Artifactory Fix Set Grows, But The Breach Path Is Still Unclear
The real issue is still the trust boundary inside Artifactory, not one isolated bug. NCSC’s new advisory widens the fixed set to 13 CVEs, which points to broken auth and request-validation plumbing across the same release line rather than a single flaw that explains the incident.
The patched issues include token-scope checks, weak refresh-token validation, SSRF, deserialization, path traversal, and authorization failures. That spread matches the earlier picture: a repository service that could trust too much, let low-privileged users cross into higher privilege, and reach places it should not have been able to reach.
For teams using Artifactory as a control point for builds, credentials, or internal service access, the unresolved question matters. Patching is still necessary, but the wider fix set means the safe assumption is a broader repository-layer trust failure until the exploited path is pinned down.