The mechanics of CVE-2026-66384 are narrow by design, which is a large part of why it scored the way it did. When Artifactory caches a Docker image retrieved through a configured remote repository, it constructs a local file path from data associated with that image. That path construction doesn't fully normalise traversal sequences, so an authenticated user with write access to a remote Docker repository can, under specific configuration conditions, get Artifactory to write a cached file outside the directory it's supposed to stay inside. GitHub's advisory lists the flaw under CWE-22, standard path traversal, and rates it "moderate" - the CVSS vector requires local, low-privilege authentication and high attack complexity, none of which sound like ingredients for a KEV listing on their own.
The gap between "hard to exploit" and "not being exploited"
CVSS attack complexity measures how difficult a single exploitation attempt is to pull off, not how likely an attacker is to already have the access the attack needs. In an Artifactory environment, "authenticated user with write access to a remote Docker repository" isn't a high bar - CI/CD pipelines routinely hold exactly that kind of service-account access, often more of it than the person auditing the repository realises. A flaw that needs specific pre-conditions to trigger still gets triggered reliably once an attacker already sits inside a pipeline that meets them, which is a very different risk picture from a flaw needing conditions an outsider has to engineer from scratch. CISA's KEV listing doesn't reference a specific published incident, but the bar for inclusion is evidence of exploitation in the wild, not evidence of an easy exploit - and it's a distinction worth sitting with given how many prioritisation frameworks still use CVSS attack complexity as a proxy for real-world risk.
What a write-outside-the-cache actually gets you
Writing a file outside Artifactory's intended Docker cache path on the server it runs on is a file integrity problem before it's anything else, and JFrog's own advisory frames it that way: an authenticated user manipulating where cached data lands, on a system that in most organisations sits directly in the software supply chain between source control and production. Depending on what's reachable from wherever the write lands, the practical outcome ranges from a nuisance to something considerably worse - overwriting configuration, corrupting artefacts other pipelines trust, or planting content in a path something else on the box later executes. JFrog's advisory, published 12 August and last updated the day of the KEV addition, still doesn't publish a specific affected-to-fixed version range in its GitHub Security Advisory entry, which for a KEV-listed flaw is its own operational headache: teams can't self-check via version number alone and instead need to work from JFrog's own release documentation directly.
Why this is the more useful KEV story of the week
A perfect-10, unauthenticated, no-user-interaction flaw getting exploited within days is alarming but not surprising - it's exactly the profile prioritisation frameworks are built to catch fast. A 5.3 getting the same KEV treatment is the more useful data point, because it's the profile those same frameworks are built to deprioritise. Software supply chain infrastructure - artifact repositories, package registries, CI/CD control planes - sits in a position where a "moderate" file-integrity bug can matter more than its score suggests, precisely because of what else trusts it downstream. Treating a CVSS number as a complete risk assessment for anything sitting in that position is the actual lesson here, not the specific path traversal mechanism.
- Check JFrog's own security advisory documentation directly for the fixed Artifactory version - don't rely on the CVSS score or a version-number guess to decide urgency.
- Audit which service accounts and CI/CD pipelines hold write access to remote Docker repositories in Artifactory; that access is the actual precondition this flaw needs, not a sophisticated exploit chain.
- Don't let CVSS attack-complexity ratings alone gate patch prioritisation for artifact repositories, package registries or CI/CD control planes - the trust position matters as much as the exploit difficulty.
- Review recent Docker cache writes in Artifactory logs for anything landing outside expected paths.
- Treat any KEV addition, regardless of score, as evidence your existing severity-based triage missed something real - and use it to check what else in that band you may have deprioritised.
The CVSS score told you this bug wasn't urgent. CISA's KEV catalog says otherwise, and CISA's version is the one grounded in what's actually happening. If you'd like a second look at how your vulnerability triage weighs exploit complexity against the trust position of the asset involved, email sales@halfteck.com.