What CVEs are caused by CWE-276?

877 recorded CVEs are attributed to CWE-276, including CVE-2013-0632, CVE-2022-22948, CVE-2023-29131. 2 are listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.

What are the consequences of CWE-276?

Exploiting CWE-276 can lead to: Read Application Data, Modify Application Data.

Is CWE-276 actively exploited?

Yes. 2 CWE-276 vulnerabilities are in CISA's KEV catalog of actively exploited flaws, out of 877 recorded CVEs.

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

Base weakness

Draft

CWE-276: Incorrect Default Permissions

During installation, installed file permissions are set to allow anyone to modify those files.

Last updated May 1, 2026

877

Recorded CVEs

With this primary weakness

2

KEVs

In the CISA KEV catalog

Medium

Likelihood of exploit

Per MITRE

Base

Abstraction

MITRE classification

Overview

CWE-276 (Incorrect Default Permissions) is a base-level software weakness catalogued by MITRE in the Common Weakness Enumeration (CWE). It describes a recurring type of mistake that can lead to exploitable security vulnerabilities.

Real-world CVEs

877 recorded CVEs are caused by CWE-276 (Incorrect Default Permissions), including 2 in CISA's KEV (Known Exploited Vulnerabilities) catalog. KEVs are shown first. 96 new CWE-276 CVEs have been recorded so far in 2026 (210 in 2025).

CVE-2023-29131

Critical · CVSS 10.0 · EPSS 34th

2023-07-11

CVE-2020-29492

Critical · CVSS 10.0 · EPSS 75th

2021-01-04

CVE-2020-29491

Critical · CVSS 10.0 · EPSS 77th

2021-01-04

CVE-2025-60262

Critical · CVSS 9.8 · EPSS 39th

2026-01-06

CVE-2024-43166

Critical · CVSS 9.8 · EPSS 39th

2025-09-03

CVE-2025-8031

Incorrect URL stripping in CSP reports

Critical · CVSS 9.8 · EPSS 35th

2025-07-22

CVE-2014-7210

Critical · CVSS 9.8 · EPSS 35th

2025-06-26

CVE-2025-6179

ChromeOS Extension Disablement and Developer Mode Bypass via ExtHang3r and ExtPrint3r Exploits

Critical · CVSS 9.8 · EPSS 12th

2025-06-16

CVE-2025-24238

Critical · CVSS 9.8 · EPSS 61th

2025-03-31

CVE-2025-24195

Critical · CVSS 9.8 · EPSS 55th

2025-03-31

Showing 12 of 877 recorded CWE-276 CVEs. Track new ones as they are published and get AI-written analysis and fixes.

Monitor CWE-276 vulnerabilities

Common consequences

What can happen when CWE-276 is exploited.

Read Application Data, Modify Application Data

Affects: Confidentiality, Integrity

How it happens

When it is introduced

Typically introduced during these phases of the software lifecycle.

Architecture and Design

Implementation

Installation

Operation

Applies to

Technologies

ICS/OT

How to prevent it

Practical mitigations for CWE-276, grouped by where in the lifecycle they apply.

Architecture and Design

Operation

The architecture needs to access and modification attributes for files to only those users who actually require those actions.

Architecture and Design

Separation of Privilege

Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.

Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.