Weakness · CWE-20
Improper Input Validation
Input isn't checked against what the program expects; the umbrella cause behind many specific flaws.
Official CWE name. Full definition on cwe.mitre.org
In the news
CVEs with this weakness that SecurityTabs has covered, newest first.
- CVE-2026-88771ADC: A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commandsCritical 9.5KEV
- CVE-2026-34197Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeansHigh 8.8KEV
How attackers exploit it
Typical ATT&CK techniques for this class of weakness across CISA's Known Exploited Vulnerabilities (CTID mapping).
How it's exploited
What the attacker gets
Controls that stop it
NIST SP 800-53 controls that mitigate the most of those techniques.
- SI-4System MonitoringSystem and Information Integrity · mitigates 9 techniques
- SI-3Malicious Code ProtectionSystem and Information Integrity · mitigates 8 techniques
- AC-6Least PrivilegeAccess Control · mitigates 7 techniques
- CA-7Continuous MonitoringSecurity Assessment and Authorization · mitigates 7 techniques
- CM-6Configuration SettingsConfiguration Management · mitigates 7 techniques
- AC-2Account ManagementAccess Control · mitigates 6 techniques
- AC-3Access EnforcementAccess Control · mitigates 6 techniques
- AC-4Information Flow EnforcementAccess Control · mitigates 6 techniques
- CM-2Baseline ConfigurationConfiguration Management · mitigates 6 techniques
- CM-7Least FunctionalityConfiguration Management · mitigates 6 techniques
Weaknesses from each CVE's CVE Record (CWE, © MITRE). Techniques: MITRE ATT&CK®. Technique ↔ control and CVE ↔ technique links: Center for Threat-Informed Defense Mappings Explorer (NIST SP 800-53 rev5; CISA KEV). Plain-language explainers are SecurityTabs editorial.