CWE-636— Not Failing Securely ('Failing Open')
When the product encounters an error condition or failure, its design requires it to fall back to a state that is less secure than other options that are available, such as selecting the weakest encryption algorithm or using the most permissive access control restrictions.— MITRE CWE catalog
56 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-636page 2 of 2
- CVE-2026-81379HIGHCVSS 8.2EG 8.22026-09-08
Not failing securely ('failing open') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
- CVE-2026-82018MEDIUMCVSS 6.1EG 6.12026-08-28
IGEL OS 12 before 12.9.0, 12.8.3 LTS and IGEL OS 11 before 11.11.150 contain a secure boot bypass vulnerability in the GRUB boot stage that allows physically present attackers to gain unauthorized root access by placing an unsigned empty f…
- CVE-2026-82744LOWCVSS 2.1EG 2.12026-09-01
Not Failing Securely (Failing Open) vulnerability in ash-project ash skips an Ash.Reactor change when the guard controlling it raises, so a change meant to run does not. An Ash.Reactor change step can be gated by where validations that de…
- CVE-2026-85649HIGHCVSS 7.9EG 7.92026-09-04
(Holloway) Chew, Kean Ho's Actualizer v1.2.0 and earlier contains a fail-open password validation vulnerability in the Alpha user and root user password loops of Shell/debian-minbase-install.sh. The installer invokes mkpasswd to generate y…
- CVE-2026-86120MEDIUMCVSS 4.3EG 4.32026-09-05
APITable through 1.13.0-beta.1 contains an incorrect authorization vulnerability in NodePermissionGuard that fails to enforce node-level access control when permission lookups throw exceptions. Attackers with valid Fusion API tokens can wr…
- CVE-2026-92591MEDIUMCVSS 5.9EG 5.92026-09-16
Craft CMS 5.0.0 through 5.10.12 treats a database connection failure as meaning that Craft is not installed, which makes anonymous installer actions — including install/validate-site — reachable on an installed production site whenever…
Map vulnerabilities like CWE-636 to your infrastructure
EchelonGraph correlates every CVE — across CWE-636 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Start Free Scan →