Identity Vulnerability Report 2026: where auth breaks

Authentication breaks most often, and gets exploited fastest, in the appliances that sit in front of identity rather than in identity systems themselves. Of 115 identity CVEs in the Start with Identity catalog, 35 (30%) are on CISA's Known Exploited Vulnerabilities (KEV) list, about 83 times the 0.37% KEV rate for all CVEs published from 2022 to 2026. Edge VPNs, gateways and remote-access tools are 23% of the catalog but 66% of the exploited entries, and the median exploited identity CVE reached KEV 3 days after disclosure. None of the 56 CVEs in dedicated identity products (IdPs, libraries, secrets managers, IGA, MFA) is on KEV. We call this split the gatekeeper gap: attackers exploit the boxes that check credentials at the network edge, then use the credentials those boxes hold.

This report is built from our own identity CVE catalog, cross-checked against the CISA KEV catalog and NVD on 30 October 2026, with catalog corrections applied on 31 October. Every number comes from a script you can re-run, and the dataset is free to download below.

Methodology

What is in the data. The catalog holds 115 CVE briefs that Start with Identity editors picked because the flaw has an identity angle: who can become whom. That covers authentication bypass, SSO, SAML and OAuth flaws, IdPs, directories and Kerberos, PAM and remote access, MFA, secrets managers, IGA, and edge appliances that authenticate users. Generic remote code execution with no authentication angle is left out. Disclosure dates run from 10 May 2022 to 15 October 2026. Five briefs were added for this report: Cisco ISE, F5 BIG-IP APM, Check Point VPN, WSO2 API Manager and Ivanti Connect Secure.

Selection bias, stated plainly. This is a curated catalog, not every CVE that touches authentication. Editors add entries when a flaw is notable, and being exploited makes a flaw notable. That pushes the KEV share up. Research-driven disclosure waves (VaultFault, ruby-saml, Keycloak) push the other way, toward unexploited library and server bugs. Read the 30% as "among identity CVEs practitioners hear about", not "among all identity CVEs". As a coverage check, the catalog holds 11 of the 43 CVEs that CISA added to KEV in 2026 with an authentication CWE (26%). Many of the missing 32 are authentication bypasses in products with no identity role, such as Splunk, Langflow and Cisco SD-WAN, but the gap is real.

Identifier check. Building this report, we compared every catalog ID with its NVD record and found four that did not match: NVD lists CVE-2025-6003 as a WordPress plugin flaw, CVE-2025-6016 as GitLab, CVE-2025-55129 as Revive Adserver, and CVE-2025-6010 as rejected. We corrected all four on 31 October 2026. Two were duplicates of briefs already in the catalog and were removed (the Vault LDAP MFA bypass is CVE-2025-6013, the Vault username enumeration is CVE-2025-6011). One was renumbered: the Vault login MFA rate-limit bypass and TOTP reuse is CVE-2025-6015, verified against NVD. One, an Ivanti EPMM entry with no matching NVD record, was retired. The old URLs redirect. Every ID in the dataset now matches NVD, so all 115 CVEs are analyzed. The script keeps the check: a future mismatch is flagged in the id_check column and left out of the statistics.

Fields. KEV status and date come from the KEV snapshot (catalog version 2026.10.30), not the brief. KEV flags in every brief matched the snapshot, so no KEV corrections were needed. The CWE comes from the brief where it has one (55 entries), otherwise from the NVD primary weakness (60). Each CVE gets one product class from a published rule list (edge gateway, app with built-in auth, PAM and remote access, directory and Kerberos, IdP and federation, library and SDK, secrets manager, IGA, MFA, protocol) and one CWE group. Days to KEV is the KEV dateAdded minus the brief's disclosure date. The KEV base rate divides KEV entries with 2022 to 2026 CVE IDs (846) by NVD CVEs published in those years, excluding rejected IDs (231,740). ID year and publication year do not always match, so treat 0.37% as approximate.

Finding 1: identity CVEs are exploited at about 83 times the base rate

Even if you discount heavily for selection bias, identity bugs are not an average sample. A flaw that turns an anonymous request into a logged-in session is the shortest path an attacker has. That is also why credential-based intrusions dominate the breach teardowns on this site, from Snowflake to Scattered Spider, and none of those six teardowns turns on a CVE.

