CWE-693: Protection Mechanism Failure
The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
Last updated
Overview
This weakness covers three distinct situations. A "missing" protection mechanism occurs when the application does not define any mechanism against a certain class of attack. An "insufficient" protection mechanism might provide some defenses - for example, against the most common attacks - but it does not protect against everything that is intended. Finally, an "ignored" mechanism occurs when a mechanism is available and in active use within the product, but the developer has not applied it in some code path.
Real-world CVEs
799 recorded CVEs are caused by CWE-693 (Protection Mechanism Failure), including 14 in CISA's KEV (Known Exploited Vulnerabilities) catalog. KEVs are shown first. 438 new CWE-693 CVEs have been recorded so far in 2026 (109 in 2025).
- CVE-2013-2465CISA KEVCritical · CVSS 10.0 · EPSS 100th2013-06-18
- CVE-2025-40536CISA KEV
SolarWinds Web Help Desk Security Control Bypass Vulnerability
Critical · CVSS 9.2 · EPSS 99th2026-01-28 - CVE-2026-58704CISA KEVHigh · CVSS 8.8 · EPSS 47th2026-09-15
- CVE-2026-21510CISA KEV
Windows Shell Security Feature Bypass Vulnerability
High · CVSS 8.7 · EPSS 98th2026-02-10 - CVE-2026-21513CISA KEV
MSHTML Framework Security Feature Bypass Vulnerability
High · CVSS 8.7 · EPSS 97th2026-02-10 - CVE-2019-1003030CISA KEV
Sandbox bypass in Jenkins Pipeline: Groovy Plugin
High · CVSS 8.7 · EPSS 100th2019-03-08 - CVE-2024-29988CISA KEV
SmartScreen Prompt Security Feature Bypass Vulnerability
High · CVSS 8.6 · EPSS 99th2024-04-09 - CVE-2024-21412CISA KEV
Internet Shortcut Files Security Feature Bypass Vulnerability
High · CVSS 8.5 · EPSS 100th2024-02-13 - CVE-2024-38226CISA KEV
Microsoft Publisher Security Feature Bypass Vulnerability
High · CVSS 7.0 · EPSS 85th2024-09-10 - CVE-2024-38213CISA KEV
Windows Mark of the Web Security Feature Bypass Vulnerability
Medium · CVSS 6.9 · EPSS 96th2024-08-13 - CVE-2025-0411CISA KEV
7-Zip Mark-of-the-Web Bypass Vulnerability
Medium · CVSS 6.4 · EPSS 99th2025-01-25 - CVE-2013-0431CISA KEVMedium · CVSS 5.3 · EPSS 100th2013-01-31
Showing 12 of 799 recorded CWE-693 CVEs. Get an alert for each new one, with AI-written analysis and fixes.
Monitor CWE-693 vulnerabilitiesCommon consequences
What can happen when CWE-693 is exploited.
Bypass Protection Mechanism
Affects: Access Control
How it happens
When it is introduced
Typically introduced during these phases of the software lifecycle.
Applies to
Technologies
Attack patterns
CAPEC attack patterns that exploit this weakness.
- CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs
- CAPEC-107: Cross Site Tracing
- CAPEC-127: Directory Indexing
- CAPEC-17: Using Malicious Files
- CAPEC-20: Encryption Brute Forcing
- CAPEC-22: Exploiting Trust in Client
- CAPEC-237: Escaping a Sandbox by Calling Code in Another Language
- CAPEC-36: Using Unpublished Interfaces or Functionality
- CAPEC-477: Signature Spoofing by Mixing Signed and Unsigned Content
- CAPEC-480: Escaping Virtualization
- CAPEC-51: Poison Web Service Registry
- CAPEC-57: Utilizing REST's Trust in the System Resource to Obtain Sensitive Data
- CAPEC-59: Session Credential Falsification through Prediction
- CAPEC-65: Sniff Application Code
- CAPEC-668: Key Negotiation of Bluetooth Attack (KNOB)
- CAPEC-74: Manipulating State
- CAPEC-87: Forceful Browsing
Frequently asked questions
Common questions about CWE-693.
- What is CWE-693?
- The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
- What CVEs are caused by CWE-693?
- 799 recorded CVEs are attributed to CWE-693, including CVE-2013-2465, CVE-2025-40536, CVE-2026-58704. 14 are listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
- What are the consequences of CWE-693?
- Exploiting CWE-693 can lead to: Bypass Protection Mechanism.
- Is CWE-693 actively exploited?
- Yes. 14 CWE-693 vulnerabilities are in CISA's KEV catalog of actively exploited flaws, out of 799 recorded CVEs.
References
- MITRE CWE definition (CWE-693) (opens in a new tab)
- CWE-693 vulnerabilities on NVD (opens in a new tab)
- Learn: What is a CWE?
Weakness data is sourced from the MITRE CWE catalog (v4.20). CVE associations are aggregated and kept current by RadicalNotion.AI.
Track CWE-693 CVEs
Get an alert when a new CWE-693 CVE affects your products, with AI-written analysis and remediation steps.