NIST 800-53 r5 · Controls catalogue · Family AC
AC-25Reference Monitor
Implement a reference monitor for {{ insert: param, ac-25_odp }} that is tamperproof, always invoked, and small enough to be subject to analysis and testing, the completeness of which can be assured.
Last updated: 16 October 2026 07:24 UTC
Implementations targeting this control (0)
- No implementations targeting this control yet.
ATT&CK techniques this control mitigates (0)
- No ATT&CK techniques mapped to this control yet.
Weaknesses this control addresses (8)AI-assisted
CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.
| CWE | Name | CVEs | Why this control addresses it |
|---|---|---|---|
CWE-862 | Missing Authorization | 11,800+ | Always invoking the reference monitor prevents missing authorization checks for protected resources. |
CWE-284 | Improper Access Control | 8,100+ | Provides a tamperproof, always-invoked, and verifiable mechanism to enforce access control policies. |
CWE-863 | Incorrect Authorization | 4,800+ | The small, testable reference monitor reduces the likelihood of incorrect authorization implementations. |
CWE-269 | Improper Privilege Management | 4,000+ | Enforces proper privilege management by requiring all decisions through the verified reference monitor. |
CWE-306 | Missing Authentication for Critical Function | 3,900+ | Guarantees critical functions are protected by mandatory invocation of the access control mechanism. |
CWE-285 | Improper Authorization | 1,700+ | Ensures authorization decisions are always performed by a complete and analyzable reference monitor. |
CWE-693 | Protection Mechanism Failure | 900+ | Implements a reliable, tamperproof protection mechanism whose completeness can be assured. |
CWE-425 | Direct Request ('Forced Browsing') | 200+ | Forces all accesses through the reference monitor, preventing direct or forced requests that bypass checks. |
Top CVEs where this control is the strongest mitigation
| CVE | Risk | CVSS | EPSS | Match |
|---|---|---|---|---|
CVE-2024-1709 KEV UPD | 10.0 | 10.0 | 0.9998 | good |
CVE-2026-20079 KEV UPD | 10.0 | 10.0 | 0.8818 | good |
CVE-2024-27198 KEV UPD | 9.9 | 9.8 | 0.9994 | good |
CVE-2024-10924 UPD | 9.9 | 9.8 | 0.8222 | good |
CVE-2024-55591 KEV UPD | 9.9 | 9.8 | 0.9415 | good |
CVE-2025-2746 KEV UPD | 9.9 | 9.8 | 0.7363 | good |
CVE-2025-2747 KEV UPD | 9.9 | 9.8 | 0.9717 | good |
CVE-2024-56325 UPD | 9.9 | 9.8 | 0.8021 | good |
CVE-2025-57819 KEV UPD | 9.9 | 9.8 | 0.8635 | good |
CVE-2026-23760 KEV UPD | 9.9 | 9.8 | 0.9654 | good |
CVE-2026-24858 KEV UPD | 9.9 | 9.8 | 0.8580 | good |
CVE-2026-19490 KEV UPD | 9.9 | 9.8 | 0.2316 | good |
CVE-2024-23917 UPD | 9.4 | 9.8 | 0.5401 | good |
CVE-2024-7314 UPD | 9.4 | 9.8 | 0.5175 | good |
CVE-2025-22224 KEV UPD | 9.2 | 9.3 | 0.0156 | good |
CVE-2024-10081 UPD | 9.1 | 10.0 | 0.3992 | good |
CVE-2022-25369 UPD | 9.1 | 9.8 | 0.4001 | good |
CVE-2026-10523 UPD | 9.1 | 9.9 | 0.5314 | good |
CVE-2024-33610 UPD | 8.9 | 9.1 | 0.5045 | good |
CVE-2024-50379 UPD | 8.9 | 9.8 | 0.3182 | good |
CVE-2026-1603 KEV UPD | 8.8 | 8.6 | 0.8833 | good |
CVE-2025-24472 KEV UPD | 8.7 | 8.1 | 0.0723 | good |
CVE-2026-18577 KEV | 8.7 | 8.1 | 0.1462 | good |
CVE-2024-39309 UPD | 8.5 | 9.8 | 0.2017 | good |
CVE-2025-34026 KEV UPD | 8.5 | 7.5 | 0.8194 | good |