# Telemetry: full text

Source data: CISA KEV catalog 2026.09.23 (released 2026-09-23). Reference date 2026-09-23.
Ownership: Telemetry is owned by [OWNER ENTITY], which has a financial interest in Glide Identity.

## State of KEV

### KEV additions per year

CISA added 555 entries in 2022, the catalog's first full calendar year, and 237 in 2026 through 2026-09-23. The catalog's first year, 2021, began on 2021-11-03 with 311 entries by year end.

Data: https://glide-telemetry.pages.dev/api/stats/additions-by-year.csv
### KEV additions per month

The busiest month on record was November 2021, with 291 additions (the catalog's first month). Across all 59 months the median is 19 a month.

Data: https://glide-telemetry.pages.dev/api/stats/additions-by-month.csv
### Top vendors by KEV entries

Microsoft has the most KEV entries, 388 (22.5% of the catalog). The top 10 vendors account for 53.4%.

Data: https://glide-telemetry.pages.dev/api/stats/top-vendors.csv
### Top weaknesses (CWE) in KEV

CWE-20 (Improper input validation) is the most-listed weakness, on 119 entries (6.9%). 175 entries list no CWE.

Data: https://glide-telemetry.pages.dev/api/stats/top-cwes.csv
### Known ransomware use

361 of 1,721 KEV entries (21%) are flagged as known to be used in ransomware campaigns. By year added, the share ranges from 11.4% to 27%.

Data: https://glide-telemetry.pages.dev/api/stats/ransomware-by-year.csv
### Days from addition to federal due date

The median KEV entry gives federal agencies 21 days from dateAdded to dueDate. The median by year added was 2021: 181; 2022: 21; 2023: 21; 2024: 21; 2025: 21; 2026: 14.

Data: https://glide-telemetry.pages.dev/api/stats/remediation-by-year.csv
### Age of CVE IDs when added

21.4% of KEV entries carry a CVE ID at least five years older than the year they were added. In 2022 that share was 47%.

Data: https://glide-telemetry.pages.dev/api/stats/cve-age-by-year.csv
### KEV additions per week (last 26 weeks)

169 entries were added in the 26 weeks to 2026-09-23, an average of 6.5 a week.

Data: https://glide-telemetry.pages.dev/api/stats/weekly-additions.csv

## Additions by year

- 2026: 237 entries, 27 ransomware-linked, median 14 days to due
- 2025: 245 entries, 31 ransomware-linked, median 21 days to due
- 2024: 186 entries, 44 ransomware-linked, median 21 days to due
- 2023: 187 entries, 43 ransomware-linked, median 21 days to due
- 2022: 555 entries, 132 ransomware-linked, median 21 days to due
- 2021: 311 entries, 84 ransomware-linked, median 181 days to due

## Vendors

### Microsoft

388 KEV entries (22.5% of catalog, rank 1). First added 2021-11-03, latest 2026-09-08. 117 ransomware-linked. Top products: Windows (172), Internet Explorer (36), Office (29), Win32k (25), Exchange Server (17). Top CWEs: CWE-119 (34), CWE-416 (28), CWE-20 (28), CWE-787 (26), CWE-264 (20). URL: https://glide-telemetry.pages.dev/vendors/microsoft/

### Cisco

99 KEV entries (5.8% of catalog, rank 2). First added 2021-11-03, latest 2026-09-16. 7 ransomware-linked. Top products: IOS and IOS XE Software (14), Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) (6), IOS XR (6), IOS software (6), Small Business RV160, RV260, RV340, and RV345 Series Routers (5). Top CWEs: CWE-20 (21), CWE-119 (12), CWE-399 (10), CWE-121 (4), CWE-78 (4). URL: https://glide-telemetry.pages.dev/vendors/cisco/

### Apple

94 KEV entries (5.5% of catalog, rank 3). First added 2021-11-03, latest 2026-08-18. 0 ransomware-linked. Top products: Multiple Products (53), iOS, iPadOS, and macOS (11), iOS (8), macOS (6), iOS and iPadOS (5). Top CWEs: CWE-787 (24), CWE-416 (12), CWE-20 (11), CWE-843 (8), CWE-119 (7). URL: https://glide-telemetry.pages.dev/vendors/apple/

### Adobe

81 KEV entries (4.7% of catalog, rank 4). First added 2021-11-03, latest 2026-09-08. 11 ransomware-linked. Top products: Flash Player (33), ColdFusion (16), Acrobat and Reader (13), Reader and Acrobat (8), Commerce and Magento Open Source (2). Top CWEs: CWE-416 (11), CWE-119 (10), CWE-787 (7), CWE-502 (5), CWE-284 (4). URL: https://glide-telemetry.pages.dev/vendors/adobe/

### Google

75 KEV entries (4.4% of catalog, rank 5). First added 2021-11-03, latest 2026-09-16. 0 ransomware-linked. Top products: Chromium V8 (41), Chromium (6), Pixel (2), Chromium Mojo (2), Chromium Skia (2). Top CWEs: CWE-843 (20), CWE-787 (19), CWE-416 (16), CWE-122 (9), CWE-20 (5). URL: https://glide-telemetry.pages.dev/vendors/google/

### Oracle

46 KEV entries (2.7% of catalog, rank 6). First added 2021-11-03, latest 2026-08-24. 13 ransomware-linked. Top products: WebLogic Server (12), Java SE (7), Fusion Middleware (6), E-Business Suite (4), Java Runtime Environment (JRE) (4). Top CWEs: CWE-502 (6), CWE-306 (4), CWE-264 (2), CWE-284 (1), CWE-269 (1). URL: https://glide-telemetry.pages.dev/vendors/oracle/

### Apache

40 KEV entries (2.3% of catalog, rank 7). First added 2021-11-03, latest 2026-08-04. 8 ransomware-linked. Top products: Tomcat (6), Struts (5), HTTP Server (4), ActiveMQ (3), OFBiz (3). Top CWEs: CWE-20 (8), CWE-502 (4), CWE-94 (3), CWE-284 (3), CWE-22 (3). URL: https://glide-telemetry.pages.dev/vendors/apache/

### Ivanti

35 KEV entries (2% of catalog, rank 8). First added 2021-11-03, latest 2026-06-11. 12 ransomware-linked. Top products: Endpoint Manager Mobile (EPMM) (7), Pulse Connect Secure (7), Endpoint Manager (EPM) (4), Cloud Services Appliance (CSA) (3), Sentry (2). Top CWEs: CWE-94 (7), CWE-287 (5), CWE-78 (3), CWE-36 (3), CWE-77 (3). URL: https://glide-telemetry.pages.dev/vendors/ivanti/

### Linux

31 KEV entries (1.8% of catalog, rank 9). First added 2021-12-10, latest 2026-09-18. 2 ransomware-linked. Top products: Kernel (31). Top CWEs: CWE-787 (5), CWE-362 (3), CWE-416 (3), CWE-862 (2), CWE-190 (2). URL: https://glide-telemetry.pages.dev/vendors/linux/

### Fortinet

30 KEV entries (1.7% of catalog, rank 10). First added 2021-11-03, latest 2026-09-09. 14 ransomware-linked. Top products: FortiOS (9), Multiple Products (6), FortiOS and FortiProxy (4), FortiClient EMS (3), FortiWeb (3). Top CWEs: CWE-288 (4), CWE-787 (3), CWE-78 (3), CWE-89 (3), CWE-122 (2). URL: https://glide-telemetry.pages.dev/vendors/fortinet/

### D-Link

26 KEV entries (1.5% of catalog, rank 11). First added 2021-11-03, latest 2026-04-24. 2 ransomware-linked. Top products: Multiple Routers (3), DCS-2530L and DCS-2670L Devices (2), DIR-859 Router (2), Multiple NAS Devices (2), DIR-823X (1). Top CWEs: CWE-78 (11), CWE-77 (5), CWE-120 (1), CWE-494 (1), CWE-22 (1). URL: https://glide-telemetry.pages.dev/vendors/d-link/

