KEV 2026.09.231,721 entries+8 in 7d8 open federal deadlinesas of / search ? keys
Telemetry

Weakness / #10

CWE-306: Missing authentication in CISA KEV

Missing Authentication for Critical Function

Catalog
2026.09.23
Rank
#10 of 185
MITRE
CWE-306 definition

Answer 42 KEV entries list CWE-306 (Missing authentication) as of catalog 2026.09.23, 2.4% of the catalog and rank 10 of 185 weaknesses. The most affected vendor is Oracle (4).

A sensitive function can be used without logging in at all.

KEV entries
422.4% of catalog
Vendors
29affected
Ransomware: known
1331%
First added
2021-11-03
Latest added
2026-09-10

VVendors

Vendors with CWE-306 KEV entries
VendorEntriesShare
Oracle49.5%
Palo Alto Networks37.1%
Juniper37.1%
Microsoft24.8%
Langflow24.8%
Fortinet24.8%
Veeam24.8%
Zoho24.8%
SAP24.8%
MikroTik12.4%
BerriAI12.4%
PaperCut12.4%

TAdditions by year

CWE-306 KEV additions per yearColumn chart of KEV additions per calendar year. 2021: 8; 2022: 5; 2023: 6; 2024: 5; 2025: 6; 2026: 12.0510152021: 8 added820212022: 5 added520222023: 6 added620232024: 5 added520242025: 6 added620252026: 12 added (year to date)122026
CWE-306 KEV additions by year
YearAdded
20218
20225
20236
20245
20256
202612

PProducts

Products with CWE-306 KEV entries
ProductEntriesShare
Juniper Junos OS37.1%
Oracle E-Business Suite24.8%
Langflow Langflow24.8%
Palo Alto Networks PAN-OS24.8%
Veeam Backup & Replication24.8%
MikroTik RouterOS12.4%
BerriAI LiteLLM12.4%
PaperCut NG/MF12.4%

EAll entries

KEV entries listing CWE-306
CVEVendorProductAddedRansomware
CVE-2026-67277MikroTikRouterOSUnknown
CVE-2026-59822BerriAILiteLLMUnknown
CVE-2026-81578PaperCutNG/MFUnknown
CVE-2026-72529TrueConfServerUnknown
CVE-2026-46817OracleE-Business SuiteUnknown
CVE-2026-56164MicrosoftSharePoint ServerUnknown
CVE-2026-20253SplunkEnterpriseUnknown
CVE-2026-35273Oracle PeopleSoft Enterprise PeopleToolsKnown
CVE-2026-41940WebProscPanel & WHM and WP2 (WordPress Squared)Known
CVE-2026-39987MarimoMarimoUnknown
CVE-2026-33017LangflowLangflowUnknown
CVE-2026-24423SmarterToolsSmarterMailKnown
CVE-2025-61757OracleFusion MiddlewareUnknown
CVE-2025-4008SmartbeddedMeteobridgeUnknown
CVE-2020-24363TP-LinkTL-WA855REUnknown
CVE-2025-32433ErlangErlang/OTPUnknown
CVE-2025-3248LangflowLangflowKnown
CVE-2025-0108Palo Alto NetworksPAN-OSUnknown
CVE-2022-23227NUUONVRmini2 DevicesUnknown
CVE-2023-28461Array Networks AG/vxAG ArrayOSKnown
CVE-2024-0012Palo Alto NetworksPAN-OSKnown
CVE-2024-5910Palo Alto NetworksExpeditionUnknown
CVE-2024-47575FortinetFortiManagerUnknown
CVE-2023-36851JuniperJunos OSUnknown
CVE-2023-36847JuniperJunos OSUnknown
CVE-2023-36846JuniperJunos OSUnknown
CVE-2023-27532VeeamBackup & ReplicationKnown
CVE-2022-24990TerraMasterTerraMaster OSKnown
CVE-2022-21587OracleE-Business SuiteKnown
CVE-2022-26501VeeamBackup & ReplicationKnown
CVE-2022-26925MicrosoftWindowsUnknown
CVE-2022-1388F5BIG-IPKnown
CVE-2022-26143MitelMiCollab, MiVoice Business ExpressUnknown
CVE-2020-13927ApacheAirflow's Experimental APIUnknown
CVE-2021-44077ZohoManageEngine ServiceDesk Plus (SDP) / SupportCenter PlusUnknown
CVE-2021-37415ZohoManageEngine ServiceDesk Plus (SDP)Unknown
CVE-2021-20021SonicWallSonicWall Email SecurityKnown
CVE-2020-6287SAPNetWeaverUnknown
CVE-2020-6207SAPSolution ManagerUnknown
CVE-2020-3952VMwarevCenter ServerUnknown
CVE-2019-9082ThinkPHPThinkPHPUnknown
CVE-2019-5591FortinetFortiOSKnown

Cite this

42 CISA KEV entries list CWE-306 (Missing authentication), 2.4% of the catalog. Source: Telemetry analysis of the CISA Known Exploited Vulnerabilities catalog, version 2026.09.23 (released 2026-09-23). https://glide-telemetry.pages.dev/cwe/cwe-306/

Source: CISA KEV catalog v2026.09.23, released 2026-09-23. Windows end 2026-09-23.

Keyboard shortcuts

Keyboard shortcuts
/Focus search
?Show this panel
EscClose panel or clear search
g dGo to Dashboard
g kGo to KEV
g vGo to Vendors
g pGo to Products
g wGo to Weaknesses
g sGo to Stats
g rGo to Regulations
g bGo to Briefings
g aGo to API