CVE-2026-17110

Independent scrutiny can identify processes or services still running with unnecessary privileges and drive their reduction before an attacker can abuse them.

A.8.18 addresses utility programs capable of overriding system/application controls — a subset of CWE-250 where the program itself holds privileges higher than needed for normal operation. For that subset, the clause restricts who may invoke the program (trusted authorized users with authentication, documented authorization levels, ad hoc approval, segregation from application traffic, and full logging), which denies exploitation to unauthorized actors. The underlying weakness — the utility program still holding unnecessary privileges — is not removed, and any authorized user can still exploit it, so the block is partial; non-utility-program instances of CWE-250 (application code running with excess privileges) are outside the clause's scope entirely.

A.8.28 explicitly names 'principle of least privilege' in its pre-operational evaluation step and its secure coding principles cover privilege management during development, so a well-implemented programme prevents a slice of CWE-250 instances; the remainder is the same shape as the other A.8.28 anchors -- the clause mandates a fallible practice, and CWE-250 can also be introduced at installation (setuid programs) and operation phases that the coding-time guidance does not reach.