CWE-279Incorrect Execution-Assigned Permissions

Abstraction: Variant · CVEs in our corpus: 26

While it is executing, the product sets the permissions of an object in a way that violates the intended permissions that have been specified by the user.

Last updated: 21 August 2026 20:21 UTC

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent

Stop it (NIST 800-53 / CSF Protect)

PR.AA-05
PR.PS-01
AC-3 Access Enforcement
AC-6 Least Privilege

Detect

Catch it (CSF Detect / Respond)

—

Harden

Shrink the surface (DISA STIG)

2 hardening rules · 1 OS baseline

Validate

Prove the fix (OWASP ASVS)

—

NIST 800-53 r5 controls that address this weakness (0)AI-assisted

Control	Title	Family	Why it addresses this CWE
No NIST controls proposed yet.

Top CVEs of this weakness type, ranked by Risk Priority

CVE	Risk	CVSS	EPSS	Published
`CVE-2024-37734`	7.4	9.8	0.0080	2024-06-26
`CVE-2023-4665`	6.8	8.8	0.0106	2023-09-15
`CVE-2025-58437`	6.1	8.1	0.0037	2025-09-06
`CVE-2025-14025`	6.0	8.5	0.0040	2026-01-08
`CVE-2022-21699`	5.9	8.2	0.0066	2022-01-19
`CVE-2023-4383`	5.8	7.8	0.0031	2023-08-16
`CVE-2025-30001`	5.8	7.3	0.0052	2025-10-10
`CVE-2024-11220`	5.6	7.8	0.0015	2024-12-06
`CVE-2025-23263`	5.6	7.6	0.0017	2025-07-17
`CVE-2023-50914`	5.3	6.7	0.0070	2024-04-30
`CVE-2025-22843`	5.3	7.8	0.0014	2025-05-13
`CVE-2024-25621`	5.3	7.3	0.0016	2025-11-06
`CVE-2023-3915`	5.1	6.5	0.0056	2023-09-01
`CVE-2025-12801`	5.1	6.5	0.0046	2026-03-04
`CVE-2024-37025`	4.9	6.7	0.0015	2024-11-13
`CVE-2026-20062`	4.9	7.2	0.0012	2026-03-04
`CVE-2025-13663`	4.8	6.7	0.0010	2025-12-11
`CVE-2020-8025`	4.6	6.1	0.0047	2020-08-07
`CVE-2025-20612`	4.3	5.5	0.0022	2025-05-13
`CVE-2026-4948`	4.1	5.5	0.0012	2026-03-27
`CVE-2017-8441`	3.8	4.3	0.0073	2017-06-05
`CVE-2026-46388`	3.3	4.4	0.0009	2026-07-10
`CVE-2025-26422`	3.1	4.0	0.0009	2025-09-04
`CVE-2025-36228`	3.1	3.8	0.0021	2025-12-26
`CVE-2025-23233`	3.0	3.5	0.0021	2025-05-13