What is CWE-459?
The product does not properly "clean up" and remove temporary or supporting resources after they have been used.
CWE-459 is a base-level weakness in MITRE’s Common Weakness Enumeration. Applicable platforms: Not Language-Specific.
Source: MITRE CWE (CWE-459 definition, reproduced verbatim). Counts and linkage below are Threadlinqs data.
Consequences
- Other, Confidentiality, Integrity — Other, Read Application Data, Modify Application Data, DoS: Resource Consumption (Other). It is possible to overflow the number of temporary files because directories typically have limits on the number of files allowed. This could create a denial of service problem.
Source: MITRE CWE, common consequences.
How CWE-459 is exploited in the wild
Threadlinqs maps 6 CVEs to CWE-459, published between 2026-05-12 and 2026-09-14. None of them is in the CISA KEV catalog yet. By CVSS v3 severity the set splits into 1 critical, 1 high, 4 low. The highest EPSS score in the set is 0.4% (CVE-2026-42492), the modelled probability of exploitation in the next 30 days. 4 tracked threats reference CWE-459 directly or through a CVE it covers; the most recent is “SafePal Data Breach: Order-Tracking Plug-in Authorization Flaw Exposes 39,798 Crypto Wallet Customers' PII, Fuels Phishing Campaign” (2026-08-16). Affected products concentrate in Arista Networks (3), Mattermost (1), SAP_SE (1), among 4 vendors in total.
Vulnerabilities (CVEs)
All 6 CVEs mapped to CWE-459, CISA KEV first, then by CVSS score.
- CVE-2026-34263 — CVSS 9.6 critical · EPSS 0.0% · published 2026-05-12
- CVE-2026-42492 — CVSS 7.5 high · EPSS 0.4% · published 2026-07-28
- CVE-2026-9693 — CVSS 3.5 low · published 2026-08-17
- CVE-2026-75944 — CVSS 2.6 low · EPSS 0.1% · published 2026-09-14
- CVE-2026-75943 — CVSS 2.6 low · EPSS 0.1% · published 2026-09-14
- CVE-2026-75945 — CVSS 2.6 low · EPSS 0.1% · published 2026-09-14
Affected vendors
- Arista Networks — 3 CVEs
- Mattermost — 1 CVE
- SAP_SE — 1 CVE
- Xen — 1 CVE
Threat activity
4 tracked threats cite CWE-459:
- SafePal Data Breach: Order-Tracking Plug-in Authorization Flaw Exposes 39,798 Crypto Wallet Customers' PII, Fuels Phishing CampaignMEDIUM
- SAP Patches Critical Code Injection, Memory Corruption Vulnerabilities (CVE-2026-58231, CVSS 10.0)CRITICAL
- Multiple Vulnerabilities in Citrix XenServer 8.4 and 9 Enable Guest-to-Host Escalation and Denial of Service (CVE-2026-42492, CVE-2026-62428, CVE-2026-62431, CVE-2026-62432, CVE-2026-62434, CVE-2026-62435, CVE-2026-62436)HIGH
- SAP May 2026 HotNews — CVE-2026-34263 Commerce Cloud Unauthenticated RCE & CVE-2026-34260 S/4HANA Enterprise Search SQL Injection (CVSS 9.6)CRITICAL
Mitigations
- Architecture and Design, Implementation: Temporary files and other supporting resources should be deleted/released immediately after they are no longer needed.
Source: MITRE CWE, potential mitigations.
Detection methods (MITRE CWE)
- Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Source: MITRE CWE, detection methods. Threadlinqs detection rules for the threats above are Blue tier and higher.