KEV 2026.10.301,766 entries+10 in 7d11 open federal deadlinesas of / search ? keys
KEV Now

Weakness / #12

CWE-284: Improper access control in CISA KEV

Improper Access Control

Catalog
2026.10.30
Rank
#12 of 198
MITRE
CWE-284 definition

Answer 37 KEV entries list CWE-284 (Improper access control) as of catalog 2026.10.30, 2.1% of the catalog and rank 12 of 198 weaknesses. The most affected vendor is Microsoft (6).

The software does not correctly restrict who can reach a resource or function.

KEV entries
372.1% of catalog
Vendors
23affected
Ransomware: known
38.1%
First added
2021-11-03
Latest added
2026-10-08

VVendors

Vendors with CWE-284 KEV entries
VendorEntriesShare
Microsoft616.2%
Adobe410.8%
Citrix410.8%
Apache38.1%
Elastic25.4%
ProFTPD12.7%
Oracle12.7%
Joomlack12.7%
Ubiquiti12.7%
Widget Factory12.7%
Fortinet12.7%
Vite12.7%

TAdditions by year

CWE-284 KEV additions per yearColumn chart of KEV additions per calendar year. 2021: 6; 2022: 7; 2023: 6; 2024: 6; 2025: 4; 2026: 8.024682021: 6 added620212022: 7 added720222023: 6 added620232024: 6 added620242025: 4 added420252026: 8 added (year to date)82026
CWE-284 KEV additions by year
YearAdded
20216
20227
20236
20246
20254
20268

PProducts

Products with CWE-284 KEV entries
ProductEntriesShare
Microsoft Windows513.5%
Adobe ColdFusion410.8%
Elastic Elasticsearch25.4%
Citrix Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance25.4%
ProFTPD ProFTPD12.7%
Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in12.7%
Joomlack Page Builder12.7%
Ubiquiti UniFi OS12.7%

EAll entries

KEV entries listing CWE-284
CVEVendorProductAddedRansomware
CVE-2015-3306ProFTPDProFTPDUnknown
CVE-2026-81963MicrosoftWindowsUnknown
CVE-2026-21962OracleHTTP Server and Oracle Weblogic Server Proxy Plug-inUnknown
CVE-2026-56290JoomlackPage BuilderUnknown
CVE-2026-34908UbiquitiUniFi OSUnknown
CVE-2026-48907Widget FactoryJoomla Content Editor Unknown
CVE-2026-35616FortinetFortiClient EMSUnknown
CVE-2025-31125ViteVitejsUnknown
CVE-2025-12480GladinetTriofoxUnknown
CVE-2025-33073MicrosoftWindowsUnknown
CVE-2025-59230MicrosoftWindowsUnknown
CVE-2025-24989MicrosoftPower PagesUnknown
CVE-2024-20767AdobeColdFusionUnknown
CVE-2024-45519SynacorZimbra Collaboration Suite (ZCS)Unknown
CVE-2024-27348ApacheHugeGraph-ServerUnknown
CVE-2024-40766SonicWallSonicOSKnown
CVE-2023-7028GitLabGitLab CE/EEUnknown
CVE-2023-23752Joomla!Joomla!Unknown
CVE-2023-24489CitrixContent CollaborationUnknown
CVE-2023-38205AdobeColdFusionUnknown
CVE-2023-29298AdobeColdFusionUnknown
CVE-2016-8735ApacheTomcatUnknown
CVE-2023-27350PaperCutMF/NGKnown
CVE-2023-26360AdobeColdFusionUnknown
CVE-2016-7256MicrosoftWindowsUnknown
CVE-2016-3393MicrosoftWindowsUnknown
CVE-2021-22941CitrixShareFileKnown
CVE-2020-2506QNAP SystemsHelpdeskUnknown
CVE-2015-1427ElasticElasticsearchUnknown
CVE-2014-3120ElasticElasticsearchUnknown
CVE-2022-23134ZabbixFrontendUnknown
CVE-2021-23874McAfeeMcAfee Total Protection (MTP)Unknown
CVE-2020-8196CitrixApplication Delivery Controller (ADC), Gateway, and SD-WAN WANOP ApplianceUnknown
CVE-2020-8193CitrixApplication Delivery Controller (ADC), Gateway, and SD-WAN WANOP ApplianceUnknown
CVE-2019-1653CiscoSmall Business RV320 and RV325 RoutersUnknown
CVE-2016-4437ApacheShiroUnknown
CVE-2016-3715ImageMagickImageMagickUnknown

Cite this

37 CISA KEV entries list CWE-284 (Improper access control), 2.1% of the catalog. Source: KEV Now analysis of the CISA Known Exploited Vulnerabilities catalog, version 2026.10.30 (released 2026-10-30). https://kevnow.com/cwe/cwe-284/

Source: CISA KEV catalog v2026.10.30, released 2026-10-30. Windows end 2026-10-30.

Keyboard shortcuts

Keyboard shortcuts
/Focus search
?Show this panel
EscClose panel or clear search
g dGo to Dashboard
g kGo to KEV
g vGo to Vendors
g pGo to Products
g wGo to Weaknesses
g sGo to Stats
g rGo to Regulations
g bGo to Briefings