Cyber Posture

CVE-2026-43510

High

Published: 07 May 2026

Published
07 May 2026
Modified
07 May 2026
KEV Added
—
Patch
—
CVSS Score 7.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:H
EPSS Score 0.0005 16.3th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Description

manage.get.gov is the .gov TLD registrar maintained by CISA. manage.get.gov allows an organization administrator to assign domain manager privileges for domains not already in another organization. Fixed in 1.176.0 on or around 2026-04-30.

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

AC-1 Policy and Procedures
addresses: CWE-266

Designation of a manager and policy dissemination ensures privileges are assigned according to defined roles.

AC-13 Supervision and Review — Access Control
addresses: CWE-266

Regular reviews catch incorrect privilege assignments to users, roles, or processes.

AC-2 Account Management
addresses: CWE-266

Explicitly specifying privileges and group/role memberships for accounts reduces the risk of incorrect privilege assignments.

AC-5 Separation of Duties
addresses: CWE-266

The control requires explicit definition of separated access authorizations, making incorrect privilege assignments that bundle conflicting duties harder to implement.

AC-6 Least Privilege
addresses: CWE-266

Ensures privileges are assigned only as necessary rather than incorrectly over-granted.

Security SummaryAI

Automated synthesis unavailable for this CVE.

Details

CWE(s)
CWE-266

References