CWE-706Use of Incorrectly-Resolved Name or Reference

Abstraction: Class · CVEs in our corpus: 120

The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.

Last updated: 21 August 2026 14:15 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: partial · 6 mapping(s) from 2 framework(s): CAPEC 4 (partial) · ATT&CK 2 (partial)

See the full cumulative-coverage rollup →

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent

Stop it (NIST 800-53 / CSF Protect)

PR.PS-06
AC-3 Access Enforcement
AC-4 Information Flow Enforcement
PR.AA-05

Detect

Catch it (CSF Detect / Respond)

—

Harden

Shrink the surface (DISA STIG)

—

Validate

Prove the fix (OWASP ASVS)

—

NIST 800-53 r5 controls that address this weakness (0)AI-assisted

Control	Title	Family	Why it addresses this CWE
No NIST controls proposed yet.

MITRE ATT&CK techniques this weakness enables

Our own two-way CWE↔ATT&CK cross-walk — a direct mapping with no public source (the CWE→CAPEC→ATT&CK chain leaves most top weaknesses, incl. XSS and SQLi, mapped to nothing).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

T1036 Masquerading←P →P T1574.008 Path Interception by Search Order Hijacking←P →M

Top CVEs of this weakness type, ranked by Risk Priority

CVE	Risk	CVSS	EPSS	Published
`CVE-2020-15505` KEV	9.9	9.8	0.9974	2020-07-07
`CVE-2021-40539` KEV	9.9	9.8	0.9896	2021-09-07
`CVE-2025-24813` KEV	9.9	9.8	0.9993	2025-03-10
`CVE-2024-27292`	8.3	7.5	0.6949	2024-03-21
`CVE-2019-8395`	8.1	9.8	0.0707	2019-02-17
`CVE-2019-7731`	7.9	9.8	0.0422	2019-02-11
`CVE-2020-12278`	7.9	9.8	0.0511	2020-04-27
`CVE-2020-12279`	7.9	9.8	0.0509	2020-04-27
`CVE-2021-40856`	7.9	7.5	0.5012	2021-12-13
`CVE-2019-8908`	7.7	9.8	0.0228	2019-02-18
`CVE-2020-23448`	7.6	9.8	0.0158	2021-01-26
`CVE-2020-10574`	7.5	9.8	0.0123	2020-03-14
`CVE-2023-31814`	7.5	9.8	0.0089	2023-05-23
`CVE-2022-30257`	7.4	9.8	0.0068	2022-11-21
`CVE-2022-30258`	7.4	9.8	0.0068	2022-11-21
`CVE-2024-35198`	7.4	9.8	0.0079	2024-07-19
`CVE-2026-65816`	7.4	10.0	0.0053	2026-08-20
`CVE-2025-65474`	7.3	9.8	0.0053	2025-12-11
`CVE-2021-37144`	7.1	9.1	0.0128	2021-07-30
`CVE-2021-37315`	7.1	9.1	0.0111	2023-02-03
`CVE-2019-0571`	7.0	7.8	0.1585	2019-01-08
`CVE-2019-6289`	6.9	8.8	0.0193	2019-01-15
`CVE-2021-37214`	6.8	8.8	0.0106	2021-08-09
`CVE-2018-12020`	6.7	7.5	0.0855	2018-06-08
`CVE-2019-1351`	6.7	7.5	0.0872	2020-01-24