What is Top Findings 2026?

Top Findings 2026 is a list of security weaknesses that commonly show up during penetration tests and security assessments. Each finding is a real-world condition that makes attacks easier, such as weak passwords, missing patches, or risky default settings.

On this site, these findings are tagged on the Backdoors & Breaches card documentation pages, so you can see which findings make each attack possible and find the labs that help you understand, exploit, or fix them.

The findings are grouped into the following categories:

Passwords & Authentication

• Weak Password Policy - Password rules (length, complexity, lockout) are too weak, or applications and exceptions bypass the main policy.
• MFA Not Required - Logins to email, VPN, cloud, or other services don't require multi-factor authentication.
• Password Reuse - The same password is used across multiple accounts or systems, so one compromise unlocks many.
• Default Credentials - Devices or applications still use the vendor's default username and password.
• Cleartext Passwords - Passwords are stored unencrypted anywhere, such as in scripts, files, shares, or configuration.
• Missing Authentication - A service or interface can be accessed without logging in at all.

Active Directory

• ADCS Weak Templates - Active Directory Certificate Services web enrollment or certificate templates allow low-privileged users to request certificates they can abuse.
• KRBTGT Password Age - The KRBTGT account password hasn't been rotated in a long time, extending the life of forged Kerberos tickets.
• Protected Users Missing - Privileged accounts aren't members of the Protected Users group, leaving their credentials easier to steal and reuse.
• Machine Account Quota - Regular users can create computer accounts in the domain, a common building block for AD attacks.
• LDAP Signing Not Enforced - LDAP signing and related protections aren't required, allowing relay and tampering attacks.

Network & SMB

• SMB Signing Not Required - Systems don't require SMB signing, allowing NTLM relay attacks.
• SMBv1 Enabled - The outdated and vulnerable SMB version 1 protocol is still enabled.
• SMB Null Sessions - SMB allows anonymous (null) sessions that expose information about users, shares, and the domain.
• Insecure Name Resolution - Protocols like LLMNR, NBT-NS, and mDNS are enabled, letting attackers poison name lookups and capture credentials.
• Sensitive Service Exposed - Management interfaces or sensitive services are reachable from networks that shouldn't have access.
• Insufficient Egress Filtering - Outbound traffic isn't restricted, making command and control and data exfiltration easy.
• SNMP Default Community Strings - SNMP uses default community strings like "public" or "private," exposing device information or configuration.
• IPMI Hash Disclosure - IPMI allows password hashes to be retrieved remotely and cracked offline.

Patching & Configuration

• Unpatched Software - Software or operating systems are missing patches, unsupported, or out of date.
• TLS Weaknesses - Services use weak, outdated, or misconfigured TLS, including bad certificates and old protocol versions.
• Unencrypted Sensitive Data - Sensitive data is sent over the network without encryption.
• Weak SSH Configuration - SSH servers allow weak algorithms, outdated versions, or risky authentication settings.
• Weak RDP Configuration - Remote Desktop is configured insecurely, such as without Network Level Authentication or with weak encryption.

Endpoint & Application Control

• Missing Application Control - There are no allowlisting controls (like AppLocker or WDAC) stopping users from running unapproved programs.
• Abused Admin Utilities - Users can run built-in tools commonly abused by attackers, such as PowerShell, WMIC, or PsExec-style utilities.
• WinGet App Installation - Users can install software through the Windows Package Manager (WinGet) without approval.
• Microsoft Store Accessible - Users can install apps from the Microsoft Store without approval.
• Weak NTFS/Share Permissions - File system or network share permissions give users more access than they need.

Cloud

• Azure Portal Accessible - Regular users can access the Azure portal and browse tenant information.

How These Tags Are Used

Each finding is tagged as "Finding: Name", for example "Finding: Password Reuse." These tags currently appear on the B&B card documentation pages only, right after the card type and card name, and only where the finding directly enables the attack on that card.