What it asks for. This category covers insecure configuration of applications, frameworks, servers, cloud services and platforms. Examples include default accounts and passwords, unnecessary features or services enabled, verbose error messages, missing security headers, overly permissive cloud storage and inconsistent hardening across environments. XML external entity issues were folded into this category in 2021.
In practice. Organisations use hardened baseline configurations, apply them automatically through infrastructure as code, keep environments consistent and remove unused features. Configuration is checked continuously with scanning and cloud posture tools. Evidence includes hardening standards, configuration scan results, drift reports and remediation records.
Common gaps. Cloud services are often configured outside the normal pipeline, so baselines are not applied. Test and staging environments frequently have weaker settings and real data.