Identity Vulnerability Report 2026: where auth breaks

November 2026 update. On 5 November 2026 we added five KEV-listed CVEs the catalog was missing: CVE-2026-0257 (PAN-OS GlobalProtect authentication override cookies), CVE-2025-30066 (tj-actions/changed-files CI secrets), CVE-2025-3928 (Commvault Web Server, the zero-day behind the Metallic app secret exposure), CVE-2026-102489 (Zammad session hijack) and CVE-2023-22894 (Strapi password hash and reset token leak). Each ID was checked against its NVD record. That took the catalog to 120 CVEs, 40 (33%) on KEV, with edge and remote-access appliances holding 24 of the 40 exploited ones (60%, down from 66%), because four of the five additions are apps with built-in auth or a CI component rather than appliances. Also on 5 November, CWE and CVSS were backfilled from NVD on every brief that lacked them, and five briefs whose SWI rating sat below their NVD CVSS band were raised (three to critical, two to high), so 59 of 120 CVEs (49.2%, was 46.7%) were rated critical. Later on 5 November 2026 we refreshed the KEV snapshot to catalog version 2026.11.04 and added 17 more briefs after an NVD check: CVE-2026-20833 (Kerberos RC4 default), FreeIPA CVE-2026-76578 and CVE-2026-79678, CVE-2025-8217 (Amazon Q Developer extension), and 13 KEV-listed authentication and privilege flaws in identity-critical products: Check Point CVE-2026-50751 and CVE-2026-16232, Ivanti EPM CVE-2026-1603, BeyondTrust CVE-2026-1731, SimpleHelp CVE-2024-57726, ScreenConnect CVE-2026-84869, N-central CVE-2026-18556, AD FS CVE-2026-56155, macOS Screen Sharing CVE-2026-65400, LiteLLM CVE-2026-59822, JFrog Artifactory CVE-2026-42016 and CVE-2026-42018, and Trivy CVE-2026-33634. The catalog now holds 137 CVEs, 53 (39%) on KEV, about 106 times the base rate; 33 of the 53 exploited ones (62%) are on edge and remote-access appliances, the median time to KEV is 5 days (was 3), 67 of 137 (48.9%) are rated critical, and AD FS is the first KEV listing among the 57 CVEs in dedicated identity products. Because 13 of the 17 were picked from the KEV list to close the coverage gap in the methodology, this pass raises the KEV share by construction; read the 39% with that in mind. Every table below uses the updated catalog and snapshot.

Authentication breaks most often, and gets exploited fastest, in the appliances that sit in front of identity rather than in identity systems themselves. Of 137 identity CVEs in the Start with Identity catalog, 53 (39%) are on CISA's Known Exploited Vulnerabilities (KEV) list, about 106 times the 0.37% KEV rate for all CVEs published from 2022 to 2026. Edge VPNs, gateways and remote-access tools are 27% of the catalog but 62% of the exploited entries, and the median exploited identity CVE reached KEV 5 days after disclosure. Only 1 of the 57 CVEs in dedicated identity products (IdPs, libraries, secrets managers, IGA, MFA) is on KEV. We call this split the gatekeeper gap: attackers exploit the boxes that check credentials at the network edge, then use the credentials those boxes hold.

This report is built from our own identity CVE catalog, cross-checked against the CISA KEV catalog and NVD on 30 October 2026, with catalog corrections applied on 31 October and the KEV snapshot refreshed on 5 November (catalog version 2026.11.04). Every number comes from a script you can re-run, and the dataset is free to download below.

Methodology

What is in the data. The catalog holds 137 CVE briefs that Start with Identity editors picked because the flaw has an identity angle: who can become whom. That covers authentication bypass, SSO, SAML and OAuth flaws, IdPs, directories and Kerberos, PAM and remote access, MFA, secrets managers, IGA, and edge appliances that authenticate users. Generic remote code execution with no authentication angle is left out. Disclosure dates run from 10 May 2022 to 15 October 2026. Five briefs were added for this report: Cisco ISE, F5 BIG-IP APM, Check Point VPN, WSO2 API Manager and Ivanti Connect Secure.

