Cyber Resilience

CWE · MITRE source

CWE-321Use of Hard-coded Cryptographic Key

Abstraction: Variant · CVEs in our corpus: 329

The product uses a hard-coded, unchangeable cryptographic key.

Last updated: 20 August 2026 13:14 UTC

OWASP Top 10 for Web (2025)

This weakness contributes to A04:2025 Cryptographic Failures.

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent
Stop it (NIST 800-53 / CSF Protect)
  • SA-12 Supply Chain Protection
  • SA-4 Acquisition Process
  • SC-12 Cryptographic Key Establishment and Management
  • SC-17 Public Key Infrastructure Certificates
Detect
Catch it (CSF Detect / Respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)

—

NIST 800-53 r5 controls that address this weakness (5)AI-assisted

Control Title Family Why it addresses this CWE
SA-12Supply Chain ProtectionSASupply chain protection includes scrutiny of cryptographic implementations, reducing hard-coded keys planted by untrusted vendors.
SA-4Acquisition ProcessSAFunctional and assurance requirements specified in acquisition can prohibit hard-coded cryptographic keys in delivered products.
SC-12Cryptographic Key Establishment and ManagementSCProper key establishment and management processes directly preclude embedding static cryptographic keys in source code or binaries.
SC-17Public Key Infrastructure CertificatesSCApproved PKI issuance and trust stores replace ad-hoc or hard-coded keys with properly managed, signed certificates.
SR-6Supplier Assessments and ReviewsSRAssessments can uncover and prevent suppliers from shipping components that contain hard-coded cryptographic keys.

Top CVEs of this weakness type, ranked by Risk Priority

CVE Risk CVSS EPSS Published
CVE-2016-4437 KEV 9.99.80.93042016-06-07
CVE-2023-32169 9.59.80.56062024-05-03
CVE-2023-27584 8.99.80.33612024-09-19
CVE-2025-30406 KEV 8.99.00.93842025-04-03
CVE-2020-10884 8.08.80.26082020-03-25
CVE-2020-6990 7.99.80.04372020-03-16
CVE-2026-26335 7.89.80.02812026-02-13
CVE-2017-14021 7.79.80.01922017-11-01
CVE-2016-9335 7.710.00.01562018-05-09
CVE-2021-40119 7.79.80.02422021-11-04
CVE-2025-57174 7.79.80.02192025-09-15
CVE-2018-0040 7.69.80.01432018-07-11
CVE-2022-0664 7.69.80.01712022-02-18
CVE-2026-62241 7.69.10.06552026-07-17
CVE-2017-7574 7.59.80.01252017-04-06
CVE-2019-19750 7.59.80.01132019-12-12
CVE-2021-27389 7.59.80.01032021-04-22
CVE-2021-32520 7.59.80.01032021-07-07
CVE-2022-22987 7.59.80.01212022-02-04
CVE-2023-27583 7.59.80.00882023-03-13
CVE-2024-30207 7.510.00.00842024-05-14
CVE-2024-5296 7.59.80.01122024-05-23
CVE-2023-37936 7.59.80.01002025-01-14
CVE-2025-34215 7.59.80.01062025-09-29
CVE-2020-2500 7.49.80.00752020-07-01