CWE-269— Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.— MITRE CWE catalog
5,416 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-269page 86 of 109
- CVE-2026-83316HIGHCVSS 7.0EG 7.02026-09-15
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security). The supported version that is affected is 26.01.0.0.0. Difficult to exploit vulnerability allows low privile…
- CVE-2026-83239HIGHCVSS 7.0EG 7.02026-09-15
Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller). The supported version that is affected is 11.4.0. Difficult to exploit vulnera…
- CVE-2026-83150HIGHCVSS 7.0EG 7.02026-09-15
Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Application Testing S…
- CVE-2026-73725HIGHCVSS 7.0EG 7.02026-09-01
A local privilege-escalation vulnerability has been discovered in HPE Networking Fabric Composer. Successful exploitation of this vulnerability could allow a local attacker to achieve arbitrary code execution with root privileges, leading …
- CVE-2026-75857HIGHCVSS 7.0EG 7.02026-08-18
CodeWhale versions >= 0.8.41 and < 0.8.64 contain a vulnerability in the exec_shell_interact (alias exec_interact) tool, whose approval_requirement returns ApprovalRequirement::Auto. This overrides the default Required approval for code-ex…
- CVE-2026-61120HIGHCVSS 7.0EG 7.02026-07-21
Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with log…
- CVE-2026-61061HIGHCVSS 7.0EG 7.02026-07-21
Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: Security Framework). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged atta…
- CVE-2026-60833HIGHCVSS 7.0EG 7.02026-07-21
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility). The supported version that is affected is 11.4. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where …
- CVE-2024-38487HIGHCVSS 7.0EG 7.02026-06-16
api-gateway container running with root privilege would allow an attacker to escape the container and access host system to perform unintended actions.
- CVE-2026-41163HIGHCVSS 7.0EG 7.02026-05-09
bubblewrap is a low-level unprivileged sandboxing tool. From version 0.11.0 to before version 0.11.2, if bubblewrap is installed in setuid mode then the user can use ptrace to attach to bubblewrap and control the unprivileged part of the s…
- CVE-2026-4824HIGHCVSS 7.0EG 7.02026-03-25
A vulnerability has been found in Enter Software Iperius Backup up to 8.7.3. Affected by this issue is some unknown functionality of the component Backup Job Configuration File Handler. The manipulation leads to improper privilege manageme…
- CVE-2025-13917HIGHCVSS 7.0EG 7.02026-01-28
WSS Agent, prior to 9.8.5, may be susceptible to a Elevation of Privilege vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated access to resources that are normally…
- CVE-2025-53914HIGHCVSS 7.0EG 7.02025-09-09
Excessive Privileges vulnerability in Calix GigaCenter ONT (Broadcom SoC modules) allows Privilege Abuse.This issue affects GigaCenter ONT: 844E, 844G, 844GE, 854GE, 812G, 813G, 818G.
- CVE-2025-53913HIGHCVSS 7.0EG 7.02025-09-09
Excessive Privileges vulnerability in Calix GigaCenter ONT (Quantenna SoC modules) allows Privilege Abuse.This issue affects GigaCenter ONT: 844E, 844G, 844GE, 854GE, 812G, 813G, 818G.
- CVE-2025-26513HIGHCVSS 7.0EG 7.02025-08-07
The installer for SAN Host Utilities for Windows versions prior to 8.0 is susceptible to a vulnerability which when successfully exploited could allow a local user to escalate their privileges.
- CVE-2025-49156HIGHCVSS 7.0EG 7.02025-06-17
A link following vulnerability in the Trend Micro Apex One scan engine could allow a local attacker to escalation privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged cod…
- CVE-2025-27468HIGHCVSS 7.0EG 7.02025-05-13
Improper privilege management in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally.
- CVE-2020-9222HIGHCVSS 7.0EG 7.02024-12-27
There is a privilege escalation vulnerability in Huawei FusionCompute product. Due to insufficient verification on specific files that need to be deserialized, local attackers can exploit this vulnerability to elevate permissions. (Vulnera…
- CVE-2024-10203HIGHCVSS 7.0EG 7.02024-11-07
Zohocorp ManageEngine EndPoint Central versions 11.3.2416.21 and below, 11.3.2428.9 and below are vulnerable to Arbitrary File Deletion in the agent installed machines.
- CVE-2023-22576HIGHCVSS 7.0EG 7.02024-08-21
Dell Repository Manager version 3.4.2 and earlier, contain a Local Privilege Escalation Vulnerability in Installation module. A local low privileged attacker may potentially exploit this vulnerability leading to the execution of arbitrary …
- CVE-2024-42050HIGHCVSS 7.0EG 7.02024-07-28
The MSI installer for Splashtop Streamer for Windows before 3.7.0.0 uses a temporary folder with weak permissions during installation. A local user can exploit this to escalate privileges to SYSTEM via an oplock on CredProvider_Inst.reg.
