AI Agent Trust, Identity & Security News

Trust & Security

VPN Infrastructure Is Now the Authentication Gap’s Final Frontier

Four major vendors hit with auth bypass CVEs in 2026, exploitation windows compressing to days. Agent deployment architectures assume the very trust model that is breaking.

◆ Heath CallahanSep 10

Trust & Security

Citrix NetScaler Authentication Bypass Under Active Exploitation – VPN Infrastructure Joins the Authentication Gap

Previdian recorded 10 exploitation attempts from six attacker IPs within 24 hours of a public PoC release. The 15-day patch-to-exploitation window shows threat actors weaponizing Citrix disclosures faster than enterprises can deploy fixes.

◆ Heath CallahanSep 10

Trust & Security

Check Point Quantum VPN Drops Two CVSS 9.8 CVEs in the Same Certificate Path – VPN Infrastructure Joins the Auth Gap

Two pre-authentication RCEs in VPN certificate handling extend the authentication gap from middleware and ERP into the infrastructure layer that secures remote enterprise access.

◆ Heath CallahanSep 9

Trust & Security

Ivanti’s September Patch Day Drops Two Authentication Bypasses – Endpoint Management Is Now Part of the Gap

Sentry and EPMM join PaperCut, N-able, Microsoft, and SAP as the latest enterprise management tools where authentication fails before the system checks who is asking.

◆ Heath CallahanSep 9

Trust & Security

SAP’s September Patch Day Drops Four Critical CVEs—Three of Them Bypass Authentication Entirely

OVERPASS and S4GET enable unauthenticated RCE on core ERP infrastructure. The authentication gap is no longer a middleware problem.

◆ Heath CallahanSep 9

Trust & Security

Microsoft’s Two-Track Patch Tuesday: Cloud Identity Flaws Fixed Before Disclosure, Windows Still Catching Up

The September 8 batch covers 70 CVEs including Windows Secure Kernel Mode and VBS vulnerabilities. But the most critical identity flaws—Azure AD B2C and Entra ID at CVSS 10.0—were silently fixed five days earlier, all server-side, no customer action required.

◆ Heath CallahanSep 8

Trust & Security

Trezor’s Supply Chain Cracked Through ShipMonk’s Unpatched Metabase: 67,000 Crypto Customers Exposed

The authentication gap pattern reaches into crypto supply chains—not through the wallet, but through the fulfillment warehouse's business intelligence tool.

◆ Heath CallahanSep 7

Trust & Security

N-able N-central CVSS 10.0 Pre-Auth RCE Marks Third Attack Wave in Six Weeks

A cascading chain of authentication bypasses and a maximum-severity RCE in MSP management software exposes the supply-chain blast radius of centralized IT tools.

◆ Heath CallahanSep 7

Trust & Security

PaperCut’s Authentication Gap Returns: Two-Minute RCE Chain Hits 70,000 Organizations

The latest PaperCut exploit chain highlights a recurring failure in securing internet-facing management tools, leaving nearly half of enterprise installations exposed.

◆ Heath CallahanSep 7

Trust & Security

The End of the Authentication Gap: Microsoft’s SSPR Enforcement

As of September 7, Microsoft has closed the self-service recovery loophole, marking a structural shift toward mandatory phishing-resistant identity.

◆ Heath CallahanSep 7