CVE-2026-60859

A.5.15 directly mandates determining access requirements, defining/enforcing topic-specific access control policy, assigning rights/restrictions by entity/role, consistency with classification, need-to-know, privileged access restrictions, segregation, formal authorization, and dynamic rules — which stops most improper privilege management from being exploitable; bounded remainder is flawed implementation of those rules (e.g. incorrect mapping or enforcement bugs).

A.5.16's identity lifecycle (unique binding, timely disable/remove, no duplicates, oversight of shared/non-human) directly stops most improper access by ensuring the actor in an access decision is correctly identified and authorized; the bounded remainder is non-identity mechanisms in CWE-284 such as path traversal or CSRF that do not turn on actor identity at all.

A.5.18 directly governs the provisioning, review, modification and timely revocation of access rights (including for role changes, termination and privilege levels), which stops most improper privilege spheres from being exploitable even if the assignment flaw exists; the bounded remainder is flaws in the underlying enforcement mechanism itself (e.g. AC-3/A.8.3)

A.6.7's policy, rules, mechanisms, authentication requirements, remote access controls, network restrictions, and device measures (e.g. screen locks, firewalls, malware protection) directly stop unauthorized actors from exploiting improper access control in remote settings; remainder is non-remote or physical-only slices of CWE-284 (as in AC-3's own mostly precedent).

A.8.1 mandates access controls, storage encryption, software restrictions, malware protection, remote lock/wipe, physical/logical device protections, and policy-driven enforcement that stop unauthorized actors from exploiting improper access control on endpoints; remainder is non-endpoint or non-device slices of CWE-284 (e.g. server-side authorization logic).

A.8.2 directly controls the identification, allocation, review, expiry, temporary use, and separation of privileged rights per policy, which prevents most improper privilege management (CWE-269) by design; the bounded remainder is flawed tracking/checking logic inside the product's own enforcement code (the AC-3 slice of 269).