One Identity Active Roles 8.6 Fixes RSTS Configuration Security Issue

One Identity released Active Roles 8.6 to fix a security issue in the configuration of its Redistributable Secure Token Server (RSTS) module, introduced in Active Roles 8.3. The vendor’s release notes state that version 8.6 supersedes versions 8.3, 8.4 and 8.5. The available announcement does not identify a CVE, explain exploitability or report active exploitation.

The update also incorporates intervening Active Directory administration improvements, including REST API capabilities and RSTS support for API access and SAML 2.0 federated authentication. Organizations running the superseded versions should prioritize evaluating and deploying 8.6, reviewing the vendor’s release notes for configuration changes, deprecated features and compatibility considerations. The available information does not establish whether a configuration-only mitigation is possible.