CVE-2026-109321

Ensuring sufficient strength of mechanism for authenticators prevents use of weak credentials.

Enforces use of credentials that comply with standards rather than weak credentials for module access.

A.5.17 mandates generation of non-guessable unique credentials, immediate change of defaults/temporary secrets, strong password enforcement, no reuse, blocking of compromised passwords, and secure transmission/storage; this stops exploitation of weak/guessable/default credentials for most but not all cases in CWE-1391 (e.g. leaves some non-password credential forms or post-compromise reuse outside its explicit scope).

Restricts privileged accounts but does not explicitly address default or hard-coded credentials for those accounts.

Requires security activities throughout the SDLC that can catch weak credentials, but does not mandate their elimination.

Secure-coding rules can prohibit hard-coded passwords, yet coverage depends on specific coding standards adopted.

Security testing can discover weak credentials, but does not guarantee they are prevented by design.

A.8.5 mandates strong, multi-factor, non-guessable authentication techniques (with brute-force protection, no cleartext, etc.) that stop weak credentials from being successfully exploited; the bounded remainder is hard-coded/default credentials inside non-interactive product components where no human or session authentication occurs at all.