Cyber Resilience

CWE · MITRE source

CWE-691Insufficient Control Flow Management

Abstraction: Pillar · CVEs in our corpus: 32

The code does not sufficiently manage its control flow during execution, creating conditions in which the control flow can be modified in unexpected ways.

Last updated: 04 July 2026 00:28 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: mostly · 19 mapping(s) from 4 framework(s): ATT&CK 16 (mostly) · CAPEC 1 (partial) · STIG windows 10 1 (partial) · STIG windows 11 1 (partial)

See the full cumulative-coverage rollup →

NIST 800-53 r5 controls that address this weakness (1)AI

Control Title Family Why it addresses this CWE
SA-24Design For Cyber ResiliencySADesign principles and implementation approaches enforce robust control-flow management to maintain function and enable recovery after disruption.

MITRE ATT&CK techniques this weakness enables

Our own two-way CWE↔ATT&CK cross-walk — a direct mapping with no public source (the CWE→CAPEC→ATT&CK chain leaves most top weaknesses, incl. XSS and SQLi, mapped to nothing). Drafted by Grok and spot-checked by Claude Opus 4.8.

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial).

T1055 Process Injection←P →MT1055.003 Thread Execution Hijacking←M →MT1055.004 Asynchronous Procedure Call←M →MT1055.005 Thread Local Storage←P →PT1055.008 Ptrace System Calls←P →PT1055.011 Extra Window Memory Injection←P →PT1055.014 VDSO Hijacking←P →PT1574 Hijack Execution Flow←P →FT1574.001 DLL←P →PT1574.004 Dylib Hijacking←M →PT1574.006 Dynamic Linker Hijacking←P →PT1574.007 Path Interception by PATH Environment Variable←P →PT1574.008 Path Interception by Search Order Hijacking←P →PT1574.009 Path Interception by Unquoted Path←P →PT1574.012 COR_PROFILER←P →PT1574.014 AppDomainManager←P →P

Top CVEs of this weakness type, ranked by Risk Priority

CVE Risk CVSS EPSS Published
CVE-2021-41065.57.80.00252022-02-16
CVE-2022-206975.58.60.01112022-04-15
CVE-2023-205595.58.80.00672023-04-02
CVE-2021-331575.57.20.00202024-02-23
CVE-2024-218015.57.10.00182024-08-14
CVE-2025-20004 UPD5.57.20.00132025-05-13
CVE-2025-22893 UPD5.57.80.00122025-08-12
CVE-2025-24305 UPD5.57.20.00132025-08-12
CVE-2025-25273 UPD5.57.80.00122025-08-12
CVE-2025-359635.57.40.00162025-11-11
CVE-2022-468283.55.20.00272022-12-08
CVE-2022-484813.55.20.00212023-04-28
CVE-2022-374093.54.70.00172023-05-10
CVE-2022-416463.54.70.00172023-05-10
CVE-2022-435053.54.10.00162023-08-11
CVE-2023-287113.55.50.00162023-08-11
CVE-2023-443843.54.10.00432023-10-06
CVE-2023-51023.55.30.00572023-10-09
CVE-2023-245873.56.90.00182023-11-14
CVE-2024-38473.56.10.00802024-04-17
CVE-2024-223743.56.50.00162024-08-14
CVE-2024-290793.56.80.00202024-11-13
CVE-2024-336173.55.90.00452024-11-13
CVE-2025-257743.56.50.00392025-03-12
CVE-2025-20022 UPD3.55.70.00192025-05-13