# CWE-358: Improperly Implemented Security Check for Standard

> As of 2026-10-24, CWE-358 (Improperly Implemented Security Check for Standard) underlies 3 CVEs tracked by Threadlinqs, none of them in the CISA Known Exploited Vulnerabilities catalog, and is cited by 6 tracked threats.

**Last updated:** 2026-10-24

## What is CWE-358?

The product does not implement or incorrectly implements one or more security-relevant checks as specified by the design of a standardized algorithm, protocol, or technique.

CWE-358 is a base-level weakness in MITRE’s Common Weakness Enumeration. Applicable platforms: Language: Not Language-Specific.

_Source: [MITRE CWE](https://cwe.mitre.org/data/definitions/358.html) (CWE-358 definition, reproduced verbatim). Counts and linkage below are Threadlinqs data._

## Consequences

- **Access Control** — Bypass Protection Mechanism

_Source: MITRE CWE, common consequences._

## How CWE-358 is exploited in the wild

Threadlinqs maps 3 CVEs to CWE-358, published between 2024-04-30 and 2026-07-01. None of them is in the CISA KEV catalog yet. By CVSS v3 severity the set splits into 1 high, 1 medium. The highest EPSS score in the set is 0.6% (CVE-2024-2617), the modelled probability of exploitation in the next 30 days. 6 tracked threats reference CWE-358 directly or through a CVE it covers; the most recent is “Multiple Vulnerabilities in Fortigate NGFW on RUGGEDCOM APE1808 Devices (SSA-864900) — Including Actively Exploited FortiCloud SSO Bypass (CVE-2025-59718/-59719) and FortiOS Heap Overflow (CVE-2025-25249)” (2026-09-13). Affected products concentrate in Cloudflare (1), Fortinet (1), Hitachi Energy (1).

## Vulnerabilities (CVEs)

All 3 CVEs mapped to CWE-358, CISA KEV first, then by CVSS score.

- [CVE-2024-2617](https://intel.threadlinqs.com/cve/CVE-2024-2617) — CVSS 7.2 high · EPSS 0.6% · published 2024-04-30
- [CVE-2024-55599](https://intel.threadlinqs.com/cve/CVE-2024-55599) — CVSS 4.9 medium · EPSS 0.3% · published 2025-07-08
- [CVE-2026-14440](https://intel.threadlinqs.com/cve/CVE-2026-14440) — EPSS 0.0% · published 2026-07-01

## Affected vendors

- **Cloudflare** — 1 CVE
- [Fortinet](https://intel.threadlinqs.com/vendors/fortinet) — 1 CVE
- **Hitachi Energy** — 1 CVE

## Threat activity

6 tracked threats cite CWE-358:

- [Multiple Vulnerabilities in Fortigate NGFW on RUGGEDCOM APE1808 Devices (SSA-864900) — Including Actively Exploited FortiCloud SSO Bypass (CVE-2025-59718/-59719) and FortiOS Heap Overflow (CVE-2025-25249)](https://intel.threadlinqs.com/threat/TL-2026-2486) — CRITICAL · 2026-09-13
- [Kaspersky ICS-CERT Q1 2026 Review: Sandworm/Static Tundra Wiper Hits Polish Energy Grid, Suspected Iran Intrusion at NCBJ Nuclear Centre, Void Manticore's Handala Persona Wipes 200,000 Stryker Devices, DragonForce Ransomware Disrupts Hazeldenes Poultry](https://intel.threadlinqs.com/threat/TL-2026-2420) — HIGH · 2026-09-09
- [MyFlaw: Cross-Platform RCE in Opera and Opera GX Browsers via the Built-in 'Opera Touch Background' Extension (My Flow Feature)](https://intel.threadlinqs.com/threat/TL-2026-0770) — HIGH · 2026-06-10
- [CIFSwitch — Linux Kernel CIFS/SPNEGO Key Validation Logic Flaw Enables Unprivileged Local Root via cifs.upcall Namespace Hijack (Public PoC, CVE Pending)](https://intel.threadlinqs.com/threat/TL-2026-0618) — HIGH · 2026-05-28
- [Chrome V8 and Skia Zero-Days Under Active Exploitation (CVE-2026-3910, CVE-2026-3909)](https://intel.threadlinqs.com/threat/TL-2026-0222) — CRITICAL · 2026-03-13
- [Static Tundra (Dragonfly/Energetic Bear) ICS Attacks on Polish Energy Infrastructure](https://intel.threadlinqs.com/threat/TL-2026-0004) — CRITICAL · 2026-02-02

## Related weaknesses

- [CWE-573](https://cwe.mitre.org/data/definitions/573.html)
- [CWE-693 Protection Mechanism Failure](https://intel.threadlinqs.com/cwe/CWE-693)
- [CWE-345 Insufficient Verification of Data Authenticity](https://intel.threadlinqs.com/cwe/CWE-345)
- [CWE-290 Authentication Bypass by Spoofing](https://intel.threadlinqs.com/cwe/CWE-290)

Canonical: https://intel.threadlinqs.com/cwe/CWE-358
Source definition: https://cwe.mitre.org/data/definitions/358.html
Detection rules and IOCs for threats exploiting CWE-358 via the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp