The timing is also worth noting. The press release went out this week, but the software itself is months old. The vendor's announcement, reported by SC Media via CSO Online and carried by CIO and GlobeNewswire, says Active Roles 8.6, updated July 27, 2026, focuses on security and cumulative platform improvements. The release notes carry the same July 27 date. If you installed 8.6 over the summer, this news is already behind you. If you didn't, read on.
What Active Roles is, briefly
For readers who haven't used it: Active Roles is One Identity's add-on management layer for Active Directory. It handles delegated administration, role-based access, user provisioning, and auditing and reporting. A lot of mid-size and large Windows shops use it so the helpdesk can reset passwords and edit group memberships without anyone handing out Domain Admin rights.
The vendor pitches the product on familiarity and consolidation. Its announcement says the thick-client interface is designed to resemble the familiar Microsoft Active Directory experience, helping reduce the learning curve for experienced AD administrators. It also describes one console covering Active Directory, Microsoft Entra ID and Microsoft 365, with PowerShell and VBScript support so existing scripts keep working. These are One Identity's own descriptions, not independent test results.
Section summary: Active Roles is a delegation and lifecycle layer for hybrid Microsoft identity. Version 8.6 has been available since July 27, 2026.
The security fix: what's known and what isn't
This is the part that matters. Here's what the record supports:
- The issue is in RSTS. RSTS stands for Redistributable Secure Token Server, the component that handles token-based and federated authentication for Active Roles. The vendor's announcement says 8.6 fixes an RSTS configuration security issue and supersedes versions 8.3, 8.4 and 8.5.
- The affected range starts at 8.3. The release notes say the issue was introduced in 8.3, which is why 8.6 replaces that whole release line.
- The details are missing. Security news aggregator Mallory, summarizing the release, notes that the available announcement does not identify a CVE, explain exploitability or report active exploitation.
So there's no CVE, no CVSS score, no list of affected configurations, no workaround and no indication of exploitation in the wild. Treat this as an important vendor-acknowledged fix, not a confirmed emergency. Any article claiming the flaw is critical or being actively exploited is going beyond what One Identity has said.
There's still a reason to move promptly. RSTS sits on the authentication path for an AD delegation tool, and that tool often holds wide write access to the directory. A configuration weakness there deserves priority even without a severity score. That's general industry judgment, not something the vendor has stated.
Section summary: Versions 8.3 through 8.5 contain an RSTS configuration flaw that 8.6 fixes. Severity and exploitability have not been disclosed.
REST API and SAML 2.0: cumulative, not brand new
SC Media's brief says the platform "introduces" expanded REST API capabilities and SAML 2.0 support. The vendor's wording is more careful: the cumulative release line adds capabilities including the Active Roles REST API, as well as Redistributable Secure Token Server capabilities supporting API access and SAML 2.0 federated authentication.
That difference matters if you're planning around it. One Identity says that compared with Active Roles 8.2.1 SP6, One Identity says 8.6 incorporates the features, enhancements and resolved issues delivered across that intervening release line. In other words, the API and SAML work arrived across 8.3 to 8.5 and is bundled into 8.6. The vendor itself calls the result an administrator and integration experience upgrade, rather than a new visual redesign.
What this means in practice depends on where you're coming from:
| Your current version | What 8.6 means for you |
|---|---|
| 8.2.1 SP6 or earlier | A large jump that brings in the REST API, the RSTS-based SAML 2.0 and API authentication, and every fix since 8.2.1 SP6 |
| 8.3, 8.4 or 8.5 | Mainly the RSTS security fix, since the vendor says the issue began in 8.3 |
| 8.6 | Nothing to do unless new guidance comes out |
There's an irony here: the RSTS work that brought SAML and API authentication is the same area where the flaw appeared. New authentication features bring new configuration settings, and those settings can go wrong.
Section summary: The API and SAML features are cumulative from the 8.3 to 8.5 line. Customers on 8.2.1 SP6 get a much bigger change than customers already on 8.3 or later.
A practical upgrade checklist
None of these steps are new menu paths or commands, just the planning that a directory-management upgrade needs:
- Find your version. If you're on 8.3, 8.4 or 8.5, you're in the range the vendor says is affected.
- Read the 8.6 release notes before touching production. They include known-issue tables for several areas, including the Active Roles API, Web Interface, Collector and Report Pack, installer, language packs and the Synchronization Service. They also describe Configuration Center scenarios that can produce errors when Active Roles Administration Service starts or when it connects to its SQL Server database.
- Test the upgrade in a lab. Active Roles keeps its configuration in SQL Server and often runs custom workflows, policies and script modules. Check that these, plus the database permissions, survive the upgrade.
- Check anything that authenticates through RSTS. That includes SAML-federated sign-ins and API clients that request tokens. Test them after the upgrade, because RSTS is the component that changed.
- Check whether you're entitled to 8.6. Upgrade timing depends on your support agreement and deployment, so confirm entitlements and lifecycle dates with One Identity rather than relying on press coverage.
Section summary: Find your version, read the known issues, test database and workflow migration, and check RSTS authentication afterward.
About the PeerSpot ranking
Every version of this story repeats the review-site ranking. The vendor's announcement says PeerSpot currently ranks Active Roles by One Identity #1 in Active Directory Management, with an 8.5/10 rating based on 92 reviews. That may help someone choosing a product, but it says nothing about whether 8.6 fixes the RSTS issue well. Remember too that this "news" is a press release distributed through syndication networks.
The bigger trend is real, though. Hybrid identity estates spanning on-premises AD, Entra ID and Microsoft 365 are driving demand for single-pane delegation tools. Those tools are trusted intermediaries, so their own authentication components become attractive targets. A flaw in an RSTS configuration is a reminder to patch the tool that manages your directory as carefully as the directory itself.
The bottom line
Active Roles 8.6 has been out since July 27, 2026. It fixes an RSTS configuration security issue that One Identity's release notes say first appeared in 8.3, and it replaces 8.3, 8.4 and 8.5. The REST API and SAML 2.0 features are cumulative from that release line, not new in 8.6. The vendor hasn't published a CVE, severity rating or exploitation status, so plan the upgrade promptly but carefully: read the known issues, test it in a lab, and check RSTS authentication once you're done.