- CVE-2024-32899HIGHCVSS 7.0EG 7.02024-06-13
In gpu_pm_power_off_top_nolock of pixel_gpu_power.c, there is a possible compromise of protected memory due to a race condition. This could lead to local escalation of privilege to TEE with no additional execution privileges needed. User i…
- CVE-2024-5907HIGHCVSS 7.0EG 7.02024-06-12
A privilege escalation (PE) vulnerability in the Palo Alto Networks Cortex XDR agent on Windows devices enables a local user to execute programs with elevated privileges. However, execution does require the local user to successfully explo…
- CVE-2024-22795HIGHCVSS 7.0EG 7.02024-02-08
Insecure Permissions vulnerability in Forescout SecureConnector v.11.3.06.0063 allows a local attacker to escalate privileges via the Recheck Compliance Status component.
- CVE-2021-37942HIGHCVSS 7.0EG 7.02023-11-22
A local privilege escalation issue was found with the APM Java agent, where a user on the system could attach a malicious plugin to an application running the APM Java agent. By using this vulnerability, an attacker could execute code at a…
- CVE-2023-36721HIGHCVSS 7.0EG 7.02023-10-10
Windows Error Reporting Service Elevation of Privilege Vulnerability
- CVE-2023-37907HIGHCVSS 7.0EG 7.02023-07-25
Cryptomator is data encryption software for users who store their files in the cloud. Prior to version 1.9.2, the MSI installer provided on the homepage allows local privilege escalation (LPE) for low privileged users, if already installed…
- CVE-2023-26062HIGHCVSS 7.0EG 7.02023-06-14
A mobile network solution internal fault is found in Nokia Web Element Manager before 22 R1, in which an authenticated, unprivileged user can execute administrative functions. Exploitation is not possible from outside of mobile network sol…
- CVE-2023-21896HIGHCVSS 7.0EG 7.02023-04-18
Vulnerability in the Oracle Solaris product of Oracle Systems (component: NSSwitch). Supported versions that are affected are 10 and 11. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure w…
- CVE-2023-21542HIGHCVSS 7.0EG 7.02023-01-10
Windows Installer Elevation of Privilege Vulnerability
- CVE-2023-21531HIGHCVSS 7.0EG 7.02023-01-10
Azure Service Fabric Container Elevation of Privilege Vulnerability
- CVE-2022-33646HIGHCVSS 7.0EG 7.02022-08-09
Azure Batch Node Agent Elevation of Privilege Vulnerability
- CVE-2022-30224HIGHCVSS 7.0EG 7.02022-07-12
Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability
- CVE-2022-22036HIGHCVSS 7.0EG 7.02022-07-12
Performance Counters for Windows Elevation of Privilege Vulnerability
- CVE-2022-30151HIGHCVSS 7.0EG 7.02022-06-15
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
- CVE-2022-29125HIGHCVSS 7.0EG 7.02022-05-10
Windows Push Notifications Apps Elevation of Privilege Vulnerability
- CVE-2022-26939HIGHCVSS 7.0EG 7.02022-05-10
Storage Spaces Direct Elevation of Privilege Vulnerability
- CVE-2022-26938HIGHCVSS 7.0EG 7.02022-05-10
Storage Spaces Direct Elevation of Privilege Vulnerability
- CVE-2021-39686HIGHCVSS 7.0EG 7.02022-03-16
In several functions of binder.c, there is a possible way to represent the wrong domain to SELinux due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction i…
- CVE-2022-24460HIGHCVSS 7.0EG 7.02022-03-09
Tablet Windows User Interface Application Elevation of Privilege Vulnerability
- CVE-2022-23298HIGHCVSS 7.0EG 7.02022-03-09
Windows NT OS Kernel Elevation of Privilege Vulnerability
- CVE-2022-23288HIGHCVSS 7.0EG 7.02022-03-09
Windows DWM Core Library Elevation of Privilege Vulnerability
- CVE-2022-23287HIGHCVSS 7.0EG 7.02022-03-09
Windows ALPC Elevation of Privilege Vulnerability
- CVE-2022-23286HIGHCVSS 7.0EG 7.02022-03-09
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
- CVE-2022-21967HIGHCVSS 7.0EG 7.02022-03-09
Xbox Live Auth Manager for Windows Elevation of Privilege Vulnerability
- CVE-2022-22717HIGHCVSS 7.0EG 7.02022-02-09
Windows Print Spooler Elevation of Privilege Vulnerability
- CVE-2022-21896HIGHCVSS 7.0EG 7.02022-01-11
Windows DWM Core Library Elevation of Privilege Vulnerability
- CVE-2022-21868HIGHCVSS 7.0EG 7.02022-01-11
Windows Devices Human Interface Elevation of Privilege Vulnerability
- CVE-2022-21867HIGHCVSS 7.0EG 7.02022-01-11
Windows Push Notifications Apps Elevation of Privilege Vulnerability
- CVE-2022-21866HIGHCVSS 7.0EG 7.02022-01-11
Windows System Launcher Elevation of Privilege Vulnerability
Map vulnerabilities like CWE-269 to your infrastructure
EchelonGraph correlates every CVE — across CWE-269 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →