CWE-696— Incorrect Behavior Order
The product performs multiple related behaviors, but the behaviors are performed in the wrong order in ways that may produce resultant weaknesses.— MITRE CWE catalog
59 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-696page 2 of 2
- CVE-2023-23576MEDIUMCVSS 4.3EG 4.32023-12-18
Incorrect behavior order in the Command Centre Server could allow privileged users to gain physical access to the site for longer than intended after a network outage when competencies are used in the access decision. This issue affects…
- CVE-2025-48965MEDIUMCVSS 4.0EG 4.02025-07-20
Mbed TLS before 3.6.4 has a NULL pointer dereference because mbedtls_asn1_store_named_data can trigger conflicting data with val.p of NULL but val.len greater than zero.
- CVE-2026-59305LOWCVSS 3.8EG 3.82026-08-27
Partition interceptor may be improperly added while sending message. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6
- CVE-2026-93304LOWCVSS 3.7EG 3.72026-09-27
A (D)TLS 1.2 client can accept a ChangeCipherSpec message before it has sent its ClientKeyExchange. No master secret has been derived at that point, so the client installs read keys derived from a known (deterministic) key and checks the s…
- CVE-2026-56355LOWCVSS 3.7EG 3.72026-06-20
GNU Savannah Administration Savane through 3.17 uses untrusted data as part of authorization.
- CVE-2026-49318LOWCVSS 2.4EG 2.42026-05-29
Incorrect behavior order in the Infotainment / Digital Round display of the Indian Motorcycle Scout Bobber + Tech 2025 model year allows an adjacent-network attacker to bypass the PIN entry screen. The Infotainment uses presence of Wireles…
- CVE-2026-49317LOWCVSS 2.4EG 2.42026-05-29
Incorrect behavior order in the Infotainment / Digital Round display of the Indian Motorcycle Scout Bobber + Tech 2025 model year allows an adjacent-network attacker to bypass the PIN entry screen. The Infotainment uses presence of Wireles…
- CVE-2026-82898LOWCVSS 2.1EG 2.12026-11-01
Incorrect order of security checks in Apache Wicket. org.apache.wicket.protocol.http.ResourceIsolationRequestCycleListener obtains the page a request targets before it consults its resource isolation policies, because those policies are p…
- CVE-2026-103012LOWCVSS 2.0EG 2.02026-09-30
Claude Code selected an API key stored by Claude Code, for example from an earlier `/login` or written directly to its configuration, ahead of the user's valid Claude Enterprise or Team sign-in when fetching the organization's server-manag…
Map vulnerabilities like CWE-696 to your infrastructure
EchelonGraph correlates every CVE — across CWE-696 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →