NIST 800-53 r5 · Controls catalogue · Family AC
AC-25Reference Monitor
Implement a reference monitor for {{ insert: param, ac-25_odp }} that is tamperproof, always invoked, and small enough to be subject to analysis and testing, the completeness of which can be assured.
Last updated: 04 July 2026 00:28 UTC
Cumulative inbound coverage
How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.
Collective: partial · 9 mapping(s) from 1 framework(s): ASVS 5.0 9 (partial)
Implementations targeting this control (0)
- No implementations targeting this control yet.
ATT&CK techniques this control mitigates (0)
- No ATT&CK techniques mapped to this control yet.
Weaknesses this control addresses (8)AI
CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.
| CWE | Name | CVEs | Why this control addresses it |
|---|---|---|---|
CWE-862 | Missing Authorization | 9,346 | Always invoking the reference monitor prevents missing authorization checks for protected resources. |
CWE-284 | Improper Access Control | 5,367 | Provides a tamperproof, always-invoked, and verifiable mechanism to enforce access control policies. |
CWE-863 | Incorrect Authorization | 3,515 | The small, testable reference monitor reduces the likelihood of incorrect authorization implementations. |
CWE-269 | Improper Privilege Management | 3,104 | Enforces proper privilege management by requiring all decisions through the verified reference monitor. |
CWE-306 | Missing Authentication for Critical Function | 2,820 | Guarantees critical functions are protected by mandatory invocation of the access control mechanism. |
CWE-285 | Improper Authorization | 1,356 | Ensures authorization decisions are always performed by a complete and analyzable reference monitor. |
CWE-693 | Protection Mechanism Failure | 613 | Implements a reliable, tamperproof protection mechanism whose completeness can be assured. |
CWE-425 | Direct Request ('Forced Browsing') | 265 | Forces all accesses through the reference monitor, preventing direct or forced requests that bypass checks. |
Top CVEs where this control is the strongest mitigation
| CVE | Risk | CVSS | EPSS | Match |
|---|---|---|---|---|
CVE-2025-24178 | 7.0 | 9.8 | 0.0148 | good |
CVE-2025-43261 UPD | 7.0 | 9.8 | 0.0077 | good |
CVE-2026-33631 | 5.5 | 8.7 | 0.0010 | good |
CVE-2026-24222 | 5.5 | 8.6 | 0.0040 | good |
CVE-2026-35666 | 5.5 | 8.8 | 0.0037 | good |
CVE-2026-29648 | 5.5 | 8.8 | 0.0032 | good |
CVE-2025-0359 | 5.5 | 8.5 | 0.0013 | good |
CVE-2026-41296 | 5.5 | 8.2 | 0.0020 | good |
CVE-2026-35570 | 5.5 | 8.4 | 0.0023 | good |
CVE-2026-28817 | 5.5 | 8.1 | 0.0016 | good |
CVE-2025-25500 | 5.5 | 7.5 | 0.0069 | good |
CVE-2026-33632 | 5.5 | 7.8 | 0.0010 | good |
CVE-2025-69783 | 5.5 | 7.8 | 0.0016 | good |
CVE-2024-53841 | 5.5 | 7.8 | 0.0009 | good |
CVE-2026-37525 | 5.5 | 7.8 | 0.0014 | good |
CVE-2026-32988 | 5.5 | 7.5 | 0.0008 | good |
CVE-2026-0008 | 5.5 | 8.4 | 0.0007 | good |
CVE-2026-23989 | 5.5 | 8.2 | 0.0027 | good |
CVE-2025-35998 UPD | 5.5 | 7.9 | 0.0015 | good |
CVE-2026-40968 | 3.5 | 4.2 | 0.0017 | good |
CVE-2022-36980 | 8.0 | 8.1 | 0.8314 | good |
CVE-2026-23830 | 7.0 | 10.0 | 0.0112 | good |
CVE-2025-24238 | 7.0 | 9.8 | 0.0106 | good |
CVE-2025-31182 | 7.0 | 9.8 | 0.0116 | good |
CVE-2026-34444 UPD | 7.0 | 10.0 | 0.0061 | good |