CWE-325Missing Cryptographic Step

Abstraction: Base · CVEs in our corpus: 59

The product does not implement a required step in a cryptographic algorithm, resulting in weaker encryption than advertised by the algorithm.

Last updated: 22 August 2026 14:14 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: mostly · 8 mapping(s) from 7 framework(s): STIG oracle linux 8 2 (mostly) · STIG rhel 8 1 (mostly) · STIG ubuntu 22 04 1 (mostly) · STIG ubuntu 24 04 1 (mostly) · STIG oracle linux 9 1 (mostly) · CAPEC 1 (partial) · STIG rhel 7 1 (partial)

See the full cumulative-coverage rollup →

OWASP Top 10 for Web (2025)

This weakness contributes to A04:2025 Cryptographic Failures.

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent

Stop it (NIST 800-53 / CSF Protect)

PR.DS-01
PR.DS-02
PR.PS-06
SC-13 Cryptographic Protection

Detect

Catch it (CSF Detect / Respond)

—

Harden

Shrink the surface (DISA STIG)

14 hardening rules · 6 OS baselines

Validate

Prove the fix (OWASP ASVS)

—

NIST 800-53 r5 controls that address this weakness (0)AI-assisted

Control	Title	Family	Why it addresses this CWE
No NIST controls proposed yet.

Top CVEs of this weakness type, ranked by Risk Priority

CVE	Risk	CVSS	EPSS	Published
`CVE-2020-15086`	7.8	9.8	0.0272	2020-07-29
`CVE-2022-24116`	7.2	9.8	0.0029	2022-12-26
`CVE-2020-15098`	7.0	8.8	0.0223	2020-07-29
`CVE-2026-17666`	6.7	9.1	0.0019	2026-07-30
`CVE-2021-22946`	6.5	7.5	0.0454	2021-09-29
`CVE-2021-33560`	6.3	7.5	0.0234	2021-06-08
`CVE-2026-4601`	6.1	8.7	0.0030	2026-03-23
`CVE-2026-45445`	5.9	7.5	0.0060	2026-06-09
`CVE-2023-46129`	5.8	7.5	0.0037	2023-10-31
`CVE-2022-20742`	5.7	7.4	0.0044	2022-05-03
`CVE-2025-60704`	5.7	7.5	0.0053	2025-11-11
`CVE-2026-22863`	5.7	7.5	0.0020	2026-01-15
`CVE-2026-28498`	5.7	7.5	0.0023	2026-03-16
`CVE-2026-4258`	5.7	7.5	0.0025	2026-03-17
`CVE-2026-40542`	5.7	7.3	0.0046	2026-04-22
`CVE-2026-41395`	5.6	7.5	0.0015	2026-04-28
`CVE-2026-42246`	5.6	7.4	0.0031	2026-05-09
`CVE-2018-5383`	5.4	6.8	0.0081	2018-08-07
`CVE-2019-3738`	5.4	6.5	0.0168	2019-09-18
`CVE-2020-26244`	5.4	6.8	0.0082	2020-12-02
`CVE-2026-49440`	5.4	7.4	0.0015	2026-06-23
`CVE-2024-43547`	5.2	6.5	0.0065	2024-10-08
`CVE-2022-20793`	5.2	6.8	0.0043	2024-11-15
`CVE-2025-47383`	5.2	7.2	0.0013	2026-03-02
`CVE-2026-55144`	5.2	7.1	0.0016	2026-07-14