CWE-269 · Access Control
Improper Privilege Management
3,429CVEs
20exploited
23with a public check
36likely (EPSS 10%+)
SortMost likely exploited
3,429 CVEs with CWE-269 as their weakness · the first 2,000 are paged here; the Atlas names every one
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2017-5689In CISA KEVExploitedIntel Active Management - Authentication BypassIntel Corporation · Intel Active Mangement Technology, Intel Small Business Technology, Intel Stand… · CVSS 9.8 · 2017-05-02 | 9.8 | 92% | 2017-05-02 |
| CVE-2021-20021In CISA KEVExploitedSonicWall Email Security <= 10.0.9.x - Unauthenticated Admin Account CreationSonicWall · Email Security · CVSS 9.8 · 2021-04-09 | 9.8 | 89% | 2021-04-09 |
| CVE-2016-0151In CISA KEVExploitedThe Client-Server Run-time Subsystem (CSRSS) in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 mismanages process tokens, whi…Microsoft · Client-Server Run-time Subsystem (CSRSS) · CVSS 7.8 · 2016-04-12 | 7.8 | 63% | 2016-04-12 |
| CVE-2020-8655In CISA KEVExploitedAn issue was discovered in EyesOfNetwork 5.3. The sudoers configuration is prone to a privilege escalation vulnerability, allowing the apache user to run arbitrary commands as roo…EyesOfNetwork · EyesOfNetwork · CVSS 7.8 · 2020-02-06 | 7.8 | 60% | 2020-02-06 |
| CVE-2019-1405In CISA KEVExploitedAn elevation of privilege vulnerability exists when the Windows Universal Plug and Play (UPnP) service improperly allows COM object creation, aka 'Windows UPnP Service Elevation o…Microsoft · Windows · CVSS 7.8 · 2019-11-12 | 7.8 | 30% | 2019-11-12 |
| CVE-2019-1215In CISA KEVExploitedAn elevation of privilege vulnerability exists in the way that ws2ifsl.sys (Winsock) handles objects in memory, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is…Microsoft · Windows · CVSS 7.8 · 2019-09-11 | 7.8 | 19% | 2019-09-11 |
| CVE-2026-102490In CISA KEVExploitedLocal privilege escalation in Zammad v1.5.0 to v7.2.2 installed via DEB or RPM packageZammad GmbH · Zammad · CVSS 8.5 · 2026-09-30 | 8.5 | 11% | 2026-09-30 |
| CVE-2013-0643In CISA KEVExploitedThe Firefox sandbox in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux, do…Adobe · Flash Player · CVSS 8.8 · 2013-02-27 | 8.8 | 11% | 2013-02-27 |
| CVE-2019-1388In CISA KEVExploitedAn elevation of privilege vulnerability exists in the Windows Certificate Dialog when it does not properly enforce user privileges, aka 'Windows Certificate Dialog Elevation of Pr…Microsoft · Windows · CVSS 7.8 · 2019-11-12 | 7.8 | 8.6% | 2019-11-12 |
| CVE-2023-28434In CISA KEVExploitedMinIO is vulnerable to privilege escalation on Linux/MacOSminio · minio · CVSS 8.8 · 2023-03-22 | 8.8 | 7.9% | 2023-03-22 |
| CVE-2020-3950In CISA KEVExploitedVMware Fusion (11.x before 11.5.2), VMware Remote Console for Mac (11.x and prior before 11.0.1) and Horizon Client for Mac (5.x and prior before 5.4.0) contain a privilege escala…VMware · VMware Fusion, VMware Remote Console for Mac and Horizon Client for Mac · CVSS 7.8 · 2020-03-17 | 7.8 | 7.3% | 2020-03-17 |
| CVE-2024-38014In CISA KEVExploitedWindows Installer Elevation of Privilege VulnerabilityMicrosoft · Windows 10 Version 1507 · CVSS 7.8 · 2024-09-10 | 7.8 | 6.3% | 2024-09-10 |
| CVE-2002-0367In CISA KEVExploitedsmss.exe debugging subsystem in Windows NT and Windows 2000 does not properly authenticate programs that connect to other programs, which allows local users to gain administrator…Microsoft · Windows · CVSS 7.8 · 2003-04-02 | 7.8 | 4.9% | 2003-04-02 |
| CVE-2026-21533In CISA KEVExploitedWindows Remote Desktop Services Elevation of Privilege VulnerabilityMicrosoft · Windows 10 Version 1607 · CVSS 7.8 · 2026-02-10 | 7.8 | 4.3% | 2026-02-10 |
| CVE-2024-26169In CISA KEVExploitedWindows Error Reporting Service Elevation of Privilege VulnerabilityMicrosoft · Windows 10 Version 1809 · CVSS 7.8 · 2024-03-12 | 7.8 | 4.0% | 2024-03-12 |
| CVE-2024-8068In CISA KEVExploitedPrivilege escalation to NetworkService Account accessCitrix · Citrix Session Recording · CVSS 5.1 · 2024-11-12 | 5.1 | 3.5% | 2024-11-12 |
| CVE-2021-25337In CISA KEVExploitedImproper access control in clipboard service in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows untrusted applications to read or write certain local files.Samsung Mobile · Samsung Mobile Devices · CVSS 4.4 · 2021-03-04 | 4.4 | 2.8% | 2021-03-04 |
| CVE-2023-35674In CISA KEVExploitedIn onCreate of WindowState.java, there is a possible way to launch a background activity due to a logic error in the code. This could lead to local escalation of privilege with no…Google · Android · CVSS 8.8 · 2023-09-11 | 8.8 | 2.6% | 2023-09-11 |
| CVE-2024-49035In CISA KEVExploitedPartner.Microsoft.Com Elevation of Privilege VulnerabilityMicrosoft · Microsoft Partner Center · CVSS 8.7 · 2024-11-26 | 8.7 | 1.4% | 2024-11-26 |
| CVE-2021-23874In CISA KEVExploitedMcAfee Total Protection (MTP) privilege escalation vulnerabilityMcAfee,LLC · McAfee Total Protection (MTP) · CVSS 8.2 · 2021-02-10 | 8.2 | 1.1% | 2021-02-10 |
| CVE-2017-12635CheckApache CouchDB 1.7.0 / 2.x < 2.1.1 - Remote Privilege EscalationApache Software Foundation · Apache CouchDB · 2017-11-14 | – | 100% | 2017-11-14 |
| CVE-2022-24637CheckOpen Web Analytics 1.7.3 - Remote Code ExecutionOpenwebanalytics · Open Web Analytics · 2022-03-18 | – | 99% | 2022-03-18 |
| CVE-2022-0441CheckMasterStudy LMS <2.7.6 - Improper Access ControlStylemixthemes · MasterStudy LMS – WordPress LMS Plugin · 2022-03-07 | – | 85% | 2022-03-07 |
| CVE-2021-38540CheckApache Airflow - Unauthenticated Variable ImportApache Software Foundation · Apache Airflow · 2021-09-09 | – | 81% | 2021-09-09 |
| CVE-2020-13638CheckrConfig 3.9 - Authentication Bypass(Admin Login)Rconfig · Rconfig · 2020-11-13 | – | 77% | 2020-11-13 |
| CVE-2023-3460CheckUltimate Member < 2.6.7 - Unauthenticated Privilege EscalationUltimatemember · Ultimate Member · 2023-07-04 | – | 72% | 2023-07-04 |
| CVE-2021-35064CheckKramer VIAware - Privilege Escalation and Remote Code ExecutionKramerav · Viaware · 2021-07-12 | – | 71% | 2021-07-12 |
| CVE-2021-34621CheckWordPress ProfilePress 3.0.0-3.1.3 - Admin User Creation WeaknessProfilePress · ProfilePress · CVSS 9.8 · 2021-07-07 | 9.8 | 69% | 2021-07-07 |
| CVE-2025-20282CheckCisco ISE < 3.4P2 - Unauthenticated Arbitrary File UploadCisco · Cisco Identity Services Engine Software · CVSS 10 · 2025-06-25 | 10.0 | 39% | 2025-06-25 |
| CVE-2022-4305CheckLogin as User or Customer < 3.3 - Privilege EscalationWp-Buy · Login as User or Customer · CVSS 9.8 · 2023-01-23 | 9.8 | 39% | 2023-01-23 |
| CVE-2026-1492CheckWordPress User Registration & Membership <= 5.1.2 - Unauthenticated Privilege Escalationwpeverest · User Registration & Membership – Free & Paid Memberships, Subscriptions, Conten… · CVSS 9.8 · 2026-03-03 | 9.8 | 29% | 2026-03-03 |
| CVE-2025-6934CheckThe Opal Estate Pro – Property Management <= 1.7.5 - Unauthenticated Privilege Escalationwpopal · Opal Estate Pro – Property Management and Submission · CVSS 9.8 · 2025-07-01 | 9.8 | 25% | 2025-07-01 |
| CVE-2016-10972CheckNewspaper Theme 6.4–6.7.1 - Privilege EscalationTagdiv · Newspaper · 2019-09-16 | – | 11% | 2019-09-16 |
| CVE-2020-36155CheckUltimate Member < 2.1.12 - Unauthenticated Privilege Escalation via User MetaUltimatemember · Ultimate Member · CVSS 10 · 2021-01-04 | 10.0 | 9.8% | 2021-01-04 |
| CVE-2021-34622CheckWordPress ProfilePress <= 3.1.3 - Privilege EscalationProfilePress · ProfilePress · CVSS 9.8 · 2021-07-07 | 9.8 | 4.9% | 2021-07-07 |
| CVE-2023-37999CheckHT Mega – Absolute Addons for Elementor <= 2.2.0 - Missing Authorization to Privilege EscalationHasThemes · HT Mega · CVSS 9.8 · 2024-05-17 | 9.8 | 3.3% | 2024-05-17 |
| CVE-2025-4334CheckSimple User Registration <= 6.3 - Unauthenticated Privilege Escalationnmedia · Simple User Registration · CVSS 9.8 · 2025-06-26 | 9.8 | 2.6% | 2025-06-26 |
| CVE-2026-12394CheckWordPress MemberGlut < 1.1.5 - Unauthenticated Privilege EscalationMemberGlut · CVSS 9.8 · 2026-07-27 | 9.8 | 2.1% | 2026-07-27 |
| CVE-2025-15403CheckRegistrationMagic <= 6.0.7.1 - Privilege Escalationmetagauss · RegistrationMagic – Custom Registration Forms, User Registration, Payment, and… · CVSS 9.8 · 2026-01-17 | 9.8 | 1.7% | 2026-01-17 |
| CVE-2026-89079CheckTheme My Login <= 7.2.1 - Privilege Escalationjfarthing84 · Theme My Login · CVSS 9.8 · 2026-10-16 | 9.8 | 1.6% | 2026-10-16 |
| CVE-2023-41954CheckProfilePress <= 4.13.1 — Unauthenticated Privilege EscalationProfilePress Membership Team · ProfilePress · CVSS 8.6 · 2024-05-17 | 8.6 | 1.4% | 2024-05-17 |
| CVE-2026-7467CheckRead More & Accordion <= 3.5.7 - Authenticated Privilege Escalationedmonparker · Read More & Accordion · CVSS 8.8 · 2026-05-20 | 8.8 | 1.3% | 2026-05-20 |
| CVE-2021-31581CheckAkkadian Provisioning Manager - Information DisclosureAkkadian · Provisioning Manager Engine (PME) · CVSS 7.9 · 2021-07-22 | 7.9 | 1.2% | 2021-07-22 |
| CVE-2024-21888A privilege escalation vulnerability in web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows a user to elevate privileges to that of an a…Ivanti · ICS · CVSS 8.8 · 2024-01-31 | 8.8 | 85% | 2024-01-31 |
| CVE-2014-1511Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remote attackers to bypass the popup blocker via unspecified ve…Mozilla · Firefox · 2014-03-19 | – | 84% | 2014-03-19 |
| CVE-2014-1510The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to execute arbi…Mozilla · Firefox · 2014-03-19 | – | 82% | 2014-03-19 |
| CVE-2017-11467OrientDB through 2.2.22 does not enforce privilege requirements during "where" or "fetchplan" or "order by" use, which allows remote attackers to execute arbitrary OS commands via…Orientdb · Orientdb · 2017-07-20 | – | 73% | 2017-07-20 |
| CVE-2023-22809In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environment variables (SUDO_EDITOR, VISUAL, and EDITOR), allowing a l…Sudo Project · Sudo · CVSS 7.8 · 2023-01-18 | 7.8 | 55% | 2023-01-18 |
| CVE-2021-34481Windows Print Spooler Remote Code Execution VulnerabilityMicrosoft · Windows 10 Version 1507 · CVSS 8.8 · 2021-07-16 | 8.8 | 48% | 2021-07-16 |
| CVE-2020-16875Microsoft Exchange Server Remote Code Execution VulnerabilityMicrosoft · Microsoft Exchange Server 2019 Cumulative Update 5 · CVSS 8.4 · 2020-09-11 | 8.4 | 47% | 2020-09-11 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.