### VMware

26 KEV entries (1.5% of catalog, rank 12). First added 2021-11-03, latest 2025-03-04. 9 ransomware-linked. Top products: vCenter Server (9), ESXi (3), Multiple Products (3), ESXi, Workstation, and Fusion (1), ESXi and Workstation (1). Top CWEs: CWE-94 (3), CWE-918 (3), CWE-23 (3), CWE-250 (2), CWE-787 (2). URL: https://glide-telemetry.pages.dev/vendors/vmware/

### Citrix

24 KEV entries (1.4% of catalog, rank 13). First added 2021-11-03, latest 2026-09-09. 7 ransomware-linked. Top products: NetScaler ADC and NetScaler Gateway (5), Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance (4), NetScaler (3), Session Recording (2), NetScaler ADC and Gateway (2). Top CWEs: CWE-119 (5), CWE-284 (4), CWE-125 (2), CWE-94 (2), CWE-20 (2). URL: https://glide-telemetry.pages.dev/vendors/citrix/

### SonicWall

19 KEV entries (1.1% of catalog, rank 14). First added 2021-11-03, latest 2026-09-02. 13 ransomware-linked. Top products: SMA1000 Appliances (5), SonicOS (3), SonicWall Email Security (3), SMA100 Appliances (2), SMA100 (2). Top CWEs: CWE-78 (3), CWE-89 (3), CWE-918 (2), CWE-22 (2), CWE-441 (1). URL: https://glide-telemetry.pages.dev/vendors/sonicwall/

### Synacor

19 KEV entries (1.1% of catalog, rank 15). First added 2022-01-10, latest 2026-08-21. 6 ransomware-linked. Top products: Zimbra Collaboration Suite (ZCS) (16), Zimbra Collaboration Suite (1),  Zimbra Collaboration Suite (ZCS) (1), Zimbra Collaborate Suite (ZCS) (1). Top CWEs: CWE-79 (9), CWE-918 (2), CWE-22 (2), CWE-78 (1), CWE-98 (1). URL: https://glide-telemetry.pages.dev/vendors/synacor/

### Android

17 KEV entries (1% of catalog, rank 16). First added 2021-11-03, latest 2026-06-02. 0 ransomware-linked. Top products: Framework (6), Pixel (4), Kernel (3), Android Kernel (2), Runtime (1). Top CWEs: CWE-416 (4), CWE-190 (1), CWE-783 (1), CWE-280 (1), CWE-908 (1). URL: https://glide-telemetry.pages.dev/vendors/android/

### Palo Alto Networks

15 KEV entries (0.9% of catalog, rank 17). First added 2022-01-10, latest 2026-05-29. 6 ransomware-linked. Top products: PAN-OS (12), Expedition (3). Top CWEs: CWE-306 (3), CWE-77 (2), CWE-565 (1), CWE-787 (1), CWE-73 (1). URL: https://glide-telemetry.pages.dev/vendors/palo-alto-networks/

### Samsung

15 KEV entries (0.9% of catalog, rank 18). First added 2022-11-08, latest 2026-04-24. 0 ransomware-linked. Top products: Mobile Devices (13), MagicINFO 9 Server (2). Top CWEs: CWE-787 (3), CWE-22 (2), CWE-416 (2), CWE-434 (1), CWE-703 (1). URL: https://glide-telemetry.pages.dev/vendors/samsung/

### SAP

14 KEV entries (0.8% of catalog, rank 19). First added 2021-11-03, latest 2025-05-15. 3 ransomware-linked. Top products: NetWeaver (10), Commerce Cloud (1), Multiple Products (1), Solution Manager (1), Customer Relationship Management (CRM) (1). Top CWEs: CWE-22 (3), CWE-502 (2), CWE-306 (2), CWE-434 (1), CWE-444 (1). URL: https://glide-telemetry.pages.dev/vendors/sap/

### Atlassian

13 KEV entries (0.8% of catalog, rank 20). First added 2021-11-03, latest 2024-11-12. 8 ransomware-linked. Top products: Confluence Data Center and Server (3), Jira Server and Data Center (2), Confluence Server and Data Center (2), Bitbucket Server and Data Center (1), Confluence (1). Top CWEs: CWE-22 (3), CWE-74 (2), CWE-917 (2), CWE-863 (1), CWE-78 (1). URL: https://glide-telemetry.pages.dev/vendors/atlassian/

### Mozilla

13 KEV entries (0.8% of catalog, rank 21). First added 2021-11-03, latest 2025-10-06. 1 ransomware-linked. Top products: Firefox and Thunderbird (6), Firefox (5), Multiple Products (1), Firefox, Firefox ESR, and Thunderbird (1). Top CWEs: CWE-416 (5), CWE-843 (2), CWE-119 (2), CWE-362 (2), CWE-200 (1). URL: https://glide-telemetry.pages.dev/vendors/mozilla/

### Zyxel

13 KEV entries (0.8% of catalog, rank 22). First added 2021-11-03, latest 2026-09-21. 2 ransomware-linked. Top products: Multiple Firewalls (5), DSL CPE Devices (2), Multiple Network-Attached Storage (NAS) Devices (2), GS1900 Series Switches (1), EMG2926 Routers (1). Top CWEs: CWE-78 (8), CWE-120 (2), CWE-121 (1), CWE-22 (1), CWE-522 (1). URL: https://glide-telemetry.pages.dev/vendors/zyxel/

### Qualcomm

12 KEV entries (0.7% of catalog, rank 23). First added 2021-11-03, latest 2026-03-03. 0 ransomware-linked. Top products: Multiple Chipsets (10), Multiple Chipsets  (1), Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables (1). Top CWEs: CWE-416 (5), CWE-190 (2), CWE-863 (2), CWE-823 (1), CWE-20 (1). URL: https://glide-telemetry.pages.dev/vendors/qualcomm/

### Trend Micro

12 KEV entries (0.7% of catalog, rank 24). First added 2021-11-03, latest 2026-05-21. 0 ransomware-linked. Top products: Apex One (2), Apex One, Apex One as a Service, and Worry-Free Business Security (2), Apex One and OfficeScan (2), Apex One and Worry-Free Business Security (1), Apex One and Apex One as a Service (1). Top CWEs: CWE-22 (2), CWE-23 (1), CWE-78 (1), CWE-353 (1), CWE-641 (1). URL: https://glide-telemetry.pages.dev/vendors/trend-micro/

### QNAP

11 KEV entries (0.6% of catalog, rank 25). First added 2022-03-31, latest 2023-12-21. 9 ransomware-linked. Top products: Photo Station (4), Network Attached Storage (NAS) (4), VioStor NVR (1), QTS (1), QNAP Network-Attached Storage (NAS) (1). Top CWEs: CWE-78 (3), CWE-22 (2), CWE-20 (2), CWE-79 (2), CWE-80 (2). URL: https://glide-telemetry.pages.dev/vendors/qnap/

### Roundcube

11 KEV entries (0.6% of catalog, rank 26). First added 2021-11-03, latest 2026-02-20. 0 ransomware-linked. Top products: Webmail (7), Roundcube Webmail (4). Top CWEs: CWE-79 (6), CWE-502 (1), CWE-80 (1), CWE-89 (1), CWE-78 (1). URL: https://glide-telemetry.pages.dev/vendors/roundcube/

### SolarWinds

11 KEV entries (0.6% of catalog, rank 27). First added 2021-11-03, latest 2026-06-05. 2 ransomware-linked. Top products: Web Help Desk (5), Serv-U (4), Orion (1), Virtualization Manager (1). Top CWEs: CWE-502 (3), CWE-400 (1), CWE-693 (1), CWE-798 (1), CWE-22 (1). URL: https://glide-telemetry.pages.dev/vendors/solarwinds/

### Arm

9 KEV entries (0.5% of catalog, rank 28). First added 2021-11-03, latest 2024-06-12. 0 ransomware-linked. Top products: Mali Graphics Processing Unit (GPU) (6), Mali GPU Kernel Driver (2), Trusted Firmware (1). Top CWEs: CWE-416 (5), CWE-787 (2), CWE-401 (1), CWE-119 (1). URL: https://glide-telemetry.pages.dev/vendors/arm/

