KEV 2026.09.231,721 entries+8 in 7d8 open federal deadlinesas of / search ? keys
Telemetry

Weakness / #12

CWE-284: Improper access control in CISA KEV

Improper Access Control

Catalog
2026.09.23
Rank
#12 of 185
MITRE
CWE-284 definition

Answer 36 KEV entries list CWE-284 (Improper access control) as of catalog 2026.09.23, 2.1% of the catalog and rank 12 of 185 weaknesses. The most affected vendor is Microsoft (6).

The software does not correctly restrict who can reach a resource or function.

KEV entries
362.1% of catalog
Vendors
22affected
Ransomware: known
38.3%
First added
2021-11-03
Latest added
2026-09-08

VVendors

Vendors with CWE-284 KEV entries
VendorEntriesShare
Microsoft616.7%
Adobe411.1%
Citrix411.1%
Apache38.3%
Elastic25.6%
Oracle12.8%
Joomlack12.8%
Ubiquiti12.8%
Widget Factory12.8%
Fortinet12.8%
Vite12.8%
Gladinet12.8%

TAdditions by year

CWE-284 KEV additions per yearColumn chart of KEV additions per calendar year. 2021: 6; 2022: 7; 2023: 6; 2024: 6; 2025: 4; 2026: 7.024682021: 6 added620212022: 7 added720222023: 6 added620232024: 6 added620242025: 4 added420252026: 7 added (year to date)72026
CWE-284 KEV additions by year
YearAdded
20216
20227
20236
20246
20254
20267

PProducts

Products with CWE-284 KEV entries
ProductEntriesShare
Microsoft Windows513.9%
Adobe ColdFusion411.1%
Elastic Elasticsearch25.6%
Citrix Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance25.6%
Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in12.8%
Joomlack Page Builder12.8%
Ubiquiti UniFi OS12.8%
Widget Factory Joomla Content Editor 12.8%

EAll entries

KEV entries listing CWE-284
CVEVendorProductAddedRansomware
CVE-2026-81963MicrosoftWindowsUnknown
CVE-2026-21962OracleHTTP Server and Oracle Weblogic Server Proxy Plug-inUnknown
CVE-2026-56290JoomlackPage BuilderUnknown
CVE-2026-34908UbiquitiUniFi OSUnknown
CVE-2026-48907Widget FactoryJoomla Content Editor Unknown
CVE-2026-35616FortinetFortiClient EMSUnknown
CVE-2025-31125ViteVitejsUnknown
CVE-2025-12480GladinetTriofoxUnknown
CVE-2025-33073MicrosoftWindowsUnknown
CVE-2025-59230MicrosoftWindowsUnknown
CVE-2025-24989MicrosoftPower PagesUnknown
CVE-2024-20767AdobeColdFusionUnknown
CVE-2024-45519SynacorZimbra Collaboration Suite (ZCS)Unknown
CVE-2024-27348ApacheHugeGraph-ServerUnknown
CVE-2024-40766SonicWallSonicOSKnown
CVE-2023-7028GitLabGitLab CE/EEUnknown
CVE-2023-23752Joomla!Joomla!Unknown
CVE-2023-24489CitrixContent CollaborationUnknown
CVE-2023-38205AdobeColdFusionUnknown
CVE-2023-29298AdobeColdFusionUnknown
CVE-2016-8735ApacheTomcatUnknown
CVE-2023-27350PaperCutMF/NGKnown
CVE-2023-26360AdobeColdFusionUnknown
CVE-2016-7256MicrosoftWindowsUnknown
CVE-2016-3393MicrosoftWindowsUnknown
CVE-2021-22941CitrixShareFileKnown
CVE-2020-2506QNAP SystemsHelpdeskUnknown
CVE-2015-1427ElasticElasticsearchUnknown
CVE-2014-3120ElasticElasticsearchUnknown
CVE-2022-23134ZabbixFrontendUnknown
CVE-2021-23874McAfeeMcAfee Total Protection (MTP)Unknown
CVE-2020-8196CitrixApplication Delivery Controller (ADC), Gateway, and SD-WAN WANOP ApplianceUnknown
CVE-2020-8193CitrixApplication Delivery Controller (ADC), Gateway, and SD-WAN WANOP ApplianceUnknown
CVE-2019-1653CiscoSmall Business RV320 and RV325 RoutersUnknown
CVE-2016-4437ApacheShiroUnknown
CVE-2016-3715ImageMagickImageMagickUnknown

Cite this

36 CISA KEV entries list CWE-284 (Improper access control), 2.1% of the catalog. Source: Telemetry analysis of the CISA Known Exploited Vulnerabilities catalog, version 2026.09.23 (released 2026-09-23). https://glide-telemetry.pages.dev/cwe/cwe-284/

Source: CISA KEV catalog v2026.09.23, released 2026-09-23. Windows end 2026-09-23.

Keyboard shortcuts

Keyboard shortcuts
/Focus search
?Show this panel
EscClose panel or clear search
g dGo to Dashboard
g kGo to KEV
g vGo to Vendors
g pGo to Products
g wGo to Weaknesses
g sGo to Stats
g rGo to Regulations
g bGo to Briefings
g aGo to API