CVE-2026-57386
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2026-57386 is a high-severity Incorrect Privilege Assignment (CWE-266) vulnerability. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 20th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-43456
Vulnerability Data
Incorrect Privilege Assignment vulnerability in Kodezen LLC aBlocks ablocks allows Privilege Escalation.This issue affects aBlocks: from n/a through < 2.9.1.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Incorrect privilege assignment in the plugin directly enables privilege escalation via exploitation.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces correct privilege checks to block unauthorized escalation from the incorrect assignment in the aBlocks plugin.
Requires assignment of only the minimum necessary privileges, directly countering the CWE-266 flaw that enabled escalation.
Mandates timely patching of the vulnerable aBlocks versions (<2.9.1) to remove the incorrect privilege assignment.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Directly enforces least-privilege policy definition, management, and review that prevents incorrect privilege assignments.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
The access-rights control governs the entire lifecycle of privilege assignment, directly eliminating incorrect assignments.
Privileged-access-rights control explicitly requires least-privilege assignment and ongoing validation, directly mitigating CWE-266.
Access control policy directly prevents incorrect privilege assignment by defining who may receive which rights.
Segregation of duties reduces blast radius of any single incorrect privilege but does not prevent the assignment itself.
Restricting privileged utility programs limits exposure from over-privileged accounts but does not address how privileges are assigned.
Information-access-restriction mechanisms enforce the correct privilege boundaries once assignment rules are defined.