What is CWE-326?
The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.
A weak encryption scheme can be subjected to brute force attacks that have a reasonable chance of succeeding using current attack methods and resources.
CWE-326 is a class-level weakness in MITRE’s Common Weakness Enumeration. Applicable platforms: Language: Not Language-Specific.
Source: MITRE CWE (CWE-326 definition, reproduced verbatim). Counts and linkage below are Threadlinqs data.
Consequences
- Access Control, Confidentiality — Bypass Protection Mechanism, Read Application Data. An attacker may be able to decrypt the data using brute force attacks.
Source: MITRE CWE, common consequences.
How CWE-326 is exploited in the wild
Threadlinqs maps 4 CVEs to CWE-326, published between 2017-08-23 and 2026-10-18. 1 is listed in CISA’s Known Exploited Vulnerabilities catalog, the authoritative record of exploitation in the wild. By CVSS v3 severity the set splits into 1 critical, 1 medium, 2 low. The highest EPSS score in the set is 84.1% (CVE-2017-11317), the modelled probability of exploitation in the next 30 days. 11 tracked threats reference CWE-326 directly or through a CVE it covers; the most recent is “Slican Telephone Exchanges: Hardcoded Encryption Key (CVE-2026-35088) and WebCTI SQL Injection / Plaintext Password Storage (CVE-2026-63314, CVE-2026-63315)” (2026-10-16). Affected products concentrate in Pronetiqs (1), diem-project (1), light0011 (1).
Vulnerabilities (CVEs)
All 4 CVEs mapped to CWE-326, CISA KEV first, then by CVSS score.
- CVE-2017-11317 — CISA KEV · CVSS 9.8 critical · EPSS 84.1% · published 2017-08-23
- CVE-2026-50044 — CVSS 6.8 medium · EPSS 0.0% · published 2026-07-23
- CVE-2026-112026 — CVSS 3.7 low · EPSS 0.2% · published 2026-10-18
- CVE-2026-112029 — CVSS 2.5 low · EPSS 0.0% · published 2026-10-18
Affected vendors
- Pronetiqs — 1 CVE
- diem-project — 1 CVE
- light0011 — 1 CVE
Threat activity
11 tracked threats cite CWE-326:
- Slican Telephone Exchanges: Hardcoded Encryption Key (CVE-2026-35088) and WebCTI SQL Injection / Plaintext Password Storage (CVE-2026-63314, CVE-2026-63315)HIGH
- LiteLLM gateway vulnerabilities: missing authorization, SSRF, file read and RCE (CVE-2026-35029, CVE-2026-59823)HIGH
- CVE-2019-18935 Telerik UI Deserialization Exploited to Deploy Web Shells and a WordPress Scanner on IIS ServersCRITICAL
- Telerik UI for ASP.NET AJAX — Padding Oracle Chained to Unauthenticated Deserialization RCE (CVE-2026-13181–13184)HIGH
- Coldcard Firmware RNG Flaw Enables Coordinated Bitcoin Wallet Theft ($70.2M Drained)CRITICAL
- EndPoint (Midnight) Ransomware — Babuk-derived double-extortion targeting Windows, ESXi, and NASCRITICAL
- Kyber Ransomware: Post-Quantum Hybrid Encryption Operation Targeting Windows & VMware ESXiCRITICAL
- APT35 (Charming Kitten) GCC Pre-Positioning Cyber Reconnaissance Campaign Enabling Kinetic TargetingCRITICAL
- FortiGate SSO Authentication Bypass Campaign (CVE-2025-59718, CVE-2025-59719, CVE-2026-24858)CRITICAL
- 25 Zero-Knowledge Bypass Vulnerabilities in Cloud Password Managers (Bitwarden/LastPass/Dashlane) — ETH Zurich Research, Key Escrow, AES-CBC Malleability, KDF Downgrade (300Kx Brute-Force), Unauthenticated Public Keys, 60M+ UsersHIGH
- LockBit 5.0 Cross-Platform Ransomware AnalysisCRITICAL
Mitigations
- Architecture and Design: Use an encryption scheme that is currently considered to be strong by experts in the field.
Source: MITRE CWE, potential mitigations.
Detection methods (MITRE CWE)
- Automated Static Analysis (effectiveness: High): Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Source: MITRE CWE, detection methods. Threadlinqs detection rules for the threats above are Blue tier and higher.