CWE-341Predictable from Observable State

Abstraction: Base · CVEs in our corpus: 16

A number or object is predictable based on observations that the attacker can make about the state of the system or network, such as time, process ID, etc.

Last updated: 20 August 2026 13:14 UTC

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent

Stop it (NIST 800-53 / CSF Protect)

IA-5 Authenticator Management
SC-12 Cryptographic Key Establishment and Management
SC-23 Session Authenticity
PR.PS-01

Detect

Catch it (CSF Detect / Respond)

—

Harden

Shrink the surface (DISA STIG)

—

Validate

Prove the fix (OWASP ASVS)

V6.6.1
V6.5.1
V6.5.3
V6.5.5

NIST 800-53 r5 controls that address this weakness (0)AI-assisted

Control	Title	Family	Why it addresses this CWE
No NIST controls proposed yet.

Top CVEs of this weakness type, ranked by Risk Priority

CVE	Risk	CVSS	EPSS	Published
`CVE-2019-6563`	7.6	9.8	0.0175	2019-03-05
`CVE-2026-38968`	7.3	9.8	0.0038	2026-07-02
`CVE-2020-1731`	7.1	9.1	0.0128	2020-03-02
`CVE-2026-5081`	6.8	9.1	0.0030	2026-05-06
`CVE-2025-40780`	6.2	8.6	0.0046	2025-10-22
`CVE-2026-42365`	6.2	8.6	0.0034	2026-05-04
`CVE-2023-49259`	5.8	7.5	0.0031	2024-01-12
`CVE-2026-40164`	5.8	7.5	0.0037	2026-04-14
`CVE-2026-36609`	5.5	7.3	0.0017	2026-06-03
`CVE-2026-15571`	5.5	7.3	0.0031	2026-08-18
`CVE-2018-17917`	4.7	5.3	0.0125	2018-10-10
`CVE-2020-5365`	4.7	5.3	0.0099	2020-05-20
`CVE-2025-48461`	4.1	5.0	0.0043	2025-06-24
`CVE-2025-42925`	3.6	4.3	0.0023	2025-09-09
`CVE-2024-10141`	3.4	3.7	0.0081	2024-10-19
`CVE-2021-4277`	2.6	2.6	0.0045	2022-12-25