CISA Adds JFrog Artifactory Vulnerability to Catalog of Actively Exploited Vulnerabilities

CISA KEV JFrog Artifactory: On August 27, 2026, CISA added the CVE-2026-66384 vulnerability in JFrog Artifactory to the Known Exploited Vulnerabilities (KEV) catalog. This means it has evidence that the vulnerability is being exploited in the wild. The flaw affects self-hosted Artifactory instances, and the vendor has already released fixes.

CVE-2026-66384 is a CWE-22 vulnerability, meaning a problem involving file path access. Under specific remote Docker repository configuration conditions, it may allow an authenticated user to write outside the designated Docker cache path. Successful exploitation could therefore compromise the integrity of data stored in the system.

CISA KEV JFrog Artifactory: Which Versions Are Affected

According to JFrog’s security advisory, the issue affects self-hosted Artifactory branches older than 7.146.35, as well as versions from 7.161.0 through releases before 7.161.16. The vendor fixed the flaw in versions 7.146.35 and 7.161.16.

• Branches older than 7.146.35 should be updated to at least 7.146.35.
• Installations in the 7.161.x branch affected through version 7.161.15 should be updated to 7.161.16 or a newer fixed release.
• For JFrog Cloud, the vendor says it has already hardened affected environments and customers should not take their own action.

According to the available description, the risk primarily concerns unpatched locally operated instances with a relevant remote Docker repository configuration. This is therefore not a scenario without access: an attacker needs authenticated access to Artifactory. However, inclusion in KEV confirms that this is not merely a theoretically described flaw.

What Operators Should Do

Operators of self-hosted Artifactory should promptly determine the version in use and compare it with the ranges listed by the vendor. If they are using an affected release, they should deploy the relevant fix from JFrog. For instances with configured remote Docker repositories, it is advisable to prioritize verification of the configuration and authenticated-user access.

For entries in the KEV catalog, CISA recommends following the vendor’s mitigations. In this case, updates are available, so remediation does not depend solely on temporary restrictions or configuration changes.

Attack Details Are Publicly Lacking

CISA and JFrog have not yet publicly described the scope of the observed attacks, the identities of the actors, the victims, or the specific exploitation chain. It has also not been confirmed whether attackers are targeting a specific type of Artifactory configuration or what the extent of activity is outside environments subject to CISA.

Additional information could come from potential technical indicators from CISA, additional detection procedures from JFrog, or notifications from security teams about incidents related to Artifactory and remote Docker repositories.

Verified and updated: 08/27/2026 20:30