OWASP Top 10 2026 Released: Major Revisions and Two New Security Classes Added

The Open Web Application Security Project (OWASP) has officially released the eighth iteration of its highly influential Top 10 security risks list for 2026, marking substantial revisions to reflect the dynamic nature of application security threats. This crucial update incorporates two novel security categories and notable shifts in the ranking of existing risks, drawing from extensive community feedback and contributed data. A significant addition to the 2026 list is "Software Supply Chain Failures," now positioned at A03. This new category broadens the scope beyond the previous "Vulnerable and Outdated Components," encompassing a wider array of compromises that can occur across the entire software dependency ecosystem, including build systems and distribution infrastructure. This inclusion directly addresses the growing concern over supply chain attacks that have increasingly impacted organizations in recent years. The second new entry is "Mishandling of Exceptional Conditions," placed at A10. This category focuses on 24 Common Weakness Enumerations (CWEs) related to improper error handling, logical errors, and 'failing open' scenarios that systems might encounter under abnormal operational conditions. Among the existing risks, "Broken Access Control" maintains its critical position as the number one threat, indicating its continued prevalence, with data showing that 3.73% of tested applications contained at least one of its 40 associated CWEs. A notable change is the ascent of "Security Misconfiguration," which has climbed from fifth place in the 2021 list to the second spot in 2026, affecting 3.00% of applications tested across 16 CWEs. This upward movement underscores the persistent challenge of correctly configuring security settings. The updated OWASP Top 10 2026 serves as an essential guide for developers, security professionals, and organizations globally, emphasizing modern attack vectors while reinforcing the importance of addressing long-standing threats like access control issues and misconfigurations.