- DHS OIG found 76,000 CBP network users could access a highly privileged service account
- Auditors identified more than 100 unauthorized paths for users to gain administrator-level permissions
- Twenty percent of sampled employee accounts were not disabled promptly after separation
The Department of Homeland Security’s Office of Inspector General has found that the U.S. Customs and Border Protection did not implement IT access controls consistently, creating risks to its systems and sensitive information.
The findings come as DHS continues to prioritize cybersecurity, technology and operational capabilities at CBP and other major components. The Potomac Officers Club’s 2026 Homeland Security Summit on Nov. 10 will bring DHS leadership and industry representatives together to discuss the department’s technology, AI and cyber priorities. Sign up now!
What Vulnerabilities Did the Audit Find?
According to a report published Friday, investigators performed an audit from October 2024 to December 2025 and found that 76,000 CBP network users had unauthorized access to a highly privileged service account. This means any user could have altered account passwords, system permissions or security configurations, compromising the network and disrupting operations, the report said.
The watchdog discovered that all CBP users had permission to do privileged account functions, including taking over accounts with access to sensitive information, such as law enforcement and biometric data. Auditors also identified more than 100 paths that could allow users to elevate their permissions to the administrator level without authorization.
How Did CBP Manage User Accounts?
CBP was unable to pin down every privileged account on its network or verify that the required periodic reviews had taken place. OIG also discovered that 20 percent of the sampled employee accounts and 15 percent of the identified contractor accounts were not promptly disabled after separation. In addition, of the employees who transferred to new positions within CBP, 17 percent retained access they no longer needed.
The audit found that CBP’s access management system did not cover all applications, limiting the agency’s visibility into privileged and service accounts.
CBP concurred with all 12 recommendations issued by OIG. The agency has since begun remediation efforts to address the vulnerabilities, including revoking identified excessive privileges and strengthening access-control monitoring.
