CWE-755: Improper Handling of Exceptional Conditions
Sources read 2026-10-30. MITRE's own page · All weakness notes · Added to CISA's list in the last seven days
What it is
From MITRE's CWE catalogue
The product does not handle or incorrectly handles an exceptional condition.
MITRE classes it as a class-level weakness and rates the likelihood of exploit as medium.
What it lets an attacker do
From MITRE's CWE catalogue
- Other (affects: other)
On CISA's exploited list
From CISA's exploited list
2 of the 109 entries CISA added from 2026-08-04 to 2026-11-01 name CWE-755, against 0 of 70 in the 90 days before. Over the whole catalogue 5 entries name it. The counts are small, so read them as a rough order, not a rate.
CISA's list is not every flaw that is exploited: it holds the ones CISA has evidence of, listed on the day it added them.
- CVE-2026-109618, PHP Group PHP, added 2026-10-26
- CVE-2026-109619, PHP Group PHP, added 2026-10-26
- CVE-2022-44698, Microsoft Defender, added 2022-12-13
- CVE-2020-7247, OpenBSD OpenSMTPD, added 2022-03-25
- CVE-2021-38003, Google Chromium V8, added 2021-11-03
How MITRE says to find it
From MITRE's CWE catalogue
- Automated Static Analysis
Start with one piece of work.
Give us one piece of work and read access to one system. We map it and come back with what we found, what we would build and what it would take — before any commitment. You decide using our output, not our pitch.
Talk to us