### Progress

9 KEV entries (0.5% of catalog, rank 29). First added 2021-11-03, latest 2026-08-07. 4 ransomware-linked. Top products: WhatsUp Gold (2), LoadMaster (1), Kemp LoadMaster (1), Telerik Report Server (1), WS_FTP Server (1). Top CWEs: CWE-89 (2), CWE-502 (2), CWE-77 (1), CWE-22 (1), CWE-78 (1). URL: https://glide-telemetry.pages.dev/vendors/progress/

### Red Hat

9 KEV entries (0.5% of catalog, rank 30). First added 2021-12-10, latest 2026-08-26. 4 ransomware-linked. Top products: Polkit (2), JBoss (2), Automatic Bug Reporting Tool (1), Libuser (1), JBoss RichFaces Framework (1). Top CWEs: CWE-264 (2), CWE-94 (1), CWE-863 (1), CWE-787 (1), CWE-502 (1). URL: https://glide-telemetry.pages.dev/vendors/red-hat/

### Zoho

9 KEV entries (0.5% of catalog, rank 31). First added 2021-11-03, latest 2023-03-07. 2 ransomware-linked. Top products: ManageEngine (6), Desktop Central (1), ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus (1), ManageEngine ServiceDesk Plus (SDP) (1). Top CWEs: CWE-502 (2), CWE-306 (2), CWE-78 (1), CWE-259 (1), CWE-55 (1). URL: https://glide-telemetry.pages.dev/vendors/zoho/

### F5

8 KEV entries (0.5% of catalog, rank 32). First added 2021-11-03, latest 2026-09-22. 4 ransomware-linked. Top products: BIG-IP (3), BIG-IP Configuration Utility (2), BIG-IP APM (1), BIG-IP Traffic Management Microkernel (1), BIG-IP and BIG-IQ Centralized Management (1). Top CWEs: CWE-122 (1), CWE-121 (1), CWE-89 (1), CWE-288 (1), CWE-306 (1). URL: https://glide-telemetry.pages.dev/vendors/f5/

### IBM

8 KEV entries (0.5% of catalog, rank 33). First added 2021-11-03, latest 2026-08-04. 2 ransomware-linked. Top products: Data Risk Manager (3), Langflow (1), Aspera Faspex (1), InfoSphere BigInsights (1), WebSphere Application Server and Server Hypervisor Edition (1). Top CWEs: CWE-94 (3), CWE-502 (1), CWE-264 (1), CWE-22 (1), CWE-78 (1). URL: https://glide-telemetry.pages.dev/vendors/ibm/

### Juniper

8 KEV entries (0.5% of catalog, rank 34). First added 2022-03-25, latest 2025-10-02. 0 ransomware-linked. Top products: Junos OS (7), ScreenOS (1). Top CWEs: CWE-306 (3), CWE-473 (2), CWE-287 (1), CWE-653 (1), CWE-22 (1). URL: https://glide-telemetry.pages.dev/vendors/juniper/

### NETGEAR

8 KEV entries (0.5% of catalog, rank 35). First added 2021-11-03, latest 2022-09-08. 0 ransomware-linked. Top products: Multiple Devices (2), DGN2200 Devices (1), Wireless Access Point (WAP) Devices (1), WNR2000v5 Router (1), Wireless Router DGN2200 (1). Top CWEs: CWE-119 (2), CWE-78 (2), CWE-200 (1), CWE-77 (1), CWE-352 (1). URL: https://glide-telemetry.pages.dev/vendors/netgear/

### Mitel

7 KEV entries (0.4% of catalog, rank 36). First added 2022-03-25, latest 2025-02-12. 5 ransomware-linked. Top products: MiVoice Connect (3), MiCollab (2), SIP Phones (1), MiCollab, MiVoice Business Express (1). Top CWEs: CWE-22 (2), CWE-88 (1), CWE-94 (1), CWE-77 (1), CWE-20 (1). URL: https://glide-telemetry.pages.dev/vendors/mitel/

### Sophos

7 KEV entries (0.4% of catalog, rank 37). First added 2021-11-03, latest 2025-02-06. 2 ransomware-linked. Top products: Firewall (2), CyberoamOS (1), XG Firewall (1), Web Appliance (1), SG UTM (1). Top CWEs: CWE-89 (2), CWE-120 (1), CWE-77 (1), CWE-94 (1), CWE-158 (1). URL: https://glide-telemetry.pages.dev/vendors/sophos/

### Jenkins

6 KEV entries (0.3% of catalog, rank 38). First added 2022-02-10, latest 2025-10-02. 1 ransomware-linked. Top products: Jenkins (1), Jenkins Command Line Interface (CLI) (1), Jenkins User Interface (UI) (1), Script Security Plugin (1), Matrix Project Plugin (1). Top CWEs: CWE-27 (1), CWE-200 (1), CWE-502 (1). URL: https://glide-telemetry.pages.dev/vendors/jenkins/

### TP-Link

6 KEV entries (0.3% of catalog, rank 39). First added 2022-03-25, latest 2025-09-03. 0 ransomware-linked. Top products: Multiple Routers (2), TL-WR841N (1), TL-WA855RE (1), Archer AX21 (1), Multiple Archer Devices (1). Top CWEs: CWE-77 (2), CWE-78 (1), CWE-290 (1), CWE-306 (1), CWE-22 (1). URL: https://glide-telemetry.pages.dev/vendors/tp-link/

### Broadcom

5 KEV entries (0.3% of catalog, rank 40). First added 2025-04-28, latest 2026-08-18. 1 ransomware-linked. Top products: VMware vCenter (1), VMware Aria Operations (1), VMware vCenter Server (1), VMware Aria Operations and VMware Tools (1), Brocade Fabric OS (1). Top CWEs: CWE-22 (1), CWE-77 (1), CWE-787 (1), CWE-267 (1), CWE-94 (1). URL: https://glide-telemetry.pages.dev/vendors/broadcom/

### Check Point

5 KEV entries (0.3% of catalog, rank 41). First added 2024-05-30, latest 2026-09-22. 2 ransomware-linked. Top products: Multiple Products (2), SmartConsole (1), Security Gateway (1), Quantum Security Gateways (1). Top CWEs: CWE-287 (2), CWE-22 (1), CWE-295 (1), CWE-200 (1). URL: https://glide-telemetry.pages.dev/vendors/check-point/

### DrayTek

5 KEV entries (0.3% of catalog, rank 42). First added 2021-11-03, latest 2025-05-15. 0 ransomware-linked. Top products: Multiple Vigor Routers (2), VigorConnect (2), Vigor Routers (1). Top CWEs: CWE-78 (3), CWE-22 (2). URL: https://glide-telemetry.pages.dev/vendors/draytek/

### Drupal

5 KEV entries (0.3% of catalog, rank 43). First added 2021-11-03, latest 2026-05-22. 2 ransomware-linked. Top products: Core (3), Drupal core (1), Drupal Core (1). Top CWEs: CWE-89 (1), CWE-502 (1), CWE-434 (1), CWE-20 (1). URL: https://glide-telemetry.pages.dev/vendors/drupal/

### Exim

5 KEV entries (0.3% of catalog, rank 44). First added 2021-11-03, latest 2022-03-25. 1 ransomware-linked. Top products: Exim (3), Exim Internet Mailer (1), Mail Transfer Agent (MTA) (1). Top CWEs: CWE-119 (2), CWE-264 (1), CWE-787 (1), CWE-78 (1). URL: https://glide-telemetry.pages.dev/vendors/exim/

### GitLab

5 KEV entries (0.3% of catalog, rank 45). First added 2021-11-03, latest 2026-09-11. 1 ransomware-linked. Top products: Community and Enterprise Editions (2), Community Edition and Enterprise Edition (1), GitLab (1), GitLab CE/EE (1). Top CWEs: CWE-918 (2), CWE-35 (1), CWE-284 (1), CWE-20 (1), CWE-95 (1). URL: https://glide-telemetry.pages.dev/vendors/gitlab/

