Log inLog in

Base weakness

Incomplete

CWE-15: External Control of System or Configuration Setting

One or more system settings or configuration elements can be externally controlled by a user.

Last updated May 1, 2026

59

Recorded CVEs

With this primary weakness

0

KEVs

In the CISA KEV catalog

Not rated

Likelihood of exploit

Per MITRE

Base

Abstraction

MITRE classification

Overview

Allowing external control of system settings can disrupt service or cause an application to behave in unexpected, and potentially malicious ways.

Real-world CVEs

59 recorded CVEs are caused by CWE-15 (External Control of System or Configuration Setting). The highest-severity and most recent are shown first. 16 new CWE-15 CVEs have been recorded so far in 2026 (22 in 2025).

Critical · CVSS 9.1

2025-01-14

Showing 12 of 59 recorded CWE-15 CVEs. Track new ones as they are published and get AI-written analysis and fixes.

Monitor CWE-15 vulnerabilities

Common consequences

What can happen when CWE-15 is exploited.

Varies by Context

Affects: Other

How it happens

When it is introduced

Typically introduced during these phases of the software lifecycle.

Implementation

Applies to

Technologies

ICS/OT

How to prevent it

Practical mitigations for CWE-15, grouped by where in the lifecycle they apply.

Architecture and Design

Separation of Privilege

Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.

Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

Implementation

Architecture and Design

Because setting manipulation covers a diverse set of functions, any attempt at illustrating it will inevitably be incomplete. Rather than searching for a tight-knit relationship between the functions addressed in the setting manipulation category, take a step back and consider the sorts of system values that an attacker should not be allowed to control.

Implementation

Architecture and Design

In general, do not allow user-provided or otherwise untrusted data to control sensitive values. The leverage that an attacker gains by controlling these values is not always immediately obvious, but do not underestimate the creativity of the attacker.

How to detect it

Automated Static Analysis

Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

Effectiveness: High

Code examples

Illustrative examples from MITRE showing how the weakness appears in code.

The following C code accepts a number as one of its command line parameters and sets it as the host ID of the current machine.

Although a process must be privileged to successfully invoke sethostid(), unprivileged users may be able to invoke the program. The code in this example allows user input to directly control the value of a system setting. If an attacker provides a malicious value for host ID, the attacker can misidentify the affected machine on the network or cause other unintended behavior.

The following Java code snippet reads a string from an HttpServletRequest and sets it as the active catalog for a database Connection.

In this example, an attacker could cause an error by providing a nonexistent catalog name or connect to an unauthorized portion of the database.

Terminology & mappings

Mapped taxonomies

7 Pernicious Kingdoms: Setting Manipulation
Software Fault Patterns: Tainted input to variable (SFP25)

Attack patterns

CAPEC attack patterns that exploit this weakness.

Frequently asked questions

Common questions about CWE-15.

What is CWE-15?

One or more system settings or configuration elements can be externally controlled by a user.

What CVEs are caused by CWE-15?

59 recorded CVEs are attributed to CWE-15, including CVE-2024-4326, CVE-2024-39800, CVE-2024-39799.

How do you prevent CWE-15?

Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.

How is CWE-15 detected?

Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

What are the consequences of CWE-15?

Exploiting CWE-15 can lead to: Varies by Context.

Is CWE-15 actively exploited?

59 recorded CVEs are caused by CWE-15; none are currently in CISA's KEV catalog of actively exploited flaws.

References

Weakness data is sourced from the MITRE CWE catalog (v4.20). CVE associations are aggregated and kept current by RadicalNotion.AI.

Stay ahead of CWE-15

Get alerted the moment a new CWE-15 vulnerability affects your stack, with AI-written analysis, severity context, and remediation guidance.

Start free See pricing

Overview

Real-world CVEs

Common consequences

How it happens

When it is introduced

Applies to

How to prevent it

How to detect it

Automated Static Analysis

Code examples

Related weaknesses

Parent

Terminology & mappings

Mapped taxonomies

Attack patterns

Frequently asked questions

What is CWE-15?

What CVEs are caused by CWE-15?

How do you prevent CWE-15?

How is CWE-15 detected?

What are the consequences of CWE-15?

Is CWE-15 actively exploited?

References

Stay ahead of CWE-15