@blamejs/exceptd-skills 0.15.30 → 0.15.32

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (8) hide show
  1. package/CHANGELOG.md +8 -0
  2. package/data/_indexes/_meta.json +5 -5
  3. package/data/attack-techniques.json +13 -0
  4. package/data/cve-catalog.json +236 -83
  5. package/data/zeroday-lessons.json +574 -182
  6. package/manifest.json +44 -44
  7. package/package.json +1 -1
  8. package/sbom.cdx.json +18 -18
package/data/zeroday-lessons.json CHANGED
@@ -7351,35 +7351,63 @@
7351
7351
  },
7352
7352
  "CVE-2023-27351": {
7353
7353
  "name": "PaperCut NG/MF Improper Authentication Vulnerability",
7354
- "lesson_date": "2026-05-18",
7354
+ "lesson_date": "2026-05-29",
7355
7355
  "attack_vector": {
7356
- "description": "PaperCut NG/MF contains an improper authentication vulnerability that could allow remote attackers to bypass authentication on affected installations via the SecurityRequestFilter class.",
7357
- "privileges_required": "network attacker (no authentication required)",
7358
- "complexity": "moderate (bulk-import default)",
7359
- "ai_factor": "Bulk-imported — AI-discovery provenance not surfaced in KEV. Detection method that surfaces this class: ADVISORIES_SOURCE (12 primary-source feeds) + CISA-KEV poller. Refine when researcher writeup publishes."
7356
+ "description": "an improper-authentication flaw (CWE-287) letting an unauthenticated attacker bypass authentication and reach administrative functionality. CISA KEV-listed 2026-04-20 with confirmed in-the-wild exploitation.",
7357
+ "privileges_required": "none (the flaw is reachable by an unauthenticated attacker on the application's public interface)",
7358
+ "complexity": "low — KEV-listed, actively exploited; treat as weaponized",
7359
+ "ai_factor": "No AI involvement documented in discovery or weaponization."
7360
+ },
7361
+ "defense_chain": {
7362
+ "prevention": {
7363
+ "what_would_have_worked": "Apply the PaperCut update; review admin activity during the exposure window and rotate admin credentials — PaperCut compromise has been used to stage ransomware.",
7364
+ "was_this_required": true,
7365
+ "framework_requiring_it": "CISA BOD 22-01 (KEV remediation)",
7366
+ "adequacy": "Patch is necessary but insufficient alone — web shells, stolen sessions, and forged keys survive the patch and require explicit cleanup and key rotation."
7367
+ },
7368
+ "detection": {
7369
+ "what_would_have_worked": "Monitoring on the PaperCut: exploit-shaped requests, new web-shell files, unexpected process execution, and session/admin takeover without a matching login.",
7370
+ "was_this_required": false,
7371
+ "framework_requiring_it": null,
7372
+ "adequacy": "Necessary to catch exploitation and resident persistence after patching."
7373
+ },
7374
+ "response": {
7375
+ "what_would_have_worked": "Patch immediately, hunt and remove web shells, rotate application secrets/machine keys, and invalidate sessions, and review for lateral movement and data exfiltration.",
7376
+ "was_this_required": true,
7377
+ "framework_requiring_it": "NIST 800-53 IR-4",
7378
+ "adequacy": "Mandatory; patch-in-place without cleanup leaves the attacker resident or able to re-authenticate."
7379
+ }
7360
7380
  },
7361
7381
  "framework_coverage": {
7362
7382
  "NIST-800-53-SI-2": {
7363
7383
  "covered": true,
7364
7384
  "adequate": false,
7365
- "gap": "30-day SLA inadequate for KEV-listed actively-exploited CVE; KEV due date is the operational clock."
7385
+ "gap": "The 30-day flaw-remediation SLA is far longer than the observed exploitation window for a KEV-listed, unauthenticated web-application flaw; these are mass-exploited within days, and SSRF/deserialization/auth-bypass chains lead to data theft or RCE."
7366
7386
  },
7367
7387
  "ISO-27001-2022-A.8.8": {
7368
7388
  "covered": true,
7369
7389
  "adequate": false,
7370
- "gap": "Standard does not differentiate routinely-disclosed CVE from KEV-listed actively-exploited CVE."
7390
+ "gap": "'Appropriate timescales' is undefined; the standard 30-day reading is unsafe for an actively-exploited, internet-facing web application."
7391
+ },
7392
+ "NIS2-Art21-network-security": {
7393
+ "covered": true,
7394
+ "adequate": false,
7395
+ "gap": "Treats internet-facing applications as essential-function infrastructure but lacks a CISA-KEV-style compressed remediation SLA, and does not require the web-shell-hunt / key-rotation / egress-restriction cleanup these flaws need."
7396
+ },
7397
+ "PCI-DSS-4.0-6.3.3": {
7398
+ "covered": true,
7399
+ "adequate": false,
7400
+ "gap": "The 30-day critical-patch window is exploitation acceptance for an internet-facing web application (e-commerce platforms like Magento sit squarely in PCI scope); WAF coverage is partial mitigation, not remediation."
7371
7401
  }
7372
7402
  },
7373
7403
  "compliance_exposure_score": {
7374
7404
  "percent_audit_passing_orgs_still_exposed": 75,
7375
- "basis": "Known ransomware-campaign use; passing orgs typically still exposed when patch deployment lags KEV due date.",
7405
+ "basis": "Internet-facing PaperCut NG/MF is run by audited organizations on a standard patch SLA and is mass-exploited within days; the required web-shell hunt, key rotation, and egress restriction are rarely part of the documented patch procedure.",
7376
7406
  "theater_pattern": "patch_management"
7377
7407
  },
7378
7408
  "ai_discovered_zeroday": false,
7379
- "ai_discovery_source": "unknown",
7380
- "ai_assist_factor": "none",
7381
- "_auto_imported": true,
7382
- "_intake_method": "v0.13.17-bulk-cisa-kev-import"
7409
+ "ai_discovery_source": "vendor_research",
7410
+ "ai_assist_factor": "none"
7383
7411
  },
7384
7412
  "CVE-2025-48700": {
7385
7413
  "name": "Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability",
@@ -8488,35 +8516,63 @@
8488
8516
  },
8489
8517
  "CVE-2025-53521": {
8490
8518
  "name": "F5 BIG-IP Stack-Based Buffer Overflow Vulnerability",
8491
- "lesson_date": "2026-05-18",
8519
+ "lesson_date": "2026-05-29",
8492
8520
  "attack_vector": {
8493
- "description": "F5 BIG-IP APM contains a stack-based buffer overflow vulnerability that could allow a threat actor to achieve remote code execution.",
8494
- "privileges_required": "network attacker (no authentication required)",
8495
- "complexity": "moderate (bulk-import default)",
8496
- "ai_factor": "Bulk-imported — AI-discovery provenance not surfaced in KEV. Detection method that surfaces this class: ADVISORIES_SOURCE (12 primary-source feeds) + CISA-KEV poller. Refine when researcher writeup publishes."
8521
+ "description": "a stack-based buffer overflow (CWE-121) exploitable by an unauthenticated attacker for memory-corruption remote code execution on the appliance. CISA KEV-listed 2026-03-27 with confirmed in-the-wild exploitation.",
8522
+ "privileges_required": "none (the device/appliance is reachable by an unauthenticated attacker on its network interface)",
8523
+ "complexity": "low — KEV-listed, actively exploited; treat as weaponized",
8524
+ "ai_factor": "No AI involvement documented in discovery or weaponization."
8525
+ },
8526
+ "defense_chain": {
8527
+ "prevention": {
8528
+ "what_would_have_worked": "Apply the vendor update; treat an exploited appliance as fully compromised — rebuild it from a known-good image and rotate every credential, key, and session secret it held, since the appliance terminates trust for the network behind it.",
8529
+ "was_this_required": true,
8530
+ "framework_requiring_it": "CISA BOD 22-01 (KEV remediation)",
8531
+ "adequacy": "Patch is necessary but an exploited appliance must be rebuilt and its secrets rotated — a patch in place does not evict a resident attacker from a device that fronts the network."
8532
+ },
8533
+ "detection": {
8534
+ "what_would_have_worked": "Monitoring of the BIG-IP: exploit-shaped requests, web shells, new processes, credential/config changes, and crashes.",
8535
+ "was_this_required": false,
8536
+ "framework_requiring_it": null,
8537
+ "adequacy": "Necessary because device/appliance compromise is often silent and persists across reboots in firmware/config."
8538
+ },
8539
+ "response": {
8540
+ "what_would_have_worked": "Rebuild the appliance from a known-good image, rotate all credentials and secrets it held, and review the network behind it for lateral movement; assume the device's trust is fully compromised.",
8541
+ "was_this_required": true,
8542
+ "framework_requiring_it": "NIST 800-53 IR-4",
8543
+ "adequacy": "Mandatory; network-device/appliance compromise gives an attacker a durable, trusted position that patching alone does not remove."
8544
+ }
8497
8545
  },
8498
8546
  "framework_coverage": {
8499
8547
  "NIST-800-53-SI-2": {
8500
8548
  "covered": true,
8501
8549
  "adequate": false,
8502
- "gap": "30-day SLA inadequate for KEV-listed actively-exploited CVE; KEV due date is the operational clock."
8550
+ "gap": "The 30-day flaw-remediation SLA is far longer than the observed exploitation window for a KEV-listed unauthenticated flaw on an internet-facing network device/appliance; consumer/embedded devices are mass-exploited into botnets within days (some end-of-life with no fix), and enterprise appliances are change-window-gated and exposed past the KEV due date."
8503
8551
  },
8504
8552
  "ISO-27001-2022-A.8.8": {
8505
8553
  "covered": true,
8506
8554
  "adequate": false,
8507
- "gap": "Standard does not differentiate routinely-disclosed CVE from KEV-listed actively-exploited CVE."
8555
+ "gap": "'Appropriate timescales' is undefined; the standard reading is unsafe for an actively-exploited internet-facing device, and unmanaged/EOL devices fall outside most patch programs entirely."
8556
+ },
8557
+ "NIS2-Art21-network-security": {
8558
+ "covered": true,
8559
+ "adequate": false,
8560
+ "gap": "Treats network devices/appliances as essential-function infrastructure but lacks a CISA-KEV-style compressed remediation SLA and does not address end-of-life devices that can only be replaced, or appliance compromise that requires rebuild rather than patch-in-place."
8561
+ },
8562
+ "PCI-DSS-4.0-6.3.3": {
8563
+ "covered": true,
8564
+ "adequate": false,
8565
+ "gap": "The 30-day critical-patch window is exploitation acceptance for an internet-facing network device or edge appliance fronting or bridging the CDE."
8508
8566
  }
8509
8567
  },
8510
8568
  "compliance_exposure_score": {
8511
- "percent_audit_passing_orgs_still_exposed": 55,
8512
- "basis": "KEV-listed but not yet ransomware-attributed; exposure concentrated in orgs whose patch SLA defaults to NIST 30 days.",
8569
+ "percent_audit_passing_orgs_still_exposed": 77,
8570
+ "basis": "Internet-facing F5 BIG-IP is a load-bearing edge/management appliance run on change-controlled patch windows; the required rebuild and secret rotation is rarely part of the documented patch procedure.",
8513
8571
  "theater_pattern": "patch_management"
8514
8572
  },
8515
8573
  "ai_discovered_zeroday": false,
8516
- "ai_discovery_source": "unknown",
8517
- "ai_assist_factor": "none",
8518
- "_auto_imported": true,
8519
- "_intake_method": "v0.13.17-bulk-cisa-kev-import"
8574
+ "ai_discovery_source": "vendor_research",
8575
+ "ai_assist_factor": "none"
8520
8576
  },
8521
8577
  "CVE-2026-33634": {
8522
8578
  "name": "Aquasecurity Trivy Embedded Malicious Code Vulnerability",
@@ -11827,35 +11883,63 @@
11827
11883
  },
11828
11884
  "CVE-2021-22054": {
11829
11885
  "name": "Omnissa Workspace ONE Server-Side Request Forgery",
11830
- "lesson_date": "2026-05-18",
11886
+ "lesson_date": "2026-05-29",
11831
11887
  "attack_vector": {
11832
- "description": "Omnissa Workspace One UEM formerly known as VMware Workspace One UEM contains a server-side request forgery (SSRF) vulnerability that could allow a malicious actor with network access to UEM to send their requests without authentication and to gain access to sensitive information.",
11833
- "privileges_required": "network attacker (no authentication required)",
11834
- "complexity": "moderate (bulk-import default)",
11835
- "ai_factor": "Bulk-imported — AI-discovery provenance not surfaced in KEV. Detection method that surfaces this class: ADVISORIES_SOURCE (12 primary-source feeds) + CISA-KEV poller. Refine when researcher writeup publishes."
11888
+ "description": "a server-side request forgery flaw (CWE-918) letting an unauthenticated attacker coerce server-side requests to internal resources. CISA KEV-listed 2026-03-09 with confirmed in-the-wild exploitation.",
11889
+ "privileges_required": "none (the flaw is reachable by an unauthenticated attacker on the application's public interface)",
11890
+ "complexity": "low — KEV-listed, actively exploited; treat as weaponized",
11891
+ "ai_factor": "No AI involvement documented in discovery or weaponization."
11892
+ },
11893
+ "defense_chain": {
11894
+ "prevention": {
11895
+ "what_would_have_worked": "Apply the Workspace ONE UEM update; restrict outbound access and block cloud-metadata endpoints, and review for internal-resource access — UEM reaches the managed mobile fleet.",
11896
+ "was_this_required": true,
11897
+ "framework_requiring_it": "CISA BOD 22-01 (KEV remediation)",
11898
+ "adequacy": "Patch is necessary; egress filtering and metadata-endpoint blocking are the compensating controls that limit SSRF impact, and a flat outbound network defeats them."
11899
+ },
11900
+ "detection": {
11901
+ "what_would_have_worked": "Monitoring on the Workspace ONE UEM: exploit-shaped requests, server-side outbound requests to internal/metadata endpoints.",
11902
+ "was_this_required": false,
11903
+ "framework_requiring_it": null,
11904
+ "adequacy": "Necessary to catch exploitation and resident persistence after patching."
11905
+ },
11906
+ "response": {
11907
+ "what_would_have_worked": "Patch immediately, restrict egress and review what internal resources the SSRF reached, and review for lateral movement and data exfiltration.",
11908
+ "was_this_required": true,
11909
+ "framework_requiring_it": "NIST 800-53 IR-4",
11910
+ "adequacy": "Mandatory; patch-in-place without cleanup leaves the attacker resident or able to re-authenticate."
11911
+ }
11836
11912
  },
11837
11913
  "framework_coverage": {
11838
11914
  "NIST-800-53-SI-2": {
11839
11915
  "covered": true,
11840
11916
  "adequate": false,
11841
- "gap": "30-day SLA inadequate for KEV-listed actively-exploited CVE; KEV due date is the operational clock."
11917
+ "gap": "The 30-day flaw-remediation SLA is far longer than the observed exploitation window for a KEV-listed, unauthenticated web-application flaw; these are mass-exploited within days, and SSRF/deserialization/auth-bypass chains lead to data theft or RCE."
11842
11918
  },
11843
11919
  "ISO-27001-2022-A.8.8": {
11844
11920
  "covered": true,
11845
11921
  "adequate": false,
11846
- "gap": "Standard does not differentiate routinely-disclosed CVE from KEV-listed actively-exploited CVE."
11922
+ "gap": "'Appropriate timescales' is undefined; the standard 30-day reading is unsafe for an actively-exploited, internet-facing web application."
11923
+ },
11924
+ "NIS2-Art21-network-security": {
11925
+ "covered": true,
11926
+ "adequate": false,
11927
+ "gap": "Treats internet-facing applications as essential-function infrastructure but lacks a CISA-KEV-style compressed remediation SLA, and does not require the web-shell-hunt / key-rotation / egress-restriction cleanup these flaws need."
11928
+ },
11929
+ "PCI-DSS-4.0-6.3.3": {
11930
+ "covered": true,
11931
+ "adequate": false,
11932
+ "gap": "The 30-day critical-patch window is exploitation acceptance for an internet-facing web application (e-commerce platforms like Magento sit squarely in PCI scope); WAF coverage is partial mitigation, not remediation."
11847
11933
  }
11848
11934
  },
11849
11935
  "compliance_exposure_score": {
11850
- "percent_audit_passing_orgs_still_exposed": 55,
11851
- "basis": "KEV-listed but not yet ransomware-attributed; exposure concentrated in orgs whose patch SLA defaults to NIST 30 days.",
11936
+ "percent_audit_passing_orgs_still_exposed": 75,
11937
+ "basis": "Internet-facing Omnissa Workspace ONE UEM is run by audited organizations on a standard patch SLA and is mass-exploited within days; the required web-shell hunt, key rotation, and egress restriction are rarely part of the documented patch procedure.",
11852
11938
  "theater_pattern": "patch_management"
11853
11939
  },
11854
11940
  "ai_discovered_zeroday": false,
11855
- "ai_discovery_source": "unknown",
11856
- "ai_assist_factor": "none",
11857
- "_auto_imported": true,
11858
- "_intake_method": "v0.13.17-bulk-cisa-kev-import"
11941
+ "ai_discovery_source": "vendor_research",
11942
+ "ai_assist_factor": "none"
11859
11943
  },
11860
11944
  "CVE-2025-26399": {
11861
11945
  "name": "SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability",
@@ -12651,35 +12735,63 @@
12651
12735
  },
12652
12736
  "CVE-2021-22175": {
12653
12737
  "name": "GitLab Server-Side Request Forgery (SSRF) Vulnerability",
12654
- "lesson_date": "2026-05-18",
12738
+ "lesson_date": "2026-05-29",
12655
12739
  "attack_vector": {
12656
- "description": "GitLab contains a server-side request forgery (SSRF) vulnerability when requests to the internal network for webhooks are enabled.",
12657
- "privileges_required": "network attacker (no authentication required)",
12658
- "complexity": "moderate (bulk-import default)",
12659
- "ai_factor": "Bulk-imported — AI-discovery provenance not surfaced in KEV. Detection method that surfaces this class: ADVISORIES_SOURCE (12 primary-source feeds) + CISA-KEV poller. Refine when researcher writeup publishes."
12740
+ "description": "a server-side request forgery flaw (CWE-918) letting an unauthenticated attacker coerce the server into making requests to internal resources. CISA KEV-listed 2026-02-18 with confirmed in-the-wild exploitation.",
12741
+ "privileges_required": "none (the flaw is reachable by an unauthenticated attacker on the application's public interface)",
12742
+ "complexity": "low — KEV-listed, actively exploited; treat as weaponized",
12743
+ "ai_factor": "No AI involvement documented in discovery or weaponization."
12744
+ },
12745
+ "defense_chain": {
12746
+ "prevention": {
12747
+ "what_would_have_worked": "Apply the GitLab update; restrict the server's outbound access (egress filtering, block cloud-metadata endpoints) and review for internal-resource access via the SSRF.",
12748
+ "was_this_required": true,
12749
+ "framework_requiring_it": "CISA BOD 22-01 (KEV remediation)",
12750
+ "adequacy": "Patch is necessary; egress filtering and metadata-endpoint blocking are the compensating controls that limit SSRF impact, and a flat outbound network defeats them."
12751
+ },
12752
+ "detection": {
12753
+ "what_would_have_worked": "Monitoring on the GitLab: exploit-shaped requests, server-side outbound requests to internal/metadata endpoints.",
12754
+ "was_this_required": false,
12755
+ "framework_requiring_it": null,
12756
+ "adequacy": "Necessary to catch exploitation and resident persistence after patching."
12757
+ },
12758
+ "response": {
12759
+ "what_would_have_worked": "Patch immediately, restrict egress and review what internal resources the SSRF reached, and review for lateral movement and data exfiltration.",
12760
+ "was_this_required": true,
12761
+ "framework_requiring_it": "NIST 800-53 IR-4",
12762
+ "adequacy": "Mandatory; patch-in-place without cleanup leaves the attacker resident or able to re-authenticate."
