What CVEs are caused by CWE-424?

31 recorded CVEs are attributed to CWE-424, including CVE-2024-58136, CVE-2025-48827, CVE-2023-52952. 1 are listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.

What are the consequences of CWE-424?

Exploiting CWE-424 can lead to: Bypass Protection Mechanism, Gain Privileges or Assume Identity.

Is CWE-424 actively exploited?

Yes. 1 CWE-424 vulnerabilities are in CISA's KEV catalog of actively exploited flaws, out of 31 recorded CVEs.

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

Class weakness

Draft

CWE-424: Improper Protection of Alternate Path

The product does not sufficiently protect all possible paths that a user can take to access restricted functionality or resources.

Last updated May 1, 2026

31

Recorded CVEs

With this primary weakness

1

KEVs

In the CISA KEV catalog

Not rated

Likelihood of exploit

Per MITRE

Class

Abstraction

MITRE classification

Overview

CWE-424 (Improper Protection of Alternate Path) is a class-level software weakness catalogued by MITRE in the Common Weakness Enumeration (CWE). It describes a recurring type of mistake that can lead to exploitable security vulnerabilities.

Real-world CVEs

31 recorded CVEs are caused by CWE-424 (Improper Protection of Alternate Path), including 1 in CISA's KEV (Known Exploited Vulnerabilities) catalog. KEVs are shown first. 5 new CWE-424 CVEs have been recorded so far in 2026 (12 in 2025).

CVE-2025-48828

Critical · CVSS 9.0 · EPSS 99th

2025-05-27

CVE-2023-20272

High · CVSS 8.8 · EPSS 55th

2023-11-21

CVE-2024-8781

Container Escape Vulnerability in TR7's Application Security Platform (ASP)

High · CVSS 8.7 · EPSS 9th

2024-11-18

CVE-2024-3459

High · CVSS 8.4 · EPSS 19th

2024-05-09

CVE-2026-54423

High · CVSS 8.2 · EPSS 40th

2026-07-10

CVE-2025-68939

High · CVSS 8.2 · EPSS 21th

2025-12-26

CVE-2023-46176

IBM MQ privilege escalation

High · CVSS 7.8 · EPSS 7th

2023-11-03

CVE-2019-18996

High · CVSS 7.8 · EPSS 32th

2019-12-18

CVE-2019-18997

High · CVSS 7.5 · EPSS 72th

2019-12-18

Showing 12 of 31 recorded CWE-424 CVEs. Track new ones as they are published and get AI-written analysis and fixes.

Monitor CWE-424 vulnerabilities

Common consequences

What can happen when CWE-424 is exploited.

Bypass Protection Mechanism, Gain Privileges or Assume Identity

Affects: Access Control

How it happens

When it is introduced

Typically introduced during these phases of the software lifecycle.

Architecture and Design

Applies to

Technologies

Web Based

How to prevent it

Practical mitigations for CWE-424, grouped by where in the lifecycle they apply.

Architecture and Design

Deploy different layers of protection to implement security in depth.

Illustrative examples

Real CVEs that MITRE cites as examples of this weakness.

CVE-2022-29238 — Access-control setting in web-based document collaboration tool is not properly implemented by the code, which prevents listing hidden directories but does not prevent direct requests to files in those directories.

Terminology & mappings

Mapped taxonomies

PLOVER: Alternate Path Errors
Software Fault Patterns: Insecure resource access (SFP35)

Attack patterns

CAPEC attack patterns that exploit this weakness.

Frequently asked questions

Common questions about CWE-424.

What is CWE-424?: The product does not sufficiently protect all possible paths that a user can take to access restricted functionality or resources.
What CVEs are caused by CWE-424?: 31 recorded CVEs are attributed to CWE-424, including CVE-2024-58136, CVE-2025-48827, CVE-2023-52952. 1 are listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
How do you prevent CWE-424?: Deploy different layers of protection to implement security in depth.
What are the consequences of CWE-424?: Exploiting CWE-424 can lead to: Bypass Protection Mechanism, Gain Privileges or Assume Identity.
Is CWE-424 actively exploited?: Yes. 1 CWE-424 vulnerabilities are in CISA's KEV catalog of actively exploited flaws, out of 31 recorded CVEs.

References

Weakness data is sourced from the MITRE CWE catalog (v4.20). CVE associations are aggregated and kept current by RadicalNotion.AI.

Stay ahead of CWE-424

Get alerted the moment a new CWE-424 vulnerability affects your stack, with AI-written analysis, severity context, and remediation guidance.

Start free See pricing