Patch Tuesday and authentication bypass risk: why old CVEs still matter

At a glance

What this is: Expel argues that May 2026 Patch Tuesday still leaves teams exposed because old authentication bypass flaws, exposed management interfaces, and privileged access paths remain attractive to attackers.

Why it matters: IAM and security teams need to treat patching, management surface exposure, and privileged account scope as one governance problem, because bypasses and elevation paths often matter more than fresh CVE headlines.

By the numbers:

• Microsoft’s May 2026 Patch Tuesday addresses 137 CVEs with no zero days.
• Microsoft labeled 16 of the May 2026 vulnerabilities as critical.

Context

Patch management is not just a vulnerability-count exercise. The real security question is whether exposed management planes, authenticated elevation paths, and stale attack surfaces are still reachable when a patch cycle lands.

This article sits at the intersection of vulnerability operations and identity governance because the most damaging issues are not always unauthenticated remote bugs. Authentication bypass, privileged role misuse, and post-compromise elevation turn ordinary admin paths into control-plane risk.

The Windows, SharePoint, DNS Client, and Fortinet examples show a familiar pattern: once an attacker reaches a trusted interface, the remaining barrier is often weak privilege separation rather than a lack of available patches.

Key questions

Q: What breaks when a security management interface has an authentication bypass?

A: When a security management interface bypasses authentication, attackers may reach the control layer that configures enforcement, policy, and access decisions. That can be worse than a single application compromise because the attacker can change how protection works across multiple systems. Organisations should treat the management plane as a privileged asset with separate access controls, monitoring, and segmentation.

Q: Why do old CVEs still matter when a new Patch Tuesday arrives?

A: Old CVEs still matter because attackers automate what already works. A public proof of concept, an exposed device, and weak segmentation can keep an older flaw operational long after disclosure. Teams should prioritise exploitability in production, not just the novelty of the bulletin.

Q: How can teams tell when a vulnerability is likely to enable privilege escalation?

A: Look for flaws that expose memory layout, require authenticated access, allow remote code execution, or sit near administrative trust paths such as update services and management planes. Those conditions often indicate that a low-level defect can become SYSTEM-level access or broader lateral movement if exploited.

Q: When should teams prioritise an older CVE over newer patch work?

A: Prioritise the older CVE when it is externally reachable, has proof of concept code, and affects a privileged management surface or identity control path. Age matters less than exploitability and blast radius. A year-old bypass on an internet-facing appliance can be more urgent than a newer flaw hidden behind stronger compensating controls.

Technical breakdown

Why authentication bypass changes the attack path

Authentication bypass removes the control that should separate an exposed management surface from privileged action. In practice, it lets an attacker skip the login boundary and reach administrative functions, API operations, or code execution paths that were assumed to be reachable only by trusted users. That is why bypass flaws are so dangerous in VPN, firewall, and endpoint-management products: they collapse the normal sequence of authenticate, authorise, then act. Once the barrier is gone, the rest of the platform often behaves as if the request is legitimate. The risk is amplified when the interface is internet-facing or when the product controls access to other systems.

Practical implication: Treat any authenticated management plane as a high-value control point and remove internet exposure wherever possible.

How privilege escalation and remote code execution differ in impact

Privilege escalation and remote code execution are different failure modes, but both can convert a contained issue into a full system compromise. Elevation of privilege means the attacker starts with some access and gains stronger rights, such as SYSTEM or super-admin. Remote code execution means the attacker can make the target run arbitrary commands, which may then lead to privilege gain, persistence, or lateral movement. In Microsoft’s May 2026 set, the RDS issue is an elevation path, while the SharePoint and DNS Client issues are execution paths. From a defender’s perspective, both matter because either one can become the first step in a deeper compromise chain.

Practical implication: Prioritise any flaw that can cross from low trust to admin-level execution, even if the vendor rates exploitation as less likely.

Why stale CVEs still matter in automated exploit stacks

Older vulnerabilities stay useful when attackers industrialise exploitation. A public proof of concept, a reusable script, or a known device class with weak segmentation can keep an issue active long after disclosure. That is especially true for authentication bypass flaws, because once the barrier is removed the attacker can automate account creation, API abuse, policy changes, and backdoor setup. Security teams often focus on the newest patch cycle while leaving older, already-understood weaknesses exposed. The article’s Fortinet example shows why that is a governance failure: the age of the CVE does not matter if the attack path still exists in production.

Practical implication: Track exploitability and exposure together, not just patch dates, because older CVEs can remain the shortest path to compromise.

Threat narrative

Attacker objective: The attacker wants trusted administrative control over infrastructure so they can change policy, maintain access, and open a path to broader compromise.

1. Entry occurs when attackers target internet-exposed management interfaces or leverage a public proof of concept against a vulnerable Fortinet device.
2. Credential and privilege barriers are bypassed or escalated, allowing the attacker to gain super-administrator rights or act through trusted admin functions.
3. The attacker modifies device settings, creates new administrative access, and prepares backdoor traffic that can support persistence or later movement.
4. Impact is contained when segmentation blocks access beyond the guest network, but the same path would support broader compromise if the management plane were reachable.

