CWE · MITRE source
CWE-214Invocation of Process Using Visible Sensitive Information
A process is invoked with sensitive command-line arguments, environment variables, or other elements that can be seen by other processes on the operating system.
Many operating systems allow a user to list information about processes that are owned by other users. Other users could see information such as command line arguments or environment variable settings. When this data contains sensitive information such as credentials, it might allow other users to launch an attack against the product or related resources.
Last updated: 14 October 2026 20:41 UTC
Control responseHuman-reviewed
Answering this weakness across the control lifecycle, from our framework cross-walks.
PR.DS-10PR.PS-06SC-4Information in Shared System Resources
—
—
V1.2.5
NIST 800-53 r5 controls PROPOSED for this weakness (0)AI-assisted
These are model PROPOSALS, not graded mappings. They come
from controls_to_cwe_proposals, which carries no grade field at
all; across the CWE pages 1,540 of 1,722 such associations (89%) have never
been graded by anything. The heading said “address” until
2026-09-29, which asserted a relationship the data does not carry.
Graded cross-walks are on the framework map, not here.
| Control | Title | Family | Why it addresses this CWE |
|---|---|---|---|
| No NIST controls proposed yet. | |||
Top CVEs of this weakness type, ranked by Risk Priority
| CVE | Risk | CVSS | EPSS | Published |
|---|---|---|---|---|
CVE-2021-3859 UPD | 6.2 | 7.5 | 0.0164 | 2022-08-26 |
CVE-2020-36771 UPD | 5.9 | 7.8 | 0.0047 | 2024-01-22 |
CVE-2018-16837 UPD | 5.8 | 7.8 | 0.0037 | 2018-10-23 |
CVE-2019-3869 UPD | 5.7 | 7.2 | 0.0127 | 2019-03-28 |
CVE-2026-33247 UPD | 5.7 | 7.4 | 0.0054 | 2026-03-25 |
CVE-2024-4254 UPD | 5.5 | 7.1 | 0.0047 | 2024-06-04 |
CVE-2026-12250 | 5.4 | 7.9 | 0.0015 | 2026-07-05 |
CVE-2020-5422 UPD | 5.3 | 6.5 | 0.0092 | 2020-10-02 |
CVE-2025-5452 UPD | 5.0 | 6.6 | 0.0031 | 2025-11-11 |
CVE-2026-81684 | 4.7 | 6.2 | 0.0017 | 2026-08-27 |
CVE-2026-61670 | 4.6 | 6.5 | 0.0011 | 2026-09-18 |
CVE-2025-59955 UPD | 4.5 | 5.7 | 0.0030 | 2026-01-05 |
CVE-2025-1333 UPD | 4.4 | 6.0 | 0.0028 | 2025-05-01 |
CVE-2025-32987 UPD | 4.3 | 6.0 | 0.0017 | 2025-04-15 |
CVE-2026-74873 UPD | 4.3 | 5.5 | 0.0032 | 2026-08-17 |
CVE-2024-28799 UPD | 4.2 | 5.6 | 0.0030 | 2024-08-14 |
CVE-2026-40159 UPD | 4.2 | 5.5 | 0.0019 | 2026-04-10 |
CVE-2026-65088 | 4.2 | 5.5 | 0.0017 | 2026-08-25 |
CVE-2026-92768 | 4.2 | 5.5 | 0.0015 | 2026-09-18 |
CVE-2020-1753 UPD | 4.1 | 5.0 | 0.0051 | 2020-03-16 |
CVE-2026-9494 | 4.1 | 5.5 | 0.0015 | 2026-07-16 |
CVE-2026-80158 | 4.1 | 5.5 | 0.0015 | 2026-08-26 |
CVE-2026-18915 UPD | 3.8 | 5.0 | 0.0014 | 2026-08-06 |
CVE-2026-92747 | 3.8 | 5.0 | 0.0015 | 2026-09-18 |
CVE-2021-32638 UPD | 3.7 | 4.4 | 0.0040 | 2021-05-25 |