Delinea Labs October 2026 Threat Outlook
In this monthly series, Delinea Labs breaks down the identity-related incidents that had the greatest operational impact over the previous month: how attacks unfolded, what failed in real environments and what those failures signal for the month ahead.
In September, a critical vulnerability in Casdoor exposed a weakness at the core of identity security
An organization administrator could retrieve a private signing key and use it to forge authentication tokens for any user, including global administrators. Rather than stealing an administrator's credentials, an attacker could manufacture an identity the system already trusted.
It was one of several September disclosures pointing to the same problem: weaknesses in the mechanisms that establish and enforce identity trust.
Here's Delinea Labs' outlook for October.
Recent Delinea Labs outlooks have tracked attackers exploiting stolen credentials, third-party applications and increasingly autonomous AI agents. September added a new layer: Attackers targeting the systems that decide which identities to trust.
Several vulnerabilities traced back to hard-coded authentication secrets, exposed signing keys, certificate authorities and gaps in authentication or authorization. Any of them could let an attacker forge legitimate-looking tokens, impersonate trusted services or gain privileges beyond their intended scope.
A stolen credential gives an attacker access to an existing identity. A compromised signing key lets them create new ones. Rotating a user's password does little if an attacker can generate another valid authentication token.
As organizations rely more on federated identity, APIs, machine identities and AI agents, the infrastructure that establishes trust needs the same protection as the identities themselves.
Trusted applications became entry points.
Two September incidents showed attackers exploiting access organizations had already granted. At Brevo, a SAML single sign-on (SSO) scoping weakness allowed an attacker to access 138 customer accounts, export contacts from 43 of them, and use 6 of them to send phishing campaigns. Days later, a separate attacker used a long-lived Cloudflare API key stored in source code to deploy malicious code through Brevo-hosted infrastructure.
At BigCommerce, attackers compromised API credentials for third-party Ribon applications, using them to reach merchant environments, steal customer information and inject malicious scripts. BigCommerce said its own platform was not breached.
Access that had been granted to a trusted application turned into a way in
The risk goes up when credentials never expire or permissions cover more than the job requires. Identity verification data is now a tool for attackers.
Identity-verification provider IDScan.net confirmed an unauthorized third party accessed or copied customer information from its cloud platform. The disclosure followed reports that about 153 million driver's-license scans were up for sale. IDScan.net hasn’t confirmed that figure.
Government-issued identification documents are more than sensitive personal information. They’re evidence used to establish identity. Once they’re exposed, attackers can use them for impersonation, social engineering and attempts to get past identity verification.
AI agents keep reaching systems they were never meant to trust. On September 18, Google confirmed Gemini models unintentionally accessed systems belonging to three real companies during cybersecurity evaluations run by Irregular in May. The models were supposed to target fictional organizations. Instead, they had internet access nobody expected, and they used it to discover or guess credentials and authenticate to real systems.
Anthropic identified a fourth incident, in addition to the three covered in last month’s outlook. In January 2026, an early Claude Opus 4.6 model gained unauthorized access to a real third-party system. Anthropic also documented threat actors using AI in intrusion workflows involving credential theft, authentication artifacts and token replay.
AI agents are getting better at finding and using existing access paths on their own. Securing them means controlling not just what they're instructed to do, but which credentials, tools and permissions they can use.
There's a vulnerability here: September recorded 14,841 common vulnerabilities and exposures (CVEs), including 1,799 identity-related vulnerabilities and 146 affecting identity products, up from 84 in August.
Several disclosures showed how weaknesses in authentication infrastructure can undermine trusted access.
Microsoft Entra ID (CVE-2026-62916 and CVE-2026-83941). Two critical privilege-escalation vulnerabilities affected authentication and authorization controls. One could allow an unauthorized remote attacker to elevate privileges without any existing access; the other could allow an already authorized attacker to gain more.
Both are reminders that authentication was only the first check, and what an identity can do afterward still has to be enforced.
Casdoor (CVE-2026-90942 and CVE-2026-91998). One vulnerability exposed an instance-wide signing key that could be used to forge JSON Web Tokens (JWTs) for other users, including global administrators. Another allowed an attacker to use application credentials to manage users across organizations, including creating administrator accounts. Together, they showed how limited access could be transformed into broader authority.
JWT signing-key vulnerabilities (CVE-2026-89026, CVE-2026-85391 and CVE-2026-75431). Vulnerabilities in Issabel, Peppermint and PowerJob came down to hard-coded or predictable signing secrets. Attackers could use them to forge authentication tokens, create unauthorized sessions, and in some cases, achieve remote code execution.
Machine identity forgery (CVE-2026-78234). A vulnerability in hawtio-operator could let users with namespace edit permissions to obtain certificates containing attacker-controlled identity information and use them to impersonate trusted services.
The common thread is clear. Compromising the mechanisms that establish identity can do more damage than compromising a single account.
Qilin and TheGentleMen tied for the largest share of September's ransomware activity at 10.66% each, followed by KryBit at 4.96%.
KryBit, a ransomware-as-a-service operation that emerged in March 2026, has expanded across Windows, Linux, VMware ESXi and network-attached storage environments. KryBit reportedly uses phishing and compromised credentials for initial access, which fits the familiar pattern that stolen identities and privileged accounts remain reliable paths from initial compromise to ransomware deployment.
Protect the systems that establish identity trust. Treat JWT signing keys, certificate-authority keys and other signing material as Tier-0 identity assets. Eliminate hard-coded secrets, restrict access and set up reliable rotation and revocation.
Strengthen authorization boundaries. September's Brevo and Entra ID findings showed that authenticating an identity is only the first step. Review federation scoping, cross-organization permissions and privilege-escalation paths, and enforce authorization on the action itself.
Reduce standing privilege for machine and third-party identities. Inventory API keys, service accounts and application integrations. Remove unnecessary permissions and replace long-lived credentials with short-lived, task-scoped access wherever possible.
Enforce AI agent access at runtime. Limit the credentials, tools and network destinations available to agents, and verify their authority when they attempt consequential actions. Model-level restrictions alone can’t contain an agent with access to trusted systems.
A stolen password gives an attacker one identity; a stolen signing key lets them create as many as they want
The Delinea Platform helps organizations discover identities, analyze privilege risk and enforce access control at the moment of action. By extending Privileged Access Management (PAM) from the point of access to the moment of action, organizations can control what AI agents, humans and machines can do, and for how long.