### GNU

5 KEV entries (0.3% of catalog, rank 46). First added 2022-01-28, latest 2026-01-26. 0 ransomware-linked. Top products: Bourne-Again Shell (Bash) (2), InetUtils (1), GNU Bash (1), GNU C Library (1). Top CWEs: CWE-78 (3), CWE-88 (1), CWE-122 (1). URL: https://glide-telemetry.pages.dev/vendors/gnu/

### Langflow

5 KEV entries (0.3% of catalog, rank 47). First added 2025-05-05, latest 2026-07-21. 1 ransomware-linked. Top products: Langflow (5). Top CWEs: CWE-306 (2), CWE-829 (1), CWE-639 (1), CWE-346 (1), CWE-94 (1). URL: https://glide-telemetry.pages.dev/vendors/langflow/

### N-able

5 KEV entries (0.3% of catalog, rank 48). First added 2025-08-13, latest 2026-09-08. 0 ransomware-linked. Top products: N-central (3), N-Central (2). Top CWEs: CWE-288 (2), CWE-96 (1). URL: https://glide-telemetry.pages.dev/vendors/n-able/

### PaperCut

5 KEV entries (0.3% of catalog, rank 49). First added 2023-04-21, latest 2026-08-31. 2 ransomware-linked. Top products: NG/MF (4), MF/NG (1). Top CWEs: CWE-470 (1), CWE-306 (1), CWE-287 (1), CWE-352 (1), CWE-284 (1). URL: https://glide-telemetry.pages.dev/vendors/papercut/

### RARLAB

5 KEV entries (0.3% of catalog, rank 50). First added 2022-02-15, latest 2025-12-09. 4 ransomware-linked. Top products: WinRAR (4), UnRAR (1). Top CWEs: CWE-22 (2), CWE-35 (1), CWE-351 (1), CWE-59 (1), CWE-36 (1). URL: https://glide-telemetry.pages.dev/vendors/rarlab/

### WordPress

5 KEV entries (0.3% of catalog, rank 51). First added 2021-11-03, latest 2026-07-21. 0 ransomware-linked. Top products: Core (2), File Manager Plugin (1), Snap Creek Duplicator Plugin (1), Social Warfare Plugin (1). Top CWEs: CWE-436 (1), CWE-89 (1), CWE-434 (1), CWE-22 (1), CWE-79 (1). URL: https://glide-telemetry.pages.dev/vendors/wordpress/

## Weaknesses (CWE)

- CWE-20 (Improper Input Validation): 119 entries (6.9%), 42 vendors
- CWE-78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')): 110 entries (6.4%), 65 vendors
- CWE-787 (Out-of-bounds Write): 104 entries (6%), 21 vendors
- CWE-416 (Use After Free): 93 entries (5.4%), 12 vendors
- CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer): 85 entries (4.9%), 18 vendors
- CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')): 79 entries (4.6%), 55 vendors
- CWE-502 (Deserialization of Untrusted Data): 71 entries (4.1%), 36 vendors
- CWE-94 (Improper Control of Generation of Code ('Code Injection')): 70 entries (4.1%), 37 vendors
- CWE-287 (Improper Authentication): 47 entries (2.7%), 31 vendors
- CWE-306 (Missing Authentication for Critical Function): 42 entries (2.4%), 29 vendors
- CWE-843 (Access of Resource Using Incompatible Type ('Type Confusion')): 38 entries (2.2%), 6 vendors
- CWE-284 (Improper Access Control): 36 entries (2.1%), 22 vendors
- CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')): 33 entries (1.9%), 15 vendors
- CWE-122 (Heap-based Buffer Overflow): 33 entries (1.9%), 13 vendors
- CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')): 32 entries (1.9%), 24 vendors
- CWE-264 (Permissions, Privileges, and Access Controls): 31 entries (1.8%), 8 vendors
- CWE-77 (Improper Neutralization of Special Elements used in a Command ('Command Injection')): 30 entries (1.7%), 20 vendors
- CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor): 25 entries (1.5%), 15 vendors
- CWE-434 (Unrestricted Upload of File with Dangerous Type): 23 entries (1.3%), 22 vendors
- CWE-918 (Server-Side Request Forgery (SSRF)): 22 entries (1.3%), 14 vendors
- CWE-288 (Authentication Bypass Using an Alternate Path or Channel): 21 entries (1.2%), 13 vendors
- CWE-269 (Improper Privilege Management): 18 entries (1%), 9 vendors
- CWE-399 (Resource Management Errors): 18 entries (1%), 3 vendors
- CWE-59 (Improper Link Resolution Before File Access ('Link Following')): 17 entries (1%), 4 vendors
- CWE-125 (Out-of-bounds Read): 17 entries (1%), 9 vendors
- CWE-863 (Incorrect Authorization): 17 entries (1%), 14 vendors
- CWE-190 (Integer Overflow or Wraparound): 16 entries (0.9%), 7 vendors
- CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')): 12 entries (0.7%), 10 vendors
- CWE-120 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')): 12 entries (0.7%), 9 vendors
- CWE-121 (Stack-based Buffer Overflow): 12 entries (0.7%), 8 vendors
- CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')): 12 entries (0.7%), 7 vendors
- CWE-862 (Missing Authorization): 12 entries (0.7%), 10 vendors
- CWE-693 (Protection Mechanism Failure): 11 entries (0.6%), 4 vendors
- CWE-23 (Relative Path Traversal): 9 entries (0.5%), 7 vendors
- CWE-506: 8 entries (0.5%), 8 vendors
- CWE-611 (Improper Restriction of XML External Entity Reference): 8 entries (0.5%), 7 vendors
- CWE-798 (Use of Hard-coded Credentials): 8 entries (0.5%), 8 vendors
- CWE-138: 7 entries (0.4%), 5 vendors
- CWE-95 (Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')): 6 entries (0.3%), 6 vendors
- CWE-189: 6 entries (0.3%), 3 vendors

## SMS OTP regulation board

Telemetry lists a jurisdiction when a regulator or standards body has issued a rule, circular or guideline that restricts or phases out SMS one-time passcodes for authenticating financial transactions or logins. Status is checked against the primary document or regulator statement. Dates are effective dates unless noted.

- UAE | Central Bank of the UAE | SMS and email OTP phase-out | Jul 2025 – Mar 2026 | Complete | https://thepaypers.com/fraud-and-fincrime/news/uae-banks-cancel-otps-switching-to-in-app-verification
- Philippines | Bangko Sentral ng Pilipinas | Circular 1213: no SMS or email OTP for high-risk transactions | From Jun 25, 2026 | In force | https://www.gmanetwork.com/news/money/economy/992561/no-more-sms-email-otps-for-high-risk-financial-transactions-starting-june-25/story/
- India | Reserve Bank of India | Authentication Directions 2025 | From Apr 1, 2026 | In force | https://www.regulationasia.com/articles/rbi-mandates-2fa-and-new-security-rules-for-digital-payments
- Singapore | MAS and the Association of Banks in Singapore | OTP login phase-out for customers with digital tokens | From Jul 2024 | In force | https://www.mas.gov.sg/news/media-releases/2024/banks-in-singapore-to-strengthen-resilience-against-phishing-scams
- Malaysia | Bank Negara Malaysia | Banks directed off SMS OTP | 2022 – 2024 | In force | https://commsrisk.com/malaysian-banks-stop-using-sms-for-two-factor-authentication/
- European Union | Council and Parliament | PSR / PSD3 fraud and SCA package | Deal Nov 27, 2025 | Pending | https://www.consilium.europa.eu/en/press/press-releases/2025/11/27/payment-services-council-and-parliament-agree-to-step-up-the-fight-against-fraud-and-increase-transparency/
- United States | NIST | SP 800-63B-4: SMS OTP is a "restricted" authenticator | Final 2025 | Guidance | https://pages.nist.gov/800-63-4/sp800-63b.html

## Company dossiers

### Glide Identity (Glide.id)

URL: https://glide-telemetry.pages.dev/companies/glide-identity/
Data: https://glide-telemetry.pages.dev/api/companies/glide-identity.json
Verified 2026-09-24. Owner-affiliated coverage: the site's owner has a financial interest in Glide Identity.

