#cve

SWI's Identity Vulnerability Report 2026 checked 137 identity CVEs against CISA's Known Exploited Vulnerabilities catalog and NVD. 53 are exploited, most of them on VPNs, gateways and remote-access tools rather than identity products, and the median exploited CVE reached KEV 5 days after disclosure.

Apache OFBiz 24.09.08, announced November 4, fixes a batch of authentication flaws: a hard-coded JWT key giving unauthenticated admin access, a password reset flaw allowing account takeover, a reusable login key not bound to a session and REST operations open by default.

A symlink flaw in the Docker Sandboxes copy command, CVE-2026-103916, let an AI coding agent inside the sandbox read or write host files outside its allowlist, such as cloud credentials and SSH keys, when the operator ran a copy. Docker fixed it in v0.51.0 on November 3.

CISA added Ivanti Connect Secure CVE-2026-111357 and CVE-2026-118527 to its exploited list on October 30, a day after Ivanti patched the root escalation UTA0576 chained with the CVE-2026-104935 login bypass. Federal deadlines are November 2 and November 13.

IBM's October 28 bulletin covers four Langflow flaws in every release from 1.0.0 to 1.12.8, including CVE-2026-93680, a 9.8-rated authentication bypass a public Metasploit module already cites, and unauthenticated code execution through MCP tool enumeration. Upgrade to 1.13.0.

Canonical's CVE-2026-112816 let an attacker authenticate to the LXD and MicroCloud HTTPS API as any trusted client by attaching that client's public certificate to their own TLS chain. Fixed in LXD 4.0.15, 5.0.11, 5.21.9 and 6.10.1.

Enclave disclosed on October 23 that Microsoft Authenticator for Android trusted a caller's claimed identity, so a zero-permission app could pose as Teams and receive Microsoft Graph tokens for the signed-in work account. CVE-2026-80097 was fixed in 6.2606.4246.

HPE patched 72 ArubaOS vulnerabilities, eight of them maximum severity, including authentication bypasses CVE-2026-79844 and CVE-2026-79845 in AOS-10 and CVE-2026-79850 in AOS-8. HPE knew of no public exploit code or in-the-wild use.

Okta published CVE-2026-115547 on October 22: an input validation flaw in the Okta Access Gateway Admin Console lets an authenticated administrator execute system commands as the OAG service account. CVSS 9.1; fixed in 2026.10.2.

GitLab's October 21 critical patch release fixes CVE-2026-15723, which let a signed-in user take over an LDAP-backed account when OmniAuth SAML and LDAP auto-linking are both on, plus OAuth/OIDC discovery cache poisoning and a SAML/LDAP membership lock gap.

Unit 42's October 19 update says Qilin and INC ransomware operators are exploiting CVE-2026-0257 in PAN-OS GlobalProtect to open VPN sessions without MFA, then in one case pivoted to vCenter and dumped credentials offline from a domain controller's virtual disk.

Unit 42 found an in-memory FortiOS implant that patches the IKE daemon so tagged VPN sessions bypass default security validations. Attackers reached root with CVE-2025-61624, which CISA added to KEV on October 16, and stole VPN credentials from 500+ firewalls.

CVE-2026-102764, a CVSS 9.3 flaw in self-hosted BeyondTrust Remote Support through 26.2.3, was exploited as a zero-day by the China-nexus group ARMORY CASTLE. Mandiant says the attacker pulled every admin credential from the appliance vault and raised Jump Item roles. CISA added it to KEV on October 16.

CVE-2026-104935 lets an unauthenticated attacker bypass Ivanti Connect Secure's login with a crafted header and run commands. Exploited since early October by an actor that went on to harvest LDAP and Active Directory credentials. KEV deadline October 16.

CVE-2026-97629 lets a forged TLS session resume on NGINX 1.23.2 through 1.31.6 when a shared session cache is set without a ticket key file, which can bypass client-certificate verification. Fixed in 1.30.6 and 1.31.7; no exploitation reported.

CVE-2026-89111, rated CVSS 10.0, lets whoever controls the tenant subdomain in a multi-tenant SAP BTP app redirect its OAuth2 token request and capture the client ID and secret. Fixed in 0.45.2, but the check went missing again in later releases.

CVE-2026-105445 (CVSS 9.4): for two years, converting a Docker Hub account into an organization re-assigned its personal access tokens to whoever was named owner, without consent. An attacker could mint a token, convert, name a victim, and push to the victim's repositories. Docker found no exploitation.

CVE-2026-107406 can lead to remote code execution on NetScaler ADC and Gateway appliances configured as a SAML identity provider or service provider. Fixed in 14.1-73.46 and 13.1-64.29; no exploitation reported yet.

CVE-2026-102255 lets an unauthenticated attacker use an unintended access path in the SMA1000 WorkPlace interface to reach internal functions. CVSS 10.0, fixed in 12.4.3-03670 and 12.5.0-03082, with no workaround.

CVE-2026-88779 crashes NetScaler ADC and Gateway appliances configured as a SAML service provider or identity provider. Exploited before the fix, on CISA KEV since October 4, fixed in 14.1-73.41 and 13.1-64.28.

Cisco FMC, Cisco ISE, N-able N-central and an unnamed security product at Bitget were all exploited in September 2026. Each one held credentials or authority that other systems trust. Patching them is necessary; treating the compromise as an identity incident is what actually ends it.

CVE-2026-76460 lets an unauthenticated attacker bypass Cisco Identity Services Engine's management interface through an API endpoint and run commands as root. Cisco confirmed active exploitation; CISA gave federal agencies until September 19.

We opened a practitioner catalog of identity CVEs: what broke, why IAM teams should care, and what to do this week. Not an NVD mirror. A place to triage SAML wrapping, Kerberos escalation, cloud-token bugs, and KEV items that let someone log in as you.

CVE-2026-24858 is the follow-on FortiCloud SSO SAML bypass. Devices patched for CVE-2025-59718 and 59719 were still exploitable. Actively exploited. CISA guidance 28 January 2026.

CVE-2026-25177, CVSS 8.8. Active Directory treated look-alike SPNs as unique. Semperis and Shai Laron showed how that becomes service hijack and NTLM downgrade. Patched March 2026.

CVE-2026-27912 lets a user who can write their own UPN aim a Kerberos change-password at a Domain Admin. Microsoft rated it Important. Identity teams should not.