CWE-471Modification of Assumed-Immutable Data (MAID)

Abstraction: Base · CVEs in our corpus: 42

The product does not properly protect an assumed-immutable element from being modified by an attacker.

This occurs when a particular input is critical enough to the functioning of the application that it should not be modifiable at all, but it is. Certain resources are often assumed to be immutable when they are not, such as hidden form fields in web applications, cookies, and reverse DNS lookups.

Last updated: 14 October 2026 20:41 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: mostly · 1 mapping(s) from 1 framework(s): STIG windows 10 1 (mostly)

See the full cumulative-coverage rollup →

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent

Stop it (NIST 800-53 / CSF Protect)

SC-33 Transmission Preparation Integrity
PR.AA-05
PR.DS-01
PR.DS-10

Detect

Catch it (CSF Detect / Respond)

—

Harden

Shrink the surface (DISA STIG)

1 hardening rule · 1 OS baseline

Validate

Prove the fix (OWASP ASVS)

—

NIST 800-53 r5 controls PROPOSED for this weakness (1)AI-assisted

These are model PROPOSALS, not graded mappings. They come from controls_to_cwe_proposals, which carries no grade field at all; across the CWE pages 1,540 of 1,722 such associations (89%) have never been graded by anything. The heading said “address” until 2026-09-29, which asserted a relationship the data does not carry. Graded cross-walks are on the framework map, not here.

Control	Title	Family	Why it addresses this CWE
`SC-33`	Transmission Preparation Integrity	SC	Checksums and integrity protection during transformation/packing detect unauthorized modification of data assumed to be immutable before it is transmitted.

Top CVEs of this weakness type, ranked by Risk Priority

CVE	Risk	CVSS	EPSS	Published
`CVE-2020-8147`	7.8	9.8	0.0315	2020-04-03
`CVE-2020-8158`	7.7	9.8	0.0212	2020-09-18
`CVE-2022-25893`	7.6	9.8	0.0149	2022-12-21
`CVE-2022-21824`	7.5	8.2	0.2151	2022-02-24
`CVE-2018-3728`	7.1	8.8	0.0419	2018-03-30
`CVE-2026-50481`	7.1	9.9	0.0082	2026-08-07
`CVE-2018-3719`	6.9	8.8	0.0209	2018-06-07
`CVE-2018-3720`	6.9	8.8	0.0199	2018-06-07
`CVE-2018-3722`	6.9	8.8	0.0200	2018-06-07
`CVE-2018-3723`	6.9	8.8	0.0200	2018-06-07
`CVE-2020-8116`	6.2	7.3	0.0308	2020-02-04
`CVE-2020-15256`	6.2	7.7	0.0155	2020-10-19
`CVE-2020-26245`	6.2	8.1	0.0223	2020-11-27
`CVE-2020-8268`	6.1	7.5	0.0129	2020-11-09
`CVE-2024-55551`	6.0	8.3	0.0064	2025-03-19
`CVE-2023-2904`	5.7	7.3	0.0056	2023-06-07
`CVE-2018-3721`	5.5	6.5	0.0235	2018-06-07
`CVE-2024-9876`	5.5	7.3	0.0025	2025-04-30
`CVE-2026-44798`	5.5	7.1	0.0050	2026-05-28
`CVE-2025-33136`	5.4	7.1	0.0034	2025-05-22
`CVE-2023-43697`	5.3	6.5	0.0087	2023-10-09
`CVE-2021-37177`	5.1	6.5	0.0039	2021-09-14
`CVE-2024-34517`	5.1	6.5	0.0063	2024-05-07
`CVE-2026-103001`	4.9	6.5	0.0024	2026-09-30
`CVE-2024-57708`	4.8	5.7	0.0093	2025-06-25