Skip to content
Start with Identity
Join free
Protocol · 50 briefs · 40 on CISA KEV

Appliance, CI, and control-plane auth CVEs

RMM, VPN, CI, print, and mail admin planes keep failing authentication. They are identity products whether the IAM team owns them or not.

How this protocol fails

ScreenConnect, TeamCity, PaperCut, N-able N-central, Ivanti EPMM/Sentry/Connect Secure, Citrix Bleed, Outlook NTLM, Zimbra MFA backup codes, SmarterMail, Check Point hash leaks, BeyondTrust PRA. The pattern is an internet-facing management login, an alternate path, and ransomware or a state actor three days later. CISA KEV is concentrated here. Incomplete first fixes (N-central, FortiCloud SSO, TeamCity sequels) are how the same incident lasts a year.

What security people should do

  • Patch KEV items on internet-facing admin planes first. Confirm the build string, not the calendar date of the last change window.
  • If the box was reachable at disclosure, rebuild and rotate. A hotfix on a planted admin is not eviction.
  • Take management UIs off the internet. Put them behind phishing-resistant MFA and a jump path.
  • Hunt for rogue admins, unexpected tunnels, and sessions with no matching interactive login.
GlossaryBreach teardownsWhat is ITDR?All identity CVEs

CVEs in this category

50
Other
40
On CISA KEV
40
Actively exploited
50
Showing
Severity
Year
Status

Showing 50 of 50

Working this protocol in production and see a brief we should add or correct? Email community@startwithidentity.com or volunteer as a CVE Analyst.