Skip to content
Exploit Radar Choose my productsProducts My radar

Products › IT administration and security

IT administration and security

Identity and access

Directories, single sign-on, access management and privileged account management.

For example: Active Directory, AD FS, Cisco ISE, Workspace ONE Access.

Category RSS feed

Affected brands

In alphabetical order, with their number of vulnerabilities in this category.

A high count also reflects how widely a product is deployed and how much attackers care about it: it is not a security rating.

See also

Patch first

In the order of the main list (Patch first): recent additions first, then the most severe. The number is the rank within this category.

  1. Rank 1

    Cisco Identity Services Engine (ISE)CVE-2026-76460

    Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability

    Recently addedHunt for compromise (CISA)

    CVSS severity 10.0critical

    Added Sep 16, 2026

  2. Rank 2

    Oracle Identity and Access Management (OIM / OAM)CVE-2025-61757

    Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability

    CVSS severity 9.8critical

    Added Nov 21, 2025

  3. Rank 3

    Microsoft AD FSCVE-2026-56155

    Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability

    CVSS severity 7.8high

    Added Jul 14, 2026

  4. Rank 4

    Cisco Identity Services Engine (ISE)CVE-2025-20281

    Cisco Identity Services Engine Injection Vulnerability

    CVSS severity 10.0critical

    Added Jul 28, 2025

  5. Rank 5

    Cisco Identity Services Engine (ISE)CVE-2025-20337

    Cisco Identity Services Engine Injection Vulnerability

    CVSS severity 10.0critical

    Added Jul 28, 2025

  6. Rank 6

    Microsoft Active DirectoryCVE-2020-1472

    Microsoft Netlogon Privilege Escalation Vulnerability

    Ransomware

    CVSS severity 10.0critical

    Added Nov 3, 2021

  7. Rank 7

    Netwrix AuditorCVE-2022-31199

    Netwrix Auditor Insecure Object Deserialization Vulnerability

    Ransomware

    CVSS severity 9.8critical

    Added Jul 11, 2023

  8. Rank 8

    Oracle Identity and Access Management (OIM / OAM)CVE-2021-35587

    Oracle Fusion Middleware Unspecified Vulnerability

    CVSS severity 9.8critical

    Added Nov 28, 2022

  9. Rank 9

    ManageEngine (Zoho) PAM360 / Password Manager ProCVE-2022-35405

    Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability

    CVSS severity 9.8critical

    Added Sep 22, 2022

  10. Rank 10

    VMware (Broadcom) Workspace ONE Access / Identity ManagerCVE-2022-22954

    VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability

    Ransomware

    CVSS severity 9.8critical

    Added Apr 14, 2022

Show 14 more vulnerabilities
  1. Rank 11

    Cisco Secure Access Control System (ACS)CVE-2018-0147

    Cisco Secure Access Control System Java Deserialization Vulnerability

    CVE from 2018, added in 2022

    CVSS severity 9.8critical

    Added Mar 25, 2022

  2. Rank 12

    Atlassian CrowdCVE-2019-11580

    Atlassian Crowd and Crowd Data Center Remote Code Execution Vulnerability

    RansomwareCVE from 2019, added in 2021

    CVSS severity 9.8critical

    Added Nov 3, 2021

  3. Rank 13

    ForgeRock Access Management (AM)CVE-2021-35464

    ForgeRock Access Management (AM) Core Server Remote Code Execution Vulnerability

    Ransomware

    CVSS severity 9.8critical

    Added Nov 3, 2021

  4. Rank 14

    ManageEngine (Zoho) ADSelfService PlusCVE-2021-40539

    Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability

    Ransomware

    CVSS severity 9.8critical

    Added Nov 3, 2021

  5. Rank 15

    VMware (Broadcom) Workspace ONE Access / Identity ManagerCVE-2020-4006

    Multiple VMware Products Command Injection Vulnerability

    CVSS severity 9.1critical

    Added Nov 3, 2021

  6. Rank 16

    Microsoft Active DirectoryCVE-2022-26923

    Microsoft Active Directory Domain Services Privilege Escalation Vulnerability

    CVSS severity 8.8high

    Added Aug 18, 2022

  7. Rank 17

    Microsoft Active DirectoryCVE-2021-42287

    Microsoft Active Directory Domain Services Privilege Escalation Vulnerability

    Ransomware

    CVSS severity 8.8high

    Added Apr 11, 2022

  8. Rank 18

    Microsoft Active DirectoryCVE-2014-6324

    Microsoft Kerberos Key Distribution Center (KDC) Privilege Escalation Vulnerability

