OWASP Top 10 2021 → 2026: what actually changed in real engagements

// 01 Why the 2021 → 2026 delta matters

OWASP refreshes the Top 10 on a roughly four-year cadence, using a combination of CVE data, community survey responses, and contributed application security data. The 2021 edition was a significant overhaul - three new categories appeared, two were merged, and the overall framing shifted from "common vulnerability patterns" to "risk categories." The anticipated 2026 update carries that evolution further.

But the official list and what practitioners actually find in engagements are two different things. The list is backward-looking by design - it reflects the collective disclosure record of the last four years. Real engagements reflect the current production environment: modern SaaS architectures, cloud-native deployments, GraphQL APIs, AI-augmented applications, and the specific way developers use today's frameworks.

// 02 A01 - Broken Access Control: still #1, and widening

In 2017 the category was Broken Access Control - in 2021 it moved from #5 to #1. In 2026 engagements it hasn't budged. Every architecture that adds abstraction layers adds access-control surfaces: microservices, tenant isolation boundaries, RBAC permission trees, data-room sharing, admin impersonation flows. Developers secure the happy path; pen testers find the edges.

What we're finding in 2026

The dominant pattern in our current engagement data is BOLA (Broken Object-Level Authorization) - or IDOR as it was classically called. Modern SaaS platforms generate resource identifiers (UUIDs, slugs, numeric IDs) and expose them in URLs, API payloads and WebSocket messages. The authorisation check is supposed to verify that the caller owns the object. In roughly half of the applications we test, that check is absent, inconsistent across endpoints, or bypassable through HTTP method switching.

HTTP# Typical BOLA pattern - A01 finding
GET /api/v2/reports/3847 HTTP/1.1
Authorization: Bearer <tenant-A-token>

HTTP/1.1 200 OK
# Returns tenant-B report - no tenant check on object retrieval
{ "report_id": 3847, "tenant": "acme-corp", "data": {...} }

# Fix: bind object lookup to authenticated tenant context
# SELECT * FROM reports WHERE id = ? AND tenant_id = current_tenant()

The second pattern is vertical privilege escalation through mass assignment. Modern ORMs and serialisation libraries bind request payloads directly to model objects. When a developer forgets the allowlist, a low-privilege user can submit fields like role, is_admin, or billing_owner and elevate themselves in a single PATCH request. We find this in roughly one in four SaaS applications, usually on profile-update or onboarding endpoints.

// 03 A02 & A03 - Cryptographic Failures and Injection: both evolved

Cryptographic Failures (A02)

In 2021 this category replaced "Sensitive Data Exposure" - a deliberate shift from "data was exposed" to "the cryptographic mechanism failed." In 2026 engagements, the most common finding in this category is JWT algorithm confusion. An application that accepts both RS256 (asymmetric) and HS256 (symmetric) tokens with the same key store can be attacked by re-signing an admin claim using the public RSA key as the HMAC secret. Libraries that were vulnerable to this in 2021 are still deployed in production.

The second-most-common cryptographic finding is weak token entropy - password reset tokens, email verification links, and API keys generated with insufficient randomness. We still find MD5 and SHA-1 in password hashing pipelines in legacy services, and TLS 1.0/1.1 on internal APIs that were never exposed to the internet hardening checklist.

Injection (A03)

SQL injection dominated A03 from 2013 to 2021. ORMs and parameterised queries have driven it down significantly in modern codebases - but injection as a class has diversified. In our 2026 engagement data, Server-Side Template Injection (SSTI) is now more commonly found than classic SQL injection in modern stacks. Applications using Jinja2, Twig, Nunjucks, Liquid, or Pebble with user-controlled template strings are trivially exploitable for remote code execution.

HTTP# SSTI probe - Jinja2 / Flask endpoint accepting template variables
POST /api/emails/preview
Content-Type: application/json

{ "subject": "Hello {{7*7}}", "template_id": "welcome" }

# Vulnerable response - template was evaluated server-side
{ "preview": "Hello 49", "subject": "Hello 49" }

# Escalation - code execution
{ "subject": "{{config.__class__.__init__.__globals__['os'].popen('id').read()}}" }

The third injection frontier in 2026 is prompt injection in AI-augmented applications. Applications that accept user input and pass it into LLM prompts without sanitisation can be manipulated to override system instructions, exfiltrate context, or produce adversarial outputs. OWASP's LLM Top 10 addresses this, but classic App Top 10 auditors are starting to include prompt injection test cases in standard engagements.

// 04 A04 - Insecure Design: the most underappreciated category

Insecure Design was introduced in 2021 as a new category distinct from implementation bugs - it covers threat modelling gaps, missing business-logic controls, and architectural decisions that make a system insecure by construction regardless of how carefully the code is written. It's the hardest category to "fix" because the fix often requires architectural change, not a code patch.

In practice, the most common Insecure Design findings we report are race conditions in transactional flows. A payment or inventory system that doesn't hold row-level locks during concurrent operations can be exploited to stack discounts, over-claim free-tier limits, or execute transfers that exceed balance. No scanner can find this - it requires understanding the business invariant and crafting a concurrent attack.

// 05 A05-A10: what moved, what faded, what's new

// 06 What the list still doesn't capture in 2026

The OWASP Top 10 is a risk awareness document, not an exhaustive test plan. There are vulnerability classes that appear frequently in our engagement data that don't map cleanly to any single category - and that list is growing as application architectures evolve.

GraphQL-specific attack surface

Introspection abuse, batching attacks, alias-based rate-limit bypass, and object-level authorisation across nested resolvers are GraphQL-specific findings that don't fit neatly into A01 or A03. Any application exposing a GraphQL endpoint needs a dedicated test plan beyond OWASP mapping.

Multi-tenancy boundary failures

The 2021 OWASP list has no category specifically for tenant isolation failures. Cross-tenant data access is arguably the highest-impact finding in modern SaaS - a single BOLA vulnerability in a shared data layer can expose every tenant's data. This falls under A01, but the specific attack surface - shared databases, shared queues, shared caches - deserves explicit test coverage.

Business logic abuse

Race conditions, coupon stacking, refund chaining, inventory manipulation and referral abuse all live under A04 (Insecure Design), but the testing methodology is completely different from any other category. You need to understand the application's business rules before you can test whether they're enforced. No automated tool can do this. 38% of critical findings we report are business-logic flaws - none of them map cleanly to a single OWASP category.

// 07 How to update your test plan for 2026

If your test scope is currently "OWASP Top 10 coverage," the following additions will meaningfully close the gaps between the list and what a 2026 attacker will actually exploit.

// 08 Mapping the 2026 findings to compliance requirements

Every finding CyberFortify reports is mapped to OWASP category, CWE, CVSS v3.1, and the relevant compliance control. For organisations using pen test results as audit evidence, the table below shows the most common 2026 findings and their compliance touchpoints.

// 09 The bottom line

The OWASP Top 10 is essential reading - but treating it as a test checklist rather than a risk map leads to incomplete engagements. The 2021 list correctly elevated Broken Access Control and added SSRF; the 2026 revision will reflect the rise of insecure design in cloud-native systems and the new injection surfaces that AI-augmented applications introduce.

What doesn't change: the gap between what automated tools find and what a skilled manual tester finds. Scanners can surface misconfiguration and known CVEs. They cannot model tenant isolation boundaries, abuse business logic, chain SSRF into credential theft, or find the JWT confusion that requires understanding the identity architecture. That gap is why manual pen testing remains the most valuable security investment a modern SaaS company can make - and why the OWASP Top 10 is a starting point, not an endpoint.