Breaches seen in the wild

• LiteLLM MCP auth bypass 2026: An exploited LiteLLM MCP auth bypass and default sk-1234 master keys let attackers steal AI gateway master and provider API keys.
• Gladinet Hard-Coded Keys RCE Exploitation: Actively exploited hard-coded keys in Gladinet CentreStack and Triofox enable remote code execution.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Authentication bypass is a governance failure, not just a patching issue. When a management plane can be reached without proper authentication, the control boundary has already failed. For IAM and PAM teams, the real question is whether administrative functions are isolated enough that a bypass does not become immediate privileged access. Practitioners should treat exposed admin surfaces as trust breaks, not routine vulnerabilities.

Residual risk is now the dominant patching problem. New CVEs matter, but older exploitable issues often remain the most operationally useful to attackers because they are already weaponised. That means remediation programmes must rank exposure, exploit automation, and privilege reach together. The patch backlog is only part of the risk picture.

Control-plane exposure should be treated as an identity problem as much as a network problem. Fortinet-style bypasses and privileged account creation show how quickly an infrastructure flaw becomes an access governance issue. Once attackers can create accounts, change roles, or alter policy, the failure has moved into identity control territory. Exposed management plane risk: that is the specific failure mode this article illustrates, and it demands tighter lifecycle control over every administrative entry point.

Segmentation still matters because it limits the value of a successful bypass. The incident described in the article had low downstream impact because the compromised device sat in a guest network and did not reach production. That outcome is not luck so much as architectural containment. Where segmentation is weak, the same initial compromise can become enterprise-wide movement.

Attacker automation now outpaces manual prioritisation. Public PoC code and repeatable scripts mean exploitation may persist long after a vendor advisory. Security teams need a model that treats exploitability windows, not disclosure dates, as the core metric for urgency. Patch ordering must reflect where attackers can actually convert access into control.

What this signals

Exposed control planes now behave like identity systems. When a firewall, VPN, or management console can be bypassed, the failure is not just technical availability. It becomes a question of who can create, elevate, or alter privileged access, which is why administrative surfaces need the same scrutiny as human and non-human identity entry points.

Residual vulnerability windows are becoming the more important metric. The operational issue is not whether a CVE is old or new, but whether it is still reachable in a production path that attackers can automate. That is especially true for internet-facing admin surfaces, where a public proof of concept can outlive the disclosure cycle.

Exposed management interfaces, privileged account creation, and network segmentation form one control story. Teams that treat these as separate workstreams miss how attackers chain them together. The governance move is to close the entry point, limit the authority reachable from it, and ensure one compromised host cannot become a stepping stone.

For practitioners

• Harden management interfaces Remove direct internet exposure from VPN, firewall, and endpoint-management consoles, and restrict admin access to controlled networks and jump paths.
• Prioritise bypass and elevation paths Rank authentication bypass, privileged elevation, and code execution issues ahead of low-impact CVEs when they can reach trusted admin surfaces.
• Review privileged account creation paths Audit whether vulnerable platforms can create new super-admins, API users, or delegated roles without strong approval and monitoring.
• Segment attacker reach Use network segmentation to prevent compromise of one management host from becoming a route into production systems or other subnets.
• Track exploitability, not just age Maintain a list of older CVEs that remain in active exploit stacks, especially when public proof-of-concept code is already circulating.

Key takeaways

• Authentication bypass on management interfaces can turn a routine vulnerability into a privileged control-plane compromise.
• Expel’s analysis highlights that Microsoft’s May 2026 Patch Tuesday includes 137 CVEs, but older Fortinet issues and reachable admin surfaces remain the practical concern.
• The strongest limit on attacker impact is not patching alone but segmentation, restricted administration, and fast removal of exposed privileged paths.

Key terms

• Authentication bypass: An authentication bypass is a flaw that lets a requester reach protected functionality without completing the intended identity check. In practice, it turns the application’s login boundary into a broken assumption, so any exposure path in front of that application becomes materially more important.
• Privilege Escalation: An attack technique where a compromised identity, often an NHI with initially limited permissions, exploits vulnerabilities or misconfigurations to gain elevated access rights, typically leading to broader compromise.
• Control plane exposure: A condition where the interface used to configure, direct, or invoke a system becomes reachable beyond its intended boundary. For non-human identities and agents, exposed control planes can turn a local helper into an externally reachable privileged service.
• Residual Risk: Residual risk is the risk that remains after controls are applied. In identity-heavy environments, it often reflects over-permissioning, stale accounts, and exceptions that were accepted but never truly removed, which means the real exposure can be higher than the documented policy baseline.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps security practitioners connect identity controls to privileged access and lifecycle risk across modern environments.