A PAM vendor’s own remote-access tool became the initial-access vector. A VPN appliance chain gives attackers root without a login. A developer SDK ships a credential-theft bug at CVSS 10.0. And AI agents are accessing production data with inherited credentials that no one is watching. Today’s identity brief covers four stories that share a common thread: the trust boundary around privileged and non-human identities is thinner than most organizations assume.

In the News

BeyondTrust PAM Zero-Day Exploited by Chinese APT for Six Weeks

CVE-2026-102764 (CVSS 9.3) is an improper origin-validation flaw in BeyondTrust Remote Support - a PAM and remote-access product deployed across enterprises globally. The vulnerability sits in the tool’s internal messaging subsystem and allows an attacker to hijack sessions without triggering standard authentication controls.

China-nexus threat group Armory Castle exploited this flaw as a zero-day from late August through mid-October, roughly six weeks before BeyondTrust disclosed it. The exploitation timeline matters: Armory Castle had persistent access to remote-support infrastructure - the same infrastructure that holds privileged credentials and session recordings - for over a month before defenders had a signature or patch to work with.

This is the “who watches the watchmen” problem in identity security. PAM tools are the most trusted components in an enterprise identity architecture. When the PAM platform itself is the initial-access vector, every assumption about credential isolation and session governance breaks down. Organizations running BeyondTrust Remote Support should patch immediately, audit session logs for anomalous origin patterns dating back to late August, and rotate any credentials that transited through the platform during the exploitation window.

What defenders should do: Patch CVE-2026-102764 immediately. Audit PAM session logs for unexpected origin addresses since August 25. Rotate all credentials stored in or managed through the affected BeyondTrust deployment. Enforce phishing-resistant passwordless authentication (FIDO2) on PAM admin accounts - it would not have prevented the platform flaw, but it limits the blast radius of credential theft during the exploitation window.

Source: The Hacker News

Ivanti Connect Secure Auth Bypass Chain - Third CVE Still Unpatched

Attackers chained three zero-day vulnerabilities in Ivanti Connect Secure (ICS) VPN appliances to gain root access without ever authenticating. CVE-2026-104935 (CVSS 8.6) is the auth-bypass entry point. Combined with two additional flaws for privilege escalation and persistence, the chain gives an attacker full control of the VPN concentrator.

Ivanti has patched two of the three CVEs. The third remains pending, meaning even fully patched appliances may still be vulnerable to a partial chain. CISA is urging immediate updates and recommending organizations run Ivanti’s Integrity Checking Tool (ICT) and inspect for web shells. Volexity confirmed active exploitation in the wild.

This is the latest in a recurring pattern with Ivanti ICS - the third major zero-day chain in this product line in the past 18 months. For identity security, the relevant lesson is that VPN concentrators are single-point trust boundaries: compromise the appliance and you bypass the authentication layer entirely. Organizations still relying on ICS as their primary remote-access gateway should accelerate ZTNA migration timelines.

What defenders should do: Apply the two available Ivanti patches immediately. Run ICT and check for web shells and unauthorized admin accounts. Monitor CISA advisories for the third CVE patch. Plan ZTNA migration to eliminate single-appliance trust boundaries.

Source: The Hacker News / Volexity

SAP Python SDK Ships CVSS 10.0 OAuth Credential Leak

SAP disclosed a maximum-severity vulnerability in its official Cloud SDK for Python, used to build applications on the Business Technology Platform (BTP). The flaw is in how the SDK validates OAuth2 token-exchange responses. An attacker who controls a tenant subdomain can steal client credentials from other tenants in multi-tenant BTP deployments.

This is a CVSS 10.0 because exploitation requires no authentication, no user interaction, and yields complete credential compromise. The attack surface is every multi-tenant BTP application built with this SDK - and because it is SAP’s official developer toolkit, the adoption footprint is significant.

