Topic

Access Control: news, advisories and analysis

12 articlesUpdated 24 Oct 2026

CyberSecureToday covers Access Control across 12 articles published between 15 Sep 2026 and 24 Oct 2026. The coverage includes 12 vulnerability advisories. 12 advisories are rated critical or high severity, and 2 involve flaws listed in CISA's Known Exploited Vulnerabilities catalog.

Stories on Access Control most often intersect with CWE-284, Privilege Escalation and Cloud Security, with Technology, Cloud & SaaS the most affected sector. The most recent story, “Azure Enterprise Services Access Control Flaw Disclosed”, was published 24 Oct 2026. Every article is listed below, newest first, with the affected products, severity and remediation guidance in each piece.

Latest coverage

ThreatsCloud & SaaSCritical
Azure Enterprise Services Access Control Flaw Disclosed
CVE-2026-83944 in Azure Enterprise Services (Access Control) allows remote attackers to trigger arbitrary code execution. Patch: Vendor security patch rele
Aisha Noor24 Oct 202610 min read
ThreatsBanking & FintechHigh
MariaDB DROP PACKAGE Defect Leaves Orphaned Grants in mysql.procs_priv Enabling Privilege Escalation
A catalog cleanup omission in MariaDB's PL/SQL package engine left orphaned grants in mysql.procs_priv, allowing low-privilege users to hijack administrative packages.
CST Editorial Desk18 Oct 202613 min read
ThreatsCloud & SaaSHigh
RubyGems Flaw in Gem Transfer Flow Allowed Organization Admins to Hijack Owner Rights and Evict Founders
A missing authorization boundary in RubyGems.org's gem transfer workflow enabled organization admins to invite attacker-controlled owners and evict founders.
Daniel Okafor18 Oct 202611 min read
ThreatsCloud & SaaSCritical
ProFTPD mod_copy Flaw Weaponized to Copy Server Files and Execute Code
ProFTPD resolves a critical access control flaw in mod_copy (CVE-2015-3306) where unauthenticated attackers copy arbitrary server files and execute remote code.
CST Editorial Desk14 Oct 20268 min read
ThreatsCloud & SaaSHigh
AWS IAM Identity Center Flaw Left Revoked Session Tokens Active
AWS resolves an access control flaw in IAM Identity Center and AWS CLI session handling (CVE-2026-82856) where revoked STS tokens remained temporarily active.
CST Editorial Desk14 Oct 20268 min read
ThreatsCloud & SaaSCritical
AWS Identity and Access Management SCIM Endpoint Authentication Bypass Exposes Cloud Federation Roles
A security vulnerability in AWS IAM Identity Center's SCIM protocol implementation could allow token bypass during automated user and group provisioning.
CST Editorial Desk10 Oct 20268 min read
ThreatsCloud & SaaSCritical
AWS IAM Identity Center Flaw Enables SCIM Bearer Token Bypass Across Enterprise Cloud Tenants
AWS resolves high-severity vulnerability CVE-2026-46210 in IAM Identity Center where cached SCIM bearer tokens allowed cross-directory role synchronization bypass.
CST Editorial Desk7 Oct 20268 min read
ThreatsCloud & SaaSCritical
Internet2 Grouper Access Management Rule Engine Flaw Allows Unauthorized Privilege Escalation (CVE-2026-103470)
A privilege escalation vulnerability in Internet2 Grouper before v7.5.1 allows authenticated users with rule editing rights to elevate to full system administrator.
Priya Raman1 Oct 202611 min read
ThreatsCloud & SaaSHigh
Fortinet FortiSandbox Web Management Access Control Flaw Exposes Forensic Threat Telemetry (CVE-2026-26084)
Fortinet resolves a high-severity improper access control flaw in FortiSandbox (CVE-2026-26084) allowing unauthenticated attackers to expose forensic analysis data.
Daniel Okafor1 Oct 20268 min read
ThreatsIndustrial & OTCritical
Siemens Siveillance Control File Upload Flaw Grants Unauthenticated Root Access
Siemens patches critical CVSS 9.0 flaw CVE-2026-50093 in Siveillance Control OIS web service, enabling unauthenticated remote attackers to obtain root privileges.
CST Editorial Desk23 Sep 202615 min read
ThreatsIndustrial & OTCritical
Johnson Controls C-CURE 9000 Vulnerabilities Allow Attackers to Hijack Physical Facility Access Gateways
Johnson Controls and CISA release emergency advisory ICSA-26-204-01 for C-CURE 9000 and victor application servers resolving critical code execution flaw CVE-2026-21655.
Mei-Lin Chen19 Sep 202613 min read
ThreatsCloud & SaaSCritical
Oracle WebLogic Server & Proxy Plug-in Flaw Exploited to Bypass Access Controls
CISA adds CVE-2026-21962 to its KEV catalog, warning of active remote exploitation bypassing Oracle HTTP Server reverse proxy rules to seize WebLogic clusters.
Aisha Noor15 Sep 20268 min read