12763
+ }
12660
12764
  },
12661
12765
  "framework_coverage": {
12662
12766
  "NIST-800-53-SI-2": {
12663
12767
  "covered": true,
12664
12768
  "adequate": false,
12665
- "gap": "30-day SLA inadequate for KEV-listed actively-exploited CVE; KEV due date is the operational clock."
12769
+ "gap": "The 30-day flaw-remediation SLA is far longer than the observed exploitation window for a KEV-listed, unauthenticated web-application flaw; these are mass-exploited within days, and SSRF/deserialization/auth-bypass chains lead to data theft or RCE."
12666
12770
  },
12667
12771
  "ISO-27001-2022-A.8.8": {
12668
12772
  "covered": true,
12669
12773
  "adequate": false,
12670
- "gap": "Standard does not differentiate routinely-disclosed CVE from KEV-listed actively-exploited CVE."
12774
+ "gap": "'Appropriate timescales' is undefined; the standard 30-day reading is unsafe for an actively-exploited, internet-facing web application."
12775
+ },
12776
+ "NIS2-Art21-network-security": {
12777
+ "covered": true,
12778
+ "adequate": false,
12779
+ "gap": "Treats internet-facing applications as essential-function infrastructure but lacks a CISA-KEV-style compressed remediation SLA, and does not require the web-shell-hunt / key-rotation / egress-restriction cleanup these flaws need."
12780
+ },
12781
+ "PCI-DSS-4.0-6.3.3": {
12782
+ "covered": true,
12783
+ "adequate": false,
12784
+ "gap": "The 30-day critical-patch window is exploitation acceptance for an internet-facing web application (e-commerce platforms like Magento sit squarely in PCI scope); WAF coverage is partial mitigation, not remediation."
12671
12785
  }
12672
12786
  },
12673
12787
  "compliance_exposure_score": {
12674
- "percent_audit_passing_orgs_still_exposed": 55,
12675
- "basis": "KEV-listed but not yet ransomware-attributed; exposure concentrated in orgs whose patch SLA defaults to NIST 30 days.",
12788
+ "percent_audit_passing_orgs_still_exposed": 75,
12789
+ "basis": "Internet-facing GitLab is run by audited organizations on a standard patch SLA and is mass-exploited within days; the required web-shell hunt, key rotation, and egress restriction are rarely part of the documented patch procedure.",
12676
12790
  "theater_pattern": "patch_management"
12677
12791
  },
12678
12792
  "ai_discovered_zeroday": false,
12679
- "ai_discovery_source": "unknown",
12680
- "ai_assist_factor": "none",
12681
- "_auto_imported": true,
12682
- "_intake_method": "v0.13.17-bulk-cisa-kev-import"
12793
+ "ai_discovery_source": "vendor_research",
12794
+ "ai_assist_factor": "none"
12683
12795
  },
12684
12796
  "CVE-2026-22769": {
12685
12797
  "name": "Dell RecoverPoint for Virtual Machines (RP4VMs) Use of Hard-coded Credentials Vulnerability",
@@ -13588,35 +13700,63 @@
13588
13700
  },
13589
13701
  "CVE-2021-39935": {
13590
13702
  "name": "GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability",
13591
- "lesson_date": "2026-05-18",
13703
+ "lesson_date": "2026-05-29",
13592
13704
  "attack_vector": {
13593
- "description": "GitLab Community and Enterprise Editions contain a server-side request forgery vulnerability which could allow unauthorized external users to perform Server Side Requests via the CI Lint API. ",
13594
- "privileges_required": "network attacker (no authentication required)",
13595
- "complexity": "moderate (bulk-import default)",
13596
- "ai_factor": "Bulk-imported — AI-discovery provenance not surfaced in KEV. Detection method that surfaces this class: ADVISORIES_SOURCE (12 primary-source feeds) + CISA-KEV poller. Refine when researcher writeup publishes."
13705
+ "description": "a server-side request forgery flaw (CWE-918) letting an unauthenticated attacker coerce server-side requests to internal resources. CISA KEV-listed 2026-02-03 with confirmed in-the-wild exploitation.",
13706
+ "privileges_required": "none (the flaw is reachable by an unauthenticated attacker on the application's public interface)",
13707
+ "complexity": "low — KEV-listed, actively exploited; treat as weaponized",
13708
+ "ai_factor": "No AI involvement documented in discovery or weaponization."
13709
+ },
13710
+ "defense_chain": {
13711
+ "prevention": {
13712
+ "what_would_have_worked": "Apply the GitLab update; enforce egress filtering and block cloud-metadata endpoints, and review for internal-resource access via the SSRF.",
13713
+ "was_this_required": true,
13714
+ "framework_requiring_it": "CISA BOD 22-01 (KEV remediation)",
13715
+ "adequacy": "Patch is necessary; egress filtering and metadata-endpoint blocking are the compensating controls that limit SSRF impact, and a flat outbound network defeats them."
13716
+ },
13717
+ "detection": {
13718
+ "what_would_have_worked": "Monitoring on the GitLab: exploit-shaped requests, server-side outbound requests to internal/metadata endpoints.",
13719
+ "was_this_required": false,
13720
+ "framework_requiring_it": null,
13721
+ "adequacy": "Necessary to catch exploitation and resident persistence after patching."
13722
+ },
13723
+ "response": {
13724
+ "what_would_have_worked": "Patch immediately, restrict egress and review what internal resources the SSRF reached, and review for lateral movement and data exfiltration.",
13725
+ "was_this_required": true,
13726
+ "framework_requiring_it": "NIST 800-53 IR-4",
13727
+ "adequacy": "Mandatory; patch-in-place without cleanup leaves the attacker resident or able to re-authenticate."
13728
+ }
13597
13729
  },
13598
13730
  "framework_coverage": {
13599
13731
  "NIST-800-53-SI-2": {
13600
13732
  "covered": true,
13601
13733
  "adequate": false,
13602
- "gap": "30-day SLA inadequate for KEV-listed actively-exploited CVE; KEV due date is the operational clock."
13734
+ "gap": "The 30-day flaw-remediation SLA is far longer than the observed exploitation window for a KEV-listed, unauthenticated web-application flaw; these are mass-exploited within days, and SSRF/deserialization/auth-bypass chains lead to data theft or RCE."
13603
13735
  },
13604
13736
  "ISO-27001-2022-A.8.8": {
13605
13737
  "covered": true,
13606
13738
  "adequate": false,
13607
- "gap": "Standard does not differentiate routinely-disclosed CVE from KEV-listed actively-exploited CVE."
13739
+ "gap": "'Appropriate timescales' is undefined; the standard 30-day reading is unsafe for an actively-exploited, internet-facing web application."
13740
+ },
13741
+ "NIS2-Art21-network-security": {
13742
+ "covered": true,
13743
+ "adequate": false,
13744
+ "gap": "Treats internet-facing applications as essential-function infrastructure but lacks a CISA-KEV-style compressed remediation SLA, and does not require the web-shell-hunt / key-rotation / egress-restriction cleanup these flaws need."
13745
+ },
13746
+ "PCI-DSS-4.0-6.3.3": {
13747
+ "covered": true,
13748
+ "adequate": false,
13749
+ "gap": "The 30-day critical-patch window is exploitation acceptance for an internet-facing web application (e-commerce platforms like Magento sit squarely in PCI scope); WAF coverage is partial mitigation, not remediation."
13608
13750
  }
13609
13751
  },
13610
13752
  "compliance_exposure_score": {
13611
- "percent_audit_passing_orgs_still_exposed": 55,
13612
- "basis": "KEV-listed but not yet ransomware-attributed; exposure concentrated in orgs whose patch SLA defaults to NIST 30 days.",
13753
+ "percent_audit_passing_orgs_still_exposed": 75,
13754
+ "basis": "Internet-facing GitLab Community and Enterprise Editions is run by audited organizations on a standard patch SLA and is mass-exploited within days; the required web-shell hunt, key rotation, and egress restriction are rarely part of the documented patch procedure.",
13613
13755
  "theater_pattern": "patch_management"
13614
13756
  },
13615
13757
  "ai_discovered_zeroday": false,
13616
- "ai_discovery_source": "unknown",
13617
- "ai_assist_factor": "none",
13618
- "_auto_imported": true,
13619
- "_intake_method": "v0.13.17-bulk-cisa-kev-import"
13758
+ "ai_discovery_source": "vendor_research",
13759
+ "ai_assist_factor": "none"
13620
13760
  },
13621
13761
  "CVE-2025-64328": {
13622
13762
  "name": "Sangoma FreePBX OS Command Injection Vulnerability",
@@ -14246,35 +14386,63 @@
14246
14386
  },
14247
14387
  "CVE-2025-34026": {
14248
14388
  "name": "Versa Concerto Improper Authentication Vulnerability",
14249
- "lesson_date": "2026-05-18",
14389
+ "lesson_date": "2026-05-29",
14250
14390
  "attack_vector": {
14251
- "description": "Versa Concerto SD-WAN orchestration platform contains an improper authentication vulnerability in the Traefik reverse proxy configuration, allowing at attacker to access administrative endpoints. The internal Actuator endpoint can be leveraged for access to heap dumps and trace logs.",
14252
- "privileges_required": "network attacker (no authentication required)",
14253
- "complexity": "moderate (bulk-import default)",
14254
- "ai_factor": "Bulk-imported — AI-discovery provenance not surfaced in KEV. Detection method that surfaces this class: ADVISORIES_SOURCE (12 primary-source feeds) + CISA-KEV poller. Refine when researcher writeup publishes."
14391
+ "description": "an authentication bypass using an alternate path or channel (CWE-288) letting an unauthenticated attacker reach administrative functionality on the Versa Concerto SD-WAN orchestrator. CISA KEV-listed 2026-01-22 with confirmed in-the-wild exploitation.",
14392
+ "privileges_required": "none (the device/appliance is reachable by an unauthenticated attacker on its network interface)",
14393
+ "complexity": "low — KEV-listed, actively exploited; treat as weaponized",
14394
+ "ai_factor": "No AI involvement documented in discovery or weaponization."
