What CVEs are caused by CWE-262?

6 recorded CVEs are attributed to CWE-262, including CVE-2026-50101, CVE-2022-22767, CVE-2025-60010.

What are the consequences of CWE-262?

Exploiting CWE-262 can lead to: Gain Privileges or Assume Identity.

Is CWE-262 actively exploited?

6 recorded CVEs are caused by CWE-262; none are currently in CISA's KEV catalog of actively exploited flaws.

Base weakness

Draft

CWE-262: Not Using Password Aging

The product does not have a mechanism in place for managing password aging.

Last updated May 1, 2026

Recorded CVEs

With this primary weakness

KEVs

In the CISA KEV catalog

Low

Likelihood of exploit

Per MITRE

Base

Abstraction

MITRE classification

Overview

Password aging (or password rotation) is a policy that forces users to change their passwords after a defined time period passes, such as every 30 or 90 days. Without mechanisms such as aging, users might not change their passwords in a timely manner. Note that while password aging was once considered an important security feature, it has since fallen out of favor by many, because it is not as effective against modern threats compared to other mechanisms such as slow hashes. In addition, forcing frequent changes can unintentionally encourage users to select less-secure passwords. However, password aging is still in use due to factors such as compliance requirements, e.g., Payment Card Industry Data Security Standard (PCI DSS).

Real-world CVEs

6 recorded CVEs are caused by CWE-262 (Not Using Password Aging). The highest-severity and most recent are shown first. 1 new CWE-262 CVE has been recorded so far in 2026 (2 in 2025).

Common consequences

What can happen when CWE-262 is exploited.

Gain Privileges or Assume Identity

Affects: Access Control

As passwords age, the probability that they are compromised grows.

How it happens

When it is introduced

Typically introduced during these phases of the software lifecycle.

Architecture and Design

How to prevent it

Practical mitigations for CWE-262, grouped by where in the lifecycle they apply.

Architecture and Design

As part of a product's design, require users to change their passwords regularly and avoid reusing previous passwords.

Implementation

Developers might disable clipboard paste operations into password fields as a way to discourage users from pasting a password into a clipboard. However, this might encourage users to choose less-secure passwords that are easier to type, and it can reduce the usability of password managers [REF-1294].

Effectiveness: Discouraged Common Practice

Code examples

Illustrative examples from MITRE showing how the weakness appears in code.

A system does not enforce the changing of passwords every certain period.

Terminology & mappings

Mapped taxonomies

CLASP: Not allowing password aging

Attack patterns

CAPEC attack patterns that exploit this weakness.

Frequently asked questions

Common questions about CWE-262.

What is CWE-262?: The product does not have a mechanism in place for managing password aging.
What CVEs are caused by CWE-262?: 6 recorded CVEs are attributed to CWE-262, including CVE-2026-50101, CVE-2022-22767, CVE-2025-60010.
How do you prevent CWE-262?: As part of a product's design, require users to change their passwords regularly and avoid reusing previous passwords.
What are the consequences of CWE-262?: Exploiting CWE-262 can lead to: Gain Privileges or Assume Identity.
Is CWE-262 actively exploited?: 6 recorded CVEs are caused by CWE-262; none are currently in CISA's KEV catalog of actively exploited flaws.

References

Weakness data is sourced from the MITRE CWE catalog (v4.20). CVE associations are aggregated and kept current by RadicalNotion.AI.

Stay ahead of CWE-262

Get alerted the moment a new CWE-262 vulnerability affects your stack, with AI-written analysis, severity context, and remediation guidance.

Start free See pricing