Cyber Posture

CWE · MITRE source

CWE-703Improper Check or Handling of Exceptional Conditions

Abstraction: Pillar · CVEs in our corpus: 146

The product does not properly anticipate or handle exceptional conditions that rarely occur during normal operation of the product.

Last updated: 09 May 2026 03:25 UTC

NIST 800-53 r5 controls that address this weakness (17)AI

Showing the 15 most specific. Generic controls that address many weakness types are collapsed below.

Control Title Family Why it addresses this CWE
CP-12Safe ModeCPProvides a defined response to detected conditions by restricting operation, ensuring exceptional conditions are handled rather than ignored or mishandled.
CP-3Contingency TrainingCPContingency training equips users with defined procedures to check and respond to exceptional conditions during disruptions, reducing exploitation of mishandled errors.
CP-4Contingency Plan TestingCPTesting verifies the system's ability to detect, handle, and recover from exceptional conditions as part of the plan, reducing exploitability of improper exception handling.
IR-1Policy and ProceduresIRPolicy defines checks and handling for exceptional conditions arising from security incidents.
IR-3Incident Response TestingIRPerforming IR tests ensures exceptional conditions are properly checked and handled to enable effective response.
IR-4Incident HandlingIRIncident handling capability directly provides structured checking and response actions for security incidents as exceptional conditions.
SA-11Developer Testing and EvaluationSATesting and evaluation exercises error paths and exceptional conditions, surfacing improper handling that is then remediated through the defined process.
SA-15Development Process, Standards, and ToolsSAStandards and tools mandated by the process include proper handling of exceptional conditions that would otherwise be omitted.
SA-24Design For Cyber ResiliencySACyber resiliency objectives explicitly include graceful handling of adverse conditions and exceptional states, reducing improper exception handling.
SI-13Predictable Failure PreventionSIRequires systematic prediction and handling of failure conditions, reducing the impact of unhandled exceptional states.
SI-17Fail-safe ProceduresSIRequires explicit, safe handling actions for specified exceptional conditions rather than allowing unchecked propagation or default unsafe behavior.
SI-6Security and Privacy Function VerificationSIThe required verification process supplies the missing checks for exceptional conditions affecting security functions.
AU-5Response to Audit Logging Process FailuresAUImplements explicit check and handling for the exceptional condition of audit logging process failure.
CA-7Continuous MonitoringCAEstablishing and monitoring system metrics with correlation and response actions helps identify and address improper handling of exceptional conditions.
SC-24Fail in Known StateSCMandates explicit, predictable handling of exceptional conditions rather than undefined continuation.
Show 2 more broadly-applicable controls
CP-5Contingency Plan UpdateCPRegular updates keep contingency procedures aligned with system changes, providing structured handling for exceptional conditions that would otherwise allow unmitigated exploitation.
IR-7Incident Response AssistanceIRSupplies advice and assistance on handling incidents, improving checks and responses to exceptional conditions.

Top CVEs of this weakness type, ranked by Risk Priority

CVE Risk CVSS EPSS Published
CVE-2021-25372 KEV3.36.10.01762021-03-26
CVE-2021-25370 KEV3.26.10.00492021-03-26
CVE-2022-22265 KEV3.05.00.00192022-01-10
CVE-2024-218942.49.80.07942024-04-04
CVE-2024-220532.18.20.07422024-04-04
CVE-2025-130212.09.80.00062025-11-11
CVE-2025-130222.09.80.00062025-11-11
CVE-2025-130232.09.80.00062025-11-11
CVE-2025-130262.09.80.00062025-11-11
CVE-2023-03971.99.60.00092023-01-19
CVE-2021-33291.99.60.00222023-02-26
CVE-2024-398151.99.10.00782024-08-12
CVE-2019-50311.88.80.01022019-10-02
CVE-2021-238591.89.10.00292021-12-08
CVE-2023-459271.89.10.00142024-03-27
CVE-2024-107811.88.10.02512024-11-26
CVE-2018-125511.78.10.00712019-03-27
CVE-2022-417771.77.50.03832022-12-05
CVE-2024-220521.77.50.04152024-04-04
CVE-2024-292051.77.50.02712024-04-25
CVE-2024-46111.78.10.01792024-05-29
CVE-2024-215251.78.30.00102024-07-10
CVE-2026-00111.78.40.00002026-03-02
CVE-2018-54631.67.80.00112018-04-09
CVE-2022-209241.67.70.00732022-11-15