Weakness / #26
CWE-863: Incorrect authorization in CISA KEV
Incorrect Authorization
Answer 17 KEV entries list CWE-863 (Incorrect authorization) as of catalog 2026.09.23, 1% of the catalog and rank 26 of 185 weaknesses. The most affected vendor is Microsoft (3).
- KEV entries
- 171% of catalog
- Vendors
- 14affected
- Ransomware: known
- 635.3%
- First added
- 2021-11-03
- Latest added
- 2026-09-11
VVendors
TAdditions by year
| Year | Added |
|---|---|
| 2021 | 1 |
| 2022 | 3 |
| 2023 | 5 |
| 2024 | 3 |
| 2025 | 4 |
| 2026 | 1 |
PProducts
| Product | Entries | Share |
|---|---|---|
| Qualcomm Multiple Chipsets | 2 | 11.8% |
| Microsoft Windows | 2 | 11.8% |
| JFrog Artifactory | 1 | 5.9% |
| Meta Platforms WhatsApp | 1 | 5.9% |
| Apple iOS and iPadOS | 1 | 5.9% |
| Oracle Agile Product Lifecycle Management (PLM) | 1 | 5.9% |
| Apache OFBiz | 1 | 5.9% |
| D-Link DIR-605 Router | 1 | 5.9% |
EAll entries
| CVE | Vendor | Product | Added | Ransomware |
|---|---|---|---|---|
| CVE-2026-42016 | JFrog | Artifactory | Unknown | |
| CVE-2025-55177 | Meta Platforms | Unknown | ||
| CVE-2025-21480 | Qualcomm | Multiple Chipsets | Unknown | |
| CVE-2025-21479 | Qualcomm | Multiple Chipsets | Unknown | |
| CVE-2025-24200 | Apple | iOS and iPadOS | Unknown | |
| CVE-2024-21287 | Oracle | Agile Product Lifecycle Management (PLM) | Unknown | |
| CVE-2024-38856 | Apache | OFBiz | Unknown | |
| CVE-2021-40655 | D-Link | DIR-605 Router | Unknown | |
| CVE-2023-22518 | Atlassian | Confluence Data Center and Server | Known | |
| CVE-2023-38035 | Ivanti | Sentry | Known | |
| CVE-2021-3560 | Red Hat | Polkit | Unknown | |
| CVE-2023-24880 | Microsoft | Windows | Known | |
| CVE-2023-21715 | Microsoft | Office | Unknown | |
| CVE-2022-41091 | Microsoft | Windows | Known | |
| CVE-2021-30533 | Chromium PopupBlocker | Unknown | ||
| CVE-2019-7192 | QNAP | Photo Station | Known | |
| CVE-2021-22986 | F5 | BIG-IP and BIG-IQ Centralized Management | Known |
Cite this
17 CISA KEV entries list CWE-863 (Incorrect authorization), 1% of the catalog. Source: Telemetry analysis of the CISA Known Exploited Vulnerabilities catalog, version 2026.09.23 (released 2026-09-23). https://glide-telemetry.pages.dev/cwe/cwe-863/
Source: CISA KEV catalog v2026.09.23, released 2026-09-23. Windows end 2026-09-23.