CWE · MITRE source
CWE-691Insufficient Control Flow Management
The code does not sufficiently manage its control flow during execution, creating conditions in which the control flow can be modified in unexpected ways.
Last updated: 14 October 2026 20:41 UTC
Cumulative inbound coverage
How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.
Collective: partial · 1 mapping(s) from 1 framework(s): STIG windows 10 1 (partial)
Control responseHuman-reviewed
Answering this weakness across the control lifecycle, from our framework cross-walks.
—
—
—
NIST 800-53 r5 controls PROPOSED for this weakness (1)AI-assisted
These are model PROPOSALS, not graded mappings. They come
from controls_to_cwe_proposals, which carries no grade field at
all; across the CWE pages 1,540 of 1,722 such associations (89%) have never
been graded by anything. The heading said “address” until
2026-09-29, which asserted a relationship the data does not carry.
Graded cross-walks are on the framework map, not here.
| Control | Title | Family | Why it addresses this CWE |
|---|---|---|---|
SA-24 | Design For Cyber Resiliency | SA | Design principles and implementation approaches enforce robust control-flow management to maintain function and enable recovery after disruption. |
Top CVEs of this weakness type, ranked by Risk Priority
| CVE | Risk | CVSS | EPSS | Published |
|---|---|---|---|---|
CVE-2023-20559 UPD | 6.6 | 8.8 | 0.0067 | 2023-04-02 |
CVE-2022-20697 UPD | 6.5 | 8.6 | 0.0115 | 2022-04-15 |
CVE-2026-79033 | 6.5 | 8.8 | 0.0041 | 2026-08-25 |
CVE-2026-20271 UPD | 6.2 | 8.6 | 0.0047 | 2026-08-05 |
CVE-2026-20276 UPD | 6.1 | 8.6 | 0.0027 | 2026-09-02 |
CVE-2021-4106 UPD | 5.7 | 7.8 | 0.0025 | 2022-02-16 |
CVE-2025-51675 UPD | 5.7 | 7.5 | 0.0026 | 2026-08-26 |
CVE-2021-0157 UPD | 5.6 | 6.7 | 0.0309 | 2021-11-17 |
CVE-2025-22893 UPD | 5.3 | 7.8 | 0.0013 | 2025-08-12 |
CVE-2025-25273 UPD | 5.3 | 7.8 | 0.0013 | 2025-08-12 |
CVE-2025-35963 UPD | 5.3 | 7.4 | 0.0020 | 2025-11-11 |
CVE-2026-76469 | 5.2 | 7.4 | 0.0015 | 2026-10-07 |
CVE-2020-12359 UPD | 5.1 | 6.8 | 0.0032 | 2021-06-09 |
CVE-2024-29079 UPD | 5.1 | 6.8 | 0.0020 | 2024-11-13 |
CVE-2025-25774 UPD | 5.1 | 6.5 | 0.0043 | 2025-03-12 |
CVE-2025-49463 UPD | 5.1 | 6.5 | 0.0049 | 2025-07-10 |
CVE-2021-33157 UPD | 5.0 | 7.2 | 0.0020 | 2024-02-23 |
CVE-2024-21801 UPD | 5.0 | 7.1 | 0.0018 | 2024-08-14 |
CVE-2025-20004 UPD | 4.9 | 7.2 | 0.0015 | 2025-05-13 |
CVE-2025-24305 UPD | 4.9 | 7.2 | 0.0014 | 2025-08-12 |
CVE-2023-24587 UPD | 4.8 | 6.9 | 0.0018 | 2023-11-14 |
CVE-2024-3847 UPD | 4.8 | 6.1 | 0.0089 | 2024-04-17 |
CVE-2024-33617 UPD | 4.7 | 5.9 | 0.0046 | 2024-11-13 |
CVE-2023-5102 UPD | 4.6 | 5.3 | 0.0078 | 2023-10-09 |
CVE-2024-22374 UPD | 4.6 | 6.5 | 0.0016 | 2024-08-14 |