CWE-394Unexpected Status Code or Return Value

Abstraction: Base · CVEs in our corpus: 15

The product does not properly check when a function or operation returns a value that is legitimate for the function, but is not expected by the product.

Last updated: 21 August 2026 14:15 UTC

OWASP Top 10 for Web (2025)

This weakness contributes to A10:2025 Mishandling of Exceptional Conditions.

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent

Stop it (NIST 800-53 / CSF Protect)

PR.PS-06
SA-11 Developer Testing and Evaluation
SA-8 Security and Privacy Engineering Principles
SA-15 Development Process, Standards, and Tools

Detect

Catch it (CSF Detect / Respond)

—

Harden

Shrink the surface (DISA STIG)

—

Validate

Prove the fix (OWASP ASVS)

—

NIST 800-53 r5 controls that address this weakness (0)AI-assisted

Control	Title	Family	Why it addresses this CWE
No NIST controls proposed yet.

Top CVEs of this weakness type, ranked by Risk Priority

CVE	Risk	CVSS	EPSS	Published
`CVE-2025-12515`	7.2	9.8	0.0034	2025-10-30
`CVE-2025-12516`	7.2	9.8	0.0034	2025-10-30
`CVE-2026-25085`	6.5	8.6	0.0046	2026-02-27
`CVE-2019-0066`	6.1	7.5	0.0136	2019-10-09
`CVE-2023-25948`	5.9	7.5	0.0057	2023-07-13
`CVE-2018-20802`	5.4	6.5	0.0148	2020-11-23
`CVE-2019-20924`	5.4	6.5	0.0130	2020-11-23
`CVE-2024-1713`	5.3	7.2	0.0055	2024-03-14
`CVE-2025-48510`	5.1	7.1	0.0013	2025-11-24
`CVE-2022-24880`	4.7	5.3	0.0116	2022-04-25
`CVE-2026-76956`	4.5	5.9	0.0025	2026-08-20
`CVE-2023-28975`	3.7	4.6	0.0029	2023-04-17
`CVE-2023-48429`	2.7	2.7	0.0059	2023-12-12