CVE-2026-89067

Requires a tamperproof, always-invoked reference monitor that structurally blocks bypass via any alternate path.

Enforces authorization checks on every logical access path, eliminating unauthenticated alternate channels.

Mandates unique identification and authentication for all organizational users, covering the primary authentication requirement.

Access rights provisioning and review prevent bypass via unmonitored or alternate channels.

Privileged access rights control reduces risk of bypass through elevated or alternate paths.

Secure coding practices help avoid bypass vulnerabilities but do not address deployed instances.

A.8.3 requires access restrictions (including no anonymous access and configuration mechanisms controlling access in systems, applications and services), which if well implemented would demand authentication on all paths and so block exploitation of an unauthenticated alternate channel; however, the weakness is a design flaw where the developer omitted authentication on a path, and A.8.3 is a policy/requirement clause whose blocking effect depends on the implementation of authentication mechanisms it does not itself enforce, leaving a nameable remainder of cases where the alternate path slips through.

A.8.8's reach is disclosure-based (vendor advisories, vulnerability scanning, CVE feeds), and CWE-288 commonly surfaces as CVEs (multiple observed examples carry CVE IDs), so the disclosed share is found; the remainder is first-party design flaws in alternate paths/channels that have not been publicly disclosed and are not surfaced by A.8.8's programme.