CWE-778: Insufficient Logging
Sources read 2026-10-29. MITRE's own page · All weakness notes · Added to CISA's list in the last seven days
What it is
From MITRE's CWE catalogue
When a security-critical event occurs, the product either does not record the event or omits important details about the event when logging it.
MITRE classes it as a base-level weakness and rates the likelihood of exploit as medium.
What it lets an attacker do
From MITRE's CWE catalogue
- Hide Activities (affects: non-repudiation)
On CISA's exploited list
From CISA's exploited list
1 of the 108 entries CISA added from 2026-08-02 to 2026-10-30 name CWE-778, against 0 of 69 in the 90 days before. Over the whole catalogue 1 entries name it. The counts are small, so read them as a rough order, not a rate.
CISA's list is not every flaw that is exploited: it holds the ones CISA has evidence of, listed on the day it added them.
How MITRE says to find it
From MITRE's CWE catalogue
- Automated Static Analysis
What MITRE suggests
From MITRE's CWE catalogue
These are MITRE's suggestions, quoted as it gives them. They are not a complete fix and not a substitute for reading the vendor's advisory for the product you run.
- Architecture and Design: Use a centralized logging mechanism that supports multiple levels of detail.
- Implementation: Ensure that all security-related successes and failures can be logged. When storing data in the cloud (e.g., AWS S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to enable and capture detailed logging information.
- Operation: Be sure to set the level of logging appropriately in a production environment. Sufficient data should be logged to enable system administrators to detect attacks, diagnose errors, and recover from attacks.
- Operation: To enable storage logging using Azure's Portal, navigate to the name of the Storage Account, locate Monitoring (CLASSIC) section, and select Diagnostic settings (classic). For each of the various properties (blob, file, table, queue), ensure the status is properly set for the desired logging data.
Our notes that name it
From our own notes
Start with one piece of work.
Give us one piece of work and read access to one system. We map it and come back with what we found, what we would build and what it would take — before any commitment. You decide using our output, not our pitch.
Talk to us