---
title: "CWE-264: Permissions, Privileges, and Access Controls"
url: https://radicalnotion.ai/cwe/cwe-264
type: cwe
description: "Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control."
updated: 2026-05-01
source: RadicalNotion.AI
license: CC BY-NC 4.0 (https://creativecommons.org/licenses/by-nc/4.0/)
---

# CWE-264: Permissions, Privileges, and Access Controls

- **Status:** Obsolete
- **CVEs with this as primary weakness:** 5,346
- **Of those, in CISA KEV:** 2
- **New in 2026:** 32
- **CWE catalog version:** 4.20

## Description

Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

## Real CVEs with this weakness (sample of 12 of 5,346)

| CVE | Title | Severity | CVSS | EPSS | CISA KEV | Published |
| --- | --- | --- | --- | --- | --- | --- |
| CVE-2016-3643 | - | high | 8.5 | - | Yes | 2016-06-17 |
| CVE-2015-1769 | - | high | 7.0 | - | Yes | 2015-08-15 |
| CVE-2016-8363 | - | critical | 10.0 | - | No | 2017-02-13 |
| CVE-2016-7457 | - | critical | 10.0 | - | No | 2016-12-29 |
| CVE-2015-7425 | - | critical | 10.0 | - | No | 2016-02-21 |
| CVE-2015-8267 | - | critical | 10.0 | - | No | 2015-12-24 |
| CVE-2015-7919 | - | critical | 10.0 | - | No | 2015-12-21 |
| CVE-2015-7071 | - | critical | 10.0 | - | No | 2015-12-11 |
| CVE-2015-8440 | - | critical | 10.0 | - | No | 2015-12-10 |
| CVE-2015-8236 | - | critical | 10.0 | - | No | 2015-11-19 |
| CVE-2015-7861 | - | critical | 10.0 | - | No | 2015-10-19 |
| CVE-2015-7709 | - | critical | 10.0 | - | No | 2015-10-05 |

## Frequently asked questions

### What is CWE-264?

Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

### What CVEs are caused by CWE-264?

5,346 recorded CVEs are attributed to CWE-264, including CVE-2016-3643, CVE-2015-1769 and CVE-2016-8363. 2 are listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.

### Is CWE-264 actively exploited?

Yes. 2 CWE-264 vulnerabilities are in CISA's KEV catalog of actively exploited flaws, out of 5,346 recorded CVEs.

Primary source: [MITRE CWE](https://cwe.mitre.org/data/definitions/264.html)

---

Source: [RadicalNotion.AI](https://radicalnotion.ai/cwe/cwe-264). Licensed CC BY-NC 4.0; attribute RadicalNotion.AI and link the source page when you reuse this data.