Identity Briefing 08: When Does a Workload Become an AI Agent?
The fortnightly read for identity practitioners.
This fortnight
All briefings →Identity Briefing 07: One Vendor Credential Got Into 173 Microsoft 365 Tenants
The fortnightly read for identity practitioners.
Identity Briefing 06: An Azure Identity Did This in Seven Minutes
The fortnightly read for identity practitioners.
31 People Tried to Secure a Compromised Passkey Account. Not One Could Do It Alone.
Cornell researcher Alaa Daffalla tested 31 people recovering compromised accounts across Google, PayPal and LinkedIn. Not one could fully secure the account without help, with many changing the password while leaving the attacker’s passkey behind.
Identity Briefing 05: Melbourne IAM Summit Recap
The fortnightly read for identity practitioners.
Identity Briefing: Attackers have Agents too
The fortnightly read for identity practitioners.
103 Websites Had Passkeys. None Got Implementation Right
Louis Jannett's USENIX-award-winning research found 18 critical and 53 high-severity vulnerabilities across 103 real-world passkey deployments. The biggest companies were the worst offenders.
Identity Threat Radar
The full radar →CISA’s Known Exploited Vulnerabilities catalogue, cut down to the entries where identity was the way in. We group them by how the failure actually happened and add our own notes on the ones worth your time.
Pre-authentication bypass 6
CVE-2026-111357Ivanti Connect SecureTop 55%
Ivanti Connect Secure contains a missing authentication for critical function vulnerability that could allow a local authenticated attacker to escalate their privileges. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-118527.
CISA Apply mitigations in accordance with vendor instructions. Federal deadline 2 Nov 2026.
CVE-2026-102764BeyondTrust Remote SupportTop 3%
BeyondTrust Remote Support contains an authentication bypass by spoofing vulnerability that could allow a remote attacker to perform file operations on the appliance.
CISA Apply mitigations in accordance with vendor instructions. Federal deadline 19 Oct 2026.
CVE-2026-76519Cisco Secure Email GatewayTop 18%
Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.
CISA Apply mitigations in accordance with vendor instructions. Federal deadline 17 Oct 2026.
CVE-2026-105133Ahsay CBSTop 1%
Ahsay AhsayCBS contains an improper authentication vulnerability that could allow a remote attacker to bypass authentication via manipulation of the random parameter in the API component’s checkSysPwd function. This vulnerability can be chained with CVE-2026-105134.
CISA Apply mitigations in accordance with vendor instructions. Federal deadline 17 Oct 2026.
CVE-2026-104935Ivanti Connect SecureTop 1%
Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands.
CISA Apply mitigations in accordance with vendor instructions. Federal deadline 16 Oct 2026.
CVE-2026-104286Fortinet FortiMailTop 8%
Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.
CISA Apply mitigations in accordance with vendor instructions. Federal deadline 4 Oct 2026.
Session and token handling 1
CVE-2026-102489Zammad GmbH ZammadTop 2%
Zammad GmbH Zammad contains a session fixation vulnerability that can lead to remote code execution as the zammad user. This vulnerability can be chained with CVE-2026-102490.
CISA Apply mitigations in accordance with vendor instructions. Federal deadline 5 Oct 2026.
Privilege escalation 1
CVE-2026-102490Zammad GmbH ZammadTop 4%
Zammad GmbH Zammad contains an improper privilege management vulnerability that can allow the local zammad user to escalate privileges to root. This vulnerability can be chained with CVE-2026-102489.
CISA Apply mitigations in accordance with vendor instructions. Federal deadline 5 Oct 2026.
Catalogue updated 3 Nov 2026 · Likelihood from FIRST’s EPSS. · All 271 identity entries
The fortnightly read for identity practitioners.
Original data from identity leaders, one proper deep dive, and the fortnight's news that actually matters. Free, every two weeks.
Read by identity architects, IAM leads and security leaders across ANZ, the US and the UK.
You're subscribed. Read the latest issue →