Artifactory CVE-2026-66384 in KEV: a cache write can reach the software supply chain

The signal and the facts that change the decision

CISA added CVE-2026-66384 to KEV on 27 August. The feed describes improper path limitation in JFrog Artifactory, allowing an authenticated user to write outside the intended Docker cache path under specific remote-repository conditions; the listed federal deadline is 10 September.

The KEV entry confirms known exploitation and describes an authenticated-user requirement and specific remote-repository conditions. Artifactory can feed pipelines and registries; impact depends on the writable path, permissions, promotion, and downstream verification.

The 10 September deadline arises from a US federal directive and is not a Portuguese legal deadline, but it is a short operating reference. Fixing the server without checking artefacts leaves open the possibility of earlier tampering. Signatures help only when verified at consumption and when the attacker does not also control the identity, pipeline, or key producing the signature.

Decision, limits, and stop condition

Treat Artifactory as trust infrastructure: confirm versions and configuration, reduce users able to reach the vulnerable path, preserve logs, and assess whether modified content or metadata could be promoted into builds, images, environments, or customers.

Fixing the server without checking artefacts leaves open the possibility of earlier tampering. Signatures help only when verified at consumption and when the attacker does not also control the identity, pipeline, or key producing the signature.

Execution and proof of completion

Execution should start by identifying instances, versions, licences, modes, remote repositories, caches, users, tokens, and consuming pipelines. Then, applying the official fix, constraining accounts, preserving audit data, and searching for anomalous writes, unexpected paths, and subsequent promotion. Closure requires rebuilding a sample of critical artefacts from clean sources and comparing hashes, sboms, signatures, and provenance.

The case closes when the fixed version and configuration are proven, the audit window has been reviewed, critical artefacts reconcile with clean sources, and exposed tokens or keys have been revoked and replaced.

• identifying instances, versions, licences, modes, remote repositories, caches, users, tokens, and consuming pipelines.
• applying the official fix, constraining accounts, preserving audit data, and searching for anomalous writes, unexpected paths, and subsequent promotion.
• rebuilding a sample of critical artefacts from clean sources and comparing hashes, SBOMs, signatures, and provenance.
• The case closes when the fixed version and configuration are proven, the audit window has been reviewed, critical artefacts reconcile with clean sources, and exposed tokens or keys have been revoked and replaced.