@blamejs/exceptd-skills 0.18.21 → 0.18.22

package/data/zeroday-lessons.json

@@ -17,7 +17,7 @@
       "rebuild_after_days": 365,
       "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
     },
-    "entry_count": 519
+    "entry_count": 619
   },
   "CVE-2026-31431": {
     "name": "Copy Fail",
@@ -29943,5 +29943,3920 @@
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_disclosure",
     "ai_assist_factor": "none"
+  },
+  "CVE-2026-56291": {
+    "name": "Balbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unauthenticated attacker submits a Balbooa Forms attachment field with a .php file; the extension performs no file-type or authentication check and stores the file in a public uploads folder, which the attacker then requests directly to execute the code.",
+      "privileges_required": "none (unauthenticated, single unauthenticated HTTP request)",
+      "complexity": "low — no CSRF token, no auth, no file-type check to bypass",
+      "ai_factor": "Not AI-discovered — reported by independent researcher Phil Taylor via private disclosure to Balbooa. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Update to Balbooa Forms 2.4.1+; compensating control of disabling anonymous file attachments or placing an upload allow-list / WAF rule blocking executable extensions at the reverse proxy.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2026-07-10)",
+        "adequacy": "Patch alone is reactive; exploitation began before the patch existed, so a compensating upload-type restriction was the only control that would have worked during the exposure window."
+      },
+      "detection": {
+        "what_would_have_worked": "File-integrity monitoring on the uploads directory for new executable files, and web-server log alerting on POSTs to the attachment endpoint followed by a GET to the same path.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Effective only if FIM/log monitoring is already deployed on the Joomla webroot, which most small/mid sites running plugin marketplaces do not have."
+      },
+      "response": {
+        "what_would_have_worked": "Isolate the site, remove planted webshells, rotate Joomla super-user credentials and any secrets reachable from the web root, then update to 2.4.1.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Standard IR steps apply but require the operator to already know the extension was compromised, which an unmonitored small site is unlikely to detect quickly."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Balbooa shipped a fix within a day of the private report, but exploitation was already underway before any patch existed — flaw-remediation SLAs measured in weeks cannot outrun a pre-disclosure zero-day."
+      },
+      "AU-Essential-8-Patch": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Patch-applications control assumes a known-vulnerable window between disclosure and exploitation; here the window was negative, so patch cadence alone can't be the only control."
+      }
+    }
+  },
+  "CVE-2026-48939": {
+    "name": "iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unauthenticated attacker submits a crafted file through iCagenda's public event-attachment feature; the extension does not validate file type or require authentication, letting a PHP payload land in a web-accessible directory and execute.",
+      "privileges_required": "none (unauthenticated, single HTTP request)",
+      "complexity": "low — public PoC automates extension-disguise and upload",
+      "ai_factor": "Not AI-discovered — reported to iCagenda maintainers via coordinated disclosure. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Update to iCagenda 4.0.8 (or 3.9.15 for the legacy branch); compensating control of a WAF rule blocking executable extensions on iCagenda's attachment endpoint.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2026-07-10)",
+        "adequacy": "Two parallel supported branches (3.x and 4.x) mean patch coverage is incomplete unless both are tracked, which most inventories miss."
+      },
+      "detection": {
+        "what_would_have_worked": "File-integrity monitoring on the iCagenda attachment directory and alerting on executable-extension uploads.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Requires FIM tooling most small Joomla deployments don't run."
+      },
+      "response": {
+        "what_would_have_worked": "Remove planted webshells, audit for newly created admin accounts, rotate secrets, then patch.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Standard but contingent on the operator noticing the compromise before secondary persistence is established."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "iCagenda shipped fixes across both the 3.x and 4.x branches, but sites running either legacy or current branches remained exploitable until each was individually patched."
+      },
+      "UK-CAF-B4": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Secure-by-default configuration for the CMS platform doesn't extend to an unauthenticated file-attachment feature bundled inside a calendaring extension."
