# CWE-668: Exposure of Resource to Wrong Sphere > As of 2026-10-05, CWE-668 (Exposure of Resource to Wrong Sphere) underlies 3 CVEs tracked by Threadlinqs, none of them in the CISA Known Exploited Vulnerabilities catalog, and is cited by 42 tracked threats. **Last updated:** 2026-10-05 ## What is CWE-668? The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource. Resources such as files and directories may be inadvertently exposed through mechanisms such as insecure permissions, or when a program accidentally operates on the wrong object. For example, a program may intend that private files can only be provided to a specific user. This effectively defines a control sphere that is intended to prevent attackers from accessing these private files. If the file permissions are insecure, then parties other than the user will be able to access those files. A separate control sphere might effectively require that the user can only access the private files, but not any other files on the system. If the program does not ensure that the user is only requesting private files, then the user might be able to access other files on the system. In either case, the end result is that a resource has been exposed to the wrong party. CWE-668 is a class-level weakness in MITRE’s Common Weakness Enumeration. Applicable platforms: Language: Not Language-Specific. _Source: [MITRE CWE](https://cwe.mitre.org/data/definitions/668.html) (CWE-668 definition, reproduced verbatim). Counts and linkage below are Threadlinqs data._ ## Consequences - **Confidentiality** — Read Application Data. An adversary that gains access to a resource exposed to a wrong sphere could potentially retrieve private data from that resource, thus breaking the intended confidentiality of that data. - **Integrity** — Modify Application Data. An adversary that gains access to a resource exposed to a wrong sphere could potentially modify data held within that resource, thus breaking the intended integrity of that data and causing the system relying on that resource to make unintended decisions. - **Other** — Varies by Context. The consequences may vary widely depending on how the product uses the affected resource. _Source: MITRE CWE, common consequences._ ## How CWE-668 is exploited in the wild Threadlinqs maps 3 CVEs to CWE-668, published between 2026-04-01 and 2026-08-13. None of them is in the CISA KEV catalog yet. By CVSS v3 severity the set splits into 2 critical, 1 high. The highest EPSS score in the set is 0.2% (CVE-2026-73843), the modelled probability of exploitation in the next 30 days. 42 tracked threats reference CWE-668 directly or through a CVE it covers; the most recent is “Cloudflare Containers Cross-Tenant Data Exposure via Unzeroed Reused Storage Blocks (skip_block_zeroing)” (2026-09-27). Affected products concentrate in Cisco (1), MervinPraison (1), openchoreo (1). ## Vulnerabilities (CVEs) All 3 CVEs mapped to CWE-668, CISA KEV first, then by CVSS score. - [CVE-2026-20160](https://intel.threadlinqs.com/cve/CVE-2026-20160) — CVSS 9.8 critical · EPSS 0.2% · published 2026-04-01 - [CVE-2026-73843](https://intel.threadlinqs.com/cve/CVE-2026-73843) — CVSS 9.6 critical · EPSS 0.2% · published 2026-08-13 - [CVE-2026-44338](https://intel.threadlinqs.com/cve/CVE-2026-44338) — CVSS 7.3 high · EPSS 0.0% · published 2026-05-08 ## Affected vendors - [Cisco](https://intel.threadlinqs.com/vendors/cisco) — 1 CVE - [MervinPraison](https://intel.threadlinqs.com/vendors/mervinpraison) — 1 CVE - [openchoreo](https://intel.threadlinqs.com/vendors/openchoreo) — 1 CVE ## Threat activity 42 tracked threats cite CWE-668; the 25 most recent are listed. - [Cloudflare Containers Cross-Tenant Data Exposure via Unzeroed Reused Storage Blocks (skip_block_zeroing)](https://intel.threadlinqs.com/threat/TL-2026-2698) — HIGH · 2026-09-27 - [Google Gemini AI Model Autonomously Breached Three Real Companies During Authorized Security Evaluation](https://intel.threadlinqs.com/threat/TL-2026-2607) — MEDIUM · 2026-09-21 - [GemStuffer: OpenAI Autonomous Agents Flood RubyGems With 2,000+ Malicious Packages, Abuse RubyDoc.info Build System for RCE and Target a RubyGems API-Key Cache-Leak Flaw](https://intel.threadlinqs.com/threat/TL-2026-2458) — HIGH · 2026-09-12 - [DeepSeek Harness Authentication Bypass Lets Sandboxed AI Agents Escape via Single Command (CVE-2026-82533)](https://intel.threadlinqs.com/threat/TL-2026-2412) — CRITICAL · 2026-09-09 - ["City-Forum" Campaign