Selection bias, stated plainly. This is a curated catalog, not every CVE that touches authentication. Editors add entries when a flaw is notable, and being exploited makes a flaw notable. That pushes the KEV share up. Research-driven disclosure waves (VaultFault, ruby-saml, Keycloak) push the other way, toward unexploited library and server bugs. Read the 39% as "among identity CVEs practitioners hear about", not "among all identity CVEs". As a coverage check, the catalog holds 18 of the 44 CVEs that CISA added to KEV in 2026 to 4 November with an authentication CWE (41%, up from 11 of 43 before the 5 November additions). Most of the missing 26 are authentication bypasses in products with no identity role, such as Splunk, Langflow, Cisco SD-WAN and Oracle PeopleSoft, and one, Apple's CVE-2024-27834, is a bypass of the CPU's pointer authentication memory protection rather than of any user login.

Identifier check. Building this report, we compared every catalog ID with its NVD record and found four that did not match: NVD lists CVE-2025-6003 as a WordPress plugin flaw, CVE-2025-6016 as GitLab, CVE-2025-55129 as Revive Adserver, and CVE-2025-6010 as rejected. We corrected all four on 31 October 2026. Two were duplicates of briefs already in the catalog and were removed (the Vault LDAP MFA bypass is CVE-2025-6013, the Vault username enumeration is CVE-2025-6011). One was renumbered: the Vault login MFA rate-limit bypass and TOTP reuse is CVE-2025-6015, verified against NVD. One, an Ivanti EPMM entry with no matching NVD record, was retired. The old URLs redirect. Every ID in the dataset now matches NVD, so all 137 CVEs are analyzed. The script keeps the check: a future mismatch is flagged in the id_check column and left out of the statistics.

Fields. KEV status and date come from the KEV snapshot (catalog version 2026.11.04), not the brief. KEV flags in every brief matched the snapshot, so no KEV corrections were needed. The CWE comes from the brief, and since the 5 November backfill every brief (137) carries the NVD CWE; the NVD primary weakness in the snapshot is only a fallback. Each CVE gets one product class from a published rule list (edge gateway, app with built-in auth, PAM and remote access, directory and Kerberos, IdP and federation, library and SDK, secrets manager, IGA, MFA, protocol) and one CWE group. Days to KEV is the KEV dateAdded minus the brief's disclosure date. The KEV base rate divides KEV entries with 2022 to 2026 CVE IDs (848) by NVD CVEs published in those years, excluding rejected IDs (231,740). ID year and publication year do not always match, so treat 0.37% as approximate.

Finding 1: identity CVEs are exploited at about 106 times the base rate

Even if you discount heavily for selection bias, identity bugs are not an average sample. A flaw that turns an anonymous request into a logged-in session is the shortest path an attacker has. That is also why credential-based intrusions dominate the breach teardowns on this site, from Snowflake to Scattered Spider, and none of those six teardowns turns on a CVE.

Finding 2: the gatekeeper gap

The hypothesis holds. Appliances at the edge that authenticate users and store credentials (SSL VPNs, ADCs, NAC, access proxies, API gateways) plus the remote-access tools that hold standing admin access together make up 37 of 137 CVEs and 33 of the 53 KEV entries. Every one of the 14 PAM, remote access and endpoint-management CVEs is on KEV, including BeyondTrust Remote Support and Privileged Remote Access (CVE-2024-12356, CVE-2026-102764, CVE-2026-1731), ScreenConnect (CVE-2024-1709, CVE-2026-84869), SimpleHelp (CVE-2026-48558, CVE-2024-57726), N-able N-central (CVE-2026-18556, CVE-2026-18577), Ivanti EPM, Check Point SmartConsole and macOS Screen Sharing.

At the other end, 57 CVEs in products whose whole job is identity have one KEV entry between them, even though 18 of them are critical. The exception is AD FS: a local privilege escalation on the federation server that Microsoft marked as exploited and CISA listed on release day, 14 July 2026. Microsoft has not said what the attacker did with it, but administrator on an AD FS server sits next to the token-signing keys. That group includes 13 Keycloak CVEs, eight HashiCorp Vault CVEs (seven from the 2025 VaultFault research), five in CyberArk Conjur, six in SailPoint, and seven ruby-saml CVEs. Three explanations fit, and the data cannot rank them. Dedicated identity products are often SaaS, fixed server-side and never listed. Libraries hide inside other products, so exploitation is hard to attribute. And an internet-facing appliance is easier to scan for than a Keycloak realm. The practical reading is the same in each case: the product that guards the door is where the exploited bugs are.