14395
+ },
14396
+ "defense_chain": {
14397
+ "prevention": {
14398
+ "what_would_have_worked": "Apply the vendor update; treat an exploited appliance as fully compromised — rebuild it from a known-good image and rotate every credential, key, and session secret it held, since the appliance terminates trust for the network behind it.",
14399
+ "was_this_required": true,
14400
+ "framework_requiring_it": "CISA BOD 22-01 (KEV remediation)",
14401
+ "adequacy": "Patch is necessary but an exploited appliance must be rebuilt and its secrets rotated — a patch in place does not evict a resident attacker from a device that fronts the network."
14402
+ },
14403
+ "detection": {
14404
+ "what_would_have_worked": "Monitoring of the Versa Concerto: exploit-shaped requests, web shells, new processes, credential/config changes, and crashes.",
14405
+ "was_this_required": false,
14406
+ "framework_requiring_it": null,
14407
+ "adequacy": "Necessary because device/appliance compromise is often silent and persists across reboots in firmware/config."
14408
+ },
14409
+ "response": {
14410
+ "what_would_have_worked": "Rebuild the appliance from a known-good image, rotate all credentials and secrets it held, and review the network behind it for lateral movement; assume the device's trust is fully compromised.",
14411
+ "was_this_required": true,
14412
+ "framework_requiring_it": "NIST 800-53 IR-4",
14413
+ "adequacy": "Mandatory; network-device/appliance compromise gives an attacker a durable, trusted position that patching alone does not remove."
14414
+ }
14255
14415
  },
14256
14416
  "framework_coverage": {
14257
14417
  "NIST-800-53-SI-2": {
14258
14418
  "covered": true,
14259
14419
  "adequate": false,
14260
- "gap": "30-day SLA inadequate for KEV-listed actively-exploited CVE; KEV due date is the operational clock."
14420
+ "gap": "The 30-day flaw-remediation SLA is far longer than the observed exploitation window for a KEV-listed unauthenticated flaw on an internet-facing network device/appliance; consumer/embedded devices are mass-exploited into botnets within days (some end-of-life with no fix), and enterprise appliances are change-window-gated and exposed past the KEV due date."
14261
14421
  },
14262
14422
  "ISO-27001-2022-A.8.8": {
14263
14423
  "covered": true,
14264
14424
  "adequate": false,
14265
- "gap": "Standard does not differentiate routinely-disclosed CVE from KEV-listed actively-exploited CVE."
14425
+ "gap": "'Appropriate timescales' is undefined; the standard reading is unsafe for an actively-exploited internet-facing device, and unmanaged/EOL devices fall outside most patch programs entirely."
14426
+ },
14427
+ "NIS2-Art21-network-security": {
14428
+ "covered": true,
14429
+ "adequate": false,
14430
+ "gap": "Treats network devices/appliances as essential-function infrastructure but lacks a CISA-KEV-style compressed remediation SLA and does not address end-of-life devices that can only be replaced, or appliance compromise that requires rebuild rather than patch-in-place."
14431
+ },
14432
+ "PCI-DSS-4.0-6.3.3": {
14433
+ "covered": true,
14434
+ "adequate": false,
14435
+ "gap": "The 30-day critical-patch window is exploitation acceptance for an internet-facing network device or edge appliance fronting or bridging the CDE."
14266
14436
  }
14267
14437
  },
14268
14438
  "compliance_exposure_score": {
14269
- "percent_audit_passing_orgs_still_exposed": 55,
14270
- "basis": "KEV-listed but not yet ransomware-attributed; exposure concentrated in orgs whose patch SLA defaults to NIST 30 days.",
14439
+ "percent_audit_passing_orgs_still_exposed": 77,
14440
+ "basis": "Internet-facing Versa Concerto is a load-bearing edge/management appliance run on change-controlled patch windows; the required rebuild and secret rotation is rarely part of the documented patch procedure.",
14271
14441
  "theater_pattern": "patch_management"
14272
14442
  },
14273
14443
  "ai_discovered_zeroday": false,
14274
- "ai_discovery_source": "unknown",
14275
- "ai_assist_factor": "none",
14276
- "_auto_imported": true,
14277
- "_intake_method": "v0.13.17-bulk-cisa-kev-import"
14444
+ "ai_discovery_source": "vendor_research",
14445
+ "ai_assist_factor": "none"
14278
14446
  },
14279
14447
  "CVE-2025-31125": {
14280
14448
  "name": "Vite Vitejs Improper Access Control Vulnerability",
@@ -14600,67 +14768,123 @@
14600
14768
  },
14601
14769
  "CVE-2025-37164": {
14602
14770
  "name": "Hewlett Packard Enterprise (HPE) OneView Code Injection Vulnerability",
14603
- "lesson_date": "2026-05-18",
14771
+ "lesson_date": "2026-05-29",
14604
14772
  "attack_vector": {
14605
- "description": "Hewlett Packard Enterprise (HPE) OneView contains a code injection vulnerability that allows a remote unauthenticated user to perform remote code execution.",
14606
- "privileges_required": "network attacker (no authentication required)",
14607
- "complexity": "moderate (bulk-import default)",
14608
- "ai_factor": "Bulk-imported — AI-discovery provenance not surfaced in KEV. Detection method that surfaces this class: ADVISORIES_SOURCE (12 primary-source feeds) + CISA-KEV poller. Refine when researcher writeup publishes."
14773
+ "description": "a code-injection flaw (CWE-94) enabling unauthenticated remote code execution on the HPE OneView infrastructure-management appliance. CISA KEV-listed 2026-01-07 with confirmed in-the-wild exploitation.",
14774
+ "privileges_required": "none (the device/appliance is reachable by an unauthenticated attacker on its network interface)",
14775
+ "complexity": "low — KEV-listed, actively exploited; treat as weaponized",
14776
+ "ai_factor": "No AI involvement documented in discovery or weaponization."
14609
14777
  },
14610
- "framework_coverage": {
14778
+ "defense_chain": {
14779
+ "prevention": {
14780
+ "what_would_have_worked": "Apply the vendor update; treat an exploited appliance as fully compromised — rebuild it from a known-good image and rotate every credential, key, and session secret it held, since the appliance terminates trust for the network behind it.",
14781
+ "was_this_required": true,
14782
+ "framework_requiring_it": "CISA BOD 22-01 (KEV remediation)",
14783
+ "adequacy": "Patch is necessary but an exploited appliance must be rebuilt and its secrets rotated — a patch in place does not evict a resident attacker from a device that fronts the network."
14784
+ },
14785
+ "detection": {
14786
+ "what_would_have_worked": "Monitoring of the HPE OneView: exploit-shaped requests, web shells, new processes, credential/config changes, and crashes.",
14787
+ "was_this_required": false,
14788
+ "framework_requiring_it": null,
14789
+ "adequacy": "Necessary because device/appliance compromise is often silent and persists across reboots in firmware/config."
14790
+ },
14791
+ "response": {
14792
+ "what_would_have_worked": "Rebuild the appliance from a known-good image, rotate all credentials and secrets it held, and review the network behind it for lateral movement; assume the device's trust is fully compromised.",
14793
+ "was_this_required": true,
14794
+ "framework_requiring_it": "NIST 800-53 IR-4",
14795
+ "adequacy": "Mandatory; network-device/appliance compromise gives an attacker a durable, trusted position that patching alone does not remove."
14796
+ }
14797
+ },
14798
+ "framework_coverage": {
14611
14799
  "NIST-800-53-SI-2": {
14612
14800
  "covered": true,
14613
14801
  "adequate": false,
14614
- "gap": "30-day SLA inadequate for KEV-listed actively-exploited CVE; KEV due date is the operational clock."
14802
+ "gap": "The 30-day flaw-remediation SLA is far longer than the observed exploitation window for a KEV-listed unauthenticated flaw on an internet-facing network device/appliance; consumer/embedded devices are mass-exploited into botnets within days (some end-of-life with no fix), and enterprise appliances are change-window-gated and exposed past the KEV due date."
14615
14803
  },
14616
14804
  "ISO-27001-2022-A.8.8": {
14617
14805
  "covered": true,
14618
14806
  "adequate": false,
14619
- "gap": "Standard does not differentiate routinely-disclosed CVE from KEV-listed actively-exploited CVE."
14807
+ "gap": "'Appropriate timescales' is undefined; the standard reading is unsafe for an actively-exploited internet-facing device, and unmanaged/EOL devices fall outside most patch programs entirely."
14808
+ },
14809
+ "NIS2-Art21-network-security": {
14810
+ "covered": true,
14811
+ "adequate": false,
14812
+ "gap": "Treats network devices/appliances as essential-function infrastructure but lacks a CISA-KEV-style compressed remediation SLA and does not address end-of-life devices that can only be replaced, or appliance compromise that requires rebuild rather than patch-in-place."
14813
+ },
14814
+ "PCI-DSS-4.0-6.3.3": {
14815
+ "covered": true,
14816
+ "adequate": false,
14817
+ "gap": "The 30-day critical-patch window is exploitation acceptance for an internet-facing network device or edge appliance fronting or bridging the CDE."
14620
14818
  }
14621
14819
  },
14622
14820
  "compliance_exposure_score": {
14623
- "percent_audit_passing_orgs_still_exposed": 55,
14624
- "basis": "KEV-listed but not yet ransomware-attributed; exposure concentrated in orgs whose patch SLA defaults to NIST 30 days.",
14821
+ "percent_audit_passing_orgs_still_exposed": 77,
14822
+ "basis": "Internet-facing HPE OneView is a load-bearing edge/management appliance run on change-controlled patch windows; the required rebuild and secret rotation is rarely part of the documented patch procedure.",
14625
14823
  "theater_pattern": "patch_management"
14626
14824
  },
14627
14825
  "ai_discovered_zeroday": false,
14628
- "ai_discovery_source": "unknown",
14629
- "ai_assist_factor": "none",
14630
- "_auto_imported": true,
14631
- "_intake_method": "v0.13.17-bulk-cisa-kev-import"
14826
+ "ai_discovery_source": "vendor_research",
14827
+ "ai_assist_factor": "none"
14632
14828
  },
14633
14829
  "CVE-2023-52163": {
14634
14830
  "name": "Digiever DS-2105 Pro Missing Authorization Vulnerability",
14635
- "lesson_date": "2026-05-18",
14831
+ "lesson_date": "2026-05-29",
14636
14832
  "attack_vector": {
14637
- "description": "Digiever DS-2105 Pro contains a missing authorization vulnerability which could allow for command injection via time_tzsetup.cgi.",
14638
- "privileges_required": "network attacker (no authentication required)",
14639
- "complexity": "moderate (bulk-import default)",
14640
- "ai_factor": "Bulk-imported — AI-discovery provenance not surfaced in KEV. Detection method that surfaces this class: ADVISORIES_SOURCE (12 primary-source feeds) + CISA-KEV poller. Refine when researcher writeup publishes."
