Critical Actively exploited

CVE-2026-66384

JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability

What this means

Weakness: An attacker-supplied file path is not confined, letting them read or write outside the intended folder.
Likelihood: Exploitation is not hypothetical: CISA has observed it in the wild.

What to doTop priority: CISA sets the remediation deadline at 10 September 2026.

Read automatically from the CVSS vector, the weakness type (CWE) and the EPSS score. The technical description above remains the one published by NIST.

Published: 27 August 2026
CVSS: —
EPSS: 0.58% probability of exploitation within 30 days · above 45% of all CVEs
Weakness: CWE-22
CISA due date: 10 September 2026
Sources: cisa-kev

Our analysis A Docker-cache path traversal in Artifactory rattles the registry every team pulls from

References

https://nvd.nist.gov/vuln/detail/CVE-2026-66384