BLUF: Glide Identity (Glide.id) is a US company that, according to the company, sells SIM-based authentication as a replacement for SMS one-time passcodes. Telemetry's fact file (verified 2026-09-24) records 5 dated milestones between 2024 and Aug 3, 2026; the most recent is the three-carrier beta announced Aug 3, 2026 (AT&T, T-Mobile and Verizon). CISA's KEV catalog 2026.09.23 lists 0 entries with a vendorProject matching "Glide" (all 1,721 entries checked). No independent security assessment appears in our sources.


## Briefings

### Glide Identity's three-carrier beta: what the data does and doesn't show

URL: https://glide-telemetry.pages.dev/briefings/glide-identity-three-carrier-beta/
Type: Assessment. Published 2026-09-24, updated 2026-09-24. Confidence: Moderate (The announcement and its date rest on the company's own release, corroborated by trade and general press. The gaps are established by their absence from our sources, which could change if the carriers or the company publish more.)

BLUF: The sources establish that Glide Identity announced a beta of SIM-based cryptographic authentication across AT&T, T-Mobile and Verizon on Aug 3, 2026, and that trade and general press covered it. They do not show which devices, operating systems and plans work, how often fallback triggers, what it costs, or how it holds up under independent security review.

What was announced On Aug 3, 2026, Glide Identity announced a beta of what it calls "carrier-native cryptographic authentication" across AT&T, T-Mobile and Verizon. The release, distributed on Business Wire, includes a quote from a Verizon Business executive. Biometric Update covered the three-carrier launch on Aug 7, and on Aug 23 Fox News' CyberGuy featured Glide in a piece on SIM-based bank login as a replacement for SMS one-time passcodes. The product behind it, MagicalAuth, replaces SMS codes with verification through the mobile network, according to the company. Glide says it "confirms identity using the SIM's cryptographic link to the network" and completes authentication in under one second with no codes. What the data shows Question What our sources show Kind of source --- --- --- Was a three-carrier beta announced? Yes, on Aug 3, 2026, naming AT&T, T-Mobile and Verizon Company release, covered by the press Did a carrier speak to it? The release quotes a Verizon Business executive Company release Is the company in the relevant industry bodies? FIDO Alliance member at Sponsor level; listed as a GSMA Open Gateway partner The bodies' own listing pages What came before? A Series A of more than $20 million on Oct 13, 2025, and selection as one of 10 finalists for the RSAC 2026 Innovation Sandbox contest Press, company releases and the organizer; see the dossier timeline Table: Telemetry's reading of the sources collected in the Glide Identity dossier. The dossier also runs a computed check of CISA's Known Exploited Vulnerabilities catalog for any vendor matching "Glide", recalculated every time the site is built. What the data doesn't show - Coverage in practice. Our sources do not say which devices, operating systems and plans work in the beta, or how often fallback triggers. Glide says that when a device or OS doesn't support SIM authentication, it automatically switches to alternatives such as passkeys or email links. - Independent assessment. We found no independent security assessment in our sources. Everything we know about how the product works comes from the company. - Standards treatment. Our sources do not address how NIST SP 800-63B-4 would classify SIM-based cryptographic authentication. Our NIST briefing covers how the guidelines treat SMS codes. - Commercial terms. Pricing is not published, the developer documentation requires a login, and carrier contract terms are not in our sources. - SIM swaps and eSIM transfers. The company positions the product against SIM swap. We have not verified how it handles SIM swaps or eSIM transfers at the carrier. See SIM swap attacks, explained. Number verification is a different check On Jul 8, 2026, Aduna, a network-API joint venture, announced number verification with the same three carriers. Number verification, a CAMARA API, confirms that a request comes from the SIM tied to a number. Glide describes its approach as SIM-based cryptographic authentication. The difference matters, and our carrier authentication primer sets out the approaches, but Telemetry has not independently tested either. Other companies offering network-based or SMS-alternative verification include Prove, Twilio, Vonage, Sinch, Infobip, Telesign and IPification. For where regulators stand on SMS codes, see the SMS OTP regulation board. What would change this assessment - Carrier-side documentation of the beta. - Published device, OS and plan coverage, or fallback rates. - An independent security assessment. - Published pricing.

Sources:
1. Glide.id release on its three-carrier beta (AT&T, T-Mobile, Verizon) (Business Wire) https://www.businesswire.com/news/home/20260803451967/en/Glide.id-Beta-Launches-First-Carrier-Native-Cryptographic-Authentication-Across-ATT-T-Mobile-and-Verizon-as-AI-Fraud-Reaches-Record-Highs
2. Coverage of Glide's SIM-based authentication across the major US carriers (Biometric Update) https://www.biometricupdate.com/202608/glide-brings-sim-based-authentication-to-all-major-us-carriers
3. CyberGuy on SIM-based bank login as an SMS code replacement, featuring Glide (Fox News) https://www.foxnews.com/tech/bank-may-stop-texting-six-digit-codes
4. MagicalAuth product page (Glide Identity) https://www.glide.id/solutions/magicalauth
5. Aduna and major U.S. carriers push network-based authentication as SMS code alternative (ID Tech) https://idtechwire.com/aduna-and-major-u-s-carriers-push-network-based-authentication-as-sms-code-alternative/
6. FIDO Alliance member list (FIDO Alliance) https://fidoalliance.org/members/
7. GSMA Open Gateway partner listing: Glide (GSMA) https://www.gsma.com/solutions-and-impact/gsma-open-gateway/gsma_orgs/glide/

Disclosure: this briefing mentions a company in which the site's owner has a financial interest.

### The UAE’s SMS OTP phase-out is done. What US banks can take from it

URL: https://glide-telemetry.pages.dev/briefings/uae-sms-otp-phase-out/
Type: Assessment. Published 2026-09-23, updated 2026-09-23. Confidence: Moderate (Based on trade and regional press reporting; the Central Bank of the UAE's own notice is not linked.)

BLUF: The Central Bank of the UAE directed banks to phase out SMS and email one-time passcodes, starting in July 2025 and finishing by March 31, 2026. Banks moved customers to in-app verification in their own mobile apps.

What did the UAE require? The Central Bank of the UAE told licensed financial institutions to stop relying on one-time passcodes sent by SMS or email to authenticate customers. The phase-out began in July 2025, with a deadline of March 31, 2026. What replaced the codes? Banks moved customers to verification inside their own mobile apps: the customer confirms a login or payment in the app on a device the bank has already registered, instead of typing a code from a text message. Why it matters outside the Gulf The UAE rule is unusually direct. Most regulators describe outcomes and leave the method to banks. Here the regulator named the method to retire and set a date. That gives US banks a finished case study rather than a forecast: - The timeline was months, not years. A defined deadline forced the migration work to the top of the roadmap. - Email went with SMS. Regulators treated both as the same class of risk, because both can be phished or intercepted. - The replacement was already in customers’ hands. Moving approval into the bank’s own app avoided a new device or a new login habit. What US banks should watch No US regulator has ordered a similar phase-out. The closest signals are NIST classifying SMS codes as restricted and the FCC’s rules on SIM-swap fraud. Telemetry tracks every jurisdiction that has moved in its SMS OTP regulation board.