+      }
+    }
+  },
+  "CVE-2026-56290": {
+    "name": "Joomlack Page Builder Improper Access Control Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unauthenticated attacker scrapes a CSRF token from a public page, then uses it to call Page Builder CK's front-end upload endpoint with an arbitrary destination folder and a PHP payload, achieving RCE without any real authentication check.",
+      "privileges_required": "none (unauthenticated; CSRF token is publicly readable, not a real credential)",
+      "complexity": "low — public PoC and Exploit-DB module automate the token-scrape-then-upload flow",
+      "ai_factor": "Not AI-discovered — reported via coordinated disclosure to Joomlack. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Update to Page Builder CK 3.6.0 (or the 3.1.1 / 3.4.10 back-ports for legacy Joomla 3/4); compensating WAF rule blocking uploads of executable extensions to non-standard paths.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2026-07-07)",
+        "adequacy": "Three separate patched releases were needed to cover the supported branch matrix, so a single patch check is insufficient to confirm remediation."
+      },
+      "detection": {
+        "what_would_have_worked": "Webshell/malware scanning of the site's file tree, and log monitoring for uploads landing outside the expected media directory.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Effective only where file-integrity or malware scanning is already running, which is inconsistent across small Joomla hosts."
+      },
+      "response": {
+        "what_would_have_worked": "Remove planted webshells across all writable directories (not just the default upload folder, since the flaw allows arbitrary destination), rotate credentials, then patch.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "The arbitrary-destination nature of the flaw complicates cleanup — a shell could be anywhere under the webroot, not just the usual uploads path."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-CM-7": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Least-functionality controls should prevent an unauthenticated caller from choosing an arbitrary upload destination, but the extension exposed that as normal front-end behavior."
+      },
+      "AU-Essential-8-Patch": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Patch cadence alone doesn't help sites still on end-of-support Joomla 3/4 branches, which needed separate back-ported fixes (3.1.1 / 3.4.10)."
+      }
+    }
+  },
+  "CVE-2026-55255": {
+    "name": "Langflow Authorization Bypass Through User-Controlled Key Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An authenticated low-privilege attacker enumerates flow UUIDs via /api/v1/flows/, then submits a victim's flow ID to /api/v1/responses along with an injected instruction (e.g. \"leak api keys\"), causing the platform to execute the victim's flow — including any embedded credentials — under the attacker's control.",
+      "privileges_required": "low (any authenticated account on the same Langflow deployment)",
+      "complexity": "high — AC:H because the attacker needs a valid low-privileged account and to enumerate a target flow ID, though observed operators did this without automation",
+      "ai_factor": "Not AI-discovered — reported to Langflow AI via coordinated GitHub Security Advisory disclosure. No AI involvement in discovery documented; the observed in-the-wild abuse uses a prompt-injection payload as its exploitation technique, not an AI-discovered flaw."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Update to Langflow 1.9.1+; in multi-tenant deployments, additionally isolate flow execution per-tenant via network segmentation until patched.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2026-07-07)",
+        "adequacy": "Patch closes the object-ownership check, but the underlying pattern — API keys embedded directly inside executable AI-agent flows — remains a residual exposure to any future authorization bug in the platform."
+      },
+      "detection": {
+        "what_would_have_worked": "Anomaly detection on API calls where the flow owner's user ID differs from the requesting account's ID, and alerting on prompt-injection-style strings in flow execution inputs.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Requires application-level authorization logging that most AI-agent platforms don't yet emit by default."
+      },
+      "response": {
+        "what_would_have_worked": "Rotate all API keys/secrets embedded in Langflow flows on the affected deployment, audit /api/v1/responses access logs for cross-tenant flow_id usage, and patch.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Effective but requires the operator to already treat flow-embedded credentials as sensitive enough to rotate broadly, which many self-hosted deployments don't."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-AC-3": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Access enforcement failed at the object level — /api/v1/responses executed any flow ID supplied in the request without verifying the caller owns it."
+      },
+      "GDPR-Art32": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Security-of-processing obligations are undermined when embedded API keys/credentials inside a 'flow' are exfiltratable by any authenticated user of the same multi-tenant deployment."
