CVE-2026-70940

Access enforcement requires prior authentication before any authorization decision for critical functions.

PR.AA-01 supplies credential/identity lifecycle support that can reduce some privilege-assignment errors but does not itself assign, modify, or check privileges, leaving most of CWE-269's risk unaddressed.

Directly requires authentication of users/services/hardware, which eliminates missing authentication for critical functions.

Protecting networks from unauthorized access can be undermined by missing authentication but does not address the root authentication gap.

Config baselines and default reviews can enforce some privilege-related settings (one facet) but do not address code-level assignment/tracking logic that defines CWE-269.

PR.PS-05 can partially limit exploitability of some privilege issues via execution restrictions, but does not address the core design/implementation flaws of CWE-269 at all.

Explicit restrictions on privileged access and segregation of duties limit the scope of privileges that can be assigned, reducing the chance that excessive or unnecessary privileges are granted to entities.

Requiring owner approval, segregation of duties, and periodic reviews prevents the assignment of excessive or unnecessary privileges to users or processes.

Defining and communicating authorization levels for each role limits the assignment of excessive or unnecessary privileges.

Separating duties such as developing software from administering production systems prevents any one person from accumulating excessive privileges that would constitute improper privilege management.

Mandating authentication requirements for critical functions at the requirements-gathering stage ensures that essential operations are not left unprotected by missing login or verification mechanisms.

Logging every use of privileges and protecting those records makes it harder for an attacker who has obtained elevated rights to operate without leaving evidence.