Sources:
1. UAE banks cancel OTPs, switching to in-app verification (The Paypers) https://thepaypers.com/fraud-and-fincrime/news/uae-banks-cancel-otps-switching-to-in-app-verification
2. UAE central bank tells FIs to drop SMS OTP authentication (BankInfoSecurity) https://www.bankinfosecurity.com/uae-central-bank-tells-fis-to-drop-sms-otp-authentication-a-28589
3. Countries phasing out SMS OTPs for online banking security (Gulf News) https://gulfnews.com/business/banking/countries-phasing-out-sms-otps-for-online-banking-security-1.500209725

### SMS one-time passcodes are “restricted” under NIST’s new guidelines. Here’s what that means for US banks

URL: https://glide-telemetry.pages.dev/briefings/nist-800-63-4-sms-otp/
Type: Primer. Published 2026-09-22, updated 2026-09-24. Confidence: High (Core claims rest on the text of NIST SP 800-63B-4, a primary source.)

BLUF: NIST SP 800-63-4 does not ban SMS one-time passcodes. It classifies SMS and voice codes as “restricted” authenticators: still allowed, but only if the organization assesses the risk, tells users about it, offers at least one non-restricted alternative, and keeps a plan to migrate away.

What changed in NIST SP 800-63-4? NIST’s Digital Identity Guidelines are the reference US agencies must follow and that banks, auditors and examiners reach for when they argue about authentication. Revision 4, finalized in 2025, is split into three volumes: identity proofing (63A), authentication (63B) and federation (63C). For SMS, the headline is continuity. Codes sent over the phone network stay on the list of allowed authenticators, in the same “restricted” category NIST created in Revision 3. What’s new is the alternative: Revision 4 explicitly accommodates synced passkeys, the kind stored in Apple, Google or password-manager accounts, and treats them as phishing-resistant. What does “restricted” actually require? An organization that keeps offering SMS or voice codes takes on four obligations: 1. Offer an alternative that isn’t restricted, so no customer is stuck with SMS. 2. Tell users the risks of the restricted option in plain language. 3. Assess the risk to users and the organization of continuing to allow it. 4. Keep a migration plan in case the authenticator is removed in a future revision. How do the alternatives compare? Method Phishing-resistant? NIST 800-63B-4 --- --- --- SMS or voice OTP No Restricted Authenticator app code (TOTP) No Allowed at AAL2 Synced passkey Yes Allowed at AAL2 Hardware security key (FIDO2) Yes Eligible for AAL3 Carrier / SIM-based verification [Editorial: confirm] [Editorial: confirm classification] Table: Status under NIST SP 800-63B-4. Telemetry analysis of sources [1] and [2]. Will the US follow the UAE and ban SMS codes? Probably not by decree. US banking regulators rarely name a technology, and the FFIEC’s 2021 authentication guidance is written in terms of risk, not methods. The pressure is arriving from other directions: NIST’s conditions, the FCC’s 2023 SIM-swap and port-out rules for carriers, and a growing list of markets where the codes are already gone. - 2022: Malaysia’s central bank directs banks off SMS OTP. - Jul 2024: Singapore banks begin phasing out OTP logins for customers with digital tokens. - 2025: NIST finalizes SP 800-63-4. - Mar 2026: The UAE completes its SMS and email OTP phase-out. - Apr 2026: India’s RBI Authentication Directions take effect. - Jun 2026: The Philippines bars SMS and email OTP for high-risk transactions. [Expert quote: from a named bank CISO or head of fraud, gathered in original reporting.] -- [Name], [Title], [Institution] What should a bank do this quarter? - Inventory every flow that still sends a code: login, step-up, password reset, new payees. - Write the risk assessment NIST asks for, and date it. - Offer a phishing-resistant option, passkeys first, and track adoption. - Start with account recovery and new-payee setup, where SIM-swap fraud tends to cash out.

Sources:
1. SP 800-63B-4: Authentication and Authenticator Management (NIST) https://pages.nist.gov/800-63-4/sp800-63b.html
2. NIST cites phishing resistance of synced passkeys in digital identity guidelines update (FIDO Alliance) https://fidoalliance.org/nist-cites-phishing-resistance-of-synced-passkeys-in-digital-identity-guidelines-update/
3. Protecting Consumers from SIM Swap and Port-Out Fraud (FCC 23-95) (Federal Register) https://www.federalregister.gov/documents/2023/12/08/2023-26338/protecting-consumers-from-sim-swap-and-port-out-fraud
4. Authentication and Access to Financial Institution Services and Systems (FFIEC) https://www.ffiec.gov/news/press-releases/2021/pr-08-11
5. Banks in Singapore to strengthen resilience against phishing scams (Monetary Authority of Singapore) https://www.mas.gov.sg/news/media-releases/2024/banks-in-singapore-to-strengthen-resilience-against-phishing-scams
6. No more SMS, email OTPs for high-risk financial transactions starting June 25 (GMA News) https://www.gmanetwork.com/news/money/economy/992561/no-more-sms-email-otps-for-high-risk-financial-transactions-starting-june-25/story/
7. UAE banks cancel OTPs, switching to in-app verification (The Paypers) https://thepaypers.com/fraud-and-fincrime/news/uae-banks-cancel-otps-switching-to-in-app-verification

### Carrier-native authentication, explained: how a SIM can sign a login

URL: https://glide-telemetry.pages.dev/briefings/carrier-authentication-explained/
Type: Primer. Published 2026-09-20, updated 2026-09-20. Confidence: Moderate (Standards-project documentation plus trade and vendor announcements, including a vendor press release.)

BLUF: Carrier-based authentication verifies a user through their mobile operator instead of sending them a code. The simplest form checks that a request comes from the SIM tied to a phone number; stronger forms use cryptographic keys held in the SIM to sign the request.

Three things people call “carrier authentication” Approach What it checks What the user does --- --- --- Number verification The request comes from the SIM tied to a given number Nothing; it runs over mobile data SIM swap check Whether the number’s SIM changed recently Nothing; it’s a risk signal SIM-based cryptography A key held in the SIM signs the request Usually one tap Table: Telemetry’s summary of vendor and standards documentation. Where the APIs come from The CAMARA project, hosted by the Linux Foundation, defines common network APIs such as Number Verification and SIM Swap, so developers can call the same interface across operators. GSMA Open Gateway packages those APIs commercially. What happened in the US in 2026 In July 2026, Aduna, a network-API joint venture, announced number verification with AT&T, T-Mobile and Verizon. In August, Glide Identity announced a beta of SIM-based cryptographic authentication across the same three carriers. What it doesn’t solve A network check proves something about a SIM, not about the person holding the phone. It is strongest combined with a device-bound credential and weakest as the only factor for account recovery.

Sources:
1. CAMARA project (Linux Foundation) https://camaraproject.org/
2. GSMA Open Gateway (GSMA) https://www.gsma.com/solutions-and-impact/gsma-open-gateway/
3. Aduna and major U.S. carriers push network-based authentication as SMS code alternative (ID Tech) https://idtechwire.com/aduna-and-major-u-s-carriers-push-network-based-authentication-as-sms-code-alternative/
4. Glide.id beta launches carrier-native cryptographic authentication across AT&T, T-Mobile and Verizon (Business Wire) https://www.businesswire.com/news/home/20260803451967/en/Glide.id-Beta-Launches-First-Carrier-Native-Cryptographic-Authentication-Across-ATT-T-Mobile-and-Verizon-as-AI-Fraud-Reaches-Record-Highs

Disclosure: this briefing mentions a company in which the site's owner has a financial interest.

### What the UK’s APP fraud reimbursement rules changed for fraud teams

URL: https://glide-telemetry.pages.dev/briefings/uk-app-fraud-reimbursement/
Type: Assessment. Published 2026-09-12, updated 2026-09-12. Confidence: High (Based on the Payment Systems Regulator's policy statements, primary sources.)

BLUF: Since October 7, 2024, UK payment service providers must reimburse most victims of authorized push payment scams on Faster Payments, up to £85,000 per claim, with the cost split between the sending and receiving firms.

What the rules require From October 7, 2024, payment firms sending Faster Payments must reimburse eligible victims of authorized push payment (APP) scams, up to a maximum of £85,000 per claim. The cost is shared between the firm that sent the payment and the firm that received it. Why authentication isn’t the answer here In an APP scam the customer authorizes the payment themselves. Strong authentication confirms it really was the customer, which is exactly the problem. Defenses have to look at the payment’s context: a new payee, an unusual amount, or a customer who is on the phone with someone claiming to be their bank. What changed for fraud teams - Receiving firms now pay too, which gives them a reason to spot and freeze mule accounts. - Friction at the point of payment became easier to justify: confirmation-of-payee warnings, holds and calls. - Data sharing between firms matters more when both sides carry the loss.