Mass-Enumerates Salesforce Experience Cloud and ServiceNow Portals via Guest Access](https://intel.threadlinqs.com/threat/TL-2026-1999) — HIGH · 2026-08-12 - [NVIDIA Releases SkillSpector: Open-Source Security Scanner for AI Agent Skills](https://intel.threadlinqs.com/threat/TL-2026-1828) — LOW · 2026-08-03 - [Node.js Patches 11 Security Flaws Across v22.23.2, v24.18.1, v26.5.1 (HTTP/2 DoS, Permission Model Bypass, TLS/mTLS Issues)](https://intel.threadlinqs.com/threat/TL-2026-1807) — HIGH · 2026-08-01 - [CosmosEscape: Platform-Wide Cosmos Master Key Exposure via Gremlin API Sandbox Escape in Azure Cosmos DB](https://intel.threadlinqs.com/threat/TL-2026-1784) — CRITICAL · 2026-07-31 - [ShutterGap: Ephemeral Public Exposure of AWS RDS/DocumentDB Snapshots, AMIs & SSM Documents Evades CSPM/CNAPP Scan Cycles](https://intel.threadlinqs.com/threat/TL-2026-1788) — MEDIUM · 2026-07-31 - [CosmosEscape: Gremlin API Sandbox Escape Exposed Platform-Wide Key for Every Azure Cosmos DB Database](https://intel.threadlinqs.com/threat/TL-2026-1802) — CRITICAL · 2026-07-31 - [CVE-2026-66066 "KindaRails2Shell": Critical Ruby on Rails Active Storage Flaw Allows Unauthenticated Arbitrary File Read / RCE via libvips Image Processing](https://intel.threadlinqs.com/threat/TL-2026-1755) — CRITICAL · 2026-07-29 - [OpenAI Admits Autonomous Agent Swarm Escaped Internal Sandbox via Package-Registry Zero-Day and Breached Hugging Face Production Infrastructure](https://intel.threadlinqs.com/threat/TL-2026-1596) — HIGH · 2026-07-22 - [Unreleased OpenAI GPT-5.6 Sol Model Exploits Zero-Day to Breach Hugging Face Production Infrastructure](https://intel.threadlinqs.com/threat/TL-2026-1600) — HIGH · 2026-07-22 - [OpenAI AI Agents Autonomously Escape Sandbox, Exploit Zero-Days, Compromise Hugging Face Production Infrastructure](https://intel.threadlinqs.com/threat/TL-2026-1603) — HIGH · 2026-07-22 - [Autonomous AI Agent (GPT-5.6 Sol) Chains Zero-Day and Stolen Credentials to Breach Hugging Face Production Infrastructure](https://intel.threadlinqs.com/threat/TL-2026-1632) — CRITICAL · 2026-07-22 - [Exposed Server Reveals AI-Assisted WebDAV Phishing Kit Targeting Mexican Users (CVE-2025-33053)](https://intel.threadlinqs.com/threat/TL-2026-1566) — HIGH · 2026-07-20 - [LegacyHive: Public PoC for Unpatched Windows User Profile Service (ProfSvc) Arbitrary Hive Load Elevation of Privilege (No CVE Assigned)](https://intel.threadlinqs.com/threat/TL-2026-1502) — HIGH · 2026-07-18 - [LegacyHive: Unpatched Windows User Profile Service (ProfSvc) Local Privilege Escalation Zero-Day — Public PoC Bypasses Fully Patched Systems](https://intel.threadlinqs.com/threat/TL-2026-1445) — HIGH · 2026-07-17 - [New "Spirals" Ransomware Encrypts Victim Network in Under 24 Hours via Exposed IIS Server](https://intel.threadlinqs.com/threat/TL-2026-1412) — HIGH · 2026-07-16 - [CISA, NSA, JPCERT/CC, NCSC-NL and NCSC-UK Publish Joint Guidance: Establishing a Coordinated Vulnerability Disclosure Program to Work With Security Researchers](https://intel.threadlinqs.com/threat/TL-2026-1419) — INFO · 2026-07-16 - [LegacyHive: Unpatched Windows User Profile Service (profsvc) Registry Hive Hijack Privilege Escalation 0-Day PoC Released by Nightmare-Eclipse](https://intel.threadlinqs.com/threat/TL-2026-1373) — HIGH · 2026-07-15 - [FortiSandbox VNC Server Exposure Allows Unauthenticated Access to Scanning VMs (CVE-2026-59835)](https://intel.threadlinqs.com/threat/TL-2026-1319) — HIGH · 2026-07-14 - [DigitalMint Ransomware Negotiator Angelo Martino Sentenced to 70 Months for BlackCat/ALPHV Insider Extortion Conspiracy](https://intel.threadlinqs.com/threat/TL-2026-1155) — HIGH · 2026-07-09 - [Cloud Bucket Hijacking — Global Namespace Risk: Silent Data-Stream Redirection via Statically-Named Storage Buckets (AWS / Google Cloud / Azure)](https://intel.threadlinqs.com/threat/TL-2026-0952) — CRITICAL · 2026-06-27 - [Cloud vn105rkj64 — Italian Invoice Phishing Drops Windows Backdoor and Force-Installed Chrome Extension Abusing Native Messaging for Cookie Theft, MFA Bypass, and Remote PowerShell](https://intel.threadlinqs.com/threat/TL-2026-0948) — HIGH · 2026-06-26 ## Related weaknesses - [CWE-664](https://cwe.mitre.org/data/definitions/664.html) Canonical: https://intel.threadlinqs.com/cwe/CWE-668 Source definition: https://cwe.mitre.org/data/definitions/668.html Detection rules and IOCs for threats exploiting CWE-668 via the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp