API Security Statistics 2026
By Axis Intelligence Research
Co-author: Marcus Chen (Cybersecurity) | Last updated: September 24, 2026 | License: CC BY 4.0
Authentication and authorization flaws made up 21.5% of all vulnerabilities CISA added to its Known Exploited Vulnerabilities catalog between January 1 and September 22, 2026, up from 12.6% in the same window of 2025, according to Axis Intelligence Research’s Broken-Access Exploitation Ratio (BAXR). That is 51 actively exploited access-control flaws, against 22 a year earlier.
Quick Answer
APIs are now the most-exploited layer of the enterprise, and the weak point is who gets let in. According to Axis Intelligence Research, the share of confirmed-exploited vulnerabilities rooted in broken authentication or authorization hit 21.5% in 2026 to date, the highest reading in a 2021–2026 series. Akamai reports daily API attacks per organization rose 113%, and Wallarm found 43% of 2025’s new KEV entries were API-related.
Key Findings
- Axis Intelligence Research finds that 21.5% of CISA KEV additions in 2026 (Jan 1–Sep 22) are access-control flaws, the highest BAXR reading since 2021.
- Axis Intelligence Research finds that CISA added 51 exploited authentication or authorization flaws to KEV by September 22, 2026, 2.32 times the 22 added in the same 2025 window.
- Axis Intelligence Research finds that exploited authentication-class flaws in 2026 (36 through September 22) already exceed the full 2025 total (22) by 63.6%.
- Axis Intelligence Research finds that 27.2% of access-control entries in CISA’s KEV catalog carry a known-ransomware flag, versus 20.9% across the whole catalog.
- According to Akamai’s 2026 State of the Internet report, the average organization faced 258 API attacks per day in 2025, up 113% from 121 in 2024.
How Many Organizations Had an API Security Incident in 2026?
It depends on who is asking, and the gap is itself the story. Two major 2026 surveys measured the same thing and landed 55 percentage points apart.
| Metric | Value | Period | Sample | Source |
|---|---|---|---|---|
| Orgs reporting an API-related security incident | 87% | 2025 | Akamai SOTI survey | Akamai, March 17, 2026 |
| Orgs reporting an API security incident, past 12 months | 32% | Early 2026 | 327 security professionals | Salt Security 1H 2026 |
| Gap between the two readings | 55 pts | 2025–2026 | Axis calculation (87 − 32) | Axis Intelligence Research |
Axis Intelligence Research does not average these. Akamai and Salt use different samples and different definitions of “incident”; a blended number would describe no real population. Read them as a range: somewhere between one in three and nearly nine in ten organizations logged an API incident in the last year, and the breadth of that range tells you incident definitions in this market are not standardized.
What Is Driving API Growth — and the Attack Surface?
- 66% of organizations saw their API count grow by more than 50% in a year (Salt Security 1H 2026).
- Only 24% maintain a fully automated API inventory (Salt Security 1H 2026).
- 83.2% of respondents have adopted an API-first approach at some level, and 64.5% of organizations generate revenue from APIs (Postman 2025 State of the API Report, n > 5,700).
- 47% delayed a production release over API security concerns (Salt Security 1H 2026).
Marcus Chen: Two-thirds of companies grew their API estate by half in a year, and three-quarters can’t list it automatically. That’s the unglamorous entry point. Nobody breaks into the API you documented; they walk through the shadow endpoint that the last sprint shipped and the inventory never saw.
How Many API Attacks Happen Per Day?
According to Akamai’s 2026 State of the Internet (SOTI) research, the average number of daily API attacks per organization rose 113% year over year. Coverage of the report by Infosecurity Magazine puts the underlying figures at 258 attacks per day in 2025, up from 121 in 2024. Axis Intelligence Research re-ran the math: (258 ÷ 121 − 1) × 100 = 113.2%, consistent with Akamai’s headline.
| Metric | 2024 | 2025 | Change | Source |
|---|---|---|---|---|
| Daily API attacks per organization | 121 | 258 | +113% | Akamai SOTI 2026 (figures via Infosecurity Magazine) |
| API attacks involving unauthorized workflows / abnormal activity | 30% | 61% | +31 pts | Akamai SOTI 2026 (via Infosecurity Magazine) |
| Layer 7 DDoS attacks | — | — | +104% over two years | Akamai SOTI 2026 |
| Web application attacks | — | — | +73% (2023→2025) | Akamai SOTI 2026 |
What Share of Bot Attacks Target APIs?
The Thales 2026 Bad Bot Report found 27% of bot attacks now target APIs, bots make up 53% of web traffic, and 40% of bot traffic is malicious. From those two same-dataset inputs, Axis Intelligence Research estimates that malicious bots account for roughly 21.2% of all web traffic (53% × 40%). Financial services absorbed 24% of all bot attacks (Thales).
Marcus Chen: Akamai’s most important number isn’t the 113%. It’s the jump from 30% to 61% of attacks involving unauthorized workflows. Volume is noise a WAF can rate-limit. Workflow abuse is an attacker using a valid session to do something the business logic never intended — API6 in the OWASP list — and no signature catches that.
Which API Vulnerabilities Are Actually Being Exploited? (The BAXR Index)
Surveys tell you what security teams feel. CISA’s Known Exploited Vulnerabilities catalog tells you what attackers did: every entry has confirmed in-the-wild exploitation. Axis Intelligence Research built the Broken-Access Exploitation Ratio (BAXR) to track one question over time: what share of confirmed-exploited flaws are failures of authentication or authorization?
Those two classes map directly onto four of the OWASP API Security Top 10 (2023): API1 Broken Object Level Authorization, API2 Broken Authentication, API3 Broken Object Property Level Authorization and API5 Broken Function Level Authorization.
BAXR = (KEV additions whose CWE falls in the authentication or authorization set ÷ all KEV additions in the period) × 100
BAXR Readings, 2021–2026
| Year | KEV additions | Authentication-class | Authorization-class | Access-control (union) | BAXR |
|---|---|---|---|---|---|
| 2021 | 311 | 17 | 15 | 32 | 10.3% |
| 2022 | 555 | 15 | 19 | 34 | 6.1% |
| 2023 | 187 | 15 | 13 | 28 | 15.0% |
| 2024 | 186 | 20 | 12 | 32 | 17.2% |
| 2025 | 245 | 22 | 14 | 36 | 14.7% |
| 2026 (Jan 1–Sep 22) | 237 | 36 | 17 | 51 | 21.5% |
| 2025 (Jan 1–Sep 22), same window | 175 | — | — | 22 | 12.6% |
Source: Axis Intelligence Research analysis of the CISA KEV catalog, version 2026.09.22, retrieved September 23, 2026. A single entry can carry both an authentication and an authorization CWE, so the union can be smaller than the sum.
Which Weaknesses Drive the 2026 Surge?
Among the 51 access-control entries added in 2026, the most frequent CWEs were CWE-287 Improper Authentication (16), CWE-306 Missing Authentication for Critical Function (12), CWE-288 Authentication Bypass Using an Alternate Path (8) and CWE-284 Improper Access Control (7). CWE-306 alone appeared in 12 KEV additions in 2026 to date, double the 6 of full-year 2025.
The pace is accelerating inside the year: 24 of the 51 2026 access-control additions landed between July 1 and September 22. Vendors with the most 2026 access-control KEV entries: Cisco (5), Microsoft (4), JFrog (3), Oracle (3).
Are Access-Control Flaws Linked to Ransomware?
Yes, disproportionately. Across the full catalog (1,721 entries), 27.2% of access-control entries carry CISA’s “Known” ransomware-campaign flag, against 20.9% for the catalog as a whole. In 2026 to date, 7 of the 51 access-control additions are flagged.
Marcus Chen: No zero-day theatrics in this table. The dominant 2026 exploited weakness is an endpoint that forgot to ask who you are. Wallarm puts it at 59% of API vulnerabilities requiring no authentication at all. CISA’s catalog now confirms attackers are cashing that in at nearly twice last year’s rate. If you fund one API control this quarter, make it server-side authorization on every object, not a better dashboard.
How Easy Are API Vulnerabilities to Exploit?
Trivially, according to Wallarm’s 2026 API ThreatStats Report, which analyzed 2025 disclosures:
| Metric (2025) | Value | Source |
|---|---|---|
| API share of all published security bulletins | 17% (11,053 of 67,058) | Wallarm 2026 ThreatStats |
| API-related share of new CISA KEV entries | 43% (106 of 245) | Wallarm 2026 ThreatStats |
| Exploitable with a single request | 97% | Wallarm 2026 ThreatStats |
| Rated easy or trivial to exploit | 98% | Wallarm 2026 ThreatStats |
| Require no authentication | 59% | Wallarm 2026 ThreatStats |
| Public exploit code available | ~30% | Wallarm 2026 ThreatStats |
| Rated High or Critical impact | 67% | Wallarm 2026 ThreatStats |
Wallarm’s 245 KEV additions for 2025 match the count Axis Intelligence Research measured independently from the CISA catalog, which is a useful cross-check. The two lenses differ on purpose: Wallarm classifies whether a KEV entry is API-related (43%); BAXR classifies whether its root cause is access control (14.7% in 2025). One asks where the door is; the other asks why it was open.
What Causes API Breaches?
Wallarm examined 60 API-related breaches from 2025. Broken authentication was the cause in 52%, and unsafe consumption of APIs (OWASP API10) in 27%. Software and AI platforms each accounted for 15% of breached organizations.
Salt Security’s telemetry points the same way from the defender’s side: 99% of attack attempts it analyzed came from authenticated sources, and 65% exploited security misconfiguration (API8).
Marcus Chen: “Authenticated” is the word defenders keep skipping. Ninety-nine percent of the attempts Salt saw came through a valid login. The perimeter did its job. Authorization — does this user get this object — is where it fails, and that is a code-review problem, not a firewall problem.
How Are AI Agents and MCP Changing API Security Risk?
- AI vulnerabilities rose from 439 in 2024 to 2,185 in 2025, and 36% of them are also API vulnerabilities (Wallarm 2026 ThreatStats).
- Model Context Protocol (MCP) accounted for 315 vulnerabilities in 2025, 14.4% of all AI vulnerabilities (Wallarm).
- 24.3% of developers already design APIs with AI agents in mind; only 10% use MCP regularly (Postman 2025).
- 90% of organizations use or plan to use GenAI in API development, yet only 18% are extremely confident they can detect GenAI-driven attacks, and 92% lack the maturity needed for AI-agent defense (Salt Security 1H 2026).
- Postman respondents’ top API security worry: unauthorized or excessive API calls (50.8%), then AI accessing sensitive data (49%) and credential leaks (45.95%).
Two of the 2026 access-control KEV entries belong to Langflow, an AI-agent workflow builder, per the CISA catalog. For incident-level detail on agent compromises, see our AI Agent Security Incident Tracker.
Marcus Chen: An agent is an API client that never gets tired and inherits whatever token you handed it. The MCP numbers are small in absolute terms. What matters is that they grew inside a single year, while nine in ten teams are writing APIs with GenAI and fewer than one in five trust their detection. Over-scoped tokens are the new hard-coded password.
Methodology
Collection. Axis Intelligence Research downloaded the CISA KEV catalog from CISA’s official data repository (cisagov/kev-data; catalog version 2026.09.22, 1,721 entries) on September 23, 2026. Survey and telemetry figures come from vendor primary publications (Akamai, Salt Security, Wallarm, Thales, Postman), each fetched and logged with URL and retrieval date in the CSV. Where a primary release did not print an underlying value (Akamai’s 121 and 258), we used named press coverage and flagged the row is_primary = no.
BAXR formula. For each calendar year (by KEV dateAdded), BAXR = access-control entries ÷ all entries × 100. An entry counts as access-control if its cwes field contains at least one of:
- Authentication set: CWE-287, 288, 290, 294, 306, 307, 798, 1390, 620, 640
- Authorization set: CWE-639, 284, 285, 862, 863, 269, 648, 266, 280
The sets follow the CWE mappings behind OWASP API1, API2, API3 and API5. Anyone can reproduce every reading from the public KEV file with these two lists.
