EN PT-BR
← Voltar ao feed
medium

One Identity Active Roles 8.6 ships an RSTS configuration security fix with REST API and SAML 2.0 federation

3 fonte(s) · 3 atualização(ões) · publicado 10/11/2026 11:11 · coletado há 18 minutos

One Identity has released Active Roles 8.6, a cumulative update that the vendor presents as a security and platform release. The article says it fixes an RSTS configuration security issue and supersedes versions 8.3, 8.4 and 8.5. The Active Roles 8.6 release notes (support-public.cfm.quest.com) now place the flaw in the reworked RSTS module introduced in 8.3 and describe the release as a minor one. The same release line adds the Active Roles REST API and Redistributable Secure Token Server capabilities for API access and SAML 2.0 federated authentication. No CVE, CVSS score, exploitation status or affected RSTS configuration range was found for the RSTS fix, so criticity remains medium.

Detalhes técnicos

  • The release notes (support-public.cfm.quest.com) tie the flaw to the reworked RSTS feature introduced in Active Roles 8.3 and list the fix as item 726777. They give no CVE, CVSS score or exact trigger condition, so deployments that used RSTS on 8.3 to 8.5 are the ones to assess, although the notes do not state the affected range.
  • RSTS supports API access and SAML 2.0 federated authentication in this release line (article). The release notes also refer to obtaining an Active Roles API bearer token through the RSTS OAuth2 Resource Owner flow (support-public.cfm.quest.com), so defenders should treat RSTS as an authentication-facing component.
  • The release notes describe a separate RSTS binding problem, in which the Active Roles API showed as Unavailable and RSTS did not restore the binding (support-public.cfm.quest.com). RSTS and API status should be checked after the upgrade.
  • The thick-client console covers Active Directory, Microsoft Entra ID and Microsoft 365 in one interface, with PowerShell and VBScript support (article).
  • No public repository, pull request or commit for the fix was found, so the code change is not confirmed beyond the release notes.

Remediação

  • Plan the move from Active Roles 8.3, 8.4 and 8.5 to 8.6, since both the article and the release notes say 8.6 supersedes those versions (support-public.cfm.quest.com).
  • Before upgrading RSTS deployments, follow the Configuring RSTS guide that the release notes point to (support-public.cfm.quest.com).
  • After the upgrade, confirm that the Active Roles REST API points to a reachable RSTS instance, as the release notes advise (support-public.cfm.quest.com).

Linha do tempo

  1. gbhackers.com ↗ · pub. 10/11/2026 12:51 · coletado 10/11 13:03

    One Identity Active Roles 8.6 fixes RSTS configuration security issue introduced in 8.3

    The Active Roles 8.6 release notes, dated 27 July 2026, now confirm that the release fixes a security issue in the RSTS configuration introduced in Active Roles 8.3 and list the fix as item 726777 (support-public.cfm.quest.com). They also describe a separate RSTS binding problem and give configuration guidance for RSTS and the REST API. No CVE or CVSS score for the fix was found in the research.

    ler a análise desta fonte

    The Active Roles 8.6 release notes, dated 27 July 2026, now confirm that the release fixes a security issue in the RSTS configuration introduced in Active Roles 8.3 and list the fix as item 726777 (support-public.cfm.quest.com). They also describe a separate RSTS binding problem and give configuration guidance for RSTS and the REST API. No CVE or CVSS score for the fix was found in the research.

    One Identity has released Active Roles 8.6, a cumulative update that the vendor presents as a security and platform release. The article says it fixes a configuration security issue in RSTS and supersedes versions 8.3, 8.4 and 8.5, and the vendor's release notes describe it as a minor release fixing a security issue in the configuration of the RSTS module introduced in Active Roles 8.3 (support-public.cfm.quest.com). No CVE, CVSS score or exploitation report was found for this flaw, and no separate One Identity security advisory was found. The RSTS component matters only once it is configured, which limits exposure to deployments that use it, but it handles API access and SAML 2.0 federated sign-in, so criticity stays medium.