    CVE from 2014, added in 2022

    CVSS severity 8.8high

    Added Mar 25, 2022

  9. Rank 19

    VMware (Broadcom) Workspace ONE Access / Identity ManagerCVE-2022-22960

    VMware Multiple Products Privilege Escalation Vulnerability

    CVSS severity 7.8high

    Added Apr 15, 2022

  10. Rank 20

    Microsoft Active DirectoryCVE-2021-42278

    Microsoft Active Directory Domain Services Privilege Escalation Vulnerability

    Ransomware

    CVSS severity 7.5high

    Added Apr 11, 2022

  11. Rank 21

    OpenText (Micro Focus) Access Manager (NetIQ)CVE-2021-22506

    Micro Focus Access Manager Information Leakage Vulnerability

    CVSS severity 7.5high

    Added Nov 3, 2021

  12. Rank 22

    ManageEngine (Zoho) ADSelfService PlusCVE-2022-28810

    Zoho ManageEngine ADSelfService Plus Remote Code Execution Vulnerability

    CVSS severity 6.8medium

    Added Mar 7, 2023

  13. Rank 23

    Twilio AuthyCVE-2024-39891

    Twilio Authy Information Disclosure Vulnerability

    CVSS severity 5.3medium

    Added Jul 23, 2024

  14. Rank 24

    Oracle Identity and Access Management (OIM / OAM)CVE-2012-0518

    Oracle Fusion Middleware Unspecified Vulnerability

    CVE from 2012, added in 2022

    CVSS severity 4.7medium

    Added Mar 28, 2022

Filed under another category

These 8 vulnerabilities also concern this type of product, but are counted in their main category. My radar finds them when you follow this category.

  1. BeyondTrust Remote Support / Privileged Remote Access (RS / PRA)CVE-2026-1731

    BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection Vulnerability

    Ransomware

    CVSS severity 9.8critical

    Added Feb 13, 2026

  2. BeyondTrust Remote Support / Privileged Remote Access (RS / PRA)CVE-2024-12356

    BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) Command Injection Vulnerability

    CVSS severity 9.8critical

    Added Dec 19, 2024

  3. Microsoft WindowsCVE-2014-1812

    Microsoft Windows Group Policy Preferences Password Privilege Escalation Vulnerability

    RansomwareCVE from 2014, added in 2021

    CVSS severity 8.8high

    Added Nov 3, 2021

  4. Microsoft WindowsCVE-2021-36942

    Microsoft Windows Local Security Authority (LSA) Spoofing Vulnerability

    Ransomware

    CVSS severity 7.5high

    Added Nov 3, 2021

  5. BeyondTrust Remote Support / Privileged Remote Access (RS / PRA)CVE-2024-12686

    BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) OS Command Injection Vulnerability

    CVSS severity 7.2high

    Added Jan 13, 2025

Show 3 more vulnerabilities

  1. Microsoft WindowsCVE-2024-43451

    Microsoft Windows NTLMv2 Hash Disclosure Spoofing Vulnerability

    CVSS severity 6.5medium

    Added Nov 12, 2024

  2. Microsoft WindowsCVE-2022-26925

    Microsoft Windows LSA Spoofing Vulnerability

    CVSS severity 5.9medium

    Added Jul 1, 2022

  3. Microsoft WindowsCVE-2025-24054

    Microsoft Windows NTLM Hash Disclosure Spoofing Vulnerability

    CVSS severity 5.4medium

    Added Apr 17, 2025

Follow and verify

Get new vulnerabilities in this category: RSS feed (add it to Outlook, Teams, Slack or your feed reader).

Indicative classification, based on the vendor and product names given by CISA. How products are classified.