Weakness / #21
CWE-288: Authentication bypass via alternate path in CISA KEV
Authentication Bypass Using an Alternate Path or Channel
Answer 21 KEV entries list CWE-288 (Authentication bypass via alternate path) as of catalog 2026.09.23, 1.2% of the catalog and rank 21 of 185 weaknesses. The most affected vendor is Fortinet (4).
- KEV entries
- 211.2% of catalog
- Vendors
- 13affected
- Ransomware: known
- 942.9%
- First added
- 2021-11-03
- Latest added
- 2026-09-09
VVendors
TAdditions by year
| Year | Added |
|---|---|
| 2021 | 1 |
| 2022 | 1 |
| 2023 | 3 |
| 2024 | 2 |
| 2025 | 6 |
| 2026 | 8 |
PProducts
| Product | Entries | Share |
|---|---|---|
| N-able N-central | 2 | 9.5% |
| Fortinet Multiple Products | 2 | 9.5% |
| Kentico Xperience CMS | 2 | 9.5% |
| Fortinet FortiOS and FortiProxy | 2 | 9.5% |
| JetBrains TeamCity | 2 | 9.5% |
| Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management | 1 | 4.8% |
| Citrix NetScaler | 1 | 4.8% |
| Ivanti Endpoint Manager (EPM) | 1 | 4.8% |
EAll entries
Cite this
21 CISA KEV entries list CWE-288 (Authentication bypass via alternate path), 1.2% of the catalog. Source: Telemetry analysis of the CISA Known Exploited Vulnerabilities catalog, version 2026.09.23 (released 2026-09-23). https://glide-telemetry.pages.dev/cwe/cwe-288/
Source: CISA KEV catalog v2026.09.23, released 2026-09-23. Windows end 2026-09-23.