OWASP Top 10 2026 Released: Major Revisions and Two New Security Classes Added

The Open Web Application Security Project (OWASP) has officially unveiled the eighth edition of its influential Top 10 security risks list for 2026, introducing significant changes that reflect the evolving landscape of application security threats.

The update features two new security categories and substantial shifts in risk rankings based on contributed data and community feedback.

Significant Additions to the List

The 2026 edition introduces Software Supply Chain Failures as a critical new category at position A03.

Rank	Category	CWEs	Prevalence
A01	Broken Access Control	40	3.73%
A02	Security Misconfiguration	16	3.00%
A03	Software Supply Chain Failures	5	Low
A04	Cryptographic Failures	32	3.80%
A05	Injection	38	High
A06	Insecure Design	36	Moderate
A07	Authentication Failures	36	Moderate
A08	Software or Data Integrity Failures	5	Moderate
A09	Logging & Alerting Failures	5	Moderate
A10	Mishandling of Exceptional Conditions	24	New

This represents an expanded focus from the previous “Vulnerable and Outdated Components” category, now encompassing broader compromises occurring across the entire software dependency ecosystem, build systems, and distribution infrastructure.

This addition reflects growing concerns about supply chain attacks that have dominated security headlines in recent years.

The second newcomer is Mishandling of Exceptional Conditions at position A10. This entirely new category addresses 24 Common Weakness Enumerations (CWEs), focusing on improper error handling, logical errors, and failing open scenarios that systems encounter under abnormal conditions.

Broken Access Control maintains its dominant position at number one, with data indicating that 3.73% of tested applications contained at least one of the 40 CWEs in this category.

The most dramatic change sees Security Misconfiguration surge from fifth place in 2021 to second position in 2026, affecting 3.00% of applications tested across 16 CWEs.

Meanwhile, previously high-ranking threats have fallen. Cryptographic Failures dropped from second to fourth place, Injection vulnerabilities slid from third to fifth, and Insecure Design moved from fourth to sixth position. Despite these declines, these categories remain critical security concerns.

The 2026 list analyzed 589 CWEs across 248 categories, a substantial increase from approximately 400 CWEs in 2021.

OWASP combined data-driven analysis with community input, using eight data-informed categories and two community-voted categories to address emerging threats that testing may not yet reliably detect.

The project analyzed roughly 175,000 CVE records mapped to CWEs from the National Vulnerability Database, incorporating CVSS exploit and impact scores to assess risk severity.

This comprehensive approach ensures the list captures both established threats visible in testing data and emerging risks identified by security practitioners.

The updated OWASP Top 10 2026 serves as a crucial awareness document for developers, security teams, and organizations worldwide.

With increased emphasis on supply chain security and proper error handling, the list addresses modern attack vectors while maintaining focus on persistent threats such as access control failures and misconfigurations that continue to plague applications.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.