Cyber Resilience

CWE · MITRE source

CWE-268Privilege Chaining

Abstraction: Base · CVEs in our corpus: 22

Two distinct privileges, roles, capabilities, or rights can be combined in a way that allows an entity to perform unsafe actions that would not be allowed without that combination.

Last updated: 22 August 2026 14:14 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: partial · 6 mapping(s) from 6 framework(s): STIG ubuntu 22 04 1 (partial) · STIG ubuntu 24 04 1 (partial) · STIG windows 10 1 (partial) · STIG windows server 2016 1 (partial) · STIG windows server 2019 1 (partial) · STIG windows server 2022 1 (partial)

See the full cumulative-coverage rollup →

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent
Stop it (NIST 800-53 / CSF Protect)
  • PR.AA-05
  • AC-5 Separation of Duties
  • AC-6 Least Privilege
  • AC-3 Access Enforcement
Detect
Catch it (CSF Detect / Respond)

—

Harden
Shrink the surface (DISA STIG)
  • 6 hardening rules · 6 OS baselines
Validate
Prove the fix (OWASP ASVS)

—

NIST 800-53 r5 controls that address this weakness (0)AI-assisted

Control Title Family Why it addresses this CWE
No NIST controls proposed yet.

Top CVEs of this weakness type, ranked by Risk Priority

CVE Risk CVSS EPSS Published
CVE-2023-0971 6.69.60.00252023-06-21
CVE-2023-0759 6.58.80.00342023-02-09
CVE-2024-4877 6.58.80.00422025-04-03
CVE-2019-3844 6.07.80.00922019-04-26
CVE-2025-49741 6.07.40.03502025-07-01
CVE-2023-5839 5.87.80.00292023-10-29
CVE-2025-0889 5.77.80.00202025-02-26
CVE-2024-47045 5.67.80.00152024-09-26
CVE-2025-2297 5.67.80.00132025-07-28
CVE-2025-64701 5.57.80.00122025-12-11
CVE-2026-3888 5.57.80.00382026-03-17
CVE-2026-32325 5.57.80.00102026-06-01
CVE-2023-2250 5.06.70.00202023-04-24
CVE-2024-1250 5.06.50.00552024-02-12
CVE-2024-1299 5.06.50.00542024-03-07
CVE-2025-36124 4.75.90.00402025-08-12
CVE-2025-32955 4.56.00.00222025-04-21
CVE-2023-20194 4.04.90.00532023-09-07
CVE-2025-20112 3.85.10.00142025-05-21
CVE-2022-1003 3.03.30.00502022-03-18