CVE-2026-83715

Explicitly identifies and limits actions permitted without authentication, preventing critical functions from being exposed.

Access enforcement requires prior authentication before any authorization decision for critical functions.

Directly mandates unique identification and authentication of users before access to functions requiring identity.

Extends the same authentication requirement to non-organizational users accessing critical functionality.

Requires authentication of services before they can invoke or expose critical functions.

Managing identities and credentials is a prerequisite for authentication but does not itself enforce it on critical functions.

Defining and enforcing authorizations assumes prior authentication and therefore only partially mitigates the absence of authentication.

Protecting networks from unauthorized access can be undermined by missing authentication but does not address the root authentication gap.

A.8.21 mandates authentication requirements for accessing network services and requires security measures (including authentication) to be identified and implemented, so applying it where it was not applied before results in authentication being added to network services that lacked it, removing those CWE-306 instances; however, A.8.21's scope is limited to network services while CWE-306 also covers non-network critical functions (UART debug ports, local APIs, backdoor channels), and the clause governs the requirement rather than directly implementing authentication, leaving a nameable remainder.

A.8.30 mandates contractual security requirements (point b referencing 8.25-8.29), acceptance testing (point d), and evidence of security capabilities (point e), which can require and verify that authentication is designed into outsourced deliverables before they ship — but it is a governance/oversight mechanism whose effect depends on the rigor of contract specification, acceptance test coverage, and developer compliance, so it prevents a slice rather than the bulk of instances.

A.8.8's reach is DISCLOSURE — it finds vulnerabilities that have been published as advisories. CWE-306 does commonly surface as CVEs (numerous examples in the observed examples section: CVE-2024-11680, CVE-2022-31260, CVE-2022-29951, etc.), so A.8.8 finds the disclosed minority of instances. However, most CWE-306 instances are design-level omissions that never receive CVE numbers — internal applications, undocumented interfaces, or 'by design' decisions that no external researcher reports — so the disclosed share is a minority of latent instances, capped at `partial` by the disclosure-reach rule.