A02: up from fifth, because behaviour moved into config
Security Misconfiguration rose from #5 in 2021 to #2 in 2025. 100% of applications tested showed some form of it, with an average incidence of 3.00% across its CWEs and over 719,000 occurrences in the data.
Why it is like this
More and more of an application's behaviour is decided by configuration rather than code — infrastructure as code, feature flags, identity providers, cloud policy. The attack surface moved, and the ranking followed it.
Not to be confused with
Forgetting to change a default password. The category spans the whole stack's configuration, including XML external entity handling, and treats a misconfigured platform as equivalent to a misconfigured application.
In practice
Configuration is also where the Top 10 touches your infrastructure work directly: a permissive storage bucket policy is this category, not an operations problem that happens to be nearby.
Source: OWASP Top 10:2025 — A02:2025 Security Misconfiguration. Read on .
The OWASP Top 10:2025 is © 2021-2025 the OWASP Top 10 Team and is licensed under a Creative Commons Attribution 3.0 Unported Licence. These cards are independent commentary written in our own words. ytyk.org is not affiliated with or endorsed by the OWASP Foundation.
Predict Check yourself
Why does OWASP say the rise of A02 from #5 to #2 is unsurprising?
Show the answer
Because software engineering keeps moving more of an application's behaviour into configuration, so more can be got wrong there.
The project states the reason explicitly. It is a claim about how software is built now, not about measurement.