PatchTheCVEIdentity and access: vulnerabilities and fixes
Active Directory, Okta, Keycloak, LDAP and single sign-on. 27 CVEs tracked.
Identity and access has 27 tracked vulnerabilities, 7 critical. A fixed release or vendor patch exists for 23. Most recent: 2026-10-23. Highest priority: CVE-2026-18963 (score 68/100).
- CVE-2026-18963 CRITICAL 9.1 A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine fo
- CVE-2026-62825 CRITICAL 10.0 MITIGATE Improper authentication in Azure Key Vault allows an unauthorized attacker to elevate privileges over a networ
- CVE-2026-50481 CRITICAL 9.9 MITIGATE Modification of assumed-immutable data (maid) in Azure Active Directory allows an authorized attacker to eleva
- CVE-2026-54725 CRITICAL 9.6 vault-secrets-webhook is a Kubernetes mutating webhook that makes direct secret injection into Pods possible
- CVE-2026-77995 CRITICAL 10.0 Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client < 3.2.0, OAuth Singl
- CVE-2026-49179 HIGH 8.8 UPGRADE UPGRADE Improper neutralization of special elements used in a command ('command injection') in Windows Active Director
- CVE-2026-96222 HIGH 7.4 UPGRADE UPGRADE Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacke
- CVE-2026-55100 HIGH 8.7 hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API
- CVE-2026-109440 HIGH 8.8 LangAlpha through 2026.09.07 contains an indirect prompt injection vulnerability that allows remote attackers
- CVE-2026-4629 MEDIUM 6.5 MITIGATE A flaw was found in Keycloak
- CVE-2026-115546 HIGH 8.1 Okta Access Gateway (OAG) does not validate the selected authentication source during sign-on
- CVE-2026-115547 CRITICAL 9.1 An input validation issue in the Okta Access Gateway (OAG) Admin Console allows the processing of specially fo
- CVE-2026-12564 CRITICAL 9.6 A flaw was found in the AAP Controller's HashiCorp Vault credential plugin
- CVE-2026-65709 HIGH 8.3 sysPass through version 3.2.11 contains a missing object-level authorization vulnerability in the JSON-RPC API
- CVE-2026-4633 LOW 3.7 MITIGATE A flaw was found in Keycloak
- CVE-2026-37980 MEDIUM 6.9 MITIGATE A flaw was found in Keycloak, specifically in the organization selection login page
- CVE-2026-60998 HIGH 8.0 DOWNGRADE Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Microso
- CVE-2026-14886 HIGH 8.2 Vault Enterprise's identity entity batch-delete endpoint is vulnerable to a cross-namespace authorization bypa
- CVE-2026-68971 MEDIUM 6.5 UPGRADE Apache Airflow's asset materialization endpoint (`POST /api/v2/assets/{asset_id}/materialize`) and the XCom re
- CVE-2026-68870 MEDIUM 5.3 The Azure Key Vault secrets backend in Apache Airflow's Microsoft Azure provider resolved a team-scoped Connec
- CVE-2026-114655 MEDIUM 5.9 libmongocrypt builds requests to external key management services (AWS, Azure and GCP) by inserting values fro
- CVE-2026-65710 HIGH 7.1 sysPass through version 3.2.11 contains a missing authorization vulnerability that allows authenticated users
- CVE-2026-0976 LOW 3.7 A flaw was found in Keycloak
- CVE-2026-4628 MEDIUM 4.3 MITIGATE A flaw was found in Keycloak
- CVE-2026-16802 MEDIUM 6.5 UPGRADE Cleartext storage of sensitive information in the variables feature in Devolutions PowerShell Universal 2026.2
- CVE-2026-110804 MEDIUM 4.3 UPGRADE Improperly controlled modification of JIT elevation settings in PAM checkout in Devolutions Server 2026.3.8.0
- CVE-2026-115364 LOW 2.2 OpenBao before 2.6.3 contains a missing authorization check that allows attackers to stop Agent and Proxy serv
FAQ
How do I fix Identity and access vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is Identity and access being exploited right now?
None of the tracked Identity and access CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which Identity and access CVE should I patch first?
CVE-2026-18963 currently ranks highest (68/100): A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine fo.
Software in this group
People search for: active directory, sso, okta, ldap, login.