CWE · MITRE source
CWE-636Not Failing Securely ('Failing Open')
When the product encounters an error condition or failure, its design requires it to fall back to a state that is less secure than other options that are available, such as selecting the weakest encryption algorithm or using the most permissive access control restrictions.
By entering a less secure state, the product inherits the weaknesses associated with that state, making it easier to compromise. At the least, it causes administrators to have a false sense of security. This weakness typically occurs as a result of wanting to "fail functional" to minimize administration and support costs, instead of "failing safe."
Last updated: 04 July 2026 00:28 UTC
Cumulative inbound coverage
How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.
Collective: full · 13 mapping(s) from 2 framework(s): ASVS 5.0 12 (full) · OWASP-Web 1 (full)
OWASP Top 10 for Web (2025)
This weakness contributes to A10:2025 Mishandling of Exceptional Conditions.
NIST 800-53 r5 controls that address this weakness (9)AI
| Control | Title | Family | Why it addresses this CWE |
|---|---|---|---|
SI-13 | Predictable Failure Prevention | SI | Standby components and explicit exchange criteria enforce a controlled, secure failover instead of failing open. |
SI-17 | Fail-safe Procedures | SI | Directly implements fail-safe (fail-closed/secure) behavior on indicated failures, preventing the system from defaulting to an insecure open state. |
SI-6 | Security and Privacy Function Verification | SI | Failed verification tests trigger alerts, reducing the window for exploitation when systems fail open. |
AU-15 | Alternate Audit Logging Capability | AU | Ensures audit logging continues on primary failure instead of failing open with no logging capability. |
AU-5 | Response to Audit Logging Process Failures | AU | Supports failing securely by requiring alerts and configurable actions (e.g., shutdown) when the audit mechanism fails instead of continuing without it. |
CP-12 | Safe Mode | CP | Entering safe mode when conditions are detected prevents failing open and continuing normal operation in a potentially exploitable state. |
CP-13 | Alternative Security Mechanisms | CP | Ensures security functions remain enforced via alternatives instead of defaulting to an insecure state when the primary means fails. |
SA-8 | Security and Privacy Engineering Principles | SA | Fail-safe-defaults principle prevents systems from failing open. |
SC-24 | Fail in Known State | SC | Directly requires transition to a known (secure) state on failure, preventing fail-open behavior. |
Top CVEs of this weakness type, ranked by Risk Priority
| CVE | Risk | CVSS | EPSS | Published |
|---|---|---|---|---|
CVE-2024-3729 | 7.0 | 9.8 | 0.0081 | 2024-05-02 |
CVE-2026-22034 | 7.0 | 9.8 | 0.0066 | 2026-01-08 |
CVE-2026-40525 | 7.0 | 9.1 | 0.0057 | 2026-04-17 |
CVE-2024-43532 | 6.0 | 8.8 | 0.1171 | 2024-10-08 |
CVE-2021-1578 | 5.5 | 8.8 | 0.0197 | 2021-08-25 |
CVE-2023-28840 | 5.5 | 7.5 | 0.0273 | 2023-04-04 |
CVE-2023-4030 | 5.5 | 8.4 | 0.0018 | 2023-08-17 |
CVE-2024-8185 | 5.5 | 7.5 | 0.0048 | 2024-10-31 |
CVE-2026-35042 | 5.5 | 7.5 | 0.0015 | 2026-04-06 |
CVE-2026-35205 UPD | 5.5 | 7.8 | 0.0018 | 2026-04-09 |
CVE-2026-40247 | 5.5 | 7.5 | 0.0049 | 2026-04-16 |
CVE-2026-40248 | 5.5 | 7.5 | 0.0043 | 2026-04-16 |
CVE-2026-42423 | 5.5 | 7.5 | 0.0032 | 2026-04-28 |
CVE-2026-42246 UPD | 5.5 | 7.4 | 0.0032 | 2026-05-09 |
CVE-2026-54762 | 5.5 | 8.6 | 0.0036 | 2026-06-23 |
CVE-2021-3614 | 3.5 | 6.4 | 0.0024 | 2021-07-16 |
CVE-2023-22943 | 3.5 | 4.8 | 0.0032 | 2023-02-14 |
CVE-2023-28841 | 3.5 | 6.8 | 0.0070 | 2023-04-04 |
CVE-2023-28842 | 3.5 | 6.8 | 0.0144 | 2023-04-04 |
CVE-2024-2660 UPD | 3.5 | 6.4 | 0.0030 | 2024-04-04 |
CVE-2025-21210 | 3.5 | 4.2 | 0.0111 | 2025-01-14 |
CVE-2025-41759 | 3.5 | 4.9 | 0.0032 | 2026-03-09 |
CVE-2025-41760 | 3.5 | 4.9 | 0.0032 | 2026-03-09 |
CVE-2026-27448 | 3.5 | 5.3 | 0.0024 | 2026-03-18 |
CVE-2026-40249 | 3.5 | 5.3 | 0.0032 | 2026-04-16 |