14833
+ "description": "a missing-authorization flaw (CWE-862) letting an unauthenticated attacker reach privileged functionality on the network video recorder. CISA KEV-listed 2025-12-22 with confirmed in-the-wild exploitation.",
14834
+ "privileges_required": "none (the device/appliance is reachable by an unauthenticated attacker on its network interface)",
14835
+ "complexity": "low — KEV-listed, actively exploited; treat as weaponized",
14836
+ "ai_factor": "No AI involvement documented in discovery or weaponization."
14837
+ },
14838
+ "defense_chain": {
14839
+ "prevention": {
14840
+ "what_would_have_worked": "Apply the vendor firmware update; for end-of-life devices with no fix, replace them. After any suspected compromise, factory-reset and re-flash — embedded-device compromise persists in firmware/config, and these devices are recruited into botnets and operational-relay (ORB) infrastructure.",
14841
+ "was_this_required": true,
14842
+ "framework_requiring_it": "CISA BOD 22-01 (KEV remediation)",
14843
+ "adequacy": "Patch is necessary but EOL firmware often has no fix, making replacement the only remediation; compromised devices need re-flash, not just patch."
14844
+ },
14845
+ "detection": {
14846
+ "what_would_have_worked": "Monitoring of the Digiever DVR: exploit-shaped requests, anomalous outbound/botnet traffic and config drift.",
14847
+ "was_this_required": false,
14848
+ "framework_requiring_it": null,
14849
+ "adequacy": "Necessary because device/appliance compromise is often silent and persists across reboots in firmware/config."
14850
+ },
14851
+ "response": {
14852
+ "what_would_have_worked": "Factory-reset and re-flash or replace the device, rotate all credentials and secrets it held, and review the network behind it for lateral movement; assume the device's trust is fully compromised.",
14853
+ "was_this_required": true,
14854
+ "framework_requiring_it": "NIST 800-53 IR-4",
14855
+ "adequacy": "Mandatory; network-device/appliance compromise gives an attacker a durable, trusted position that patching alone does not remove."
14856
+ }
14641
14857
  },
14642
14858
  "framework_coverage": {
14643
14859
  "NIST-800-53-SI-2": {
14644
14860
  "covered": true,
14645
14861
  "adequate": false,
14646
- "gap": "30-day SLA inadequate for KEV-listed actively-exploited CVE; KEV due date is the operational clock."
14862
+ "gap": "The 30-day flaw-remediation SLA is far longer than the observed exploitation window for a KEV-listed unauthenticated flaw on an internet-facing network device/appliance; consumer/embedded devices are mass-exploited into botnets within days (some end-of-life with no fix), and enterprise appliances are change-window-gated and exposed past the KEV due date."
14647
14863
  },
14648
14864
  "ISO-27001-2022-A.8.8": {
14649
14865
  "covered": true,
14650
14866
  "adequate": false,
14651
- "gap": "Standard does not differentiate routinely-disclosed CVE from KEV-listed actively-exploited CVE."
14867
+ "gap": "'Appropriate timescales' is undefined; the standard reading is unsafe for an actively-exploited internet-facing device, and unmanaged/EOL devices fall outside most patch programs entirely."
14868
+ },
14869
+ "NIS2-Art21-network-security": {
14870
+ "covered": true,
14871
+ "adequate": false,
14872
+ "gap": "Treats network devices/appliances as essential-function infrastructure but lacks a CISA-KEV-style compressed remediation SLA and does not address end-of-life devices that can only be replaced, or appliance compromise that requires rebuild rather than patch-in-place."
14873
+ },
14874
+ "PCI-DSS-4.0-6.3.3": {
14875
+ "covered": true,
14876
+ "adequate": false,
14877
+ "gap": "The 30-day critical-patch window is exploitation acceptance for an internet-facing network device or edge appliance fronting or bridging the CDE."
14652
14878
  }
14653
14879
  },
14654
14880
  "compliance_exposure_score": {
14655
- "percent_audit_passing_orgs_still_exposed": 55,
14656
- "basis": "KEV-listed but not yet ransomware-attributed; exposure concentrated in orgs whose patch SLA defaults to NIST 30 days.",
14881
+ "percent_audit_passing_orgs_still_exposed": 80,
14882
+ "basis": "Internet-facing Digiever DS-2105 Pro is frequently unmanaged or end-of-life; audited organizations rarely track embedded-device firmware on a KEV SLA, and re-flash/replace is almost never part of a routine patch procedure.",
14657
14883
  "theater_pattern": "patch_management"
14658
14884
  },
14659
14885
  "ai_discovered_zeroday": false,
14660
- "ai_discovery_source": "unknown",
14661
- "ai_assist_factor": "none",
14662
- "_auto_imported": true,
14663
- "_intake_method": "v0.13.17-bulk-cisa-kev-import"
14886
+ "ai_discovery_source": "vendor_research",
14887
+ "ai_assist_factor": "none"
14664
14888
  },
14665
14889
  "CVE-2025-14733": {
14666
14890
  "name": "WatchGuard Firebox Out of Bounds Write Vulnerability",
@@ -14968,35 +15192,63 @@
14968
15192
  },
14969
15193
  "CVE-2018-4063": {
14970
15194
  "name": "Sierra Wireless AirLink ALEOS Unrestricted Upload of File with Dangerous Type Vulnerability",
14971
- "lesson_date": "2026-05-18",
15195
+ "lesson_date": "2026-05-29",
14972
15196
  "attack_vector": {
14973
- "description": "Sierra Wireless AirLink ALEOS contains an unrestricted upload of file with dangerous type vulnerability. A specially crafted HTTP request can upload a file, resulting in executable code being uploaded, and routable, to the webserver. An attacker can make an authenticated HTTP request to trigger this vulnerability. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.",
14974
- "privileges_required": "network attacker (no authentication required)",
14975
- "complexity": "moderate (bulk-import default)",
14976
- "ai_factor": "Bulk-imported — AI-discovery provenance not surfaced in KEV. Detection method that surfaces this class: ADVISORIES_SOURCE (12 primary-source feeds) + CISA-KEV poller. Refine when researcher writeup publishes."
15197
+ "description": "an unrestricted file-upload flaw (CWE-434) letting an unauthenticated attacker upload a file (e.g. a web shell) for code execution on the cellular gateway. CISA KEV-listed 2025-12-12 with confirmed in-the-wild exploitation.",
15198
+ "privileges_required": "none (the device/appliance is reachable by an unauthenticated attacker on its network interface)",
15199
+ "complexity": "low — KEV-listed, actively exploited; treat as weaponized",
15200
+ "ai_factor": "No AI involvement documented in discovery or weaponization."
15201
+ },
15202
+ "defense_chain": {
15203
+ "prevention": {
15204
+ "what_would_have_worked": "Apply the vendor firmware update; for end-of-life devices with no fix, replace them. After any suspected compromise, factory-reset and re-flash — embedded-device compromise persists in firmware/config, and these devices are recruited into botnets and operational-relay (ORB) infrastructure.",
15205
+ "was_this_required": true,
15206
+ "framework_requiring_it": "CISA BOD 22-01 (KEV remediation)",
15207
+ "adequacy": "Patch is necessary but EOL firmware often has no fix, making replacement the only remediation; compromised devices need re-flash, not just patch."
15208
+ },
15209
+ "detection": {
15210
+ "what_would_have_worked": "Monitoring of the AirLink ALEOS gateway: exploit-shaped requests, anomalous outbound/botnet traffic and config drift.",
15211
+ "was_this_required": false,
15212
+ "framework_requiring_it": null,
15213
+ "adequacy": "Necessary because device/appliance compromise is often silent and persists across reboots in firmware/config."
15214
+ },
15215
+ "response": {
15216
+ "what_would_have_worked": "Factory-reset and re-flash or replace the device, rotate all credentials and secrets it held, and review the network behind it for lateral movement; assume the device's trust is fully compromised.",
15217
+ "was_this_required": true,
15218
+ "framework_requiring_it": "NIST 800-53 IR-4",
15219
+ "adequacy": "Mandatory; network-device/appliance compromise gives an attacker a durable, trusted position that patching alone does not remove."
15220
+ }
14977
15221
  },
14978
15222
  "framework_coverage": {
14979
15223
  "NIST-800-53-SI-2": {
14980
15224
  "covered": true,
14981
15225
  "adequate": false,
14982
- "gap": "30-day SLA inadequate for KEV-listed actively-exploited CVE; KEV due date is the operational clock."
15226
+ "gap": "The 30-day flaw-remediation SLA is far longer than the observed exploitation window for a KEV-listed unauthenticated flaw on an internet-facing network device/appliance; consumer/embedded devices are mass-exploited into botnets within days (some end-of-life with no fix), and enterprise appliances are change-window-gated and exposed past the KEV due date."
14983
15227
  },
14984
15228
  "ISO-27001-2022-A.8.8": {
14985
15229
  "covered": true,
14986
15230
  "adequate": false,
14987
- "gap": "Standard does not differentiate routinely-disclosed CVE from KEV-listed actively-exploited CVE."
15231
+ "gap": "'Appropriate timescales' is undefined; the standard reading is unsafe for an actively-exploited internet-facing device, and unmanaged/EOL devices fall outside most patch programs entirely."
15232
+ },
15233
+ "NIS2-Art21-network-security": {
15234
+ "covered": true,
15235
+ "adequate": false,
15236
+ "gap": "Treats network devices/appliances as essential-function infrastructure but lacks a CISA-KEV-style compressed remediation SLA and does not address end-of-life devices that can only be replaced, or appliance compromise that requires rebuild rather than patch-in-place."