    Technical Details

    • The release notes (support-public.cfm.quest.com) tie the flaw to the reworked RSTS feature introduced in Active Roles 8.3 and list the fix as item 726777. They give no CVE, CVSS score or exact trigger condition, so deployments that used RSTS on 8.3 to 8.5 are the ones to assess, although the notes do not state the affected range.
    • RSTS supports API access and SAML 2.0 federated authentication in this release line (article). The release notes also refer to obtaining an Active Roles API bearer token through the RSTS OAuth2 Resource Owner flow (support-public.cfm.quest.com), so defenders should treat RSTS as an authentication-facing component.
    • The release notes describe a separate RSTS binding problem, in which the Active Roles API showed as Unavailable and RSTS did not restore the binding (support-public.cfm.quest.com). RSTS and API status should be checked after the upgrade.
    • The thick-client console covers Active Directory, Microsoft Entra ID and Microsoft 365 in one interface, with PowerShell and VBScript support (article).
    • No public repository, pull request or commit for the fix was found, so the code change is not confirmed beyond the release notes and there is no Fix Details section.

    Remediation

    • Plan the move from Active Roles 8.3, 8.4 and 8.5 to 8.6, since both the article and the release notes say 8.6 supersedes those versions (support-public.cfm.quest.com).
    • Before upgrading RSTS deployments, follow the Configuring RSTS guide that the release notes point to (support-public.cfm.quest.com).
    • After the upgrade, confirm that the Active Roles REST API points to a reachable RSTS instance, as the release notes advise (support-public.cfm.quest.com).
  2. securityonline.info ↗ · pub. 10/11/2026 11:12 · coletado 10/11 13:03

    One Identity Unveils Active Roles 8.6 with Enhanced Security and Administration

    ler a análise desta fonte

    One Identity has introduced Active Roles 8.6, strengthening secure and streamlined Active Directory administration with cumulative platform improvements, expanded API capabilities and greater authentication flexibility.

    Active Roles 8.6, updated July 27, 2026, focuses on security and cumulative platform improvements. It fixes an RSTS configuration security issue and supersedes versions 8.3, 8.4 and 8.5. Compared with Active Roles 8.2.1 SP6, One Identity says 8.6 incorporates the features, enhancements and resolved issues delivered across that intervening release line. See the Active Roles 8.6 Release Notes.

  3. hackread.com ↗ · pub. 10/11/2026 11:11 · coletado 10/11 12:01 primeiro registro

    One Identity Active Roles 8.6 ships an RSTS configuration security fix with REST API and SAML 2.0 federation

    ler a análise desta fonte

    One Identity has released Active Roles 8.6, a cumulative update that the vendor presents as a security and platform release. The article says it fixes an RSTS configuration security issue and supersedes versions 8.3, 8.4 and 8.5. The same release line adds the Active Roles REST API and Redistributable Secure Token Server capabilities for API access and SAML 2.0 federated authentication. The article gives no CVE, CVSS score, affected RSTS configuration or exploitation status, and the research did not find a CVE for the RSTS fix. Criticity is medium because this is a product release with an unspecified security fix, not a reported exploited flaw.

    Technical Details

    • The article describes the RSTS fix only as a configuration security issue. It does not name the flaw, its prerequisites or the versions it affects before 8.6.
    • RSTS supports API access and SAML 2.0 federated authentication in this release line, so a defender should treat it as an authentication-facing component.
    • The thick-client console covers Active Directory, Microsoft Entra ID and Microsoft 365 in one interface, with PowerShell and VBScript support.
    • The research did not open the One Identity release notes or a security advisory for 8.6, so the exact RSTS change is not confirmed beyond the article's wording.

    Remediation

    • Plan the move from Active Roles 8.3, 8.4 and 8.5 to 8.6, since the article says 8.6 supersedes those versions.
    • Read the Active Roles 8.6 Release Notes, which the article points to, to confirm the RSTS fix and any configuration steps before upgrading RSTS deployments.