CWE · MITRE source
CWE-524Use of Cache Containing Sensitive Information
The code uses a cache that contains sensitive information, but the cache can be read by an actor outside of the intended control sphere.
Applications may use caches to improve efficiency when communicating with remote entities or performing intensive calculations. A cache maintains a pool of objects, threads, connections, pages, financial data, passwords, or other resources to minimize the time it takes to initialize and access these resources. If the cache is accessible to unauthorized actors, attackers can read the cache and obtain this sensitive information.
Last updated: 20 August 2026 20:22 UTC
Cumulative inbound coverage
How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.
Collective: mostly · 2 mapping(s) from 2 framework(s): CAPEC 1 (mostly) · ATT&CK 1 (partial)
Control responseHuman-reviewed
Answering this weakness across the control lifecycle, from our framework cross-walks.
—
—
V14.3.2
NIST 800-53 r5 controls that address this weakness (1)AI-assisted
| Control | Title | Family | Why it addresses this CWE |
|---|---|---|---|
SI-21 | Information Refresh | SI | Refreshing cached data or generating it ephemerally and deleting afterward directly mitigates storage of sensitive information in caches. |
MITRE ATT&CK techniques this weakness enables
Our own two-way CWE↔ATT&CK cross-walk — a direct mapping with no public source (the CWE→CAPEC→ATT&CK chain leaves most top weaknesses, incl. XSS and SQLi, mapped to nothing).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Top CVEs of this weakness type, ranked by Risk Priority
| CVE | Risk | CVSS | EPSS | Published |
|---|---|---|---|---|
CVE-2025-64762 UPD | 6.8 | 9.1 | 0.0037 | 2025-11-21 |
CVE-2026-53943 | 6.6 | 9.6 | 0.0028 | 2026-06-24 |
CVE-2021-24027 UPD | 6.4 | 7.5 | 0.0381 | 2021-04-06 |
CVE-2026-61836 UPD | 6.1 | 8.6 | 0.0027 | 2026-07-15 |
CVE-2024-27917 UPD | 5.9 | 7.5 | 0.0061 | 2024-03-06 |
CVE-2026-35172 UPD | 5.8 | 7.5 | 0.0046 | 2026-04-06 |
CVE-2026-13007 UPD | 5.8 | 7.5 | 0.0043 | 2026-06-23 |
CVE-2026-48901 UPD | 5.7 | 7.5 | 0.0024 | 2026-05-26 |
CVE-2026-50170 UPD | 5.7 | 7.5 | 0.0027 | 2026-06-22 |
CVE-2026-64792 | 5.7 | 7.5 | 0.0025 | 2026-07-22 |
CVE-2026-65755 | 5.7 | 7.5 | 0.0024 | 2026-07-23 |
CVE-2026-71316 | 5.7 | 7.5 | 0.0030 | 2026-08-05 |
CVE-2026-25703 | 5.6 | 7.3 | 0.0022 | 2026-08-05 |
CVE-2024-45596 UPD | 5.5 | 7.4 | 0.0066 | 2024-09-10 |
CVE-2024-12314 | 5.3 | 7.2 | 0.0035 | 2025-02-18 |
CVE-2026-0281 UPD | 5.3 | 7.1 | 0.0017 | 2026-07-09 |
CVE-2019-9494 UPD | 5.2 | 5.9 | 0.0388 | 2019-04-17 |
CVE-2026-25540 UPD | 5.1 | 6.5 | 0.0039 | 2026-02-04 |
CVE-2025-69202 | 5.0 | 6.5 | 0.0028 | 2025-12-29 |
CVE-2026-46309 UPD | 5.0 | 7.0 | 0.0013 | 2026-06-08 |
CVE-2026-59903 | 5.0 | 6.5 | 0.0040 | 2026-08-17 |
CVE-2025-57752 UPD | 4.8 | 6.2 | 0.0035 | 2025-08-29 |
CVE-2023-37486 UPD | 4.7 | 5.9 | 0.0052 | 2023-08-08 |
CVE-2025-9901 UPD | 4.7 | 5.9 | 0.0046 | 2025-09-03 |
CVE-2024-0874 UPD | 4.6 | 5.3 | 0.0076 | 2024-04-25 |