Finding 2: the gatekeeper gap

The hypothesis holds. Appliances at the edge that authenticate users and store credentials (SSL VPNs, ADCs, NAC, access proxies, API gateways) plus the remote-access tools that hold standing admin access together make up 27 of 115 CVEs and 23 of the 35 KEV entries. Every one of the seven PAM, remote access and endpoint-management CVEs is on KEV, including BeyondTrust Remote Support (CVE-2024-12356, CVE-2026-102764), ScreenConnect, SimpleHelp and N-able N-central.

At the other end, 56 CVEs in products whose whole job is identity have zero KEV entries, even though 18 of them are critical. That group includes 13 Keycloak CVEs, eight HashiCorp Vault CVEs (seven from the 2025 VaultFault research), five in CyberArk Conjur, six in SailPoint, and seven ruby-saml CVEs. Three explanations fit, and the data cannot rank them. Dedicated identity products are often SaaS, fixed server-side and never listed. Libraries hide inside other products, so exploitation is hard to attribute. And an internet-facing appliance is easier to scan for than a Keycloak realm. The practical reading is the same in each case: the product that guards the door is where the exploited bugs are.

The pattern does not stop at the first box. In the October 2026 Ivanti Connect Secure chain, Volexity found the attacker using the appliance's LDAP credentials to search Active Directory for LAPS passwords and BitLocker recovery keys, then running Kerberoasting and password spraying. The gateway was the way into the directory.

Finding 3: the exploited bug class is "authentication never ran"

The single most exploited pattern is an alternate path or a spoofed header that reaches a function the login was supposed to guard: CWE-288 on Fortinet FortiWeb and the FortiCloud SSO cross-account bypass, Citrix NetScaler and SmarterMail, CWE-290 on Ivanti and BeyondTrust, an unauthenticated API on Cisco ISE. These need no cryptography and no stolen secret, which is why they get weaponized in days.

Signature validation is the second class and the one identity engineers own. Outside SAML, six catalog CVEs are JWT or token signature failures (CWE-347), and four of the six are on KEV: SharePoint twice (CVE-2026-55040), SimpleHelp, and WSO2 API Manager, which accepted tokens signed with algorithms it was never configured for. Each one is a relying party that let the token's header choose how it would be checked.

The whole KEV catalog shows the same move. Among KEV additions that carry CWE data, the share with an authentication CWE went from 2.9% in 2022 to 9.1% in 2023, 10.7% in 2024, 10.0% in 2025 and 15.8% in 2026 to 30 October. That 2026 count, 43, is nearly double 2025's 22. This trend comes from all of KEV, not our catalog, so curation does not bias it.

Finding 4: SAML signature wrapping recurs, but is exploited only on appliances

SAML is where the same bug keeps coming back. 15 of 24 SAML CVEs are CWE-347 signature failures, seven of them in ruby-saml or samlify and five in GitHub Enterprise Server and HaloITSM. ruby-saml alone shipped bypasses in 2024, March 2025, July 2025 (an incomplete fix) and December 2025. The SAML forgery technique page explains the parser-differential mechanism.

None of those library or application bugs is on KEV. All four KEV-listed SAML CVEs are on edge appliances: Ivanti's SAML SSRF (CVE-2024-21893), FortiCloud SSO signature verification (CVE-2025-59718), and two NetScaler flaws reachable through SAML configuration. The January 2026 FortiCloud SSO bypass (CVE-2026-24858) is counted under other protocols, because Fortinet describes a cross-account login flaw in FortiCloud SSO, not a SAML failure. The protocol is not what attackers go after. They go after the SAML endpoint on a box that is reachable from the internet. See the SAML CVE hub and OAuth and OIDC hub for every entry.

Finding 5: the three-day window

Half of exploited identity CVEs were on KEV within three days of the advisory. For edge gateways it was one day. Nine were listed on or before the disclosure date, meaning exploitation came first. CISA's deadlines have tightened to match: 107 of the 136 KEV additions since 1 July 2026 (79%) carry a remediation due date three days after listing, including 12 in this catalog.

The long tail matters too. Kerberos and AD bugs took a median of 100 days, and two entries took more than a year: PaperCut CVE-2023-27351 (1,096 days) and Quest KACE CVE-2025-32975 (383 days). WSO2's JWT flaw sat for 144 days between advisory and listing. A vulnerability being absent from KEV today does not mean it is safe.