+      }
+    }
+  },
+  "CVE-2026-48908": {
+    "name": "JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unauthenticated attacker POSTs directly to SP Page Builder's asset.uploadCustomIcon task, which accepts any file type with no session, permission, or CSRF check, then requests the uploaded PHP file to execute code and create a rogue Super User account.",
+      "privileges_required": "none (unauthenticated, single HTTP request)",
+      "complexity": "low — 13+ public PoCs automate the upload-and-execute chain",
+      "ai_factor": "Not AI-discovered — first publicly surfaced by a community member on the JoomShaper forum. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Update to SP Page Builder 6.6.2+ and independently verify the IconsTrait.php code path is closed, since community reports flag the official patch as potentially incomplete.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2026-07-07)",
+        "adequacy": "Patch-and-forget is insufficient here — the vendor's own forum contains a post-patch report that the flaw may persist, so remediation needs independent verification."
+      },
+      "detection": {
+        "what_would_have_worked": "Log monitoring for unauthenticated requests to task=asset.uploadCustomIcon and alerting on new Super User account creation.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Straightforward to implement but requires the operator to already log and review Joomla admin-account changes, which is inconsistent in practice."
+      },
+      "response": {
+        "what_would_have_worked": "Remove planted webshells, revoke any rogue Super User accounts created during the exposure window, rotate all credentials, and re-verify the patch closes IconsTrait.php.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "The rogue-admin-account chaining means standard webshell cleanup is insufficient without an account audit."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "JoomShaper's 6.6.2 patch was reported by a follow-up forum thread as still incomplete (IconsTrait.php not fully patched), meaning flaw-remediation verification needs to go beyond 'version >= 6.6.2'."
+      },
+      "ISO-27001-2022-A.8.8": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Technical vulnerability management requires confirming remediation efficacy, not just patch application — relevant here given the reported incomplete fix."
+      }
+    }
+  },
+  "CVE-2026-48282": {
+    "name": "Adobe ColdFusion Path Traversal Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unauthenticated attacker sends a crafted request to ColdFusion's RDS FILEIO endpoint (/CFIDE/main/ide.cfm?ACTION=FILEIO) with a path-traversal payload in the FILE parameter, writing an arbitrary file (e.g. a .cfm webshell) into the webroot for RCE, or reading sensitive files as reconnaissance.",
+      "privileges_required": "none (unauthenticated, single crafted HTTP request)",
+      "complexity": "low — the public technical write-up documents the exact payload; scope-changed CVSS vector confirms no auth barrier",
+      "ai_factor": "Not AI-discovered — reported to Adobe via coordinated disclosure and fixed in APSB26-68. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply the APSB26-68 update; disable/block RDS endpoints (/CFIDE/main/ide.cfm) at the network boundary in production, since RDS is a development feature that should never be internet-reachable.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2026-07-07)",
+        "adequacy": "Patch alone is necessary but not sufficient — RDS being reachable from the internet at all is a boundary-protection failure independent of this specific CVE, and the pattern will likely recur in the RDS component."
+      },
+      "detection": {
+        "what_would_have_worked": "WAF/IDS signatures for ACTION=FILEIO with traversal sequences, and file-integrity monitoring on the ColdFusion webroot for unexpected new files.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Effective and reportedly how KEVIntel honeypots caught the earliest exploitation attempts, but requires monitoring infrastructure many ColdFusion operators lack."
+      },
+      "response": {
+        "what_would_have_worked": "Isolate affected servers, hunt for planted .cfm/.jsp webshells anywhere under the webroot, rotate all credentials/keys accessible to the ColdFusion service account, and apply APSB26-68.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Arbitrary file write means the search for planted files must cover the full filesystem the ColdFusion process can reach, not just the default webroot."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SC-7": {
+        "covered": true,
+        "adequate": false,
+        "gap": "RDS (Remote Development Services) endpoints like /CFIDE/main/ide.cfm are development tooling that should be blocked at the network boundary in production, not internet-reachable."
