Critical JFrog Artifactory Vulnerability Exploited in the Wild
- Severity
- HIGH
- Affected component
- jfrog artifactory (npm)
- Patched version
- Not yet available
A critical vulnerability in JFrog Artifactory, tracked as CVE-2026-66384, has been exploited in the wild. This vulnerability allows an authenticated user to write data outside the intended Docker cache path under specific conditions.
What happened
The vulnerability in JFrog Artifactory, identified as CVE-2026-66384, was first flagged on August 27, 2026, and confirmed on September 1, 2026. This flaw enables an authenticated user to write data outside the intended Docker cache path, potentially leading to unauthorized access and data manipulation. The exploit has been observed in the wild, indicating active exploitation by threat actors.
To assess your exposure, review your JFrog Artifactory configurations and Docker cache paths for any unauthorized changes. Ensure that your instance is not using the default configuration, as this is where the vulnerability is most likely to be exploited.
What to do about it
- Upgrade to the latest version of JFrog Artifactory to mitigate the risk of exploitation.
- Review and secure your Docker cache paths to prevent unauthorized data writes.
- Monitor your JFrog Artifactory instance for any suspicious activities or changes.
- Consult the primary sources for the most up-to-date information and recommendations.
How 0Day would have caught this
jfrog artifactory is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
If you are using JFrog Artifactory, you may be affected. Consult the primary sources for the latest information on affected versions and patches.
What should I do right now?
Upgrade to the latest version of JFrog Artifactory and review your Docker cache paths for any unauthorized changes.
Has this been exploited in the wild?
Yes, this vulnerability has been exploited in the wild.
Sources
- NCSC-2026-0336 [1.00] [M/H] Kwetsbaarheid verholpen in JFrog Artifactory
- Attackers Exploit Critical JFrog Artifactory Flaw to Mint Admin Tokens Days After Disclosure
- Hackers exploit critical JFrog Artifactory flaw to forge admin tokens
- [CISA KEV] CVE-2026-66384 — JFrog Artifactory
- Stop Malicious Packages with the Spectra Assure Community Plugin for JFrog Artifactory
- Critical JFrog Artifactory Vulnerability Reportedly Exploited in the Wild