CWE · MITRE source
CWE-636Not Failing Securely ('Failing Open')
When the product encounters an error condition or failure, its design requires it to fall back to a state that is less secure than other options that are available, such as selecting the weakest encryption algorithm or using the most permissive access control restrictions.
By entering a less secure state, the product inherits the weaknesses associated with that state, making it easier to compromise. At the least, it causes administrators to have a false sense of security. This weakness typically occurs as a result of wanting to "fail functional" to minimize administration and support costs, instead of "failing safe."
Last updated: 20 August 2026 13:14 UTC
OWASP Top 10 for Web (2025)
This weakness contributes to A10:2025 Mishandling of Exceptional Conditions.
Control responseHuman-reviewed
Answering this weakness across the control lifecycle, from our framework cross-walks.
—
—
V3.2.1V7.4.1V8.3.3V10.3.4
NIST 800-53 r5 controls that address this weakness (9)AI-assisted
| Control | Title | Family | Why it addresses this CWE |
|---|---|---|---|
SI-13 | Predictable Failure Prevention | SI | Standby components and explicit exchange criteria enforce a controlled, secure failover instead of failing open. |
SI-17 | Fail-safe Procedures | SI | Directly implements fail-safe (fail-closed/secure) behavior on indicated failures, preventing the system from defaulting to an insecure open state. |
SI-6 | Security and Privacy Function Verification | SI | Failed verification tests trigger alerts, reducing the window for exploitation when systems fail open. |
AU-15 | Alternate Audit Logging Capability | AU | Ensures audit logging continues on primary failure instead of failing open with no logging capability. |
AU-5 | Response to Audit Logging Process Failures | AU | Supports failing securely by requiring alerts and configurable actions (e.g., shutdown) when the audit mechanism fails instead of continuing without it. |
CP-12 | Safe Mode | CP | Entering safe mode when conditions are detected prevents failing open and continuing normal operation in a potentially exploitable state. |
CP-13 | Alternative Security Mechanisms | CP | Ensures security functions remain enforced via alternatives instead of defaulting to an insecure state when the primary means fails. |
SA-8 | Security and Privacy Engineering Principles | SA | Fail-safe-defaults principle prevents systems from failing open. |
SC-24 | Fail in Known State | SC | Directly requires transition to a known (secure) state on failure, preventing fail-open behavior. |
Top CVEs of this weakness type, ranked by Risk Priority
| CVE | Risk | CVSS | EPSS | Published |
|---|---|---|---|---|
CVE-2024-43532 UPD | 7.5 | 8.8 | 0.1197 | 2024-10-08 |
CVE-2024-3729 UPD | 7.4 | 9.8 | 0.0081 | 2024-05-02 |
CVE-2026-22034 UPD | 7.4 | 9.8 | 0.0067 | 2026-01-08 |
CVE-2026-53913 | 7.4 | 9.8 | 0.0075 | 2026-07-06 |
CVE-2021-1578 UPD | 6.9 | 8.8 | 0.0197 | 2021-08-25 |
CVE-2026-40525 UPD | 6.9 | 9.1 | 0.0057 | 2026-04-17 |
CVE-2026-68746 | 6.6 | 8.8 | 0.0045 | 2026-08-05 |
CVE-2026-44094 | 6.4 | 8.6 | 0.0026 | 2026-07-30 |
CVE-2026-50528 UPD | 6.3 | 8.2 | 0.0055 | 2026-07-14 |
CVE-2026-54762 | 6.2 | 8.6 | 0.0041 | 2026-06-23 |
CVE-2023-4030 UPD | 6.1 | 8.4 | 0.0019 | 2023-08-17 |
CVE-2023-28840 UPD | 5.9 | 7.5 | 0.0271 | 2023-04-04 |
CVE-2024-8185 UPD | 5.9 | 7.5 | 0.0048 | 2024-10-31 |
CVE-2026-40247 | 5.9 | 7.5 | 0.0049 | 2026-04-16 |
CVE-2026-69306 | 5.9 | 8.2 | 0.0040 | 2026-08-11 |
CVE-2026-40248 | 5.8 | 7.5 | 0.0043 | 2026-04-16 |
CVE-2026-35205 UPD | 5.7 | 7.8 | 0.0022 | 2026-04-09 |
CVE-2026-70452 | 5.7 | 7.4 | 0.0046 | 2026-08-13 |
CVE-2026-35042 | 5.6 | 7.5 | 0.0015 | 2026-04-06 |
CVE-2026-42423 | 5.6 | 7.5 | 0.0032 | 2026-04-28 |
CVE-2026-42246 UPD | 5.6 | 7.4 | 0.0031 | 2026-05-09 |
CVE-2023-28842 UPD | 5.3 | 6.8 | 0.0144 | 2023-04-04 |
CVE-2023-28841 UPD | 5.1 | 6.8 | 0.0069 | 2023-04-04 |
CVE-2026-41334 | 5.0 | 6.5 | 0.0032 | 2026-04-23 |
CVE-2021-3614 UPD | 4.8 | 6.4 | 0.0024 | 2021-07-16 |