Class weakness
Draft
CWE-326: Inadequate Encryption Strength
The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.
164
Recorded CVEs
With this primary weakness
4
KEVs
In the CISA KEV catalog
Not rated
Likelihood of exploit
Per MITRE
Class
Abstraction
MITRE classification
Overview
A weak encryption scheme can be subjected to brute force attacks that have a reasonable chance of succeeding using current attack methods and resources.
Real-world CVEs
164 recorded CVEs are caused by CWE-326 (Inadequate Encryption Strength), including 4 in CISA's KEV (Known Exploited Vulnerabilities) catalog. KEVs are shown first. 13 new CWE-326 CVEs have been recorded so far in 2026 (30 in 2025).