Cyber Resilience

CWE · MITRE source

CWE-506Embedded Malicious Code

Abstraction: Class · CVEs in our corpus: 99

The product contains code that appears to be malicious in nature.

Malicious flaws have acquired colorful names, including Trojan horse, trapdoor, timebomb, and logic-bomb. A developer might insert malicious code with the intent to subvert the security of a product or its host system at some time in the future. It generally refers to a program that performs a useful service but exploits rights of the program's user in a way the user does not intend.

Last updated: 22 August 2026 14:14 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: full · 9 mapping(s) from 4 framework(s): ATT&CK 4 (mostly) · CAPEC 3 (full) · STIG oracle linux 9 1 (partial) · STIG rhel 9 1 (partial)

See the full cumulative-coverage rollup →

OWASP Top 10 for Web (2025)

This weakness contributes to A08:2025 Software or Data Integrity Failures.

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent
Stop it (NIST 800-53 / CSF Protect)
  • SR-1 Policy and Procedures
  • SR-10 Inspection of Systems or Components
  • SR-11 Component Authenticity
  • SR-2 Supply Chain Risk Management Plan
Detect
Catch it (CSF Detect / Respond)

—

Harden
Shrink the surface (DISA STIG)
  • 3 hardening rules · 2 OS baselines
Validate
Prove the fix (OWASP ASVS)

—

NIST 800-53 r5 controls that address this weakness (35)AI-assisted

Showing the 15 most specific. Generic controls that address many weakness types are collapsed below.

Control Title Family Why it addresses this CWE
SR-1Policy and ProceduresSRSupply chain risk management procedures include controls to detect and prevent insertion of malicious code through suppliers and vendors.
SR-10Inspection of Systems or ComponentsSRDirect inspection of components can detect embedded malicious code inserted through supply-chain or runtime tampering.
SR-11Component AuthenticitySRCounterfeit components are a common vector for embedding malicious code; preventing their entry reduces this exposure.
SA-1Policy and ProceduresSAAcquisition procedures can prescribe integrity checks, code review, and provenance validation to reduce introduction of embedded malicious code.
SA-10Developer Configuration ManagementSARequiring documented, approved changes plus security flaw tracking makes undetected insertion of malicious code substantially harder.
SA-12Supply Chain ProtectionSAThe control mandates vetting suppliers and tamper detection, making it harder for malicious code to be embedded by upstream providers.
SC-18Mobile CodeSCMonitoring mobile code usage enables detection of embedded malicious code delivered through allowed mobile code channels.
SC-25Thin NodesSCReduced code footprint and storage make insertion or persistence of embedded malicious code far less feasible.
SC-29HeterogeneitySCEmbedding malicious code becomes far harder to achieve uniformly when components use heterogeneous languages, runtimes, and hardware.
CM-10Software Usage RestrictionsCMRestricting software to licensed versions and controlling P2P prevents introduction of software containing embedded malicious code from unauthorized sources.
CM-11User-installed SoftwareCMThe control prevents users from installing software that contains embedded malicious code.
CM-8System Component InventoryCMRegular inventory reviews and updates make it harder to conceal or exploit embedded malicious code by requiring all components to be documented and accounted for.
SI-14Non-persistenceSIAny embedded malicious code or backdoor written into an instance is erased at termination, rendering persistence mechanisms ineffective across successive instances.
SI-3Malicious Code ProtectionSIDirectly detects and eradicates embedded malicious code at entry/exit points via periodic and real-time scans.
SI-7Software, Firmware, and Information IntegritySIUnauthorized insertion of malicious code into software or firmware is revealed by integrity monitoring.
Show 20 more broadly-applicable controls
SR-2Supply Chain Risk Management PlanSRA supply chain risk management plan requires vetting suppliers and components to prevent introduction of embedded malicious code throughout the system lifecycle.
SR-3Supply Chain Controls and ProcessesSRIdentifying weaknesses and applying supplier controls reduces the likelihood of embedded malicious code being introduced through procured elements.
SR-4ProvenanceSRValid provenance monitoring makes insertion of embedded malicious code during supply chain or development stages detectable.
SR-5Acquisition Strategies, Tools, and MethodsSRAcquisition strategies can require trusted suppliers, code reviews, and integrity attestations that directly reduce the likelihood of receiving components with embedded malicious code.
SR-6Supplier Assessments and ReviewsSRReviews of suppliers and their deliverables can detect or deter introduction of embedded malicious code.
SR-8Notification AgreementsSRNotification agreements enable suppliers to alert acquirers to discovered or suspected embedded malicious code, directly supporting detection and response.
SR-9Tamper Resistance and DetectionSRTamper detection mechanisms can identify embedded malicious code inserted via supply-chain or runtime tampering.
SA-13TrustworthinessSADirectly reduces risk of embedded malicious code by requiring verification that acquired or developed components perform only as specified without hidden malicious behavior.
SA-19Component AuthenticitySAAuthenticity verification and anti-counterfeit procedures detect and block components that may contain embedded malicious code or backdoors.
SA-20Customized Development of Critical ComponentsSAIn-house development of critical components eliminates the attack surface of vendor-embedded malicious code.
SA-21Developer ScreeningSAScreening developers for trustworthiness and appropriate authorizations directly reduces the likelihood that a malicious insider will intentionally embed malicious code during development.
SA-6Software Usage RestrictionsSAMandating only contract-approved software reduces the chance of introducing binaries that contain embedded malicious code.
SC-34Non-modifiable Executable ProgramsSCPrevents embedding or persistence of malicious code in the OS or specified applications since the media cannot be written.
SC-44Detonation ChambersSCDetonation chambers directly detect and analyze embedded malicious code by executing it in isolation before it reaches production systems.
RA-10Threat HuntingRAThe capability explicitly searches for embedded malicious code and backdoors as indicators of compromise.
RA-6Technical Surveillance Countermeasures SurveyRATSCM directly targets and removes embedded malicious hardware or code planted for ongoing technical surveillance.
CP-10System Recovery and ReconstitutionCPReverting to a known state removes any malicious code embedded by an attacker.
MA-3Maintenance ToolsMAThe approval and review process for maintenance tools can prevent introduction or continued use of tools containing embedded malicious code.
PM-30Supply Chain Risk Management StrategyPMSupply chain strategy requires vetting and controls during acquisition to prevent or detect insertion of malicious code by vendors or integrators.
PS-2Position Risk DesignationPSBackground screening for development or deployment roles makes intentional insertion of malicious code by insiders materially harder to accomplish.

