CISA KEV Catalog Update: ownCloud, Linux Kernel, and JFrog Artifactory Actively Exploited Vulnerabilities

Technical Analysis

CVE-2023-49105 affects ownCloud and involves improper authentication, potentially allowing attackers to bypass access controls and gain unauthorized access to file storage. CVE-2026-53362 is an unspecified vulnerability in the Linux Kernel, a foundational component across servers, containers, and cloud infrastructure, that could enable privilege escalation or system compromise if exploited. CVE-2026-66384 impacts JFrog Artifactory, involving improper limitation of a pathname to a restricted directory (path traversal), which could allow attackers to read or write files outside intended directories, potentially leading to code execution or credential exposure. JFrog Artifactory is widely used as an artifact and package repository, including for hosting Python, npm, and container images consumed by CI/CD pipelines and AI/ML development environments; exploitation could allow attackers to poison packages or extract secrets used by automated build and deployment systems. Given that AI agent frameworks and MLOps pipelines frequently pull dependencies from Artifactory-hosted repositories and run on Linux-based infrastructure, successful exploitation of these vulnerabilities could lead to supply-chain compromise of agent tooling, credential theft (including API keys used by agents), or full host takeover on systems supporting agent workloads.

Affected Systems

ownCloud instances vulnerable to CVE-2023-49105 (improper authentication); Linux Kernel versions affected by CVE-2026-53362 (unspecified vulnerability, version details pending official kernel advisory); JFrog Artifactory deployments vulnerable to CVE-2026-66384 (path traversal in restricted directory handling).

Indicators of Compromise

• No specific IOCs (hashes, IPs, domains) provided in source data. Organizations should consult CISA KEV Catalog and vendor advisories for exploitation indicators.

Remediation Steps

1. 1

   Patch ownCloud immediately

   Apply the vendor-supplied fix for CVE-2023-49105 addressing improper authentication in ownCloud deployments.

2. 2

   Update Linux Kernel

   Apply the latest kernel security patches addressing CVE-2026-53362 across all affected Linux-based servers, containers, and cloud instances, including those hosting AI/agent workloads.

3. 3

   Patch JFrog Artifactory

   Upgrade Artifactory to the version that resolves CVE-2026-66384 path traversal vulnerability; audit repository access logs for signs of unauthorized directory traversal.

4. 4

   Audit CI/CD and package repositories

   Review Artifactory-hosted packages and build pipelines for unauthorized modifications, especially those feeding AI agent, LLM, or RAG pipeline dependencies.

5. 5

   Follow BOD 26-04 guidance

   FCEB agencies must prioritize remediation per Binding Operational Directive 26-04; all organizations are encouraged to adopt risk-based patching aligned with the KEV Catalog and verify systems were not compromised prior to patching.

6. 6

   Rotate exposed credentials

   If Artifactory or ownCloud instances were exposed prior to patching, rotate API keys, tokens, and credentials that may have been accessed, including those used by automated agents and CI/CD systems.