Identity Briefing 06: An Azure Identity Did This in Seven Minutes
The fortnightly read for identity practitioners.
This fortnight
All briefings →31 People Tried to Secure a Compromised Passkey Account. Not One Could Do It Alone.
Cornell researcher Alaa Daffalla tested 31 people recovering compromised accounts across Google, PayPal and LinkedIn. Not one could fully secure the account without help, with many changing the password while leaving the attacker’s passkey behind. Pasted markdown
Identity Briefing 05: Melbourne IAM Summit Recap
The fortnightly read for identity practitioners.
Identity Briefing: Attackers have Agents too
The fortnightly read for identity practitioners.
103 Websites Had Passkeys. None Got Implementation Right
Louis Jannett's USENIX-award-winning research found 18 critical and 53 high-severity vulnerabilities across 103 real-world passkey deployments. The biggest companies were the worst offenders.
Microsoft fixes a CVSS 10.0 Entra ID flaw, and nobody has to do anything
A maximum-severity deserialization bug that could have meant remote code execution, patched on the service side before customers ever saw an action item.
Not one identity leader could count the AI agents running in production
We surveyed the Identity Leaders Network and ran a roundtable on agent inventory and governance. 40% have no idea how many agents they are running, and 40% say nobody owns the problem.
Identity Threat Radar
The full radar →CISA’s Known Exploited Vulnerabilities catalogue, cut down to the entries where identity was the way in. We group them by how the failure actually happened and add our own notes on the ones worth your time.
Pre-authentication bypass 4
CVE-2026-104286Fortinet FortiMailTop 18%
Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.
CISA Apply mitigations in accordance with vendor instructions. Federal deadline 4 Oct 2026.
CVE-2026-76504Cisco Catalyst SD-WAN ManagerTop 22%
Cisco Catalyst SD-WAN Manager contains a hex encoding vulnerability that could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user due to improper handling of URI encoding in an HTTP request.
CISA Apply mitigations in accordance with vendor instructions. Federal deadline 3 Oct 2026.
CVE-2026-88771Citrix NetScalerTop 36%
Citrix NetScaler ADC and NetScaler Gateway contain an improper input validation vulnerability that could allow an unauthenticated attacker to execute arbitrary commands.
CISA Apply mitigations in accordance with vendor instructions. Federal deadline 30 Sep 2026.
CVE-2026-76460Cisco Identity Services EngineTop 4%
Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) contain an incorrect use of privileged APIs vulnerability that could allow an unauthenticated, remote attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.
CISA Apply mitigations in accordance with vendor instructions. Federal deadline 19 Sep 2026.
Session and token handling 1
CVE-2026-102489Zammad GmbH ZammadTop 31%
Zammad GmbH Zammad contains a session fixation vulnerability that can lead to remote code execution as the zammad user. This vulnerability can be chained with CVE-2026-102490.
CISA Apply mitigations in accordance with vendor instructions. Federal deadline 5 Oct 2026.
Federation and SSO trust 1
CVE-2026-5430WSO2 Multiple ProductsTop 53%
WSO2 API Control Plane, API Manager, Traffic Manager & Universal Gateway contain a path traversal vulnerability that could allow for unrestricted file upload and lead to remote code execution.
CISA Apply mitigations in accordance with vendor instructions. Federal deadline 27 Sep 2026.
Privilege escalation 2
CVE-2026-102490Zammad GmbH ZammadTop 56%
Zammad GmbH Zammad contains an improper privilege management vulnerability that can allow the local zammad user to escalate privileges to root. This vulnerability can be chained with CVE-2026-102489.
CISA Apply mitigations in accordance with vendor instructions. Federal deadline 5 Oct 2026.
CVE-2026-71362Adobe Commerce and MagentoTop 1%
Adobe Commerce and Magento contains an incorrect authorization vulnerability that could allow an attacker to leverage this vulnerability to gain elevated access to sensitive resources without any user interaction.
CISA Apply mitigations in accordance with vendor instructions. Federal deadline 27 Sep 2026.
Catalogue updated 8 Oct 2026 · Likelihood from FIRST’s EPSS. · All 266 identity entries
The fortnightly read for identity practitioners.
Original data from identity leaders, one proper deep dive, and the fortnight's news that actually matters. Free, every two weeks.
Read by identity architects, IAM leads and security leaders across ANZ, the US and the UK.
You're subscribed. Read the latest issue →