+      },
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Adobe's patch existed before the exploitation wave, but the ~24-hour gap between WatchTowr's public technical analysis and CISA's KEV addition shows flaw-remediation timelines can't outrun a public write-up that doubles as an exploitation guide."
+      }
+    }
+  },
+  "CVE-2025-23209": {
+    "name": "Craft CMS Code Injection Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An attacker who has already obtained an unpatched Craft installation's application security key (often via a chained separate flaw) uses it to trigger code injection through Craft's database-backup path handling, achieving remote code execution.",
+      "privileges_required": "low (requires prior possession of the site's compromised security key, not a normal user account)",
+      "complexity": "high — AC:H reflects the precondition that the security key must already be leaked through some other vector before this flaw is reachable",
+      "ai_factor": "Not AI-discovered — reported to Craft CMS (Pixel & Tonic) via coordinated disclosure. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Update to Craft 4.13.8 / 5.5.8+ AND rotate the security key regardless of patch status, since a previously leaked key remains dangerous even after patching unless rotated.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2025-02-20)",
+        "adequacy": "Patching alone is insufficient — Craft's own advisory explicitly calls out key rotation as a required companion step, which many operators skip if they only track CVE/patch status."
+      },
+      "detection": {
+        "what_would_have_worked": "Monitoring for anomalous database-backup/restore operations and unexpected outbound connections from the Craft application process.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Requires application-level behavioral monitoring that most Craft CMS deployments (often small-to-mid marketing sites) don't run."
+      },
+      "response": {
+        "what_would_have_worked": "Rotate the security key immediately, audit for webshells/backdoors installed via the injection path, and patch to 4.13.8/5.5.8.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Effective, but requires the operator to already suspect key compromise, which the lack of public in-the-wild reporting makes hard to detect proactively."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Patch alone (4.13.8 / 5.5.8) doesn't remediate an already-compromised security key from before the update — rotation is a separate required action the patch cannot force."
+      },
+      "GDPR-Art32": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Security-of-processing is directly undermined when a leaked application security key enables remote code execution against a system that may process personal data."
+      }
+    }
+  },
+  "CVE-2025-0108": {
+    "name": "Palo Alto Networks PAN-OS Authentication Bypass Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unauthenticated attacker with network access to the PAN-OS management web interface exploits an nginx/Apache path-confusion bug to invoke restricted PHP scripts without authenticating, then commonly chains the bypass with a separate command-injection flaw (CVE-2024-9474) to reach full remote code execution.",
+      "privileges_required": "none (unauthenticated network access to the management interface)",
+      "complexity": "low — a public PoC automates the path-confusion request; the only precondition is network reachability of the management plane",
+      "ai_factor": "Not AI-discovered — reported through Palo Alto Networks PSIRT and independently detailed by SL Cyber researchers. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Patch to the fixed PAN-OS maintenance release AND restrict the management interface to trusted internal IPs per vendor best practice, which Palo Alto explicitly recommends as a pre-patch mitigation",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2025-02-18)",
+        "adequacy": "Patching alone is insufficient if the management interface stays internet-exposed against vendor guidance; network isolation is the primary control and patching is the backstop"
+      },
+      "detection": {
+        "what_would_have_worked": "Alert on unauthenticated requests to management-interface PHP endpoints and on mass internet-wide scanning signatures",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Requires management-plane traffic visibility that many organizations don't instrument separately from data-plane traffic"
+      },
+      "response": {
+        "what_would_have_worked": "Rotate admin credentials and audit for follow-on CVE-2024-9474 command-injection indicators if any management-interface access is suspected",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Response is only as fast as detection; without management-plane logging, compromise can go unnoticed until the chained RCE stage"
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SC-7": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Boundary protection guidance recommends restricting the management interface to trusted internal IPs, but this is advisory in PAN-OS deployments — it doesn't enforce network isolation by default, leaving internet-exposed interfaces reachable pre-patch."
