CVE-2026-66384

This vulnerability is like having a “back door” route in your file storage rules. With the right setup and a logged-in account, someone could force Artifactory to store data in places it wasn’t supposed to, potentially damaging system files or altering what gets served to users.

This matters if you run JFrog Artifactory (any self-managed deployment) because the bug can be triggered by authenticated users. The issue is reachable in default configuration, but it still requires specific remote-repository conditions to be present. Treat it as a real risk if your Artifactory is reachable to attackers with valid account access, particularly if they can use the affected remote-repository feature path.

This is RED because it’s confirmed as a known risk by CISA (listed in the CISA KEV) and has a defined remediation due date of 2026-09-10. Attackers have a viable route through authenticated access to attempt writing data outside the intended cache area, and the guidance expects action rather than waiting for internal testing.

1. Confirm exposure

• Identify your exact JFrog Artifactory version.
• Determine whether your deployment uses the Docker cache functionality and has remote-repository features configured in the way described by JFrog’s advisory (the findings note “specific remote-repository conditions must be present”).
• Confirm who can authenticate to Artifactory and what remote-repository actions they can perform.

2. Validate reachability and risk gate

• This vulnerability is network reachable, but it requires authentication (signed-in user) and the specific remote-repository conditions.
• Prioritize assets where accounts might be reachable/compromised (e.g., external-facing Artifactory with weak account controls, shared accounts, or broad permissions).

3. Patch with fixed versions

• Upgrade artifactory to 7.146.35 (if you are on a compatible branch) or 7.161.16.
• Follow the upgrade procedure for your Artifactory deployment type (self-managed) and ensure you test in staging if your release process requires it.

4. Mitigation if patch is delayed

• Apply the mitigations described by JFrog in the security advisory linked in the findings.
• Reduce exposure immediately by restricting access to the accounts and remote-repository functionality that could meet the “specific remote-repository conditions.”
• If mitigation guidance requires disabling functionality, do so temporarily until you can patch.

5. Forensics and monitoring after upgrade

• Review logs around the time of any abnormal activity for signs of unexpected file writes related to the Docker cache area.
• Watch for repeated failed/odd remote-repository operations and any activity that suggests attempts to bypass expected directory restrictions.

6. Deadline awareness

• CISA remediation due date (per KEV): 2026-09-10.
• Follow CISA’s KEV guidance to align with incident triage/forensics requirements where applicable.

CVE-2026-66384 (CWE-22) affects artifactory. The core mechanism is a path validation/bypass weakness that lets an authenticated user write data outside the intended Docker cache path. The findings state the issue is network reachable and reachable in default configuration, but exploitation also requires specific remote-repository conditions.

Exploitation status: CISA KEV listing is confirmed (added 2026-08-27) with a CISA remediation due date of 2026-09-10, which elevates this from a theoretical issue to a prioritized real-world risk. No public exploit code is on record, and there is no clear dated press claim of exploitation, but PULSE indicates sustained press attention and a reported actor context.

Fix availability: artifactory is fixed in versions 7.146.35 and 7.161.16 per the findings. No clean install/upgrade command is provided in the findings because this is a server product rather than a language package.