MITRE ATT&CK techniques this weakness enables

Our own two-way CWE↔ATT&CK cross-walk — a direct mapping with no public source (the CWE→CAPEC→ATT&CK chain leaves most top weaknesses, incl. XSS and SQLi, mapped to nothing).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

T1027.009 Embedded Payloads←MT1195.001 Compromise Software Dependencies and Development Tools←PT1218.001 Compiled HTML File←PT1221 Template Injection←P

Top CVEs of this weakness type, ranked by Risk Priority

CVE Risk CVSS EPSS Published
CVE-2024-3094 10.010.00.85972024-03-29
CVE-2025-59374 KEV9.99.80.01172025-12-17
CVE-2026-8398 KEV 9.99.80.01462026-05-15
CVE-2026-48027 KEV 9.99.80.01852026-05-27
CVE-2026-45321 KEV 9.49.60.02342026-05-12
CVE-2026-33634 KEV9.28.80.59162026-03-23
CVE-2025-30066 KEV 8.88.60.69792025-03-15
CVE-2025-30154 KEV 8.88.60.02392025-03-19
CVE-2024-4978 KEV 8.68.40.26942024-05-23
CVE-2025-54313 KEV 8.17.50.04152025-07-19
CVE-2017-16128 7.69.80.01462018-06-07
CVE-2026-464127.410.00.00422026-07-20
CVE-2026-180727.49.80.00592026-07-29
CVE-2026-667477.49.80.00582026-08-05
CVE-2026-319767.39.80.00502026-03-11
CVE-2026-344247.39.80.00552026-04-09
CVE-2026-64437.39.80.00502026-04-17
CVE-2026-44484 7.39.80.00392026-05-14
CVE-2026-735327.39.80.00462026-08-13
CVE-2026-735337.39.80.00452026-08-13
CVE-2026-776497.39.80.00432026-08-21
CVE-2026-776507.39.80.00432026-08-21
CVE-2026-776517.39.80.00432026-08-21
CVE-2026-34841 7.19.80.00232026-04-06
CVE-2023-2003 7.09.10.00922023-07-13