Finding 6: repeat vendors

18 vendors have two or more entries. The ones with exploited repeats:

Ivanti is the only vendor where every catalog entry is exploited, across Connect Secure, Sentry and EPMM from 2023 to 2026. Microsoft has the most entries (21, mostly Kerberos, AD CS and SharePoint) and five KEV listings. The repeat-without-exploitation group is just as telling: Keycloak (13), HashiCorp (8), ruby-saml (7), SailPoint (6), CyberArk (5) and GitHub (4) have 43 entries between them and no KEV listing. Three entries are explicitly incomplete fixes of an earlier CVE, one of them exploited (N-central).

Year trend, read with care. By disclosure year the catalog holds 1 (2022), 9 (2023), 28 (2024), 50 (2025) and 27 (2026) entries, with 1, 8, 6, 4 and 16 on KEV. The 2025 bulge is research disclosures in libraries and secrets managers. The 2026 KEV jump is mostly edge appliances (9 of 10 edge entries exploited). Curation choices move these counts more than attacker behavior does, so do not read them as a trend line. The KEV-wide CWE trend in Finding 3 is the unbiased one.

What this means for identity teams

1. Put every appliance that authenticates users in the identity inventory. That means any VPN, ADC, WAF, NAC, API gateway or remote-support tool that terminates SAML, OAuth, certificate auth or an LDAP bind. If your IdP team does not own the patch SLA for FortiCloud SSO or the F5 APM OAuth profile, nobody does.
2. Patch KEV-class edge identity bugs within 72 hours, and turn off the feature while you wait. CISA now gives most of these three days. Leaving appliance SSO off when unused (FortiCloud SSO, unused OAuth authorization server profiles on BIG-IP APM) removes the attack surface outright.
3. Strip the appliance's directory account down. Give the VPN or NAC LDAP bind account read access to the attributes authentication needs and nothing else. In particular, deny ms-Mcs-AdmPwd, msLAPS-Password and msFVE-RecoveryPassword. Treat that account as tier zero and alert when it queries anything else.
4. Write the rotation runbook before you need it. After an edge identity compromise, rotate the LDAP bind account, RADIUS and TACACS+ shared secrets, OAuth signing keys and client secrets, VPN client certificates and any stored integration credentials. Then revoke sessions. ITDR tooling should watch for the appliance's address spraying or Kerberoasting.
5. Ship appliance logs off the box. Cisco warns that attackers with root on ISE may remove evidence, and Volexity found UTA0576 deleting Ivanti debug and audit logs. Keep authentication logs in a SIEM that the appliance cannot write to.
6. Pin token verification. For every JWT relying party, resolve keys from a server-side JWKS, allow-list algorithms per issuer, and reject alg: none. Our validate a JWT recipe lists the checks. For SAML, use one XML parser and keep a signature-wrapping fixture in CI that must fail after every library upgrade.
7. Do not let KEV be your only trigger for domain controllers. Kerberos and AD flaws reach KEV slowly, if at all. Take the Patch Tuesday DC updates and move enforcement-mode settings on your own schedule.

About the data

• Dataset: one row per catalog CVE (115 rows, all analyzed) with id, vendor, product, product_class, protocol, cwe, cwe_source, cwe_group, severity, cvss, kev, kev_date_added, disclosed, days_disclosure_to_kev, technique, status, incomplete_fix and id_check. Download it below as CSV or JSON. The JSON also holds the product-class and CWE-group definitions and every statistic in this report.
• Reproduce it: node scripts/reports/identity-vulnerability-report.mjs --print in the site repository reads content/cves/*.md plus the source snapshot and rewrites the files. --refresh-kev re-downloads the CISA KEV feed.
• Sources: CISA KEV catalog version 2026.10.30 (1,766 entries); NVD API 2.0 totals and per-CVE records queried 30 October 2026; vendor advisories linked from each CVE brief.
• Limits: curated catalog with the selection bias described above; CWE for 60 entries comes from NVD, not editors; CVSS is recorded in only some briefs, so this report does not compare CVSS medians; KEV under-counts SaaS and non-US exploitation.
• Corrections: if a classification looks wrong, or a notable identity CVE is missing, tell us through the contact page. We will re-run the numbers and date the change.