15237
+ },
15238
+ "PCI-DSS-4.0-6.3.3": {
15239
+ "covered": true,
15240
+ "adequate": false,
15241
+ "gap": "The 30-day critical-patch window is exploitation acceptance for an internet-facing network device or edge appliance fronting or bridging the CDE."
14988
15242
  }
14989
15243
  },
14990
15244
  "compliance_exposure_score": {
14991
- "percent_audit_passing_orgs_still_exposed": 55,
14992
- "basis": "KEV-listed but not yet ransomware-attributed; exposure concentrated in orgs whose patch SLA defaults to NIST 30 days.",
15245
+ "percent_audit_passing_orgs_still_exposed": 80,
15246
+ "basis": "Internet-facing Sierra Wireless AirLink ALEOS is frequently unmanaged or end-of-life; audited organizations rarely track embedded-device firmware on a KEV SLA, and re-flash/replace is almost never part of a routine patch procedure.",
14993
15247
  "theater_pattern": "patch_management"
14994
15248
  },
14995
15249
  "ai_discovered_zeroday": false,
14996
- "ai_discovery_source": "unknown",
14997
- "ai_assist_factor": "none",
14998
- "_auto_imported": true,
14999
- "_intake_method": "v0.13.17-bulk-cisa-kev-import"
15250
+ "ai_discovery_source": "vendor_research",
15251
+ "ai_assist_factor": "none"
15000
15252
  },
15001
15253
  "CVE-2025-58360": {
15002
15254
  "name": "OSGeo GeoServer Improper Restriction of XML External Entity Reference Vulnerability",
@@ -16186,35 +16438,63 @@
16186
16438
  },
16187
16439
  "CVE-2025-54236": {
16188
16440
  "name": "Adobe Commerce and Magento Improper Input Validation Vulnerability",
16189
- "lesson_date": "2026-05-18",
16441
+ "lesson_date": "2026-05-29",
16190
16442
  "attack_vector": {
16191
- "description": "Adobe Commerce and Magento Open Source contain an improper input validation vulnerability that could allow an attacker to take over customer accounts through the Commerce REST API.",
16192
- "privileges_required": "network attacker (no authentication required)",
16193
- "complexity": "moderate (bulk-import default)",
16194
- "ai_factor": "Bulk-imported — AI-discovery provenance not surfaced in KEV. Detection method that surfaces this class: ADVISORIES_SOURCE (12 primary-source feeds) + CISA-KEV poller. Refine when researcher writeup publishes."
16443
+ "description": "an improper-input-validation flaw (CWE-20) in the Commerce/Magento REST API (the 'SessionReaper' flaw), letting an unauthenticated attacker take over customer/admin sessions and reach code execution. CISA KEV-listed 2025-10-24 with confirmed in-the-wild exploitation.",
16444
+ "privileges_required": "none (the flaw is reachable by an unauthenticated attacker on the application's public interface)",
16445
+ "complexity": "low — KEV-listed, actively exploited; treat as weaponized",
16446
+ "ai_factor": "No AI involvement documented in discovery or weaponization."
16447
+ },
16448
+ "defense_chain": {
16449
+ "prevention": {
16450
+ "what_would_have_worked": "Apply the Adobe Commerce/Magento patch and the isolated hotfix; rotate the encryption key, invalidate sessions, and hunt for web shells — Magento RCE chains drop persistent backdoors.",
16451
+ "was_this_required": true,
16452
+ "framework_requiring_it": "CISA BOD 22-01 (KEV remediation)",
16453
+ "adequacy": "Patch is necessary but insufficient alone — web shells, stolen sessions, and forged keys survive the patch and require explicit cleanup and key rotation."
16454
+ },
16455
+ "detection": {
16456
+ "what_would_have_worked": "Monitoring on the Adobe Commerce / Magento: exploit-shaped requests, new web-shell files, unexpected process execution, and session/admin takeover without a matching login.",
16457
+ "was_this_required": false,
16458
+ "framework_requiring_it": null,
16459
+ "adequacy": "Necessary to catch exploitation and resident persistence after patching."
16460
+ },
16461
+ "response": {
16462
+ "what_would_have_worked": "Patch immediately, hunt and remove web shells, rotate application secrets/machine keys, and invalidate sessions, and review for lateral movement and data exfiltration.",
16463
+ "was_this_required": true,
16464
+ "framework_requiring_it": "NIST 800-53 IR-4",
16465
+ "adequacy": "Mandatory; patch-in-place without cleanup leaves the attacker resident or able to re-authenticate."
16466
+ }
16195
16467
  },
16196
16468
  "framework_coverage": {
16197
16469
  "NIST-800-53-SI-2": {
16198
16470
  "covered": true,
16199
16471
  "adequate": false,
16200
- "gap": "30-day SLA inadequate for KEV-listed actively-exploited CVE; KEV due date is the operational clock."
16472
+ "gap": "The 30-day flaw-remediation SLA is far longer than the observed exploitation window for a KEV-listed, unauthenticated web-application flaw; these are mass-exploited within days, and SSRF/deserialization/auth-bypass chains lead to data theft or RCE."
16201
16473
  },
16202
16474
  "ISO-27001-2022-A.8.8": {
16203
16475
  "covered": true,
16204
16476
  "adequate": false,
16205
- "gap": "Standard does not differentiate routinely-disclosed CVE from KEV-listed actively-exploited CVE."
16477
+ "gap": "'Appropriate timescales' is undefined; the standard 30-day reading is unsafe for an actively-exploited, internet-facing web application."
16478
+ },
16479
+ "NIS2-Art21-network-security": {
16480
+ "covered": true,
16481
+ "adequate": false,
16482
+ "gap": "Treats internet-facing applications as essential-function infrastructure but lacks a CISA-KEV-style compressed remediation SLA, and does not require the web-shell-hunt / key-rotation / egress-restriction cleanup these flaws need."
16483
+ },
16484
+ "PCI-DSS-4.0-6.3.3": {
16485
+ "covered": true,
16486
+ "adequate": false,
16487
+ "gap": "The 30-day critical-patch window is exploitation acceptance for an internet-facing web application (e-commerce platforms like Magento sit squarely in PCI scope); WAF coverage is partial mitigation, not remediation."
16206
16488
  }
16207
16489
  },
16208
16490
  "compliance_exposure_score": {
16209
- "percent_audit_passing_orgs_still_exposed": 55,
16210
- "basis": "KEV-listed but not yet ransomware-attributed; exposure concentrated in orgs whose patch SLA defaults to NIST 30 days.",
16491
+ "percent_audit_passing_orgs_still_exposed": 75,
16492
+ "basis": "Internet-facing Adobe Commerce and Magento is run by audited organizations on a standard patch SLA and is mass-exploited within days; the required web-shell hunt, key rotation, and egress restriction are rarely part of the documented patch procedure.",
16211
16493
  "theater_pattern": "patch_management"
16212
16494
  },
16213
16495
  "ai_discovered_zeroday": false,
16214
- "ai_discovery_source": "unknown",
16215
- "ai_assist_factor": "none",
16216
- "_auto_imported": true,
16217
- "_intake_method": "v0.13.17-bulk-cisa-kev-import"
16496
+ "ai_discovery_source": "vendor_research",
16497
+ "ai_assist_factor": "none"
16218
16498
  },
16219
16499
  "CVE-2025-59287": {
16220
16500
  "name": "Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data Vulnerability",
@@ -16549,35 +16829,63 @@
16549
16829
  },
16550
16830
  "CVE-2025-54253": {
16551
16831
  "name": "Adobe Experience Manager Forms Code Execution Vulnerability",
16552
- "lesson_date": "2026-05-18",
16832
+ "lesson_date": "2026-05-29",
16553
16833
  "attack_vector": {
16554
- "description": "Adobe Experience Manager Forms in JEE contains an unspecified vulnerability that allows for arbitrary code execution.",
16555
- "privileges_required": "network attacker (no authentication required)",
16556
- "complexity": "moderate (bulk-import default)",
16557
- "ai_factor": "Bulk-imported — AI-discovery provenance not surfaced in KEV. Detection method that surfaces this class: ADVISORIES_SOURCE (12 primary-source feeds) + CISA-KEV poller. Refine when researcher writeup publishes."
16834
+ "description": "a code-execution flaw (CWE-94) enabling unauthenticated remote code execution on the AEM Forms server. CISA KEV-listed 2025-10-15 with confirmed in-the-wild exploitation.",
16835
+ "privileges_required": "none (the flaw is reachable by an unauthenticated attacker on the application's public interface)",
16836
+ "complexity": "low — KEV-listed, actively exploited; treat as weaponized",
16837
+ "ai_factor": "No AI involvement documented in discovery or weaponization."
16838
+ },
16839
+ "defense_chain": {
16840
+ "prevention": {
16841
+ "what_would_have_worked": "Apply the AEM Forms update; hunt for web shells and rotate service credentials reachable from the AEM host.",
16842
+ "was_this_required": true,
16843
+ "framework_requiring_it": "CISA BOD 22-01 (KEV remediation)",
16844
+ "adequacy": "Patch is necessary but insufficient alone — web shells, stolen sessions, and forged keys survive the patch and require explicit cleanup and key rotation."
16845
+ },
16846
+ "detection": {
16847
+ "what_would_have_worked": "Monitoring on the AEM Forms: exploit-shaped requests, new web-shell files, unexpected process execution, and session/admin takeover without a matching login.",
16848
+ "was_this_required": false,
16849
+ "framework_requiring_it": null,
16850
+ "adequacy": "Necessary to catch exploitation and resident persistence after patching."
16851
+ },
16852
+ "response": {
16853
+ "what_would_have_worked": "Patch immediately, hunt and remove web shells, rotate application secrets/machine keys, and invalidate sessions, and review for lateral movement and data exfiltration.",
16854
+ "was_this_required": true,
16855
+ "framework_requiring_it": "NIST 800-53 IR-4",
16856
+ "adequacy": "Mandatory; patch-in-place without cleanup leaves the attacker resident or able to re-authenticate."
16857
+ }
16558
16858
  },
16559
16859
  "framework_coverage": {
16560
16860
  "NIST-800-53-SI-2": {
16561
16861
  "covered": true,
16562
16862
  "adequate": false,
16563
- "gap": "30-day SLA inadequate for KEV-listed actively-exploited CVE; KEV due date is the operational clock."