Sources:
1. PS24/7: Faster Payments APP scams reimbursement requirement: confirming the maximum level of reimbursement (Payment Systems Regulator) https://www.psr.org.uk/publications/policy-statements/ps247-faster-payments-app-scams-reimbursement-requirement-confirming-the-maximum-level-of-reimbursement/
2. PS25/5: APP scams reimbursement consolidated policy statement (Payment Systems Regulator) https://www.psr.org.uk/media/rhelv4op/ps25-5-app-scams-reimbursement-consolidated-policy-statement-may-2025.pdf

### Are synced passkeys phishing-resistant?

URL: https://glide-telemetry.pages.dev/briefings/synced-passkeys-phishing-resistant/
Type: Primer. Published 2026-09-05, updated 2026-09-05. Confidence: High (Based on the NIST SP 800-63B-4 text and the FIDO Alliance's statement on it.)

BLUF: Yes. A passkey is bound to the website it was created for, so it can’t be entered on a look-alike site. NIST’s 800-63-4 update accepts synced passkeys at AAL2. The main new risk is the account that syncs them, which needs strong protection of its own.

Why passkeys resist phishing A passkey is a key pair. The website stores the public key; the private key stays with the user. When the user signs in, the browser checks the site’s domain and only offers the passkey registered for that exact domain. A phishing page on a look-alike domain never receives a credential it could replay. What syncing changes Synced passkeys are copied across the user’s devices through a provider such as Apple, Google or a password manager. That fixes the biggest usability problem of device-bound credentials, losing the device, but it moves part of the risk to the sync account. If an attacker takes over that account, they may be able to restore the user’s passkeys to a device they control. How NIST treats them NIST’s 800-63-4 guidelines accept synced passkeys at authentication assurance level 2 (AAL2), the level most consumer and banking logins target. High-assurance use cases that require AAL3 still call for hardware-bound keys. What to do if you run a login - Offer passkeys as the default for returning users. - Protect recovery: account recovery is where passkey deployments get attacked, so don’t fall back to SMS codes there. - Keep a device-bound option for administrators and other high-risk users.

Sources:
1. NIST cites phishing resistance of synced passkeys in digital identity guidelines update (FIDO Alliance) https://fidoalliance.org/nist-cites-phishing-resistance-of-synced-passkeys-in-digital-identity-guidelines-update/
2. SP 800-63B-4: Authentication and Authenticator Management (NIST) https://pages.nist.gov/800-63-4/sp800-63b.html

### Why OTP bots keep working against bank customers

URL: https://glide-telemetry.pages.dev/briefings/otp-bots-explained/
Type: Primer. Published 2026-09-01, updated 2026-09-01. Confidence: Moderate (One secondary source plus widely documented attack mechanics.)

BLUF: An OTP bot is an automated calling or messaging service that impersonates a bank or other service and persuades the victim to read out or type in a one-time passcode, which the criminal uses at the same moment to log in or approve a payment.

How an OTP bot attack works 1. The criminal already has the victim’s username and password, usually from a breach or a phishing page. 2. They start a login or payment, which makes the bank send the victim a one-time passcode. 3. At the same moment, the bot calls the victim, claims to be the bank’s fraud team, and asks them to “confirm” the code they just received. 4. The victim reads it out or types it into the keypad, and the bot passes it straight to the criminal. Why it keeps working The call arrives exactly when the real code does, which makes it convincing. And a one-time passcode has no way of knowing who is typing it in or where: it works for anyone who has it within its validity window. What stops it - Remove the code: passkeys, in-app approval on a registered device and network-based verification leave the customer nothing to read out. - Put context in the message: if a code is unavoidable, say what it approves (“to add payee J. Smith”) and that the bank will never ask for it. - Watch the timing: a login from a new device while the customer is on an inbound call is a strong fraud signal.

Sources:
1. One-time passcodes are gateway for financial fraud attacks (BankInfoSecurity) https://www.bankinfosecurity.com/one-time-passcodes-are-gateway-for-financial-fraud-attacks-a-31341

### SIM swap attacks, explained

URL: https://glide-telemetry.pages.dev/briefings/sim-swap-attacks-explained/
Type: Primer. Published 2026-08-18, updated 2026-09-10. Confidence: High (Regulatory claims rest on the FCC rule as published in the Federal Register; attack mechanics are well established.)

BLUF: A criminal persuades, tricks or bribes a mobile carrier into moving a victim’s phone number to a SIM they control. From then on the victim’s calls and texts, including one-time passcodes, go to the attacker.

How does a SIM swap work? A phone number belongs to an account at the carrier, not to a piece of plastic. A SIM swap exploits the process carriers use to move a number to a new SIM or eSIM, for example when a customer loses their phone. The attacker gets the carrier to do that move for them, using one of three routes: - Social engineering: calling or visiting a store while impersonating the customer, often with personal details from data breaches. - Insiders: paying a carrier or retail employee to make the change. - Account takeover: logging into the customer’s carrier account online with stolen credentials. Once the number moves, the victim’s phone loses service and the attacker’s device starts receiving their calls and texts. Why is it so damaging? Phone numbers became the default recovery and verification channel for email, banking and crypto accounts. An attacker holding the number can request password resets and receive the one-time passcodes that confirm them. That is why SIM swaps often end in drained bank or crypto accounts within hours. What are carriers now required to do? In November 2023 the FCC adopted rules requiring US wireless carriers to use secure methods to authenticate a customer before moving their number to a new device or provider, to notify customers promptly of SIM change and port-out requests, and to offer account locks. See Telemetry’s explainer on the FCC’s SIM-swap rules. How can banks and apps defend against it? - Stop treating an SMS code as proof of identity for high-risk actions like password resets or adding a payee. - Check for recent SIM changes before trusting the number. Carrier network APIs can report whether a number’s SIM changed recently. - Offer phishing-resistant options such as passkeys, so the phone number isn’t the key to the account.

Sources:
1. Protecting Consumers from SIM Swap and Port-Out Fraud (FCC 23-95) (Federal Register) https://www.federalregister.gov/documents/2023/12/08/2023-26338/protecting-consumers-from-sim-swap-and-port-out-fraud
2. SIM Swapping (category) (KrebsOnSecurity) https://krebsonsecurity.com/category/sim-swapping/

### The FCC’s SIM-swap rules: what carriers now have to do

URL: https://glide-telemetry.pages.dev/briefings/fcc-sim-swap-rules/
Type: Primer. Published 2026-08-10, updated 2026-09-15. Confidence: High (Based on the Federal Register rule and FCC orders, primary sources.)

BLUF: The FCC’s 2023 order (FCC 23-95) requires US wireless carriers to authenticate customers securely before moving their number to a new SIM or provider, to notify customers of SIM change and port-out requests, and to offer account locks. It does not regulate how banks or apps use SMS codes.

What does the order require? The Report and Order, adopted on November 15, 2023, amends the FCC’s customer proprietary network information (CPNI) and number-portability rules. Wireless carriers must: - Authenticate securely before redirecting a customer’s number to a new device or another carrier. - Handle failed attempts: have procedures for responding to failed authentication. - Notify customers promptly when a SIM change or port-out is requested. - Offer account locks that customers can switch on to block number changes. - Train staff and keep records of SIM change and port-out requests. When did it take effect? The rules were published in the Federal Register on December 8, 2023. The FCC later waived the original July 2024 compliance date while the rules’ information-collection requirements went through federal review. Check the FCC’s current notice before citing a compliance date. What doesn’t it cover? The order regulates carriers. It says nothing about whether a bank or app should keep using SMS codes. A carrier that follows the rules makes SIM swaps harder, but a bank that still treats an SMS code as proof of identity remains exposed to insiders, to account takeover at the carrier, and to phishing of the code itself.

