CWE · MITRE source
CWE-636Not Failing Securely ('Failing Open')
When the product encounters an error condition or failure, its design requires it to fall back to a state that is less secure than other options that are available, such as selecting the weakest encryption algorithm or using the most permissive access control restrictions.
By entering a less secure state, the product inherits the weaknesses associated with that state, making it easier to compromise. At the least, it causes administrators to have a false sense of security. This weakness typically occurs as a result of wanting to "fail functional" to minimize administration and support costs, instead of "failing safe."
Last updated: 14 October 2026 20:41 UTC
OWASP Top 10 for Web (2025)
This weakness contributes to A10:2025 Mishandling of Exceptional Conditions.
Control responseHuman-reviewed
Answering this weakness across the control lifecycle, from our framework cross-walks.
—
—
—
NIST 800-53 r5 controls PROPOSED for this weakness (9)AI-assisted
These are model PROPOSALS, not graded mappings. They come
from controls_to_cwe_proposals, which carries no grade field at
all; across the CWE pages 1,540 of 1,722 such associations (89%) have never
been graded by anything. The heading said “address” until
2026-09-29, which asserted a relationship the data does not carry.
Graded cross-walks are on the framework map, not here.
| Control | Title | Family | Why it addresses this CWE |
|---|---|---|---|
SI-13 | Predictable Failure Prevention | SI | Standby components and explicit exchange criteria enforce a controlled, secure failover instead of failing open. |
SI-17 | Fail-safe Procedures | SI | Directly implements fail-safe (fail-closed/secure) behavior on indicated failures, preventing the system from defaulting to an insecure open state. |
SI-6 | Security and Privacy Function Verification | SI | Failed verification tests trigger alerts, reducing the window for exploitation when systems fail open. |
AU-15 | Alternate Audit Logging Capability | AU | Ensures audit logging continues on primary failure instead of failing open with no logging capability. |
AU-5 | Response to Audit Logging Process Failures | AU | Supports failing securely by requiring alerts and configurable actions (e.g., shutdown) when the audit mechanism fails instead of continuing without it. |
CP-12 | Safe Mode | CP | Entering safe mode when conditions are detected prevents failing open and continuing normal operation in a potentially exploitable state. |
CP-13 | Alternative Security Mechanisms | CP | Ensures security functions remain enforced via alternatives instead of defaulting to an insecure state when the primary means fails. |
SA-8 | Security and Privacy Engineering Principles | SA | Fail-safe-defaults principle prevents systems from failing open. |
SC-24 | Fail in Known State | SC | Directly requires transition to a known (secure) state on failure, preventing fail-open behavior. |
Top CVEs of this weakness type, ranked by Risk Priority
| CVE | Risk | CVSS | EPSS | Published |
|---|---|---|---|---|
CVE-2024-43532 UPD | 7.5 | 8.8 | 0.1197 | 2024-10-08 |
CVE-2026-53913 | 7.5 | 9.8 | 0.0109 | 2026-07-06 |
CVE-2024-3729 UPD | 7.4 | 9.8 | 0.0081 | 2024-05-02 |
CVE-2026-22034 UPD | 7.4 | 9.8 | 0.0071 | 2026-01-08 |
CVE-2026-40525 UPD | 7.0 | 9.1 | 0.0076 | 2026-04-17 |
CVE-2021-1578 UPD | 6.9 | 8.8 | 0.0197 | 2021-08-25 |
CVE-2026-95848 | 6.8 | 9.1 | 0.0042 | 2026-09-23 |
CVE-2026-68746 | 6.7 | 8.8 | 0.0080 | 2026-08-05 |
CVE-2026-44094 | 6.5 | 8.6 | 0.0045 | 2026-07-30 |
CVE-2026-50528 UPD | 6.3 | 8.2 | 0.0061 | 2026-07-14 |
CVE-2026-54762 | 6.2 | 8.6 | 0.0043 | 2026-06-23 |
CVE-2026-18329 | 6.2 | 8.2 | 0.0038 | 2026-09-02 |
CVE-2026-77560 | 6.2 | 8.1 | 0.0061 | 2026-09-21 |
CVE-2023-4030 UPD | 6.1 | 8.4 | 0.0019 | 2023-08-17 |
CVE-2023-28840 UPD | 5.9 | 7.5 | 0.0256 | 2023-04-04 |
CVE-2024-8185 UPD | 5.9 | 7.5 | 0.0048 | 2024-10-31 |
CVE-2026-40247 | 5.9 | 7.5 | 0.0051 | 2026-04-16 |
CVE-2026-40248 | 5.9 | 7.5 | 0.0050 | 2026-04-16 |
CVE-2026-69306 UPD | 5.9 | 8.2 | 0.0054 | 2026-08-11 |
CVE-2026-81379 | 5.9 | 8.2 | 0.0054 | 2026-09-08 |
CVE-2026-42423 | 5.8 | 7.5 | 0.0058 | 2026-04-28 |
CVE-2026-95676 UPD | 5.8 | 7.5 | 0.0037 | 2026-09-23 |
CVE-2026-35042 | 5.7 | 7.5 | 0.0020 | 2026-04-06 |
CVE-2026-35205 UPD | 5.7 | 7.8 | 0.0022 | 2026-04-09 |
CVE-2026-70452 UPD | 5.7 | 7.4 | 0.0046 | 2026-08-13 |