Cyber Posture

CWE · MITRE source

CWE-250Execution with Unnecessary Privileges

Abstraction: Base · CVEs in our corpus: 305

The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.

Last updated: 09 May 2026 03:25 UTC

NIST 800-53 r5 controls that address this weakness (43)AI

Showing the 15 most specific. Generic controls that address many weakness types are collapsed below.

Control Title Family Why it addresses this CWE
SC-2Separation of System and User FunctionalitySCSeparating user-facing code from system management functions directly prevents execution of privileged operations from untrusted user contexts.
SC-25Thin NodesSCMinimal functionality inherently eliminates execution of unneeded code paths and associated privileges.
SC-27Platform-independent ApplicationsSCRuntimes for platform-independent applications commonly support configurable security managers or sandboxes that enforce least privilege by default.
PS-1Policy and ProceduresPSPersonnel security policy and procedures enforce least-privilege assignment, periodic review, and revocation on termination or role change, directly reducing unnecessary privileges.
PS-2Position Risk DesignationPSRisk designation and screening for elevated positions directly reduces the chance that unvetted personnel receive or retain unnecessary privileges.
PS-3Personnel ScreeningPSScreening supports assignment of access only to those who have been evaluated, reducing execution with unnecessary privileges by untrusted or unqualified personnel.
SA-14Criticality AnalysisSACriticality analysis identifies high-impact functions so that unnecessary privileges can be removed from them, directly reducing the exploitability of excessive-privilege weaknesses.
SA-16Developer-provided TrainingSATraining on correct operation of privilege-related security functions directly reduces unnecessary privilege execution by teaching least-privilege usage.
SA-23SpecializationSASpecialized components can be engineered and configured to execute only the minimal necessary functionality and privileges for the essential service.
AC-1Policy and ProceduresACPolicy promotes least privilege by defining necessary privileges and management commitment to them.
AC-13Supervision and Review — Access ControlACSupervision detects and allows removal of unnecessary privileges that enable execution with excess rights.
AC-2Account ManagementACReviewing accounts for compliance, disabling/removing unneeded accounts, and aligning with termination processes prevents execution with unnecessary privileges.
PM-10Authorization ProcessPMIntegration of authorization into organization-wide risk management includes evaluation of privileges, making execution with unnecessary privileges less likely to be approved.
PM-12Insider Threat ProgramPMInsider threat program enforces least-privilege reviews and monitors privileged actions, directly reducing abuse of unnecessary rights.
PM-13Security and Privacy WorkforcePMWorkforce programs emphasize least-privilege principles, directly reducing unnecessary privilege assignments.
Show 28 more broadly-applicable controls
SC-3Security Function IsolationSCIsolating security functions allows them to execute with only the privileges they require while preventing non-security code from inheriting or accessing those privileges.
SC-32System PartitioningSCEnables execution with minimal necessary privileges by isolating components into distinct environments.
SC-39Process IsolationSCProcess isolation confines each process to its own execution domain, preventing one process from exercising the privileges or resources belonging to another.
SC-43Usage RestrictionsSCAuthorizing only necessary component uses reduces the chance of processes running with extraneous privileges.
SC-49Hardware-enforced Separation and Policy EnforcementSCMandatory hardware separation makes it harder to run code with unnecessary privileges by isolating privilege domains.
SC-50Software-enforced Separation and Policy EnforcementSCSeparation and policy enforcement reduce the ability to execute with unnecessary privileges by isolating higher-privilege functions.
PS-4Personnel TerminationPSDisabling access and retrieving security-related property prevents continued execution with unnecessary privileges by ex-employees.
PS-6Access AgreementsPSAccess agreements document and require acknowledgment of assigned privileges, making execution with unnecessary privileges less likely by establishing accountability and expected behavior.
PS-7External Personnel SecurityPSRequires notification of external personnel terminations and monitors revocation of credentials/privileges, directly reducing retained unnecessary access.
PS-8Personnel SanctionsPSFormal sanctions deter personnel from violating least-privilege policies by imposing consequences for unnecessary privilege use.
PS-9Position DescriptionsPSPosition descriptions that explicitly define security responsibilities directly support assignment of only the privileges needed for a role, reducing execution with unnecessary privileges.
SA-5System DocumentationSADocumentation on secure operation of privileged functions and known vulnerabilities directly reduces execution with unnecessary privileges.
SA-7User-installed SoftwareSARestricts users from obtaining or retaining unnecessary installation/execution privileges.
SA-8Security and Privacy Engineering PrinciplesSALeast-privilege engineering principle directly reduces execution with unnecessary privileges.
AC-5Separation of DutiesACSeparation of duties prevents any single user from holding all privileges needed to complete a critical task, directly reducing execution with unnecessary privileges.
AC-6Least PrivilegeACDirectly prevents execution with more privileges than needed for assigned tasks.
PM-29Risk Management Program Leadership RolesPMOrg-wide risk executive function provides accountability and oversight that directly reduces execution with unnecessary privileges through consistent identification and mitigation.
PM-32PurposingPMIdentifies privileges or capabilities that exceed what is required for the stated mission purpose, enabling removal.
CM-2Baseline ConfigurationCMBaseline review prevents systems from running with unnecessary privileges by enforcing least-privilege settings.
CM-5Access Restrictions for ChangeCMLimiting change access to only approved entities reduces the risk of unnecessary privileges being available for modifications.
CM-6Configuration SettingsCMConfiguration settings can mandate least-privilege execution, reducing unnecessary privileges.
CM-7Least FunctionalityCMProhibiting unnecessary functions, ports, protocols, software, and services directly prevents execution with privileges beyond what is required for the system's purpose.
PL-4Rules of BehaviorPLRules of behavior explicitly require users to operate with only the privileges needed for their role, directly reducing execution with unnecessary privileges.
PL-7Concept of OperationsPLCONOPS explicitly defines intended operational roles, procedures, and privilege usage, reducing the likelihood of unnecessary privileges being assigned or retained during system operation.
AT-3Role-based TrainingATRole-based training on least privilege principles reduces the chance personnel assign or retain unnecessary privileges.
AU-6Audit Record Review, Analysis, and ReportingAUAnalysis of audit records can identify execution with unnecessary privileges through unusual activity patterns.
CA-9Internal System ConnectionsCAAutomatic termination after a defined period eliminates unnecessary privileges from persistent connections.
RA-9Criticality AnalysisRAKnowing which functions and components are critical supports application of least privilege, reducing execution with unnecessary privileges.

