KEV 2026.10.301,766 entries+10 in 7d11 open federal deadlinesas of / search ? keys
KEV Now

Weakness / #10

CWE-306: Missing authentication in CISA KEV

Missing Authentication for Critical Function

Catalog
2026.10.30
Rank
#10 of 198
MITRE
CWE-306 definition

Answer 43 KEV entries list CWE-306 (Missing authentication) as of catalog 2026.10.30, 2.4% of the catalog and rank 10 of 198 weaknesses. The most affected vendor is Oracle (4).

A sensitive function can be used without logging in at all.

KEV entries
432.4% of catalog
Vendors
30affected
Ransomware: known
1330.2%
First added
2021-11-03
Latest added
2026-10-30

VVendors

Vendors with CWE-306 KEV entries
VendorEntriesShare
Oracle49.3%
Palo Alto Networks37%
Juniper37%
Microsoft24.7%
Langflow24.7%
Fortinet24.7%
Veeam24.7%
Zoho24.7%
SAP24.7%
Ivanti12.3%
MikroTik12.3%
BerriAI12.3%

TAdditions by year

CWE-306 KEV additions per yearColumn chart of KEV additions per calendar year. 2021: 8; 2022: 5; 2023: 6; 2024: 5; 2025: 6; 2026: 13.0510152021: 8 added820212022: 5 added520222023: 6 added620232024: 5 added520242025: 6 added620252026: 13 added (year to date)132026
CWE-306 KEV additions by year
YearAdded
20218
20225
20236
20245
20256
202613

PProducts

Products with CWE-306 KEV entries
ProductEntriesShare
Juniper Junos OS37%
Oracle E-Business Suite24.7%
Langflow Langflow24.7%
Palo Alto Networks PAN-OS24.7%
Veeam Backup & Replication24.7%
Ivanti Connect Secure12.3%
MikroTik RouterOS12.3%
BerriAI LiteLLM12.3%

EAll entries

KEV entries listing CWE-306
CVEVendorProductAddedRansomware
CVE-2026-111357IvantiConnect Secure NewUnknown
CVE-2026-67277MikroTikRouterOSUnknown
CVE-2026-59822BerriAILiteLLMUnknown
CVE-2026-81578PaperCutNG/MFUnknown
CVE-2026-72529TrueConfServerUnknown
CVE-2026-46817OracleE-Business SuiteUnknown
CVE-2026-56164MicrosoftSharePoint ServerUnknown
CVE-2026-20253SplunkEnterpriseUnknown
CVE-2026-35273Oracle PeopleSoft Enterprise PeopleToolsKnown
CVE-2026-41940WebProscPanel & WHM and WP2 (WordPress Squared)Known
CVE-2026-39987MarimoMarimoUnknown
CVE-2026-33017LangflowLangflowUnknown
CVE-2026-24423SmarterToolsSmarterMailKnown
CVE-2025-61757OracleFusion MiddlewareUnknown
CVE-2025-4008SmartbeddedMeteobridgeUnknown
CVE-2020-24363TP-LinkTL-WA855REUnknown
CVE-2025-32433ErlangErlang/OTPUnknown
CVE-2025-3248LangflowLangflowKnown
CVE-2025-0108Palo Alto NetworksPAN-OSUnknown
CVE-2022-23227NUUONVRmini2 DevicesUnknown
CVE-2023-28461Array Networks AG/vxAG ArrayOSKnown
CVE-2024-0012Palo Alto NetworksPAN-OSKnown
CVE-2024-5910Palo Alto NetworksExpeditionUnknown
CVE-2024-47575FortinetFortiManagerUnknown
CVE-2023-36851JuniperJunos OSUnknown
CVE-2023-36847JuniperJunos OSUnknown
CVE-2023-36846JuniperJunos OSUnknown
CVE-2023-27532VeeamBackup & ReplicationKnown
CVE-2022-24990TerraMasterTerraMaster OSKnown
CVE-2022-21587OracleE-Business SuiteKnown
CVE-2022-26501VeeamBackup & ReplicationKnown
CVE-2022-26925MicrosoftWindowsUnknown
CVE-2022-1388F5BIG-IPKnown
CVE-2022-26143MitelMiCollab, MiVoice Business ExpressUnknown
CVE-2020-13927ApacheAirflow's Experimental APIUnknown
CVE-2021-44077ZohoManageEngine ServiceDesk Plus (SDP) / SupportCenter PlusUnknown
CVE-2021-37415ZohoManageEngine ServiceDesk Plus (SDP)Unknown
CVE-2021-20021SonicWallSonicWall Email SecurityKnown
CVE-2020-6287SAPNetWeaverUnknown
CVE-2020-6207SAPSolution ManagerUnknown
CVE-2020-3952VMwarevCenter ServerUnknown
CVE-2019-9082ThinkPHPThinkPHPUnknown
CVE-2019-5591FortinetFortiOSKnown

Cite this

43 CISA KEV entries list CWE-306 (Missing authentication), 2.4% of the catalog. Source: KEV Now analysis of the CISA Known Exploited Vulnerabilities catalog, version 2026.10.30 (released 2026-10-30). https://kevnow.com/cwe/cwe-306/

Source: CISA KEV catalog v2026.10.30, released 2026-10-30. Windows end 2026-10-30.

Keyboard shortcuts

Keyboard shortcuts
/Focus search
?Show this panel
EscClose panel or clear search
g dGo to Dashboard
g kGo to KEV
g vGo to Vendors
g pGo to Products
g wGo to Weaknesses
g sGo to Stats
g rGo to Regulations
g bGo to Briefings