NIST 800-53 r5 · Controls catalogue · Family AC
AC-14Permitted Actions Without Identification or Authentication
Identify {{ insert: param, ac-14_odp }} that can be performed on the system without identification or authentication consistent with organizational mission and business functions; and Document and provide supporting rationale in the security plan for the system, user actions not requiring identification or authentication.
Last updated: 04 July 2026 00:28 UTC
Cumulative inbound coverage
How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.
Collective: partial · 1 mapping(s) from 1 framework(s): ASVS 5.0 1 (partial)
Implementations targeting this control (0)
- No implementations targeting this control yet.
ATT&CK techniques this control mitigates (1)
- T1137.002 Office Test Persistence
Weaknesses this control addresses (4)AI
CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.
| CWE | Name | CVEs | Why this control addresses it |
|---|---|---|---|
CWE-862 | Missing Authorization | 9,346 | Documenting permitted unauthenticated actions prevents missing authorization by making all exceptions explicit and subject to organizational review. |
CWE-284 | Improper Access Control | 5,367 | Explicitly identifying and documenting actions permitted without identification or authentication enforces proper access control boundaries by defining justified exceptions. |
CWE-306 | Missing Authentication for Critical Function | 2,820 | Requiring identification and rationale for actions allowed without authentication ensures critical functions are not left unprotected by forcing review of authentication requirements. |
CWE-285 | Improper Authorization | 1,356 | The control's documentation requirement reduces improper authorization by ensuring only mission-justified actions bypass authentication. |
Top CVEs where this control is the strongest mitigation
| CVE | Risk | CVSS | EPSS | Match |
|---|---|---|---|---|
CVE-2025-40554 | 8.0 | 9.8 | 0.5845 | good |
CVE-2026-25192 | 7.0 | 9.4 | 0.0048 | good |
CVE-2026-3587 | 7.0 | 10.0 | 0.0068 | good |
CVE-2026-3611 UPD | 7.0 | 10.0 | 0.0558 | good |
CVE-2026-4312 UPD | 7.0 | 9.8 | 0.0045 | good |
CVE-2026-27944 | 7.0 | 9.8 | 0.2216 | good |
CVE-2026-28710 | 7.0 | 9.8 | 0.0041 | good |
CVE-2026-27446 UPD | 7.0 | 9.8 | 0.1063 | good |
CVE-2026-24898 | 7.0 | 10.0 | 0.0056 | good |
CVE-2026-23693 | 7.0 | 10.0 | 0.0038 | good |
CVE-2026-2249 | 7.0 | 9.8 | 0.0051 | good |
CVE-2025-70150 | 7.0 | 9.8 | 0.0057 | good |
CVE-2025-70146 | 7.0 | 9.1 | 0.0045 | good |
CVE-2019-25337 | 7.0 | 9.8 | 0.0041 | good |
CVE-2026-25084 | 7.0 | 9.8 | 0.0073 | good |
CVE-2026-2248 | 7.0 | 9.8 | 0.0051 | good |
CVE-2026-24789 | 7.0 | 9.8 | 0.0067 | good |
CVE-2026-2096 | 7.0 | 9.8 | 0.0052 | good |
CVE-2026-1453 | 7.0 | 9.8 | 0.0050 | good |
CVE-2021-47891 | 7.0 | 9.8 | 0.0080 | good |
CVE-2025-23504 | 7.0 | 9.8 | 0.0043 | good |
CVE-2025-37184 | 7.0 | 9.8 | 0.0057 | good |
CVE-2026-23944 | 7.0 | 9.8 | 0.0044 | good |
CVE-2026-24042 | 7.0 | 9.4 | 0.0058 | good |
CVE-2026-1019 | 7.0 | 9.8 | 0.0053 | good |