Patch Tuesday and authentication bypass risk: why old CVEs still matter

At a glance

What this is: This is Expel’s analysis of May 2026 Patch Tuesday and active authentication bypass risk, with the central finding that older, exposed vulnerabilities can be more operationally dangerous than fresh CVEs.

Why it matters: It matters because IAM and PAM teams must treat privileged access paths, management interfaces, and service-admin credentials as attack surfaces, not just patch targets.

By the numbers:

• Microsoft’s May 2026 Patch Tuesday addresses 137 CVEs and includes 16 classified as critical.
• CVE-2026-35616 carries a CVSS score of 9.1 because it bypasses API authentication and can execute arbitrary commands on FortiClient EMS endpoints.
• CVE-2026-41096 at CVSS 9.8, 1096 at CVSS 9.8, even while labelling exploitation unlikely.
• CVE-2024-55591 enabled super-administrator access on a FortiGate device in Expel’s incident response case.

👉 Read Expel’s May 2026 Patch Tuesday analysis and Fortinet bypass findings

Context

Patch management fails when organisations treat severity as the only decision variable. In practice, authenticated privilege escalation, authentication bypass, and exposed management interfaces often create a faster path to impact than headline-grabbing new vulnerabilities, especially when administrators and service users already hold powerful access.

This article also has a clear identity angle because the attack paths depend on privileged accounts, management credentials, and administrative roles. That makes it relevant to IAM and PAM teams, not just patch and vulnerability management owners.

Expel’s incident example is typical of the broader problem: when a device is reachable, over-privileged, and insufficiently segmented, attackers can turn a single bypass into device control with very little noise.

Key questions

Q: What breaks when a security management interface has an authentication bypass?

A: When a security management interface bypasses authentication, attackers may reach the control layer that configures enforcement, policy, and access decisions. That can be worse than a single application compromise because the attacker can change how protection works across multiple systems. Organisations should treat the management plane as a privileged asset with separate access controls, monitoring, and segmentation.

Q: When should teams prioritise an older CVE over newer patch work?

A: Prioritise the older CVE when it is externally reachable, has proof of concept code, and affects a privileged management surface or identity control path. Age matters less than exploitability and blast radius. A year-old bypass on an internet-facing appliance can be more urgent than a newer flaw hidden behind stronger compensating controls.

Q: What do security teams get wrong about severity-based patching?

A: They often assume a high score means equal urgency everywhere. In practice, exploitability depends on reachability, authentication, and the configuration actually deployed in your environment. A lower-scoring vulnerability on a privileged or internet-facing asset may be more dangerous than a higher-scoring flaw on an isolated system.

Q: Who is accountable when privileged management access is used to disrupt endpoints?

A: Accountability sits with the organisation that granted and governed the privileged access, not just the attacker who abused it. IAM, PAM, endpoint engineering, and security operations all share responsibility for role scope, session trust, and command gating. Frameworks such as NIST CSF and OWASP NHI are relevant because they connect access governance to operational resilience.

Technical breakdown

Why authentication bypass is an early-stage control failure

Authentication bypass is not just a login bug. It removes the control point that is supposed to separate unauthorised traffic from trusted administration, which means an attacker can move straight into the control plane of a device or application. On network appliances, VPN portals, and management consoles, that often turns a perimeter control into an execution path. Once that trust boundary is broken, downstream controls such as logging, role checks, and conditional access may never get a chance to work.

Practical implication: expose management interfaces only through tightly controlled administrative paths and isolate them from general network reachability.

Why privilege escalation turns compromise into takeover

Privilege escalation becomes decisive when an attacker already has a foothold and only needs a small control weakness to reach administrative rights. In Windows environments, authenticated elevation flaws can move an attacker from low-privilege code execution to SYSTEM-level control. In appliance and SaaS-admin environments, the same logic applies when a bypass or role abuse grants super-admin privileges, account creation, or API-level control. At that point, the problem is no longer access, but governance of what that access can change.

Practical implication: map high-risk accounts and roles to PAM controls, session restrictions, and change monitoring before patching windows open wider.

How segmented exposure limits the blast radius of a bypass

Network segmentation does not prevent exploitation, but it can stop a compromised management device from becoming an enterprise-wide incident. If a vulnerable appliance sits inside a guest segment with no direct route to production, attacker movement can be contained and lateral movement attempts become easier to detect. This is where identity and network controls intersect: even if an attacker acquires privileged access on one system, the reachable trust graph determines whether that access becomes a local event or a broad compromise.

Practical implication: place administrative systems in isolated segments and verify that privileged access cannot traverse into production without explicit controls.

Threat narrative

Attacker objective: The attacker wants durable administrative control over a vulnerable management plane so they can expand access, evade detection, and pivot deeper into the environment.

1. Entry occurs when attackers use authentication bypass or exploit a public proof of concept against an exposed management interface or vulnerable appliance.
2. Escalation follows when the bypass yields elevated device control, super-administrator rights, or authenticated code execution on the target.
3. Impact comes when the attacker creates new admin accounts, alters VPN or firewall policy, and attempts lateral movement beyond the initial device.

