#saml
- Analysis · Nov 6, 202639% of identity CVEs are on CISA KEV, and edge appliances hold 62% of the exploited ones
SWI's Identity Vulnerability Report 2026 checked 137 identity CVEs against CISA's Known Exploited Vulnerabilities catalog and NVD. 53 are exploited, most of them on VPNs, gateways and remote-access tools rather than identity products, and the median exploited CVE reached KEV 5 days after disclosure.
- News · Oct 21, 2026GitLab patches a SAML-to-LDAP account takeover and OIDC discovery cache poisoning
GitLab's October 21 critical patch release fixes CVE-2026-15723, which let a signed-in user take over an LDAP-backed account when OmniAuth SAML and LDAP auto-linking are both on, plus OAuth/OIDC discovery cache poisoning and a SAML/LDAP membership lock gap.
- News · Oct 9, 2026NetScaler patches a CVSS 9.5 memory overflow reachable only through SAML
CVE-2026-107406 can lead to remote code execution on NetScaler ADC and Gateway appliances configured as a SAML identity provider or service provider. Fixed in 14.1-73.46 and 13.1-64.29; no exploitation reported yet.
- News · Oct 3, 2026Exploited NetScaler SAML zero-day forces a second upgrade after the September patch
CVE-2026-88779 crashes NetScaler ADC and Gateway appliances configured as a SAML service provider or identity provider. Exploited before the fix, on CISA KEV since October 4, fixed in 14.1-73.41 and 13.1-64.28.
- News · Aug 13, 2026Fortinet's January SSO bypass hit boxes already patched for December's SAML bug
CVE-2026-24858 is the follow-on FortiCloud SSO SAML bypass. Devices patched for CVE-2025-59718 and 59719 were still exploitable. Actively exploited. CISA guidance 28 January 2026.