Other calculations. Recomputed Akamai growth: (258/121 − 1) × 100. Malicious-bot share of web traffic: 53% × 40% (both Thales, same dataset). Incident-rate gap: 87 − 32 (displayed, not merged). Authentication growth: (36/22 − 1) × 100.
Scope notes. BAXR measures access-control root causes across all KEV entries, not only web APIs; it is an exploitation signal for the flaw classes that dominate API risk. KEV entries without a CWE (175 of 1,721, concentrated in 2021–2022) count in the denominator, which makes early-year readings conservative. 2026 is a partial year.
About This Dataset
File: api-security-statistics.csv ·
Rows: 143 · License: CC BY 4.0
Contents: BAXR readings 2021–2026, KEV counts by weakness class, row-level list of all 51 access-control KEV entries added in 2026 (CVE, vendor, CWE, date, ransomware flag), plus every survey and telemetry figure cited on this page, each with source_org, source_document, source_url, retrieved_date, is_primary, axis_calculated and method_note.
Mirrors: Hugging Face, Kaggle and GitHub (Axis Intelligence Research).
Cite This Page
APA: Axis Intelligence Research, & Chen, M. (2026, September 23). API security statistics 2026: Exploited auth flaws doubled, attacks per org up 113%. Axis Intelligence. https://axis-intelligence.com/api-security-statistics/
MLA: Axis Intelligence Research, and Marcus Chen. “API Security Statistics 2026: Exploited Auth Flaws Doubled, Attacks Per Org Up 113%.” Axis Intelligence, 23 Sept. 2026, axis-intelligence.com/api-security-statistics/.
Chicago: Axis Intelligence Research, and Marcus Chen. “API Security Statistics 2026: Exploited Auth Flaws Doubled, Attacks Per Org Up 113%.” Axis Intelligence, September 23, 2026. https://axis-intelligence.com/api-security-statistics/.
API Security FAQ
What is the most exploited API vulnerability in 2026?
Broken authentication. CWE-287 Improper Authentication was the most frequent weakness among the 51 access-control flaws CISA added to KEV in 2026 through September 22 (16 entries), and Wallarm found broken authentication caused 52% of 60 analyzed 2025 API breaches.
What is BAXR (Broken-Access Exploitation Ratio)?
BAXR is an Axis Intelligence Research index: the percentage of new CISA KEV entries whose root-cause CWE is an authentication or authorization failure. It read 21.5% for 2026 through September 22, the highest annual reading from 2021 onward.
Why do surveys disagree so much on API incident rates?
Because they define “incident” and sample differently. Akamai reports 87% of organizations had an API-related incident in 2025; Salt Security’s 327-respondent survey reports 32%. Treat the 55-point gap as a definitional range, not an error in either report.
Does an API gateway or WAF stop BOLA attacks?
Not on its own. BOLA (API1) requests are well-formed and usually authenticated — Salt found 99% of attack attempts came from authenticated sources. Detecting them requires object-level authorization checks in the application or behavioral analysis of who accesses which object.
How fast are attacks on APIs growing?
According to Akamai’s 2026 SOTI report, daily API attacks per organization rose 113% year over year, from 121 in 2024 to 258 in 2025. Attacks involving unauthorized workflows grew from 30% to 61% of the total.
Are MCP servers an API security risk?
Yes. Wallarm counted 315 MCP vulnerabilities in 2025, 14.4% of all AI vulnerabilities, and 36% of AI vulnerabilities also qualify as API flaws. MCP servers expose tools through API calls, so they inherit API authentication and authorization failures.
What share of the OWASP API Top 10 is about access control?
Four of ten: API1 (object-level authorization), API2 (authentication), API3 (object property-level authorization) and API5 (function-level authorization). Those four classes are what the BAXR index tracks in CISA’s exploitation data.
Which industries are most targeted by API and bot attacks?
Financial services accounted for 24% of all bot attacks in Thales’ 2026 Bad Bot Report, and 27% of bot attacks targeted APIs. In Wallarm’s 2025 breach sample, software and AI platforms each made up 15% of breached organizations.
Related: Machine Identity Statistics · AI Security Statistics · Cybersecurity Statistics 2026