Breaches seen in the wild

• Gravity SMTP CVE-2026-4020 API Keys Exposure — CVE-2026-4020 in Gravity SMTP exposes API keys via single HTTP request across 100,000 WordPress sites.
• Gladinet Hard-Coded Keys RCE Exploitation — Actively exploited hard-coded keys in Gladinet CentreStack and Triofox enable remote code execution.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Authentication bypass is an identity control failure, not just a software flaw. When a management interface accepts traffic without properly verifying the caller, the security boundary collapses before IAM or PAM can enforce role, session, or audit controls. That is why bypass vulnerabilities belong in the same governance conversation as privileged access and service account exposure. Practitioners should treat exposed admin surfaces as identity gateways, not generic endpoints.

Standing administrative reach creates the real blast radius. The article’s Fortinet example shows how a single compromised device can become a platform for account creation, policy manipulation, and hidden backdoor paths. This is a classic case of governance debt where persistent administrative reach outlives the event that justified it. Teams should focus on where privileged reach remains standing rather than where the latest CVE appears.

Management plane exposure gap: this is the failure mode that lets attackers turn an external bypass into device ownership. The issue is not only the bug itself, but the fact that management interfaces are often reachable, role-rich, and lightly segmented. Once that gap exists, attack automation can convert old CVEs into reliable entry points. Practitioners should prioritise shrinking the reachable management plane before relying on patch cadence alone.

Patch priority without exposure control is incomplete governance. Expel’s analysis reinforces that older CVEs remain operationally relevant when attackers can script them against internet-facing assets. The better control model combines vulnerability remediation with identity-aware access restrictions, device segmentation, and privileged session visibility. That means security teams should measure whether a device can still be reached, not just whether it has been patched.

IAM and PAM teams have a direct role in appliance risk. When devices expose super-admin creation, REST API users, or high-impact policy changes, the security problem includes identity lifecycle, not just endpoint hygiene. Role governance, account review, and administrative path isolation all matter here. Practitioners should fold management appliances into privileged identity governance and not leave them outside the access model.

From our research:

• 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, according to 2024 ESG Report: Managing Non-Human Identities.
• Two-thirds of enterprises have endured a successful cyberattack resulting from compromised non-human identities, with a quarter encountering multiple attacks.
• If privileged management access is part of the attack path, the next step is lifecycle control. Read the Ultimate Guide to NHIs for rotation, offboarding, and visibility guidance.

What this signals

Management-plane exposure is becoming an identity governance issue, not just a vulnerability issue. Teams that own IAM, PAM, and device administration need a shared view of where administrative reach is still standing, because exposed console paths turn patching into only one part of the fix.

Privileged path isolation will matter more as attackers automate older CVEs. The operational signal is simple: if a compromised appliance cannot reach production, the incident is containable. If it can, patch lag becomes a business risk rather than a technical backlog item.

For practitioners

• Remove direct internet exposure from management surfaces Place VPN, firewall, and appliance consoles behind restricted administrative networks, jump hosts, or strong conditional access so authentication bypasses cannot be reached from the public internet.
• Review super-admin and REST API account creation paths Audit every device and platform that can create high-privilege users or API accounts, then alert on new administrative identities, policy edits, and logging changes.
• Treat old bypass CVEs as active risk Prioritise remediation for publicly exploited authentication bypass flaws even when they are older than the latest Patch Tuesday cycle, especially on exposed appliances and edge systems.
• Constrain lateral movement from segmented assets Validate that guest, lab, and management segments cannot reach production trust boundaries without explicit approval and monitoring, and test that separation routinely.

Key takeaways

• This article shows that authentication bypass is dangerous because it removes the trust gate before privileged access controls can even engage.
• The practical evidence is clear: exposed management devices and old CVEs still produce real compromise paths, especially when attackers can automate them.
• The strongest reduction in risk comes from combining patching with management-plane isolation, privilege governance, and tighter control of administrative identities.

Key terms

• Authentication bypass: An authentication bypass is a flaw that lets a requester reach protected functionality without completing the intended identity check. In practice, it turns the application’s login boundary into a broken assumption, so any exposure path in front of that application becomes materially more important.
• Management Plane: The administrative layer used to configure, govern, and enforce behaviour across many endpoints or services. A management plane is not the workload itself. It is the control layer above it, which makes it especially sensitive to privileged misuse and delegated automation.
• Privileged Access: Privileged access is any elevated entitlement that can change systems, data, or security settings. When privilege is excessive or poorly scoped, a single compromised identity can create outsized blast radius across environments.

What's in the full article

Expel's full analysis covers the operational detail this post intentionally leaves for the source:

• Device-level exploitation notes for the specific Windows and Fortinet CVEs discussed in the patch roundup
• The incident timeline showing how the FortiGate compromise progressed from bypass to super-admin control
• The response details that explain how segmentation contained the attack and where detection occurred
• The practical patching and exposure-management recommendations Expel applies to internet-facing management systems

👉 The full Expel post covers the patch priorities, exploit behavior, and containment lesson in more operational detail.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners connect identity lifecycle controls to the broader programmes they already run.