CWE · MITRE source
CWE-524Use of Cache Containing Sensitive Information
The code uses a cache that contains sensitive information, but the cache can be read by an actor outside of the intended control sphere.
Applications may use caches to improve efficiency when communicating with remote entities or performing intensive calculations. A cache maintains a pool of objects, threads, connections, pages, financial data, passwords, or other resources to minimize the time it takes to initialize and access these resources. If the cache is accessible to unauthorized actors, attackers can read the cache and obtain this sensitive information.
Last updated: 15 October 2026 20:36 UTC
Cumulative inbound coverage
How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.
Collective: partial · 1 mapping(s) from 1 framework(s): ATT&CK 1 (partial)
Control responseHuman-reviewed
Answering this weakness across the control lifecycle, from our framework cross-walks.
—
—
V14.3.2
NIST 800-53 r5 controls PROPOSED for this weakness (1)AI-assisted
These are model PROPOSALS, not graded mappings. They come
from controls_to_cwe_proposals, which carries no grade field at
all; across the CWE pages 1,540 of 1,722 such associations (89%) have never
been graded by anything. The heading said “address” until
2026-09-29, which asserted a relationship the data does not carry.
Graded cross-walks are on the framework map, not here.
| Control | Title | Family | Why it addresses this CWE |
|---|---|---|---|
SI-21 | Information Refresh | SI | Refreshing cached data or generating it ephemerally and deleting afterward directly mitigates storage of sensitive information in caches. |
Top CVEs of this weakness type, ranked by Risk Priority
| CVE | Risk | CVSS | EPSS | Published |
|---|---|---|---|---|
CVE-2025-64762 UPD | 6.8 | 9.1 | 0.0037 | 2025-11-21 |
CVE-2026-53943 | 6.7 | 9.6 | 0.0045 | 2026-06-24 |
CVE-2021-24027 UPD | 6.4 | 7.5 | 0.0381 | 2021-04-06 |
CVE-2026-61836 UPD | 6.2 | 8.6 | 0.0047 | 2026-07-15 |
CVE-2024-27917 UPD | 5.9 | 7.5 | 0.0061 | 2024-03-06 |
CVE-2026-35172 UPD | 5.9 | 7.5 | 0.0067 | 2026-04-06 |
CVE-2026-13007 UPD | 5.9 | 7.5 | 0.0061 | 2026-06-23 |
CVE-2026-25703 UPD | 5.9 | 7.3 | 0.0080 | 2026-08-05 |
CVE-2026-71316 UPD | 5.9 | 7.5 | 0.0051 | 2026-08-05 |
CVE-2026-93748 UPD | 5.9 | 7.5 | 0.0057 | 2026-09-18 |
CVE-2026-48901 UPD | 5.8 | 7.5 | 0.0042 | 2026-05-26 |
CVE-2026-50170 UPD | 5.8 | 7.5 | 0.0043 | 2026-06-22 |
CVE-2026-64792 | 5.8 | 7.5 | 0.0042 | 2026-07-22 |
CVE-2026-65755 | 5.8 | 7.5 | 0.0042 | 2026-07-23 |
CVE-2024-45596 UPD | 5.5 | 7.4 | 0.0066 | 2024-09-10 |
CVE-2026-0281 UPD | 5.4 | 7.1 | 0.0028 | 2026-07-09 |
CVE-2024-12314 | 5.3 | 7.2 | 0.0036 | 2025-02-18 |
CVE-2019-9494 UPD | 5.2 | 5.9 | 0.0388 | 2019-04-17 |
CVE-2026-25540 UPD | 5.2 | 6.5 | 0.0046 | 2026-02-04 |
CVE-2025-69202 UPD | 5.0 | 6.5 | 0.0032 | 2025-12-29 |
CVE-2026-46309 UPD | 5.0 | 7.0 | 0.0013 | 2026-06-08 |
CVE-2026-84933 UPD | 5.0 | 6.5 | 0.0030 | 2026-09-04 |
CVE-2026-59903 UPD | 4.9 | 6.5 | 0.0025 | 2026-08-17 |
CVE-2025-57752 UPD | 4.8 | 6.2 | 0.0035 | 2025-08-29 |
CVE-2026-109829 | 4.8 | 7.4 | 0.0000 | 2026-10-15 |