NIST 800-53 r5 · Controls catalogue · Family SC
SC-14Public Access Protections
Public Access Protections
Last updated: 04 July 2026 08:17 UTC
Cumulative inbound coverage
How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.
Collective: partial · 3 mapping(s) from 1 framework(s): ASVS 5.0 3 (partial)
Implementations targeting this control (0)
- No implementations targeting this control yet.
ATT&CK techniques this control mitigates (0)
- No ATT&CK techniques mapped to this control yet.
Weaknesses this control addresses (9)AI
CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.
| CWE | Name | CVEs | Why this control addresses it |
|---|---|---|---|
CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | 10,506 | Limits disclosure of sensitive information by ensuring only authorized actors can reach it through public interfaces. |
CWE-862 | Missing Authorization | 9,350 | Forces explicit authorization enforcement before any public request can affect protected data or functions. |
CWE-284 | Improper Access Control | 5,385 | Directly requires mechanisms to restrict public users from unauthorized actions on system resources. |
CWE-863 | Incorrect Authorization | 3,523 | Addresses incorrect policy decisions that would otherwise allow public users to exceed intended privileges. |
CWE-306 | Missing Authentication for Critical Function | 2,820 | Requires authentication gates on critical functions that must remain unavailable to anonymous public users. |
CWE-732 | Incorrect Permission Assignment for Critical Resource | 1,875 | Requires correct permission settings on public-facing resources to block unauthorized read/write access. |
CWE-285 | Improper Authorization | 1,360 | Mandates authorization checks so public access cannot perform disallowed operations or modifications. |
CWE-668 | Exposure of Resource to Wrong Sphere | 798 | Enforces separation so resources are not placed in a public sphere without explicit protection. |
CWE-552 | Files or Directories Accessible to External Parties | 563 | Prevents public exposure of files or directories that should not be reachable by unauthenticated parties. |
Top CVEs where this control is the strongest mitigation
| CVE | Risk | CVSS | EPSS | Match |
|---|---|---|---|---|
CVE-2025-60949 | 7.0 | 9.1 | 0.0040 | good |
CVE-2025-66603 | 7.0 | 9.8 | 0.0026 | good |
CVE-2025-13371 | 5.5 | 8.6 | 0.0037 | good |
CVE-2026-35408 | 5.5 | 8.7 | 0.0017 | good |
CVE-2026-30617 | 5.5 | 8.6 | 0.0047 | good |
CVE-2026-41055 | 5.5 | 8.6 | 0.0038 | good |
CVE-2025-27615 | 5.5 | 8.2 | 0.0049 | good |
CVE-2024-13622 | 5.5 | 7.5 | 0.0047 | good |
CVE-2024-12315 | 5.5 | 7.5 | 0.0046 | good |
CVE-2025-25281 | 5.5 | 7.5 | 0.0043 | good |
CVE-2026-35185 | 5.5 | 7.5 | 0.0036 | good |
CVE-2018-25164 | 5.5 | 7.5 | 0.0027 | good |
CVE-2026-28110 | 5.5 | 7.1 | 0.0015 | good |
CVE-2024-13641 | 3.5 | 5.9 | 0.0044 | good |
CVE-2024-52367 | 3.5 | 5.3 | 0.0033 | good |
CVE-2026-27944 | 7.0 | 9.8 | 0.2216 | good |
CVE-2026-23693 | 7.0 | 10.0 | 0.0038 | good |
CVE-2019-25337 | 7.0 | 9.8 | 0.0041 | good |
CVE-2025-70841 | 7.0 | 10.0 | 0.0038 | good |
CVE-2026-22237 | 7.0 | 9.8 | 0.0042 | good |
CVE-2020-36923 | 7.0 | 9.8 | 0.0092 | good |
CVE-2025-63223 | 7.0 | 9.8 | 0.0068 | good |
CVE-2024-57480 | 7.0 | 9.8 | 0.0083 | good |
CVE-2025-13329 | 7.0 | 9.8 | 0.0062 | good |
CVE-2026-2446 | 7.0 | 9.8 | 0.0030 | good |