The pattern does not stop at the first box. In the October 2026 Ivanti Connect Secure chain, Volexity found the attacker using the appliance's LDAP credentials to search Active Directory for LAPS passwords and BitLocker recovery keys, then running Kerberoasting and password spraying. The gateway was the way into the directory.

Finding 3: the exploited bug class is "authentication never ran"

The single most exploited pattern is an alternate path or a spoofed header that reaches a function the login was supposed to guard: CWE-288 on Fortinet FortiWeb and the FortiCloud SSO cross-account bypass, Citrix NetScaler and SmarterMail, CWE-290 on Ivanti and BeyondTrust, an unauthenticated API on Cisco ISE. These need no cryptography and no stolen secret, which is why they get weaponized in days.

Authorization is now the second most exploited group, with 8 KEV entries, mostly remote-access tools that let a low-privileged user or API key act as an administrator, such as SimpleHelp and ScreenConnect. Signature validation is the class identity engineers own. Outside SAML, six catalog CVEs are JWT or token signature failures (CWE-347), and four of the six are on KEV: SharePoint twice (CVE-2026-55040), SimpleHelp, and WSO2 API Manager, which accepted tokens signed with algorithms it was never configured for. Each one is a relying party that let the token's header choose how it would be checked.

The whole KEV catalog shows the same move. Among KEV additions that carry CWE data, the share with an authentication CWE went from 2.9% in 2022 to 9.1% in 2023, 10.7% in 2024, 10.0% in 2025 and 16.0% in 2026 to 4 November. That 2026 count, 44, is double 2025's 22. This trend comes from all of KEV, not our catalog, so curation does not bias it.

Finding 4: SAML signature wrapping recurs, but is exploited only on appliances

SAML is where the same bug keeps coming back. 15 of 24 SAML CVEs are CWE-347 signature failures, seven of them in ruby-saml or samlify and five in GitHub Enterprise Server and HaloITSM. ruby-saml alone shipped bypasses in 2024, March 2025, July 2025 (an incomplete fix) and December 2025. The SAML forgery technique page explains the parser-differential mechanism.

None of those library or application bugs is on KEV. All four KEV-listed SAML CVEs are on edge appliances: Ivanti's SAML SSRF (CVE-2024-21893), FortiCloud SSO signature verification (CVE-2025-59718), and two NetScaler flaws reachable through SAML configuration. The January 2026 FortiCloud SSO bypass (CVE-2026-24858) is counted under other protocols, because Fortinet describes a cross-account login flaw in FortiCloud SSO, not a SAML failure. The protocol is not what attackers go after. They go after the SAML endpoint on a box that is reachable from the internet. See the SAML CVE hub and OAuth and OIDC hub for every entry.

Finding 5: the five-day window

Half of exploited identity CVEs were on KEV within five days of the advisory. For edge gateways it was one day. Twelve were listed on or before the disclosure date, meaning exploitation came first. CISA's deadlines have tightened to match: 108 of the 138 KEV additions since 1 July 2026 (78%) carry a remediation due date three days after listing, including 18 in this catalog.

The long tail matters too. Kerberos and AD bugs took a median of 100 days, and four entries took more than a year: Strapi CVE-2023-22894 (1,270 days), PaperCut CVE-2023-27351 (1,096 days), SimpleHelp CVE-2024-57726 (466 days) and Quest KACE CVE-2025-32975 (383 days). WSO2's JWT flaw sat for 144 days between advisory and listing. A vulnerability being absent from KEV today does not mean it is safe.

Finding 6: repeat vendors

23 vendors have two or more entries. The ones with exploited repeats:

Ivanti has the most exploited entries, and every one of its seven catalog CVEs is on KEV, across Connect Secure, Sentry, EPMM and EPM from 2023 to 2026. Microsoft has the most entries (23, mostly Kerberos, AD CS and SharePoint) and six KEV listings. The repeat-without-exploitation group is just as telling: Keycloak (13), HashiCorp (8), ruby-saml (7), SailPoint (6), CyberArk (5) and GitHub (4) have 43 entries between them and no KEV listing. Three entries are explicitly incomplete fixes of an earlier CVE, one of them exploited (N-central).

