Cyber Posture

CWE · MITRE source

CWE-494Download of Code Without Integrity Check

Abstraction: Base · CVEs in our corpus: 200

The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.

An attacker can execute malicious code by compromising the host server, performing DNS spoofing, or modifying the code in transit.

Last updated: 09 May 2026 03:25 UTC

NIST 800-53 r5 controls that address this weakness (23)AI

Showing the 13 most specific. Generic controls that address many weakness types are collapsed below.

Control Title Family Why it addresses this CWE
SR-1Policy and ProceduresSRPolicy establishes requirements for integrity verification of acquired software and updates, preventing download and use of code lacking integrity checks.
SR-10Inspection of Systems or ComponentsSRPost-download inspection serves as a compensating control that detects code tampering when integrity checks were not performed at acquisition time.
SR-11Component AuthenticitySRDetecting counterfeits requires integrity verification of received components before acceptance.
SA-10Developer Configuration ManagementSAMandating integrity control and approved-only changes during development prevents incorporation of code or components lacking integrity validation.
SA-12Supply Chain ProtectionSASupply chain protection requires integrity verification of acquired components, directly reducing insertion or tampering of malicious code during delivery.
SA-13TrustworthinessSAReduces exposure to code obtained without integrity verification by requiring assurance processes that confirm authenticity and absence of tampering.
CM-11User-installed SoftwareCMPolicies can require integrity verification of software prior to installation, reducing risks from unverified downloads.
CM-14Signed ComponentsCMBlocks installation of components lacking a valid signature, mitigating download or installation of code without integrity checks.
SC-18Mobile CodeSCAuthorizing and controlling mobile code requires verifying origin and integrity before download/execution, directly preventing this weakness.
SC-35External Malicious Code IdentificationSCProactive network scanning for malicious code directly detects and blocks downloads that lack integrity verification.
SI-3Malicious Code ProtectionSIPerforms real-time scans of downloaded code, mitigating risks from downloads lacking integrity checks.
SI-7Software, Firmware, and Information IntegritySIExplicitly detects code or firmware that was obtained or altered without an integrity check.
PM-30Supply Chain Risk Management StrategyPMAcquisition and maintenance portions of the strategy drive requirements for integrity verification of downloaded or supplied code.
Show 10 more broadly-applicable controls
SR-2Supply Chain Risk Management PlanSRThe plan typically requires integrity verification steps for acquired code and components, directly addressing downloads lacking integrity checks.
SR-3Supply Chain Controls and ProcessesSRSupply chain processes require integrity verification of acquired components, directly preventing download or incorporation of unverified code.
SR-4ProvenanceSRTracking provenance of components and code necessitates integrity verification, preventing downloads or inclusions without such checks.
SR-5Acquisition Strategies, Tools, and MethodsSRAcquisition strategies can stipulate that delivered code or firmware must be signed and integrity-checked, making downloads without verification contractually non-compliant.
SR-6Supplier Assessments and ReviewsSRSupply-chain reviews verify that suppliers implement integrity checks before code or components are accepted.
SR-8Notification AgreementsSRSuppliers can be contractually required to notify of integrity failures or required updates for delivered code, improving detection of tampering.
SR-9Tamper Resistance and DetectionSRMandates integrity verification on system components, closing the gap that allows download without checks.
SA-18Tamper Resistance and DetectionSATamper resistance and detection commonly include integrity verification of code and firmware obtained from external sources.
SA-19Component AuthenticitySAComponent authenticity requires verifying origin/integrity of acquired firmware or software, directly preventing inclusion of code without integrity checks.
SA-4Acquisition ProcessSARequiring integrity-protection mechanisms and assurance requirements in contracts prevents acquisition of code-download features lacking integrity checks.

Top CVEs of this weakness type, ranked by Risk Priority

CVE Risk CVSS EPSS Published
CVE-2022-40799 KEV7.08.80.53892022-11-29
CVE-2020-53986.97.50.90182020-01-17
CVE-2026-271804.99.80.48802026-02-18
CVE-2025-15556 KEV3.97.50.06092026-02-03
CVE-2026-3502 KEV3.77.80.02752026-03-30
CVE-2025-681093.39.10.25442025-12-17
CVE-2021-44168 KEV2.73.30.01072022-01-04
CVE-2021-450272.57.50.17352022-09-01
CVE-2022-246442.48.80.10842022-03-10
CVE-2022-289442.48.80.10872022-05-23
CVE-2022-274382.48.10.12272022-06-06
CVE-2001-11252.29.80.03462001-10-05
CVE-2024-274382.19.80.02342024-03-21
CVE-2002-06712.09.80.00512002-07-23
CVE-2016-65672.09.80.01192018-07-13
CVE-2018-192342.08.80.04592018-12-20
CVE-2019-38012.09.80.00072019-04-25
CVE-2018-54092.09.80.00192019-05-08
CVE-2020-12102.09.90.00702020-09-11
CVE-2020-15952.09.90.00532020-09-11
CVE-2020-283322.09.80.00282020-11-24
CVE-2020-23202.09.80.00442020-12-03
CVE-2020-78832.09.80.00772021-12-28
CVE-2022-241172.09.80.00112022-12-26
CVE-2020-226542.09.80.00192023-01-20