+      }
+    }
+  },
+  "CVE-2024-53704": {
+    "name": "SonicWall SonicOS SSLVPN Improper Authentication Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "A remote, unauthenticated attacker sends a crafted session cookie to the SonicOS SSLVPN authentication endpoint, exploiting improper session validation to hijack an already-authenticated user's active VPN session and reach internal network resources.",
+      "privileges_required": "none (unauthenticated network access to the SSLVPN portal)",
+      "complexity": "low — a public PoC with a documented crafted-cookie technique is available",
+      "ai_factor": "Not AI-discovered — reverse-engineered and reported by Bishop Fox after SonicWall's own PSIRT disclosure. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Patch to a fixed SonicOS release and disable SSL VPN internet exposure where not operationally required",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2025-02-18)",
+        "adequacy": "Patch-only remediation trailed the exploitation window; roughly 4,500 internet-facing instances stayed unpatched even after a public PoC existed"
+      },
+      "detection": {
+        "what_would_have_worked": "Monitor for anomalous SSLVPN session-cookie values and unexpected session takeovers (forced logout followed by a new login from a different IP)",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Most SMB firewall deployments lack SSLVPN session-anomaly monitoring"
+      },
+      "response": {
+        "what_would_have_worked": "Force-terminate all active SSL VPN sessions and rotate credentials on any account with anomalous session activity",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Effective only if session hijacking is detected quickly; ransomware affiliates moved from hijack to lateral movement within the same operational window"
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-IA-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Identification/authentication control assumes session-validation logic is sound; here the SSLVPN mechanism itself failed to validate sessions correctly, bypassing IA-2's intent regardless of any MFA configuration."
+      }
+    }
+  },
+  "CVE-2024-57727": {
+    "name": "SimpleHelp Path Traversal Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unauthenticated remote attacker sends crafted HTTP requests with directory-traversal sequences to the SimpleHelp toolbox resource handler, downloading server configuration files (including hashed credentials and secrets) that are then used for follow-on ransomware intrusion.",
+      "privileges_required": "none (unauthenticated network access to the SimpleHelp web server)",
+      "complexity": "low — multiple public PoCs and a Metasploit module automate the traversal request",
+      "ai_factor": "Not AI-discovered — disclosed by Horizon3.ai's Attack Research team and confirmed by the vendor. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Upgrade to SimpleHelp 5.5.8+ and isolate the management server from direct internet exposure",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2025-02-13)",
+        "adequacy": "Patching closes the traversal path, but any secrets already harvested pre-patch (server config, hashed passwords) still need rotation"
+      },
+      "detection": {
+        "what_would_have_worked": "Alert on unauthenticated requests containing ../ traversal sequences to the toolbox resource endpoint and on anomalous config-file downloads",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "RMM/remote-support tooling is rarely instrumented for web-request anomaly detection at the level applied to customer-facing apps"
+      },
+      "response": {
+        "what_would_have_worked": "Rotate all credentials referenced in serverconfig.xml and hunt for ransomware-precursor activity (credential reuse, lateral movement) across every downstream customer network the SimpleHelp instance manages",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Blast radius extends to every customer network the compromised RMM server touches, so response scope is much larger than the vulnerable host itself"
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-AC-3": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Access enforcement assumed authentication was required before file retrieval; the traversal bug let the toolbox handler serve files outside any access-control check."
+      }
+    }
+  },
+  "CVE-2025-24200": {
+    "name": "Apple iOS and iPadOS Incorrect Authorization Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An attacker with physical possession of a locked iOS/iPadOS device uses specialized forensic-extraction hardware to exploit a state-management flaw and disable USB Restricted Mode, restoring full USB data access to a device that should only permit charging when locked.",
+      "privileges_required": "none in the software sense, but requires physical possession of the target device plus specialized hardware/tooling",
+      "complexity": "high — requires physical access, purpose-built forensic hardware, and precise timing/state manipulation; Apple describes the observed use as 'extremely sophisticated'",
+      "ai_factor": "Not AI-discovered — reported by Bill Marczak of The Citizen Lab. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Patch to iOS 18.3.1/iPadOS 18.3.1 (or the corresponding fix for older-branch devices); enable auto-update and minimize the window a device sits unpatched",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2025-02-12)",
+        "adequacy": "Patching is necessary but not sufficient for high-risk individuals whose devices may be physically seized before an update cycle completes"
+      },
+      "detection": {
+        "what_would_have_worked": "MDM/EMM monitoring for unexpected USB Restricted Mode state changes or device-lock-state anomalies on managed devices",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Personal devices belonging to high-risk individuals are frequently unmanaged, so this detection surface doesn't exist for the population most targeted"
+      },
+      "response": {
+        "what_would_have_worked": "Forensic re-imaging and credential/session revocation for any device suspected of physical tampering, plus threat-intel engagement (e.g., Citizen Lab, Amnesty Security Lab) for suspected targeted-surveillance cases",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Effective response requires specialist digital-forensics capability most individuals and even most enterprises lack in-house"
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-AC-3": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Access enforcement for a locked device assumed the USB Restricted Mode state machine was sound; the authorization flaw let a physical attacker force the device back into an accessible state without credentials."
