CWE-698Execution After Redirect (EAR)

Abstraction: Base · CVEs in our corpus: 17

The web application sends a redirect to another location, but instead of exiting, it executes additional code.

Last updated: 04 July 2026 13:15 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: partial · 1 mapping(s) from 1 framework(s): ATT&CK 1 (partial)

See the full cumulative-coverage rollup →

NIST 800-53 r5 controls that address this weakness (0)AI

Control	Title	Family	Why it addresses this CWE
No NIST controls proposed yet.

MITRE ATT&CK techniques this weakness enables

Our own two-way CWE↔ATT&CK cross-walk — a direct mapping with no public source (the CWE→CAPEC→ATT&CK chain leaves most top weaknesses, incl. XSS and SQLi, mapped to nothing). Drafted by Grok and spot-checked by Claude Opus 4.8.

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial).

T1190 Exploit Public-Facing Application←P →P

Top CVEs of this weakness type, ranked by Risk Priority

CVE	Risk	CVSS	EPSS	Published
`CVE-2024-48766` UPD	8.0	8.6	0.6808	2025-05-13
`CVE-2025-8350` UPD	7.0	9.8	0.0055	2026-02-19
`CVE-2026-2699`	7.0	9.8	0.4942	2026-04-02
`CVE-2026-58455`	7.0	9.8	0.0119	2026-07-02
`CVE-2024-2569` UPD	5.5	7.3	0.0118	2024-03-18
`CVE-2024-2570` UPD	5.5	7.3	0.0103	2024-03-18
`CVE-2024-2571` UPD	5.5	7.3	0.0103	2024-03-18
`CVE-2024-2572` UPD	5.5	7.3	0.0103	2024-03-18
`CVE-2024-2573` UPD	5.5	7.3	0.0103	2024-03-18
`CVE-2024-2635` UPD	5.5	7.3	0.0043	2024-03-19
`CVE-2024-3376` UPD	5.5	7.3	0.0134	2024-04-06
`CVE-2025-9848` UPD	5.5	7.3	0.0056	2025-09-03
`CVE-2025-6967` UPD	5.5	8.7	0.0045	2026-02-10
`CVE-2025-53077` UPD	3.5	6.5	0.0031	2025-07-29
`CVE-2026-3262`	3.5	6.3	0.0042	2026-02-26
`CVE-2026-3264`	3.5	6.3	0.0042	2026-02-26
`CVE-2026-10271` UPD	3.5	6.3	0.0030	2026-06-01