CWE · MITRE source
CWE-356Product UI does not Warn User of Unsafe Actions
The product's user interface does not warn the user before undertaking an unsafe action on behalf of that user. This makes it easier for attackers to trick users into inflicting damage to their system.
Product systems should warn users that a potentially dangerous action may occur if the user proceeds. For example, if the user downloads a file from an unknown source and attempts to execute the file on their machine, then the application's GUI can indicate that the file is unsafe.
Last updated: 22 August 2026 14:14 UTC
Control responseHuman-reviewed
Answering this weakness across the control lifecycle, from our framework cross-walks.
Prevent
Stop it (NIST 800-53 / CSF Protect)
SC-15Collaborative Computing Devices and ApplicationsPR.PS-06
Detect
Catch it (CSF Detect / Respond)
—
Harden
Shrink the surface (DISA STIG)
- 1 hardening rule · 1 OS baseline
Validate
Prove the fix (OWASP ASVS)
—
NIST 800-53 r5 controls that address this weakness (1)AI-assisted
| Control | Title | Family | Why it addresses this CWE |
|---|---|---|---|
SC-15 | Collaborative Computing Devices and Applications | SC | Mandates explicit user-visible indication, directly countering absence of warnings for device activation. |
Top CVEs of this weakness type, ranked by Risk Priority
| CVE | Risk | CVSS | EPSS | Published |
|---|---|---|---|---|
CVE-2018-16858 UPD | 8.3 | 7.8 | 0.6732 | 2019-03-25 |
CVE-2019-6736 UPD | 7.1 | 8.8 | 0.0367 | 2019-06-03 |
CVE-2019-6737 UPD | 7.1 | 8.8 | 0.0382 | 2019-06-03 |
CVE-2019-6738 UPD | 7.1 | 8.8 | 0.0367 | 2019-06-03 |
CVE-2019-13322 UPD | 7.0 | 8.8 | 0.0255 | 2020-02-10 |
CVE-2022-39362 UPD | 6.7 | 8.8 | 0.0083 | 2022-10-26 |
CVE-2025-2450 UPD | 6.6 | 8.8 | 0.0052 | 2025-03-18 |
CVE-2025-3909 UPD | 6.1 | 8.1 | 0.0044 | 2025-05-14 |
CVE-2022-35873 UPD | 6.0 | 7.8 | 0.0071 | 2022-07-25 |
CVE-2022-36970 UPD | 5.9 | 7.8 | 0.0065 | 2023-03-29 |
CVE-2025-14403 UPD | 5.8 | 7.8 | 0.0031 | 2025-12-23 |
CVE-2026-0777 UPD | 5.8 | 7.8 | 0.0034 | 2026-02-20 |
CVE-2025-14412 UPD | 5.7 | 7.8 | 0.0020 | 2025-12-23 |
CVE-2025-14414 UPD | 5.7 | 7.8 | 0.0021 | 2025-12-23 |
CVE-2025-14415 UPD | 5.7 | 7.8 | 0.0025 | 2025-12-23 |
CVE-2025-14417 UPD | 5.7 | 7.8 | 0.0020 | 2025-12-23 |
CVE-2025-3839 UPD | 5.7 | 8.0 | 0.0039 | 2026-01-23 |
CVE-2025-31334 UPD | 5.5 | 6.8 | 0.0123 | 2025-04-03 |
CVE-2024-3044 UPD | 5.4 | 6.5 | 0.0101 | 2024-05-14 |
CVE-2025-14402 UPD | 5.2 | 7.0 | 0.0026 | 2025-12-23 |
CVE-2025-14404 UPD | 5.2 | 7.0 | 0.0026 | 2025-12-23 |
CVE-2025-14416 UPD | 5.1 | 7.0 | 0.0016 | 2025-12-23 |
CVE-2025-14418 UPD | 5.1 | 7.0 | 0.0016 | 2025-12-23 |
CVE-2018-10595 UPD | 4.9 | 6.3 | 0.0041 | 2018-05-24 |
CVE-2025-0092 UPD | 4.8 | 6.5 | 0.0015 | 2025-08-26 |