Cyber Resilience

CWE · MITRE source

CWE-636Not Failing Securely ('Failing Open')

Abstraction: Class · CVEs in our corpus: 46

When the product encounters an error condition or failure, its design requires it to fall back to a state that is less secure than other options that are available, such as selecting the weakest encryption algorithm or using the most permissive access control restrictions.

By entering a less secure state, the product inherits the weaknesses associated with that state, making it easier to compromise. At the least, it causes administrators to have a false sense of security. This weakness typically occurs as a result of wanting to "fail functional" to minimize administration and support costs, instead of "failing safe."

Last updated: 20 August 2026 13:14 UTC

OWASP Top 10 for Web (2025)

This weakness contributes to A10:2025 Mishandling of Exceptional Conditions.

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent
Stop it (NIST 800-53 / CSF Protect)
  • SI-13 Predictable Failure Prevention
  • SI-17 Fail-safe Procedures
  • SI-6 Security and Privacy Function Verification
  • AU-15 Alternate Audit Logging Capability
Detect
Catch it (CSF Detect / Respond)

Harden
Shrink the surface (DISA STIG)

Validate
Prove the fix (OWASP ASVS)
  • V3.2.1
  • V7.4.1
  • V8.3.3
  • V10.3.4

NIST 800-53 r5 controls that address this weakness (9)AI-assisted

Control Title Family Why it addresses this CWE
SI-13Predictable Failure PreventionSIStandby components and explicit exchange criteria enforce a controlled, secure failover instead of failing open.
SI-17Fail-safe ProceduresSIDirectly implements fail-safe (fail-closed/secure) behavior on indicated failures, preventing the system from defaulting to an insecure open state.
SI-6Security and Privacy Function VerificationSIFailed verification tests trigger alerts, reducing the window for exploitation when systems fail open.
AU-15Alternate Audit Logging CapabilityAUEnsures audit logging continues on primary failure instead of failing open with no logging capability.
AU-5Response to Audit Logging Process FailuresAUSupports failing securely by requiring alerts and configurable actions (e.g., shutdown) when the audit mechanism fails instead of continuing without it.
CP-12Safe ModeCPEntering safe mode when conditions are detected prevents failing open and continuing normal operation in a potentially exploitable state.
CP-13Alternative Security MechanismsCPEnsures security functions remain enforced via alternatives instead of defaulting to an insecure state when the primary means fails.
SA-8Security and Privacy Engineering PrinciplesSAFail-safe-defaults principle prevents systems from failing open.
SC-24Fail in Known StateSCDirectly requires transition to a known (secure) state on failure, preventing fail-open behavior.

Top CVEs of this weakness type, ranked by Risk Priority

CVE Risk CVSS EPSS Published
CVE-2024-43532 7.58.80.11972024-10-08
CVE-2024-3729 7.49.80.00812024-05-02
CVE-2026-22034 7.49.80.00672026-01-08
CVE-2026-539137.49.80.00752026-07-06
CVE-2021-1578 6.98.80.01972021-08-25
CVE-2026-40525 6.99.10.00572026-04-17
CVE-2026-687466.68.80.00452026-08-05
CVE-2026-440946.48.60.00262026-07-30
CVE-2026-50528 6.38.20.00552026-07-14
CVE-2026-547626.28.60.00412026-06-23
CVE-2023-4030 6.18.40.00192023-08-17
CVE-2023-28840 5.97.50.02712023-04-04
CVE-2024-8185 5.97.50.00482024-10-31
CVE-2026-402475.97.50.00492026-04-16
CVE-2026-693065.98.20.00402026-08-11
CVE-2026-402485.87.50.00432026-04-16
CVE-2026-35205 5.77.80.00222026-04-09
CVE-2026-704525.77.40.00462026-08-13
CVE-2026-350425.67.50.00152026-04-06
CVE-2026-424235.67.50.00322026-04-28
CVE-2026-42246 5.67.40.00312026-05-09
CVE-2023-28842 5.36.80.01442023-04-04
CVE-2023-28841 5.16.80.00692023-04-04
CVE-2026-413345.06.50.00322026-04-23
CVE-2021-3614 4.86.40.00242021-07-16