16863
+ "gap": "The 30-day flaw-remediation SLA is far longer than the observed exploitation window for a KEV-listed, unauthenticated web-application flaw; these are mass-exploited within days, and SSRF/deserialization/auth-bypass chains lead to data theft or RCE."
16564
16864
  },
16565
16865
  "ISO-27001-2022-A.8.8": {
16566
16866
  "covered": true,
16567
16867
  "adequate": false,
16568
- "gap": "Standard does not differentiate routinely-disclosed CVE from KEV-listed actively-exploited CVE."
16868
+ "gap": "'Appropriate timescales' is undefined; the standard 30-day reading is unsafe for an actively-exploited, internet-facing web application."
16869
+ },
16870
+ "NIS2-Art21-network-security": {
16871
+ "covered": true,
16872
+ "adequate": false,
16873
+ "gap": "Treats internet-facing applications as essential-function infrastructure but lacks a CISA-KEV-style compressed remediation SLA, and does not require the web-shell-hunt / key-rotation / egress-restriction cleanup these flaws need."
16874
+ },
16875
+ "PCI-DSS-4.0-6.3.3": {
16876
+ "covered": true,
16877
+ "adequate": false,
16878
+ "gap": "The 30-day critical-patch window is exploitation acceptance for an internet-facing web application (e-commerce platforms like Magento sit squarely in PCI scope); WAF coverage is partial mitigation, not remediation."
16569
16879
  }
16570
16880
  },
16571
16881
  "compliance_exposure_score": {
16572
- "percent_audit_passing_orgs_still_exposed": 55,
16573
- "basis": "KEV-listed but not yet ransomware-attributed; exposure concentrated in orgs whose patch SLA defaults to NIST 30 days.",
16882
+ "percent_audit_passing_orgs_still_exposed": 75,
16883
+ "basis": "Internet-facing Adobe Experience Manager Forms is run by audited organizations on a standard patch SLA and is mass-exploited within days; the required web-shell hunt, key rotation, and egress restriction are rarely part of the documented patch procedure.",
16574
16884
  "theater_pattern": "patch_management"
16575
16885
  },
16576
16886
  "ai_discovered_zeroday": false,
16577
- "ai_discovery_source": "unknown",
16578
- "ai_assist_factor": "none",
16579
- "_auto_imported": true,
16580
- "_intake_method": "v0.13.17-bulk-cisa-kev-import"
16887
+ "ai_discovery_source": "vendor_research",
16888
+ "ai_assist_factor": "none"
16581
16889
  },
16582
16890
  "CVE-2025-47827": {
16583
16891
  "name": "IGEL OS Use of a Key Past its Expiration Date Vulnerability",
@@ -17848,35 +18156,63 @@
17848
18156
  },
17849
18157
  "CVE-2025-53690": {
17850
18158
  "name": "Sitecore Multiple Products Deserialization of Untrusted Data Vulnerability",
17851
- "lesson_date": "2026-05-18",
18159
+ "lesson_date": "2026-05-29",
17852
18160
  "attack_vector": {
17853
- "description": "Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC), and Managed Cloud contain a deserialization of untrusted data vulnerability involving the use of default machine keys. This flaw allows attackers to exploit exposed ASP.NET machine keys to achieve remote code execution. ",
17854
- "privileges_required": "network attacker (no authentication required)",
17855
- "complexity": "moderate (bulk-import default)",
17856
- "ai_factor": "Bulk-imported — AI-discovery provenance not surfaced in KEV. Detection method that surfaces this class: ADVISORIES_SOURCE (12 primary-source feeds) + CISA-KEV poller. Refine when researcher writeup publishes."
18161
+ "description": "a deserialization-of-untrusted-data flaw (CWE-502) abusing a known/static ASP.NET machine key via ViewState, enabling unauthenticated remote code execution. CISA KEV-listed 2025-09-04 with confirmed in-the-wild exploitation.",
18162
+ "privileges_required": "none (the flaw is reachable by an unauthenticated attacker on the application's public interface)",
18163
+ "complexity": "low — KEV-listed, actively exploited; treat as weaponized",
18164
+ "ai_factor": "No AI involvement documented in discovery or weaponization."
18165
+ },
18166
+ "defense_chain": {
18167
+ "prevention": {
18168
+ "what_would_have_worked": "Apply the Sitecore update AND rotate the ASP.NET machine keys — the deserialization abuses key material, so patching without key rotation leaves the RCE path open; hunt for web shells.",
18169
+ "was_this_required": true,
18170
+ "framework_requiring_it": "CISA BOD 22-01 (KEV remediation)",
18171
+ "adequacy": "Patch is necessary but insufficient alone — web shells, stolen sessions, and forged keys survive the patch and require explicit cleanup and key rotation."
18172
+ },
18173
+ "detection": {
18174
+ "what_would_have_worked": "Monitoring on the Sitecore: exploit-shaped requests, new web-shell files, unexpected process execution, and session/admin takeover without a matching login.",
18175
+ "was_this_required": false,
18176
+ "framework_requiring_it": null,
18177
+ "adequacy": "Necessary to catch exploitation and resident persistence after patching."
18178
+ },
18179
+ "response": {
18180
+ "what_would_have_worked": "Patch immediately, hunt and remove web shells, rotate application secrets/machine keys, and invalidate sessions, and review for lateral movement and data exfiltration.",
18181
+ "was_this_required": true,
18182
+ "framework_requiring_it": "NIST 800-53 IR-4",
18183
+ "adequacy": "Mandatory; patch-in-place without cleanup leaves the attacker resident or able to re-authenticate."
18184
+ }
17857
18185
  },
17858
18186
  "framework_coverage": {
17859
18187
  "NIST-800-53-SI-2": {
17860
18188
  "covered": true,
17861
18189
  "adequate": false,
17862
- "gap": "30-day SLA inadequate for KEV-listed actively-exploited CVE; KEV due date is the operational clock."
18190
+ "gap": "The 30-day flaw-remediation SLA is far longer than the observed exploitation window for a KEV-listed, unauthenticated web-application flaw; these are mass-exploited within days, and SSRF/deserialization/auth-bypass chains lead to data theft or RCE."
17863
18191
  },
17864
18192
  "ISO-27001-2022-A.8.8": {
17865
18193
  "covered": true,
17866
18194
  "adequate": false,
17867
- "gap": "Standard does not differentiate routinely-disclosed CVE from KEV-listed actively-exploited CVE."
18195
+ "gap": "'Appropriate timescales' is undefined; the standard 30-day reading is unsafe for an actively-exploited, internet-facing web application."
18196
+ },
18197
+ "NIS2-Art21-network-security": {
18198
+ "covered": true,
18199
+ "adequate": false,
18200
+ "gap": "Treats internet-facing applications as essential-function infrastructure but lacks a CISA-KEV-style compressed remediation SLA, and does not require the web-shell-hunt / key-rotation / egress-restriction cleanup these flaws need."
18201
+ },
18202
+ "PCI-DSS-4.0-6.3.3": {
18203
+ "covered": true,
18204
+ "adequate": false,
18205
+ "gap": "The 30-day critical-patch window is exploitation acceptance for an internet-facing web application (e-commerce platforms like Magento sit squarely in PCI scope); WAF coverage is partial mitigation, not remediation."
17868
18206
  }
17869
18207
  },
17870
18208
  "compliance_exposure_score": {
17871
- "percent_audit_passing_orgs_still_exposed": 55,
17872
- "basis": "KEV-listed but not yet ransomware-attributed; exposure concentrated in orgs whose patch SLA defaults to NIST 30 days.",
18209
+ "percent_audit_passing_orgs_still_exposed": 75,
18210
+ "basis": "Internet-facing Sitecore is run by audited organizations on a standard patch SLA and is mass-exploited within days; the required web-shell hunt, key rotation, and egress restriction are rarely part of the documented patch procedure.",
17873
18211
  "theater_pattern": "patch_management"
17874
18212
  },
17875
18213
  "ai_discovered_zeroday": false,
17876
- "ai_discovery_source": "unknown",
17877
- "ai_assist_factor": "none",
17878
- "_auto_imported": true,
17879
- "_intake_method": "v0.13.17-bulk-cisa-kev-import"
18214
+ "ai_discovery_source": "vendor_research",
18215
+ "ai_assist_factor": "none"
17880
18216
  },
17881
18217
  "CVE-2023-50224": {
17882
18218
  "name": "TP-Link TL-WR841N Authentication Bypass by Spoofing Vulnerability",
@@ -20506,35 +20842,63 @@
20506
20842
  },
20507
20843
  "CVE-2021-32030": {
20508
20844
  "name": "ASUS Routers Improper Authentication Vulnerability",
20509
- "lesson_date": "2026-05-18",
20845
+ "lesson_date": "2026-05-29",
20510
20846
  "attack_vector": {
20511
- "description": "ASUS Lyra Mini and ASUS GT-AC2900 devices contain an improper authentication vulnerability that allows an attacker to gain unauthorized access to the administrative interface. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.",
20512
- "privileges_required": "network attacker (no authentication required)",
20513
- "complexity": "moderate (bulk-import default)",
20514
- "ai_factor": "Bulk-imported — AI-discovery provenance not surfaced in KEV. Detection method that surfaces this class: ADVISORIES_SOURCE (12 primary-source feeds) + CISA-KEV poller. Refine when researcher writeup publishes."
20847
+ "description": "an improper-authentication flaw (CWE-287) letting an unauthenticated attacker bypass authentication on the router's administrative interface. CISA KEV-listed 2025-06-02 with confirmed in-the-wild exploitation.",
20848
+ "privileges_required": "none (the device/appliance is reachable by an unauthenticated attacker on its network interface)",
20849
+ "complexity": "low — KEV-listed, actively exploited; treat as weaponized",
20850
+ "ai_factor": "No AI involvement documented in discovery or weaponization."
