CWE-691Insufficient Control Flow Management

Abstraction: Pillar · CVEs in our corpus: 33

The code does not sufficiently manage its control flow during execution, creating conditions in which the control flow can be modified in unexpected ways.

Last updated: 20 August 2026 14:15 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: partial · 3 mapping(s) from 3 framework(s): CAPEC 1 (partial) · STIG windows 10 1 (partial) · STIG windows 11 1 (partial)

See the full cumulative-coverage rollup →

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent

Stop it (NIST 800-53 / CSF Protect)

SA-24 Design For Cyber Resiliency
PR.PS-06
SC-2 Separation of System and User Functionality
SC-3 Security Function Isolation

Detect

Catch it (CSF Detect / Respond)

—

Harden

Shrink the surface (DISA STIG)

2 hardening rules · 2 OS baselines

Validate

Prove the fix (OWASP ASVS)

—

NIST 800-53 r5 controls that address this weakness (1)AI-assisted

Control	Title	Family	Why it addresses this CWE
`SA-24`	Design For Cyber Resiliency	SA	Design principles and implementation approaches enforce robust control-flow management to maintain function and enable recovery after disruption.

Top CVEs of this weakness type, ranked by Risk Priority

CVE	Risk	CVSS	EPSS	Published
`CVE-2023-20559`	6.6	8.8	0.0067	2023-04-02
`CVE-2022-20697`	6.4	8.6	0.0114	2022-04-15
`CVE-2026-20271`	6.1	8.6	0.0027	2026-08-05
`CVE-2021-4106`	5.7	7.8	0.0025	2022-02-16
`CVE-2025-22893`	5.3	7.8	0.0013	2025-08-12
`CVE-2025-25273`	5.3	7.8	0.0013	2025-08-12
`CVE-2025-35963`	5.2	7.4	0.0019	2025-11-11
`CVE-2024-29079`	5.1	6.8	0.0020	2024-11-13
`CVE-2025-25774`	5.1	6.5	0.0041	2025-03-12
`CVE-2025-49463`	5.1	6.5	0.0043	2025-07-10
`CVE-2021-33157`	5.0	7.2	0.0020	2024-02-23
`CVE-2024-21801`	5.0	7.1	0.0018	2024-08-14
`CVE-2025-20004`	4.9	7.2	0.0015	2025-05-13
`CVE-2025-24305`	4.9	7.2	0.0014	2025-08-12
`CVE-2023-24587`	4.8	6.9	0.0018	2023-11-14
`CVE-2024-3847`	4.8	6.1	0.0089	2024-04-17
`CVE-2024-33617`	4.7	5.9	0.0046	2024-11-13
`CVE-2024-22374`	4.6	6.5	0.0016	2024-08-14
`CVE-2023-5102`	4.5	5.3	0.0057	2023-10-09
`CVE-2025-20022`	4.3	5.7	0.0022	2025-05-13
`CVE-2023-28711`	4.2	5.5	0.0017	2023-08-11
`CVE-2026-5938`	4.1	5.5	0.0010	2026-04-27
`CVE-2022-46828`	3.9	5.2	0.0027	2022-12-08
`CVE-2022-48481`	3.9	5.2	0.0021	2023-04-28
`CVE-2022-37409`	3.6	4.7	0.0017	2023-05-10