CWE · MITRE source
CWE-798Use of Hard-coded Credentials
The product contains hard-coded credentials, such as a password or cryptographic key.
There are two main variations:
Last updated: 16 October 2026 00:29 UTC
Cumulative inbound coverage
How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.
Collective: partial · 1 mapping(s) from 1 framework(s): CSF 2.0 1 (partial)
OWASP Top 10 for Web (2025)
This weakness contributes to A07:2025 Authentication Failures.
Control responseHuman-reviewed
Answering this weakness across the control lifecycle, from our framework cross-walks.
NIST 800-53 r5 controls PROPOSED for this weakness (21)AI-assisted
These are model PROPOSALS, not graded mappings. They come
from controls_to_cwe_proposals, which carries no grade field at
all; across the CWE pages 1,540 of 1,722 such associations (89%) have never
been graded by anything. The heading said “address” until
2026-09-29, which asserted a relationship the data does not carry.
Graded cross-walks are on the framework map, not here.
Showing the 15 most specific. Generic controls that address many weakness types are collapsed below.
| Control | Title | Family | Why it addresses this CWE |
|---|---|---|---|
IA-5 | Authenticator Management | IA | graded partial Changing default authenticators prior to first use and protecting content prevents use of hard-coded credentials. |
SA-12 | Supply Chain Protection | SA | Supplier evaluation and secure acquisition practices make it harder for hard-coded credentials to be introduced via procured products. |
SA-13 | Trustworthiness | SA | Reduces hard-coded credentials by requiring that trustworthiness evidence includes absence of embedded secrets that bypass normal authentication. |
SA-21 | Developer Screening | SA | Vetting reduces the chance a developer will deliberately insert hard-coded credentials as a backdoor or unauthorized access mechanism. |
IA-1 | Policy and Procedures | IA | Policy and procedures prohibit hard-coded credentials in favor of managed authentication. |
IA-13 | Identity Providers and Authorization Servers | IA | External identity providers eliminate the need for hard-coded credentials in applications. |
PM-16 | Threat Awareness Program | PM | Intelligence programs surface reports of campaigns that abuse hard-coded credentials in products, prompting removal or replacement and thereby reducing successful exploitation. |
PM-3 | Information Security and Privacy Resources | PM | Planned investment enables secure credential storage and management systems instead of hard-coded credentials. |
PM-30 | Supply Chain Risk Management Strategy | PM | Strategy enforces supplier requirements and code reviews that reduce hard-coded credentials introduced through acquired products. |
SR-1 | Policy and Procedures | SR | Policy and procedures require review of procured products for hard-coded credentials, reducing the chance they are introduced via the supply chain. |
SR-6 | Supplier Assessments and Reviews | SR | Supplier risk reviews identify and discourage hard-coded credentials in delivered products or services. |
AC-9 | Previous Logon Notification | AC | Enables users to notice when hard-coded credentials have been exploited for unauthorized access. |
AT-3 | Role-based Training | AT | Security training explicitly warns against hard-coded credentials, lowering their use in systems. |
PL-9 | Central Management | PL | Central credential stores and rotation policies remove the need for hard-coded credentials in configuration files or code. |
PS-2 | Position Risk Designation | PS | Vetting individuals before they occupy roles that touch credentials or secrets reduces the likelihood of hard-coded credentials being introduced or abused. |
Show 6 more broadly-applicable controls
SA-3 | System Development Life Cycle | SA | Integrating risk management and security responsibilities into the SDLC makes use of hard-coded credentials visible during design and code reviews, reducing their introduction. |
SA-4 | Acquisition Process | SA | Requiring security functional requirements and acceptance criteria allows contracts to prohibit hard-coded credentials in delivered systems or components. |
SA-5 | System Documentation | SA | Known vulnerabilities section of admin docs covers hard-coded credentials and how to replace them, limiting their use in deployments. |
RA-10 | Threat Hunting | RA | Anomalous use of hard-coded credentials can be uncovered through behavioral and log analysis during hunts. |
SC-38 | Operations Security | SC | Makes hard-coded credentials less likely by requiring OPSEC treatment of authentication material as protected information throughout development. |
SI-5 | Security Alerts, Advisories, and Directives | SI | Advisories about products containing hard-coded credentials allow organizations to apply mitigations or avoid affected components before exploitation. |
Top CVEs of this weakness type, ranked by Risk Priority
| CVE | Risk | CVSS | EPSS | Published |
|---|---|---|---|---|
CVE-2026-22769 KEV | 10.0 | 10.0 | 0.1353 | 2026-02-17 |
CVE-2017-14143 UPD | 9.9 | 9.8 | 0.7742 | 2017-09-19 |
CVE-2019-1619 UPD | 9.9 | 9.8 | 0.8282 | 2019-06-27 |
CVE-2019-1935 UPD | 9.9 | 9.8 | 0.8339 | 2019-08-21 |
CVE-2019-15975 UPD | 9.9 | 9.8 | 0.9646 | 2020-01-06 |
CVE-2019-15976 UPD | 9.9 | 9.8 | 0.9284 | 2020-01-06 |
CVE-2020-8657 KEV UPD | 9.9 | 9.8 | 0.9187 | 2020-02-06 |
CVE-2020-13166 UPD | 9.9 | 9.8 | 0.7763 | 2020-05-19 |
CVE-2020-11854 UPD | 9.9 | 9.8 | 0.7445 | 2020-10-27 |
CVE-2022-26138 KEV UPD | 9.9 | 9.8 | 0.9824 | 2022-07-20 |
CVE-2023-6448 KEV UPD | 9.9 | 9.8 | 0.0209 | 2023-12-05 |
CVE-2024-3272 KEV UPD | 9.9 | 9.8 | 0.9804 | 2024-04-04 |
CVE-2024-3408 UPD | 9.9 | 9.8 | 0.7797 | 2024-06-06 |
CVE-2024-20439 KEV UPD | 9.9 | 9.8 | 0.9709 | 2024-09-04 |
CVE-2025-14611 KEV UPD | 9.9 | 9.8 | 0.5330 | 2025-12-12 |
CVE-2016-1560 UPD | 9.8 | 9.8 | 0.7229 | 2017-04-21 |
CVE-2014-9614 UPD | 9.8 | 9.8 | 0.6871 | 2020-02-19 |
CVE-2020-4429 UPD | 9.8 | 9.8 | 0.7195 | 2020-05-07 |
CVE-2023-22463 UPD | 9.8 | 9.8 | 0.6967 | 2023-01-04 |
CVE-2023-5074 UPD | 9.8 | 9.8 | 0.6956 | 2023-09-20 |
CVE-2021-22707 UPD | 9.7 | 9.8 | 0.6461 | 2021-07-21 |
CVE-2023-28503 UPD | 9.6 | 9.8 | 0.6214 | 2023-03-29 |
CVE-2018-9161 UPD | 9.5 | 9.8 | 0.5671 | 2018-03-31 |
CVE-2024-28987 KEV UPD | 9.5 | 9.1 | 0.9330 | 2024-08-21 |
CVE-2022-1162 UPD | 9.4 | 9.1 | 0.7564 | 2022-04-04 |