CISA encourages rapid remediation and prioritization of security updates. Federal Civilian Executive Branch agencies must follow Binding Operational Directive 26-04, which requires prioritizing patches for KEV Catalog vulnerabilities on publicly exposed assets and checking for pre-existing compromise before applying patches. Organizations should consult vendor-specific advisories for mitigation guidance for each CVE and adopt risk-based vulnerability management practices.
Quick answers
What is CVE-2026-66384?
CISA encourages rapid remediation and prioritization of security updates. Federal Civilian Executive Branch agencies must follow Binding Operational Directive 26-04, which requires prioritizing patches for KEV Catalog vulnerabilities on publicly exposed assets and checking for pre-existing compromise before applying patches. Organizations should consult vendor-specific advisories for mitigation guidance for each CVE and adopt risk-based vulnerability management practices.
How severe is CVE-2026-66384?
high
Is CVE-2026-66384 known to be exploited?
It is not marked known-exploited in this record.
How should CVE-2026-66384 be mitigated?
CISA encourages rapid remediation and prioritization of security updates. Federal Civilian Executive Branch agencies must follow Binding Operational Directive 26-04, which requires prioritizing patches for KEV Catalog vulnerabilities on publicly exposed assets and checking for pre-existing compromise before applying patches. Organizations should consult vendor-specific advisories for mitigation guidance for each CVE and adopt risk-based vulnerability management practices.
CVSS
—
Vendor
ownCloud
Published
Sep 30, 2026 · 08:05
Patch
Unknown / not confirmed
Affected products
ownCloud, Linux Kernel, JFrog Artifactory
Mitigation
CISA encourages rapid remediation and prioritization of security updates. Federal Civilian Executive Branch agencies must follow Binding Operational Directive 26-04, which requires prioritizing patches for KEV Catalog vulnerabilities on publicly exposed assets and checking for pre-existing compromise before applying patches. Organizations should consult vendor-specific advisories for mitigation guidance for each CVE and adopt risk-based vulnerability management practices.
On August 27, 2026, CISA added three vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation. The newly listed flaws are CVE-2023-49105 (ownCloud Improper Authentication), CVE-2026-53362 (Linux Kernel Unspecified), and CVE-2026-66384 (JFrog Artifactory Improper Limitation of a Pathname). CISA also reminded organizations of Binding Operational Directive 26-04, which mandates rapid remediation of KEV-listed vulnerabilities on publicly exposed federal assets and requires pre-patch compromise checks.