20851
+ },
20852
+ "defense_chain": {
20853
+ "prevention": {
20854
+ "what_would_have_worked": "Apply the vendor firmware update; for end-of-life devices with no fix, replace them. After any suspected compromise, factory-reset and re-flash — embedded-device compromise persists in firmware/config, and these devices are recruited into botnets and operational-relay (ORB) infrastructure.",
20855
+ "was_this_required": true,
20856
+ "framework_requiring_it": "CISA BOD 22-01 (KEV remediation)",
20857
+ "adequacy": "Patch is necessary but EOL firmware often has no fix, making replacement the only remediation; compromised devices need re-flash, not just patch."
20858
+ },
20859
+ "detection": {
20860
+ "what_would_have_worked": "Monitoring of the ASUS router: exploit-shaped requests, anomalous outbound/botnet traffic and config drift.",
20861
+ "was_this_required": false,
20862
+ "framework_requiring_it": null,
20863
+ "adequacy": "Necessary because device/appliance compromise is often silent and persists across reboots in firmware/config."
20864
+ },
20865
+ "response": {
20866
+ "what_would_have_worked": "Factory-reset and re-flash or replace the device, rotate all credentials and secrets it held, and review the network behind it for lateral movement; assume the device's trust is fully compromised.",
20867
+ "was_this_required": true,
20868
+ "framework_requiring_it": "NIST 800-53 IR-4",
20869
+ "adequacy": "Mandatory; network-device/appliance compromise gives an attacker a durable, trusted position that patching alone does not remove."
20870
+ }
20515
20871
  },
20516
20872
  "framework_coverage": {
20517
20873
  "NIST-800-53-SI-2": {
20518
20874
  "covered": true,
20519
20875
  "adequate": false,
20520
- "gap": "30-day SLA inadequate for KEV-listed actively-exploited CVE; KEV due date is the operational clock."
20876
+ "gap": "The 30-day flaw-remediation SLA is far longer than the observed exploitation window for a KEV-listed unauthenticated flaw on an internet-facing network device/appliance; consumer/embedded devices are mass-exploited into botnets within days (some end-of-life with no fix), and enterprise appliances are change-window-gated and exposed past the KEV due date."
20521
20877
  },
20522
20878
  "ISO-27001-2022-A.8.8": {
20523
20879
  "covered": true,
20524
20880
  "adequate": false,
20525
- "gap": "Standard does not differentiate routinely-disclosed CVE from KEV-listed actively-exploited CVE."
20881
+ "gap": "'Appropriate timescales' is undefined; the standard reading is unsafe for an actively-exploited internet-facing device, and unmanaged/EOL devices fall outside most patch programs entirely."
20882
+ },
20883
+ "NIS2-Art21-network-security": {
20884
+ "covered": true,
20885
+ "adequate": false,
20886
+ "gap": "Treats network devices/appliances as essential-function infrastructure but lacks a CISA-KEV-style compressed remediation SLA and does not address end-of-life devices that can only be replaced, or appliance compromise that requires rebuild rather than patch-in-place."
20887
+ },
20888
+ "PCI-DSS-4.0-6.3.3": {
20889
+ "covered": true,
20890
+ "adequate": false,
20891
+ "gap": "The 30-day critical-patch window is exploitation acceptance for an internet-facing network device or edge appliance fronting or bridging the CDE."
20526
20892
  }
20527
20893
  },
20528
20894
  "compliance_exposure_score": {
20529
- "percent_audit_passing_orgs_still_exposed": 55,
20530
- "basis": "KEV-listed but not yet ransomware-attributed; exposure concentrated in orgs whose patch SLA defaults to NIST 30 days.",
20895
+ "percent_audit_passing_orgs_still_exposed": 80,
20896
+ "basis": "Internet-facing ASUS routers is frequently unmanaged or end-of-life; audited organizations rarely track embedded-device firmware on a KEV SLA, and re-flash/replace is almost never part of a routine patch procedure.",
20531
20897
  "theater_pattern": "patch_management"
20532
20898
  },
20533
20899
  "ai_discovered_zeroday": false,
20534
- "ai_discovery_source": "unknown",
20535
- "ai_assist_factor": "none",
20536
- "_auto_imported": true,
20537
- "_intake_method": "v0.13.17-bulk-cisa-kev-import"
20900
+ "ai_discovery_source": "vendor_research",
20901
+ "ai_assist_factor": "none"
20538
20902
  },
20539
20903
  "CVE-2025-3935": {
20540
20904
  "name": "ConnectWise ScreenConnect Improper Authentication Vulnerability",
@@ -20690,35 +21054,63 @@
20690
21054
  },
20691
21055
  "CVE-2023-39780": {
20692
21056
  "name": "ASUS RT-AX55 Routers OS Command Injection Vulnerability",
20693
- "lesson_date": "2026-05-18",
21057
+ "lesson_date": "2026-05-29",
20694
21058
  "attack_vector": {
20695
- "description": "ASUS RT-AX55 devices contain an OS command injection vulnerability that could allow a remote, authenticated attacker to execute arbitrary commands. As represented by CVE-2023-41346.",
20696
- "privileges_required": "network attacker (no authentication required)",
20697
- "complexity": "moderate (bulk-import default)",
20698
- "ai_factor": "Bulk-imported — AI-discovery provenance not surfaced in KEV. Detection method that surfaces this class: ADVISORIES_SOURCE (12 primary-source feeds) + CISA-KEV poller. Refine when researcher writeup publishes."
21059
+ "description": "an OS command-injection flaw (CWE-78) enabling unauthenticated remote command execution on the router. CISA KEV-listed 2025-06-02 with confirmed in-the-wild exploitation.",
21060
+ "privileges_required": "none (the device/appliance is reachable by an unauthenticated attacker on its network interface)",
21061
+ "complexity": "low — KEV-listed, actively exploited; treat as weaponized",
21062
+ "ai_factor": "No AI involvement documented in discovery or weaponization."
21063
+ },
21064
+ "defense_chain": {
21065
+ "prevention": {
21066
+ "what_would_have_worked": "Apply the vendor firmware update; for end-of-life devices with no fix, replace them. After any suspected compromise, factory-reset and re-flash — embedded-device compromise persists in firmware/config, and these devices are recruited into botnets and operational-relay (ORB) infrastructure.",
21067
+ "was_this_required": true,
21068
+ "framework_requiring_it": "CISA BOD 22-01 (KEV remediation)",
21069
+ "adequacy": "Patch is necessary but EOL firmware often has no fix, making replacement the only remediation; compromised devices need re-flash, not just patch."
21070
+ },
21071
+ "detection": {
21072
+ "what_would_have_worked": "Monitoring of the ASUS router: exploit-shaped requests, anomalous outbound/botnet traffic and config drift.",
21073
+ "was_this_required": false,
21074
+ "framework_requiring_it": null,
21075
+ "adequacy": "Necessary because device/appliance compromise is often silent and persists across reboots in firmware/config."
21076
+ },
21077
+ "response": {
21078
+ "what_would_have_worked": "Factory-reset and re-flash or replace the device, rotate all credentials and secrets it held, and review the network behind it for lateral movement; assume the device's trust is fully compromised.",
21079
+ "was_this_required": true,
21080
+ "framework_requiring_it": "NIST 800-53 IR-4",
21081
+ "adequacy": "Mandatory; network-device/appliance compromise gives an attacker a durable, trusted position that patching alone does not remove."
21082
+ }
20699
21083
  },
20700
21084
  "framework_coverage": {
20701
21085
  "NIST-800-53-SI-2": {
20702
21086
  "covered": true,
20703
21087
  "adequate": false,
20704
- "gap": "30-day SLA inadequate for KEV-listed actively-exploited CVE; KEV due date is the operational clock."
21088
+ "gap": "The 30-day flaw-remediation SLA is far longer than the observed exploitation window for a KEV-listed unauthenticated flaw on an internet-facing network device/appliance; consumer/embedded devices are mass-exploited into botnets within days (some end-of-life with no fix), and enterprise appliances are change-window-gated and exposed past the KEV due date."
20705
21089
  },
20706
21090
  "ISO-27001-2022-A.8.8": {
20707
21091
  "covered": true,
20708
21092
  "adequate": false,
20709
- "gap": "Standard does not differentiate routinely-disclosed CVE from KEV-listed actively-exploited CVE."
21093
+ "gap": "'Appropriate timescales' is undefined; the standard reading is unsafe for an actively-exploited internet-facing device, and unmanaged/EOL devices fall outside most patch programs entirely."
21094
+ },
21095
+ "NIS2-Art21-network-security": {
21096
+ "covered": true,
21097
+ "adequate": false,
21098
+ "gap": "Treats network devices/appliances as essential-function infrastructure but lacks a CISA-KEV-style compressed remediation SLA and does not address end-of-life devices that can only be replaced, or appliance compromise that requires rebuild rather than patch-in-place."
21099
+ },
21100
+ "PCI-DSS-4.0-6.3.3": {
21101
+ "covered": true,
21102
+ "adequate": false,
21103
+ "gap": "The 30-day critical-patch window is exploitation acceptance for an internet-facing network device or edge appliance fronting or bridging the CDE."
20710
21104
  }
20711
21105
  },
20712
21106
  "compliance_exposure_score": {
20713
- "percent_audit_passing_orgs_still_exposed": 55,
20714
- "basis": "KEV-listed but not yet ransomware-attributed; exposure concentrated in orgs whose patch SLA defaults to NIST 30 days.",
21107
+ "percent_audit_passing_orgs_still_exposed": 80,
21108
+ "basis": "Internet-facing ASUS RT-AX55 routers is frequently unmanaged or end-of-life; audited organizations rarely track embedded-device firmware on a KEV SLA, and re-flash/replace is almost never part of a routine patch procedure.",
20715
21109
  "theater_pattern": "patch_management"
20716
21110
  },
20717
21111
  "ai_discovered_zeroday": false,
20718
- "ai_discovery_source": "unknown",
20719
- "ai_assist_factor": "none",
20720
- "_auto_imported": true,
20721
- "_intake_method": "v0.13.17-bulk-cisa-kev-import"
21112
+ "ai_discovery_source": "vendor_research",
21113
+ "ai_assist_factor": "none"
20722
21114
  },
20723
21115
  "CVE-2025-4632": {
20724
21116
  "name": "Samsung MagicINFO 9 Server Path Traversal Vulnerability (variant: CVE-2025-4632)",