Identity & Access Management
HashiCorp Vault Updates Prevent Unverified ACME Certificate Identities
HashiCorp published HCSEC-2026-40 security fixes. Inventory scope, apply supported updates, validate operations, and retain evidence.
WatchGuard AuthPoint 7.5.1 Fixes LDAP Authentication Bypass
AuthPoint Authentication Gateway 7.5.1 fixes an LDAP Sync first-factor bypass under non-default conditions. Update affected gateways while preserving additional factors; WatchGuard explicitly says those factors still apply, so this is not a complete MFA bypass.
Tinyauth Security Update Addresses 3 Vulnerabilities
Tinyauth advisories cover username timing, mixed-case hostname ACL bypass and global login lockout. Select a supported release containing all fixes, verify the maintained container image source, and preserve a trusted administrative access path.
OpenBao Security Update Addresses 4 Vulnerabilities
OpenBao 2.6.0 addresses Agent log-secret exposure, policy-template privilege expansion, recovery-token timing leakage and a LIST deny-rule bypass. Update servers and Agents separately, restrict exposed logs and assess credential revocation where warranted.
ManageEngine ADSelfService Plus 7001 Fixes RCE and Authentication Bypass
ADSelfService Plus fixes separate Windows logon-client SYSTEM execution and unauthenticated REST API bypass. Update the server and verify vendor-supported GINA client rollout; a server build check alone does not establish that affected endpoints changed.