IAM Engineer: 2026-09-19
8 minutes in total
SolarWinds, 2026-09-17. Read, 1 min.
SolarWinds published an advisory for CVE-2026-28326, an unauthenticated remote code execution vulnerability in Access Rights Manager rated CVSS 8.8 that stems from a hardcoded static key. Access Rights Manager 2026.2 and all previous versions are affected, the fix is 2026.2.1, and the advisory makes no statement either way about exploitation.
Why it matters for this role: Access Rights Manager is the tooling behind your entitlement reviews, so unauthenticated code execution in it exposes permissions data and the service accounts ARM uses. Confirm the version, get 2026.2.1 scheduled, and review what privileges those service accounts hold in the meantime.
Corrected 2026-09-21: An earlier version said there was no evidence of exploitation and placed the fix in the normal patch cycle. The SolarWinds advisory makes no statement about exploitation either way. The item now cites the advisory itself instead of a news report about it.
Cisco Identity Services Engine Authentication Bypass Vulnerability
Cisco (PSIRT), 2026-09-16. Read, 7 min.
Cisco published advisory cisco-sa-ISE-ABP-VNSW7Tn5 on 2026-09-16 for CVE-2026-76460, a CVSS 10.0 authentication bypass caused by insufficient authentication control on an ISE API endpoint, affecting Identity Services Engine and the ISE Passive Identity Connector regardless of device configuration. Cisco says an unauthenticated attacker sending a crafted request may obtain command execution with root privileges, that PSIRT is aware of active exploitation, and that there are no workarounds that address the vulnerability, with infrastructure access control lists restricting management traffic offered as mitigation only. First fixed releases are 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7 and 3.5 Patch 4.
Why it matters for this role: ISE is your network access policy decision point, so an authentication bypass Cisco says is being exploited means patching to the fixed release now and then reviewing ISE admin and API activity for requests you cannot account for.
The quiz for this edition has closed.