39% of identity CVEs are on CISA KEV, and edge appliances hold 62% of the exploited ones

Of 137 identity CVEs in Start with Identity's catalog, 53 (39%) are on CISA's Known Exploited Vulnerabilities list, against 0.37% of all CVEs published from 2022 to 2026, according to SWI's Identity Vulnerability Report 2026. Most of the exploited ones are not in identity products. They are in the VPNs, gateways and remote-access tools that check credentials at the network edge. The report cross-checks the identity CVE catalog against the CISA KEV catalog (version 2026.11.04) and NVD, with catalog corrections applied on 31 October and 22 CVEs added on 5 November, 18 of them KEV-listed.

Exploited at about 106 times the base rate

53 of 137 identity CVEs are on KEV, about 106 times the base rate for all CVEs from the same years. The catalog is curated, and editors add flaws that are notable, which pushes the share up. Some entries were added precisely because they are on KEV, which pushes it up further. Even with a heavy discount for that, identity bugs are not an average sample. A flaw that turns an anonymous request into a logged-in session is the shortest path an attacker has.

The gatekeeper gap

The report's central finding is what it calls the gatekeeper gap. Edge and remote-access appliances are 27% of identity CVEs in the catalog (37 of 137) but 62% of the exploited ones (33 of 53), and 89% of those appliance CVEs are on CISA KEV. All 14 PAM, remote access and endpoint-management CVEs in the catalog are exploited, including three in BeyondTrust Remote Support and Privileged Remote Access and two each in ScreenConnect, SimpleHelp and N-able N-central.

At the other end, only 1 of the 57 CVEs in dedicated identity products (IdPs, identity libraries, secrets managers, IGA, MFA and specifications) is on CISA KEV, a Microsoft AD FS privilege escalation, although 18 of them are rated critical. The exception, CVE-2026-56155, puts an attacker with administrator rights on the federation server next to its token-signing keys. The group also includes Keycloak, HashiCorp Vault, CyberArk Conjur and SailPoint. The data cannot say why so few are listed: these products are often SaaS and fixed server-side, libraries make exploitation hard to attribute, and an internet-facing appliance is easier to scan for. The practical reading is the same either way. Any VPN, ADC, NAC, API gateway or remote-support tool that terminates SAML, OAuth or an LDAP bind belongs in the identity inventory, with a patch SLA owned by someone. Our earlier post on remote-access appliances as credential vaults covers why.

Five days from disclosure to KEV

The median identity CVE in the catalog reached CISA KEV 5 days after public disclosure; for edge VPNs and gateways the median was 1 day, and 12 of 53 were listed on or before the disclosure date, meaning exploitation came first. The report recommends patching KEV-class edge identity bugs within 72 hours and turning the affected feature off while you wait.

The tail runs the other way. Kerberos and Active Directory bugs took a median of 100 days to reach KEV, so KEV should not be the only patch trigger for domain controllers.

The exploited bug class is "authentication never ran"

Missing or skipped authentication (CWE-287, 288, 290, 306 and relatives) is the most exploited identity bug class: 23 of 53 KEV-listed identity CVEs, 43%. These are alternate paths or spoofed headers that reach a function the login was supposed to guard, as on Fortinet FortiWeb and Cisco ISE. They need no cryptography and no stolen secret.

The same shift shows across all of KEV, not only the catalog, so curation does not bias it. Authentication weaknesses rose from 2.9% of CISA KEV additions with CWE data in 2022 to 16.0% in 2026 to 4 November, and 2026's 44 such additions are double 2025's 22.

SAML bugs recur, but only appliances get exploited

15 of 24 SAML CVEs in the catalog are signature-validation failures (CWE-347), yet all 4 KEV-listed SAML CVEs sit on edge appliances from Ivanti, Fortinet and Citrix, including Ivanti's CVE-2024-21893 and FortiCloud SSO's CVE-2025-59718. Attackers go after the SAML endpoint on a box reachable from the internet. The SAML forgery technique page explains the signature-wrapping mechanism, and the SAML CVE hub lists every entry.

One vendor stands out. Ivanti has 7 identity CVEs in the catalog and all 7 are on CISA KEV, the highest exploited count of any vendor. In the October 2026 Ivanti Connect Secure chain, the attacker used the appliance's LDAP credentials to search Active Directory, then ran Kerberoasting and password spraying. Strip the appliance's directory bind account to the attributes authentication needs, and alert when it queries anything else.

How we did it

The catalog holds 137 CVE briefs chosen for an identity angle, disclosed from May 2022 to October 2026, and all 137 are analyzed. Every catalog ID was checked against its NVD record, and the four that did not match were corrected on 31 October 2026 (two duplicates removed, one renumbered, one retired), and 22 CVEs were added on 5 November after an NVD check, 13 of them picked from 2026 KEV additions in identity-critical products to close a coverage gap. KEV status and dates come from the KEV snapshot, CWEs from the brief or NVD, and each CVE gets one product class and one CWE group from a published rule list. Limits: this is a curated catalog with selection bias that raises the KEV share, so read 39% as a rate among identity CVEs practitioners hear about, not all identity CVEs; KEV under-counts SaaS and non-US exploitation; and the 0.37% base rate is approximate because CVE ID year and publication year do not always match.

Use the data: download the dataset as CSV or JSON, plus the source snapshot of KEV and NVD records. All are free to reuse under CC BY 4.0 with attribution to Start with Identity and a link to the report.