+      }
+    }
+  },
+  "CVE-2024-41710": {
+    "name": "Mitel SIP Phones Argument Injection Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An attacker who already holds administrative access to a Mitel SIP phone's management interface injects shell metacharacters into a boot-process parameter, escaping the intended parameter context to execute arbitrary commands in the phone's underlying OS.",
+      "privileges_required": "high (authenticated administrator on the phone's management interface)",
+      "complexity": "low — a public PoC documents the exact injection point in the boot process",
+      "ai_factor": "Not AI-discovered — reported through Mitel's own coordinated disclosure program. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Patch to the fixed firmware release and restrict/rotate SIP phone admin credentials so a compromised admin account can't reach the injection point",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2025-02-12)",
+        "adequacy": "Patching removes the injection flaw, but doesn't address weak/shared VoIP admin credential hygiene that made the precondition reachable in the first place"
+      },
+      "detection": {
+        "what_would_have_worked": "Log and alert on SIP phone provisioning/boot-parameter changes containing shell metacharacters",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "VoIP endpoint management traffic is rarely captured by enterprise SIEM pipelines, so this detection is largely absent in practice"
+      },
+      "response": {
+        "what_would_have_worked": "Isolate and re-image affected phones, rotate the compromised admin credential, and audit for lateral movement from the phone's network segment",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "VoIP endpoints are often on flat network segments, so containment requires broader network review, not just the phone itself"
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-AC-6": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Least-privilege control is undermined because the flaw is reachable by any admin-privileged account — a compromised or over-provisioned VoIP admin credential is sufficient to pivot to full command execution."
+      }
+    }
+  },
+  "CVE-2025-21418": {
+    "name": "Microsoft Windows Ancillary Function Driver for WinSock Heap-Based Buffer Overflow Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "A local attacker who already has code execution on a Windows host (typically via a prior phishing-delivered payload) sends crafted IOCTL requests to the kernel-mode afd.sys driver, triggering a heap-based buffer overflow to corrupt kernel memory and escalate to SYSTEM privileges.",
+      "privileges_required": "low (a standard authenticated local session is sufficient to reach the vulnerable IOCTL handler)",
+      "complexity": "high — reliable kernel heap-overflow exploitation requires precise memory-layout control; no public exploit exists, suggesting a sophisticated actor developed it",
+      "ai_factor": "Not AI-discovered — identified through Microsoft's internal security response process. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply the February 2025 cumulative update promptly; this was a zero-day so no pre-patch mitigation existed beyond limiting local code-execution opportunities (phishing/malware defenses)",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2025-02-11)",
+        "adequacy": "Patching only helps after release; the real gap during the zero-day window was preventing the initial-access step that made local exploitation possible"
+      },
+      "detection": {
+        "what_would_have_worked": "EDR rules for anomalous kernel-driver IOCTL activity and unexpected SYSTEM-privileged process creation from a standard user session",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Kernel-level exploitation is specifically designed to operate below most EDR visibility, making this detection unreliable in practice"
+      },
+      "response": {
+        "what_would_have_worked": "Full re-image of any host where SYSTEM-level compromise is suspected, since kernel-level access can persist below OS-level remediation",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Kernel compromise materially raises the bar for confident remediation short of a full rebuild"
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Monthly Patch Tuesday cadence is the fastest routine remediation path, but this flaw was exploited in the wild as a zero-day before the February 2025 patch existed."
