.jfrog.com/releases/docs/jfrog-security-advisoriesAnalysisopenai.com/index/hugging-face-incident-and-the-road-ahead