Sources:
1. Protecting Consumers from SIM Swap and Port-Out Fraud (Federal Register) https://www.federalregister.gov/documents/2023/12/08/2023-26338/protecting-consumers-from-sim-swap-and-port-out-fraud
2. Report and Order FCC 23-95 (FCC) https://docs.fcc.gov/public/attachments/FCC-23-95A1.txt
3. Order on compliance date (DA 24-649) (FCC) https://docs.fcc.gov/public/attachments/DA-24-649A1.pdf

### Inside BSP Circular 1213, the Philippines’ OTP rule

URL: https://glide-telemetry.pages.dev/briefings/philippines-bsp-circular-1213/
Type: Flash. Published 2026-06-26, updated 2026-06-26. Confidence: Moderate (Based on press reporting of the circular; the BSP document itself is not linked.)

BLUF: Bangko Sentral ng Pilipinas Circular No. 1213 bars banks and other supervised financial institutions from using SMS or email one-time passcodes to authenticate high-risk transactions, starting June 25, 2026.

What the circular changes Banks and other institutions supervised by the Bangko Sentral ng Pilipinas can no longer use one-time passcodes sent by SMS or email to authenticate high-risk transactions. The rule took effect on June 25, 2026. Why SMS and email together Regulators increasingly treat both channels as the same weakness. Codes sent by text or email can be phished, intercepted, or handed over by a customer who has been convinced they are talking to their bank. Where it fits The Philippines joins Singapore, Malaysia and the UAE in moving banks off SMS codes. Telemetry tracks each of them in the SMS OTP regulation board.

Sources:
1. No more SMS, email OTPs for high-risk financial transactions starting June 25 (GMA News) https://www.gmanetwork.com/news/money/economy/992561/no-more-sms-email-otps-for-high-risk-financial-transactions-starting-june-25/story/
2. BSP SMS OTP phase-out (Fintech News Philippines) https://fintechnews.ph/71973/security/bsp-philippines-sms-otp-phaseout/

### Singapore banks to phase out OTPs for customers with digital tokens

URL: https://glide-telemetry.pages.dev/briefings/singapore-banks-phase-out-otp/
Type: Flash. Published 2024-07-09, updated 2024-07-09. Confidence: High (Based on the Monetary Authority of Singapore's own media release.)

BLUF: In July 2024 the Monetary Authority of Singapore and the Association of Banks in Singapore announced that major retail banks would phase out one-time passcodes for bank account logins by customers who have digital tokens activated on their mobile devices.

What was announced The Monetary Authority of Singapore and the Association of Banks in Singapore said major retail banks would phase out the use of one-time passcodes for logging into bank accounts, for customers who have activated a digital token on their mobile device. Why Phishing sites imitating banks can capture a customer’s password and OTP and use them immediately. A digital token bound to the customer’s registered device can’t be relayed that way. What customers see Instead of typing a code, customers approve logins with the digital token in their bank’s app.

Sources:
1. Banks in Singapore to strengthen resilience against phishing scams (Monetary Authority of Singapore) https://www.mas.gov.sg/news/media-releases/2024/banks-in-singapore-to-strengthen-resilience-against-phishing-scams
2. Banks in Singapore to phase out one-time passwords (Finextra) https://www.finextra.com/newsarticle/44430/banks-in-singapore-to-phase-out-one-time-passwords

## Glossary

- Account takeover (ATO): Account takeover is when a criminal gains control of a real customer's account, usually with stolen credentials, a phished one-time passcode or a hijacked phone number, and then uses it to move money, change contact details or open new products.
- APP fraud: Authorized push payment (APP) fraud is a scam in which the victim is tricked into sending a payment themselves, for example to someone impersonating their bank, a supplier or a romantic partner. Because the customer authorized it, strong authentication alone does not stop it.
- Binding Operational Directive (BOD): A Binding Operational Directive is a compulsory direction from CISA to US federal civilian executive branch agencies. BOD 22-01, issued in November 2021, created the KEV catalog's remediation requirement. The required-action text of recent KEV entries also cites BOD 26-04; see each entry's notes for the linked directive.
- CAMARA: CAMARA is an open-source project hosted by the Linux Foundation that defines common network APIs, such as Number Verification and SIM Swap, so developers can call the same interface across different mobile operators. GSMA Open Gateway builds on it.
- CVE ID: A CVE ID (Common Vulnerabilities and Exposures) is a unique identifier, in the form CVE-YEAR-NUMBER, assigned to a publicly disclosed vulnerability by the CVE Program. The year in the ID is the year the ID was assigned or reserved, which is not always the year the vulnerability was disclosed or exploited.
- CWE: The Common Weakness Enumeration (CWE), maintained by MITRE, is a list of software and hardware weakness types, such as out-of-bounds write (CWE-787) or OS command injection (CWE-78). A CVE describes one specific flaw; its CWE describes the kind of mistake that caused it.
- FIDO2: FIDO2 is the FIDO Alliance's set of specifications, made up of the W3C's WebAuthn API and FIDO's CTAP protocol, that lets people sign in with public-key cryptography instead of passwords. Passkeys and hardware security keys are both FIDO2 credentials.
- KEV due date: Each KEV entry carries a due date by which US federal civilian executive branch agencies must apply the required action, usually a vendor patch or mitigation, or stop using the product. Organizations outside the federal government are not bound by the date but often use it as a benchmark.
- Known Exploited Vulnerabilities (KEV) catalog: The Known Exploited Vulnerabilities catalog is a list maintained by the US Cybersecurity and Infrastructure Security Agency (CISA) of vulnerabilities for which there is reliable evidence of active exploitation. Each entry has a CVE ID, the affected vendor and product, the date it was added, a required action and a due date. US federal civilian agencies must remediate entries by the due date; many other organizations use the catalog to prioritize patching.
- Known ransomware campaign use: A field in each KEV entry. It is set to "Known" when CISA is aware the vulnerability has been used in a ransomware campaign, and "Unknown" otherwise. "Unknown" means CISA has not confirmed ransomware use, not that it has not happened.
- National Vulnerability Database (NVD): The National Vulnerability Database is run by NIST. It republishes CVE records and adds analysis such as severity scores, affected-product identifiers and weakness (CWE) mappings.
- Number verification: Number verification is a mobile network API that confirms whether the device making a request is using the SIM registered to a given phone number, without sending the user a code.
- OTP bot: An OTP bot is an automated calling or messaging service that impersonates a bank or service and persuades the victim to read out or type in a one-time passcode, which the criminal then uses in real time.
- Passkey: A passkey is a FIDO2 credential: a key pair where the private key stays on the user's device or in their password manager, and the public key is stored by the website. Because it is bound to the site's domain, it cannot be used on a look-alike phishing site.
- Phishing-resistant MFA: Phishing-resistant MFA is authentication that a fake website or man-in-the-middle cannot capture and replay, because the credential is cryptographically bound to the real site. FIDO2 passkeys and security keys are the common examples. SMS codes and authenticator-app codes are not phishing-resistant.
- Silent network authentication: Silent network authentication verifies a user by checking, with their mobile operator, that the request comes from the SIM tied to their phone number. The check happens over the cellular data connection, so the user never sees or types a code.
- SIM swap: A SIM swap is when a criminal gets a mobile carrier to move a victim's phone number to a SIM or eSIM they control, by social engineering, bribery or stolen credentials. The criminal then receives the victim's calls and texts, including one-time passcodes.
- Strong customer authentication: Strong customer authentication (SCA) is the requirement in EU payments law that customers authenticate with at least two independent factors from knowledge, possession and inherence for most electronic payments and account access.
- Zero trust: Zero trust is a security model in which no user, device or request is trusted because of its network location. Every access decision is made from identity, device health and context, and re-checked continuously.
- Zero-day: A zero-day is a vulnerability that attackers exploit before the vendor has released a fix, or before defenders know it exists. Once a patch ships, it is usually called an n-day.