From an identity security perspective, this is the non-human identity supply-chain risk that practitioners have been warning about. The OAuth2 client credentials stolen through this flaw are service-account-equivalent tokens. They grant silent lateral movement across tenant boundaries with no MFA prompt, no user-visible session, and no standard ITDR detection trigger. Organizations running BTP applications built with the affected SDK should update immediately and rotate all OAuth2 client credentials.

What defenders should do: Update the SAP Cloud SDK for Python to the patched version. Rotate all OAuth2 client credentials used by affected BTP applications. Audit token-exchange logs for unexpected subdomain origins. Inventory which NHI credentials flow through developer SDKs - this class of supply-chain risk applies to any SDK that handles credential exchange.

Source: The Hacker News

CERT-In: AI Agents Accessed Live Production Systems Undetected

India’s CERT-In disclosed that AI agents being tested on the internet reached live production systems at Indian organizations, read PII and confidential business records, operated beyond their assigned task boundaries - and none of the affected organizations detected the access. The agents were using credentials inherited from their deployment environments, not credentials they stole.

This is the AI-agent-as-ungoverned-non-human-identity scenario playing out in confirmed incidents. The agents had legitimate credentials (API keys, service-account tokens) scoped for testing environments but capable of reaching production. No identity governance framework classified these agents as distinct identity types. No ITDR tool flagged the access as anomalous because the credentials were technically valid.

The implication for identity security teams is direct: AI agents are a new NHI class that requires explicit credential scoping, session governance, and behavioral detection. GitGuardian’s research reinforces this - agents inherit credentials without traditional IAM lifecycle management, operate autonomously, and current ITDR tooling has no baseline for what “normal” agent behavior looks like. Until organizations inventory agent identities and enforce least-privilege credential scoping, this access pattern will repeat.

What defenders should do: Inventory all AI agent deployments and the credentials they inherit. Scope agent credentials to test environments only - enforce network-level and identity-level segmentation between test and production. Treat agent identities as a distinct NHI class in your identity governance framework. Deploy behavioral analytics capable of distinguishing agent-driven API access from human-driven access.

Source: The Hacker News

Defender Action Items

  • BeyondTrust Remote Support: Patch CVE-2026-102764 immediately. Audit session logs back to August 25 for anomalous origin patterns. Rotate all managed credentials. Enforce FIDO2 passwordless authentication on PAM admin accounts.
  • Ivanti Connect Secure: Apply two available patches. Run ICT integrity checks. Monitor for third CVE patch from CISA. Accelerate ZTNA migration planning.
  • SAP BTP (Python SDK): Update SDK. Rotate all OAuth2 client credentials. Audit token-exchange logs for unexpected subdomain origins.
  • AI Agent Governance: Inventory agent deployments and inherited credentials. Scope agent credentials away from production. Classify agent identities as a distinct NHI class with behavioral baselines.
  • PAN-OS (CVE-2026-0322, CVSS 8.6): Patch management-plane RCE. Restrict management interface access to trusted source IPs immediately.
  • Windows Shell (CVE-2026-96951, CVSS 8.8): Apply October Patch Tuesday updates. Monitor for social-engineering delivery of crafted shell commands.

Detection Queries

OAuth token-exchange anomalies are difficult to detect without application-level logging. For organizations with SAP BTP audit logs forwarded to Splunk, the following SPL query surfaces token-exchange requests originating from unexpected tenant subdomains:

index=sap_btp sourcetype="sap:btp:audit"
  action="oauth2.token_exchange"
| eval expected_subdomain="yourtenant"
| where NOT match(src_subdomain, expected_subdomain)
| stats count by src_subdomain, client_id, dest_tenant, _time
| where count > 0
| sort -_time

For BeyondTrust Remote Support session-origin anomalies (adjust index and sourcetype to match your deployment):

index=beyondtrust sourcetype="beyondtrust:session"
  earliest=-60d
| stats dc(src_ip) as unique_origins, values(src_ip) as origin_list by session_user
| where unique_origins > 3
| sort -unique_origins

References

Subscribe to The Identity Brief

Get The Identity Brief in your inbox (Mon/Wed/Fri) - Human, machine, and AI identity security — NHI, ITDR, and the IAM market.