Year trend, read with care. By disclosure year the catalog holds 1 (2022), 10 (2023), 28 (2024), 54 (2025) and 44 (2026) entries, with 1, 9, 6, 7 and 30 on KEV. The 2025 bulge is research disclosures in libraries and secrets managers. The 2026 KEV jump is edge appliances (12 of 13 edge entries exploited) and remote-access tools, and it grew on 5 November because we added KEV-listed 2026 entries on purpose. Curation choices move these counts more than attacker behavior does, so do not read them as a trend line. The KEV-wide CWE trend in Finding 3 is the unbiased one.

What this means for identity teams

1. Put every appliance that authenticates users in the identity inventory. That means any VPN, ADC, WAF, NAC, API gateway or remote-support tool that terminates SAML, OAuth, certificate auth or an LDAP bind. If your IdP team does not own the patch SLA for FortiCloud SSO or the F5 APM OAuth profile, nobody does.
2. Patch KEV-class edge identity bugs within 72 hours, and turn off the feature while you wait. CISA now gives most of these three days. Leaving appliance SSO off when unused (FortiCloud SSO, unused OAuth authorization server profiles on BIG-IP APM) removes the attack surface outright.
3. Strip the appliance's directory account down. Give the VPN or NAC LDAP bind account read access to the attributes authentication needs and nothing else. In particular, deny ms-Mcs-AdmPwd, msLAPS-Password and msFVE-RecoveryPassword. Treat that account as tier zero and alert when it queries anything else.
4. Write the rotation runbook before you need it. After an edge identity compromise, rotate the LDAP bind account, RADIUS and TACACS+ shared secrets, OAuth signing keys and client secrets, VPN client certificates and any stored integration credentials. Then revoke sessions. ITDR tooling should watch for the appliance's address spraying or Kerberoasting.
5. Ship appliance logs off the box. Cisco warns that attackers with root on ISE may remove evidence, and Volexity found UTA0576 deleting Ivanti debug and audit logs. Keep authentication logs in a SIEM that the appliance cannot write to.
6. Pin token verification. For every JWT relying party, resolve keys from a server-side JWKS, allow-list algorithms per issuer, and reject alg: none. Our validate a JWT recipe lists the checks. For SAML, use one XML parser and keep a signature-wrapping fixture in CI that must fail after every library upgrade.
7. Do not let KEV be your only trigger for domain controllers. Kerberos and AD flaws reach KEV slowly, if at all. Take the Patch Tuesday DC updates and move enforcement-mode settings on your own schedule.

About the data

• Dataset: one row per catalog CVE (137 rows, all analyzed) with id, vendor, product, product_class, protocol, cwe, cwe_source, cwe_group, severity, cvss, kev, kev_date_added, disclosed, days_disclosure_to_kev, technique, status, incomplete_fix and id_check. Download it below as CSV or JSON. The JSON also holds the product-class and CWE-group definitions and every statistic in this report.
• Reproduce it: node scripts/reports/identity-vulnerability-report.mjs --print in the site repository reads content/cves/*.md plus the source snapshot and rewrites the files. --refresh-kev re-downloads the CISA KEV feed.
• Sources: CISA KEV catalog version 2026.11.04 (1,768 entries); NVD API 2.0 totals and per-CVE records queried 30 October 2026, with the 22 briefs added on 5 November checked against NVD that day; vendor advisories linked from each CVE brief.
• Limits: curated catalog with the selection bias described above; on 5 November 2026 we backfilled CWE (60 briefs) and the CVSS base score (66 briefs) from the NVD API, so every brief now carries both; severity is the SWI rating, which also weighs exploitation and identity impact, so it can sit above the CVSS band, and this report counts severity, not CVSS medians; KEV under-counts SaaS and non-US exploitation.
• Corrections: if a classification looks wrong, or a notable identity CVE is missing, tell us through the contact page. We will re-run the numbers and date the change.