+      }
+    }
+  },
+  "CVE-2025-21391": {
+    "name": "Microsoft Windows Storage Link Following Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "A local attacker with standard user access creates a symbolic link that redirects a privileged Windows Storage file-management operation to an unintended target, allowing them to delete arbitrary files — including security event logs — and escalate privileges.",
+      "privileges_required": "low (a standard authenticated local session is sufficient to stage the link-following condition)",
+      "complexity": "low — link-following/race-style exploitation of storage operations is a well-understood technique once the vulnerable operation is identified",
+      "ai_factor": "Not AI-discovered — identified through Microsoft's internal security response process. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply the February 2025 cumulative update promptly; this was exploited as a zero-day, so no pre-patch software mitigation existed",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2025-02-11)",
+        "adequacy": "Patch-only remediation addresses the flaw but not the log-deletion damage already caused during the zero-day exploitation window"
+      },
+      "detection": {
+        "what_would_have_worked": "Forward security/event logs to a separate, tamper-resistant log-collection pipeline (e.g. SIEM with write-once storage) so local log deletion doesn't erase the only copy",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Only effective if remote log forwarding was already configured before the intrusion; many endpoints rely solely on the local event log"
+      },
+      "response": {
+        "what_would_have_worked": "Treat any host with unexplained gaps in local security logs as a likely privilege-escalation indicator and investigate via centrally-forwarded logs or endpoint telemetry instead",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Effective only where centralized logging exists independent of the compromised host"
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-AU-9": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Protection-of-audit-information control is directly undermined — the observed exploitation pattern deletes security logs via link-following, defeating log-integrity assumptions."
+      }
+    }
+  },
+  "CVE-2024-40891": {
+    "name": "Zyxel DSL CPE OS Command Injection Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An attacker with a Telnet session to a legacy Zyxel DSL CPE device (using default or otherwise-obtained service-account credentials) sends management commands containing embedded shell metacharacters, which are passed unsanitized to the underlying OS shell and executed.",
+      "privileges_required": "low (authenticated Telnet session using a service account such as supervisor/zyuser, often default or trivially obtained on legacy CPE)",
+      "complexity": "low — no special conditions required beyond reaching the Telnet management port and authenticating",
+      "ai_factor": "Not AI-discovered — disclosed by VulnCheck security researchers; exploitation activity documented by GreyNoise. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "No vendor patch exists; the only durable prevention is decommissioning the EOL device or firewalling the Telnet management interface off the WAN entirely.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2025-02-11)",
+        "adequacy": "Patch-based remediation is not available at all for this entry — BOD 22-01's remediation deadline can only be met via mitigation/decommissioning, not a vendor patch."
+      },
+      "detection": {
+        "what_would_have_worked": "Egress monitoring for anomalous outbound scanning/C2 traffic from consumer/SMB router IP ranges, and Telnet exposure scanning of the managed fleet.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Detection is a compensating control only; most affected devices are unmanaged consumer/SMB equipment with no monitoring agent."
+      },
+      "response": {
+        "what_would_have_worked": "ISP/operator-driven notification and forced decommissioning or firmware replacement of affected legacy CPE.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Response is slow and diffuse because affected devices are distributed across many individual subscribers rather than a centrally managed fleet."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Flaw remediation is structurally impossible: Zyxel has declared these DSL CPE devices end-of-life/end-of-service with no patch planned, so the standard remediate-within-SLA control has no path to closure short of hardware replacement."
