CWE · MITRE source
CWE-296Improper Following of a Certificate's Chain of Trust
The product does not follow, or incorrectly follows, the chain of trust for a certificate back to a trusted root certificate.
There are several ways in which the chain of trust might be broken, including but not limited to:
Last updated: 25 September 2026 21:25 UTC
Cumulative inbound coverage
How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.
Collective: full · 4 mapping(s) from 4 framework(s): STIG oracle linux 8 1 (full) · STIG rhel 8 1 (full) · STIG oracle linux 9 1 (mostly) · STIG rhel 9 1 (mostly)
OWASP Top 10 for Web (2025)
This weakness contributes to A04:2025 Cryptographic Failures.
Control responseHuman-reviewed
Answering this weakness across the control lifecycle, from our framework cross-walks.
SC-17Public Key Infrastructure CertificatesPR.AA-03PR.AA-04PR.DS-02
—
- 12 hardening rules · 5 OS baselines
—
NIST 800-53 r5 controls that address this weakness (1)AI-assisted
| Control | Title | Family | Why it addresses this CWE |
|---|---|---|---|
SC-17 | Public Key Infrastructure Certificates | SC | Requires only approved trust anchors in stores, ensuring proper chain-of-trust validation rather than arbitrary or incomplete paths. |
Top CVEs of this weakness type, ranked by Risk Priority
| CVE | Risk | CVSS | EPSS | Published |
|---|---|---|---|---|
CVE-2025-48057 UPD | 7.3 | 9.8 | 0.0044 | 2025-05-27 |
CVE-2019-3890 UPD | 6.3 | 8.1 | 0.0099 | 2019-08-01 |
CVE-2021-23155 UPD | 6.3 | 9.0 | 0.0048 | 2021-11-18 |
CVE-2026-27134 UPD | 6.1 | 8.1 | 0.0042 | 2026-02-21 |
CVE-2025-1146 UPD | 6.0 | 8.1 | 0.0026 | 2025-02-12 |
CVE-2026-24066 | 6.0 | 8.4 | 0.0012 | 2026-06-10 |
CVE-2019-3762 UPD | 5.9 | 7.5 | 0.0065 | 2020-03-18 |
CVE-2021-23162 UPD | 5.9 | 7.7 | 0.0042 | 2021-11-18 |
CVE-2021-1566 UPD | 5.8 | 7.4 | 0.0067 | 2021-06-16 |
CVE-2026-44852 UPD | 5.5 | 7.2 | 0.0061 | 2026-05-12 |
CVE-2021-44532 UPD | 5.4 | 5.3 | 0.1036 | 2022-02-24 |
CVE-2026-33779 UPD | 4.9 | 6.5 | 0.0018 | 2026-04-09 |
CVE-2026-27133 | 4.5 | 5.9 | 0.0023 | 2026-02-20 |
CVE-2025-22459 UPD | 3.9 | 4.8 | 0.0031 | 2025-04-08 |
CVE-2026-42789 UPD | 3.9 | 4.8 | 0.0035 | 2026-05-27 |
CVE-2025-10539 UPD | 3.8 | 4.8 | 0.0018 | 2026-04-28 |
CVE-2024-43196 UPD | 3.6 | 4.3 | 0.0024 | 2025-02-20 |
CVE-2026-73542 UPD | 3.1 | 3.7 | 0.0018 | 2026-08-20 |