#kev

SWI's Identity Vulnerability Report 2026 checked 137 identity CVEs against CISA's Known Exploited Vulnerabilities catalog and NVD. 53 are exploited, most of them on VPNs, gateways and remote-access tools rather than identity products, and the median exploited CVE reached KEV 5 days after disclosure.

CISA added Ivanti Connect Secure CVE-2026-111357 and CVE-2026-118527 to its exploited list on October 30, a day after Ivanti patched the root escalation UTA0576 chained with the CVE-2026-104935 login bypass. Federal deadlines are November 2 and November 13.

Four October disclosures about BeyondTrust, Ivanti and Fortinet gateways all ended the same way: the attacker left with the credentials the box was holding. A patch closes the door, but the passwords, keys and certificates that walked out stay valid until you rotate them.

Unit 42's October 19 update says Qilin and INC ransomware operators are exploiting CVE-2026-0257 in PAN-OS GlobalProtect to open VPN sessions without MFA, then in one case pivoted to vCenter and dumped credentials offline from a domain controller's virtual disk.

Unit 42 found an in-memory FortiOS implant that patches the IKE daemon so tagged VPN sessions bypass default security validations. Attackers reached root with CVE-2025-61624, which CISA added to KEV on October 16, and stole VPN credentials from 500+ firewalls.

CVE-2026-104935 lets an unauthenticated attacker bypass Ivanti Connect Secure's login with a crafted header and run commands. Exploited since early October by an actor that went on to harvest LDAP and Active Directory credentials. KEV deadline October 16.