Top CVEs of this weakness type, ranked by Risk Priority

CVE Risk CVSS EPSS Published
CVE-2024-38813 KEV5.37.50.29532024-09-17
CVE-2023-463605.18.80.55122024-02-06
CVE-2025-40602 KEV3.36.60.00412025-12-18
CVE-2023-520302.89.80.14822024-01-11
CVE-2024-254212.19.80.02562024-03-26
CVE-2021-410352.09.80.00152021-10-25
CVE-2022-15172.010.00.00552022-06-24
CVE-2022-26342.010.00.00262022-08-10
CVE-2022-445442.09.80.00542022-11-06
CVE-2023-46622.09.80.00742023-09-15
CVE-2024-271432.09.80.00192024-06-14
CVE-2024-33302.09.90.00332024-06-27
CVE-2024-420242.08.80.04312024-09-07
CVE-2024-87672.09.90.00382024-09-17
CVE-2025-324452.09.90.00372025-04-15
CVE-2025-495812.08.80.03872025-06-13
CVE-2025-571192.09.80.00122025-09-16
CVE-2025-345152.09.80.00162025-10-16
CVE-2025-430172.09.80.00042025-10-28
CVE-2025-342742.09.80.00822025-10-30
CVE-2025-332232.09.80.00172025-12-23
CVE-2025-332242.09.80.00042025-12-23
CVE-2025-124202.09.80.00052026-01-12
CVE-2025-133752.09.80.00072026-02-04
CVE-2026-270022.09.80.00022026-02-20