CWE-201: Insertion of Sensitive Information Into Sent Data

cwe.mitre.org • September 8, 2026

Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.

Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

Class: Not Language-Specific (Undetermined Prevalence)

The following is an actual MySQL error statement:

The error clearly exposes the database credentials.

Note: this is a curated list of examples for users to understand the variety of ways in which this weakness can be introduced. It is not a complete list of all CVEs that are related to this CWE entry.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple CVEs Disclosed on September 8, 2026, Affecting Microsoft Products On September 8, 2026, multiple CVEs were disclosed affecting various Microsoft products, including SharePoint and Office. Key vulnerabilities include improper access controls, buffer overflows, and command injections, which could allow unauthorized code execution and information disclosure. CVE-2026-85880, noted for active exploitation, was added to CISA's KEV list on the same day. Other vulnerabilities, such as CVE-2026-69428 and CVE-2026-69621, also pose significant risks due to their potential for exploitation. Organizations using affected versions of Microsoft products are urged to apply patches immediately to mitigate risks. The vulnerabilities impact a range of systems, including SharePoint Server and Microsoft Office, and could lead to severe consequences if exploited. 927 sources 74

CWE-201: Insertion of Sensitive Information Into Sent Data

The full story

Extracted Entities

Attack Types (1)

Platforms (1)