About CWE-264
MITRE lists no common consequences for this entry; the impact depends on the specific weakness involved.
MITRE marks CWE-264 as prohibited for mapping real-world vulnerabilities, so a more specific weakness usually describes the root cause better.
- MITRE name
- Permissions, Privileges, and Access Controls
- Abstraction
- Grouping: an organizational entry for weaknesses that share a characteristic, not a weakness itself
- Status
- Obsolete
CWE-264 in the KEV Catalog
as of 2026-11-12- 20 CISA KEV entries name Permissions, Privileges, and Access Controls (CWE-264) in their CVE record, tied for 25th among the 194 weaknesses named in the catalog.
- Microsoft has the most CWE-264 entries in the CISA KEV catalog (17), followed by Adobe (1), Oracle (1), and SolarWinds (1).
- CISA marks 20% of CWE-264 KEV entries (4 of 20) as known to be used in ransomware campaigns, compared with 20% of all KEV entries.
- CISA's SSVC enrichment rates 5% of CWE-264 KEV entries with SSVC data (1 of 20) as automatable, compared with 41% across the catalog.
CWE-264 Vulnerabilities
20 CVEs| CVE | Title | Vendor | CVSS | EPSS | KEV | Published |
|---|---|---|---|---|---|---|
| CVE-2016-0165KEV Microsoft Win32k Privilege Escalation Vulnerability | Microsoft Win32k Privilege Escalation Vulnerability | - | 7.8 | 13.7% | KEV | 2016-04-12 |
| CVE-2014-4077KEV Microsoft IME Japanese Privilege Escalation Vulnerability | Microsoft IME Japanese Privilege Escalation Vulnerability | - | 7.8 | 54.6% | KEV | 2014-11-11 |
| CVE-2014-4123KEV Microsoft Internet Explorer Privilege Escalation Vulnerability | Microsoft Internet Explorer Privilege Escalation Vulnerability | - | 8.8 | 47.1% | KEV | 2014-10-15 |
| CVE-2015-0071KEV Microsoft Internet Explorer ASLR Bypass Vulnerability | Microsoft Internet Explorer ASLR Bypass Vulnerability | - | 6.5 | 33.6% | KEV | 2015-02-11 |
| CVE-2014-2817KEV Microsoft Internet Explorer Privilege Escalation Vulnerability | Microsoft Internet Explorer Privilege Escalation Vulnerability | - | 8.8 | 26.3% | KEV | 2014-08-12 |
| CVE-2015-6175KEV Microsoft Windows Kernel Privilege Escalation Vulnerability | Microsoft Windows Kernel Privilege Escalation Vulnerability | - | 7.8 | 5.3% | KEV | 2015-12-09 |
| CVE-2015-1769KEV Microsoft Windows Mount Manager Privilege Escalation Vulnerability | Microsoft Windows Mount Manager Privilege Escalation Vulnerability | - | 6.6 | 4.1% | KEV | 2015-08-15 |
| CVE-2014-4113KEV Microsoft Win32k Privilege Escalation Vulnerability | Microsoft Win32k Privilege Escalation Vulnerability | - | 7.8 | 86.6% | KEV | 2014-10-15 |
| CVE-2011-2005KEV Microsoft Ancillary Function Driver (afd.sys) Improper Input Validation Vulnerability | Microsoft Ancillary Function Driver (afd.sys) Improper Input Validation Vulnerability | - | 7.8 | 31.8% | KEV | 2011-10-12 |
| CVE-2016-0040KEV Microsoft Windows Kernel Privilege Escalation Vulnerability | Microsoft Windows Kernel Privilege Escalation Vulnerability | - | 7.8 | 24.3% | KEV | 2016-02-10 |
| CVE-2014-6324KEV Microsoft Kerberos Key Distribution Center (KDC) Privilege Escalation Vulnerability | Microsoft Kerberos Key Distribution Center (KDC) Privilege Escalation Vulnerability | - | 8.8 | 87.3% | KEV | 2014-11-18 |
| CVE-2016-3309KEV Microsoft Windows Kernel Privilege Escalation Vulnerability | Microsoft Windows Kernel Privilege Escalation Vulnerability | - | 7.8 | 20.5% | KEV | 2016-08-09 |
| CVE-2013-0629KEV Adobe ColdFusion Directory Traversal Vulnerability | Adobe ColdFusion Directory Traversal Vulnerability | - | 7.5 | 65.8% | KEV | 2013-01-09 |
| CVE-2015-1701KEV Microsoft Win32k Privilege Escalation Vulnerability | Microsoft Win32k Privilege Escalation Vulnerability | - | 7.8 | 56.2% | KEV | 2015-04-21 |
| CVE-2010-0232KEV Microsoft Windows Kernel Exception Handler Vulnerability | Microsoft Windows Kernel Exception Handler Vulnerability | - | 7.8 | 28.7% | KEV | 2010-01-21 |
| CVE-2008-3431KEV Oracle VirtualBox Insufficient Input Validation Vulnerability | Oracle VirtualBox Insufficient Input Validation Vulnerability | - | 8.8 | 6.9% | KEV | 2008-08-05 |
| CVE-2016-7255KEV Microsoft Win32k Privilege Escalation Vulnerability | Microsoft Win32k Privilege Escalation Vulnerability | - | 7.8 | 81.0% | KEV | 2016-11-10 |
| CVE-2016-3235KEV Microsoft Office OLE DLL Side Loading Vulnerability | Microsoft Office OLE DLL Side Loading Vulnerability | - | 7.8 | 43.3% | KEV | 2016-06-16 |
| CVE-2016-0167KEV Microsoft Win32k Privilege Escalation Vulnerability | Microsoft Win32k Privilege Escalation Vulnerability | - | 7.8 | 5.7% | KEV | 2016-04-12 |
| CVE-2016-3643KEV SolarWinds Virtualization Manager Privilege Escalation Vulnerability | SolarWinds Virtualization Manager Privilege Escalation Vulnerability | - | 7.8 | 3.7% | KEV | 2016-06-17 |
Frequently Asked Questions
What is CWE-264?→
CWE-264 (Permissions, Privileges, and Access Controls) is a MITRE CWE entry. Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
How many exploited vulnerabilities are classified as CWE-264?→
This database lists 20 CVE records mapped to CWE-264 by their CVE Numbering Authority. 20 of them are in the CISA Known Exploited Vulnerabilities catalog, and CISA links 4 to known ransomware campaigns. Examples include CVE-2016-0165, CVE-2014-4077, CVE-2014-4123.
Weakness description, consequences, and mitigations from the CWE List, © The MITRE Corporation, used under the CWE Terms of Use. CWE mappings come from each CVE record's CNA. Exploited-in-the-wild data from the CISA KEV catalog (CC0). This site is not affiliated with or endorsed by MITRE or CISA.