+      }
+    }
+  },
+  "CVE-2024-40890": {
+    "name": "Zyxel DSL CPE OS Command Injection Vulnerability (CGI)",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An attacker with an authenticated session sends a crafted HTTP POST request to the CGI management program on a legacy Zyxel DSL CPE device; the CGI program passes request parameters unsanitized to the underlying OS shell, achieving command execution.",
+      "privileges_required": "low (authenticated HTTP session using a service account such as supervisor/zyuser, often default or trivially obtained on legacy CPE)",
+      "complexity": "low — a single crafted HTTP POST is sufficient once authenticated",
+      "ai_factor": "Not AI-discovered — disclosed by VulnCheck security researchers; exploitation activity documented by GreyNoise. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "No vendor patch exists; the only durable prevention is decommissioning the EOL device or restricting the CGI management interface from the WAN entirely.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2025-02-11)",
+        "adequacy": "Patch-based remediation is not available at all for this entry — BOD 22-01's remediation deadline can only be met via mitigation/decommissioning, not a vendor patch."
+      },
+      "detection": {
+        "what_would_have_worked": "Web-application-firewall or perimeter logging on the CGI endpoint for shell-metacharacter payloads in POST bodies, plus fleet-wide exposure scanning.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Detection is a compensating control only; most affected devices are unmanaged consumer/SMB equipment with no monitoring agent."
+      },
+      "response": {
+        "what_would_have_worked": "ISP/operator-driven notification and forced decommissioning or firmware replacement of affected legacy CPE.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Response is slow and diffuse because affected devices are distributed across many individual subscribers rather than a centrally managed fleet."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SC-7": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Boundary protection is absent by design: the CGI management program is reachable via HTTP POST from the untrusted WAN interface with no network-layer restriction."
+      }
+    }
+  },
+  "CVE-2025-0994": {
+    "name": "Trimble Cityworks Deserialization Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An attacker with a low-privileged authenticated session to a Cityworks-hosted IIS server submits a crafted serialized object that, upon deserialization, achieves remote code execution on the underlying Windows/IIS host — used in the wild to stage Rust-based loaders that deploy Cobalt Strike/VShell.",
+      "privileges_required": "low (authenticated Cityworks user session)",
+      "complexity": "low — a single crafted request against the deserialization endpoint is sufficient once authenticated",
+      "ai_factor": "Not AI-discovered — identified via incident response and reported by Trimble/CISA. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply Cityworks 15.8.9 / 23.10 promptly and restrict IIS/Cityworks management access to trusted networks (VPN/allow-list) rather than exposing it directly to the internet.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2025-02-07)",
+        "adequacy": "Patch alone is insufficient against a zero-day: the exploitation window opened before the patch existed, so network-layer restriction of the management interface is a necessary compensating control."
+      },
+      "detection": {
+        "what_would_have_worked": "EDR alerting on anomalous child processes from w3wp.exe and on Rust-compiled loader binaries staging Cobalt Strike/VShell.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Effective if deployed, but several victims reportedly reached the post-exploitation staging phase before detection, indicating monitoring maturity gaps."
+      },
+      "response": {
+        "what_would_have_worked": "Isolate the affected IIS host, rotate credentials used by the Cityworks service account, and hunt for the Rust-loader/Cobalt Strike/VShell IOCs shared by Trimble/CISA across the fleet.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Timely response depends on having the Trimble/CISA IOC set pre-loaded into detection tooling, which is not universal across critical-infrastructure operators."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "The emergency patches (15.8.9 / 23.10, released Jan 28-29 2025) landed only after in-the-wild zero-day exploitation was already underway, showing standard patch-SLA timelines don't cover a pre-disclosure exploitation window."
+      }
+    }
+  },
+  "CVE-2025-0411": {
+    "name": "7-Zip Mark of the Web Bypass Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "A victim opens a spear-phished, homoglyph-spoofed double-encapsulated 7-Zip archive; because 7-Zip fails to propagate the outer archive's Mark-of-the-Web to the inner archive's extracted files, script files (.js/.wsf/.url) run without triggering Windows SmartScreen or Office Protected View, executing attacker code (observed delivering SmokeLoader).",
+      "privileges_required": "none (unauthenticated remote attacker; requires user interaction to open the crafted archive)",
+      "complexity": "high — requires social-engineering (homoglyph filename spoofing) plus a specifically-crafted double-encapsulated archive structure",
+      "ai_factor": "Not AI-discovered — identified in the wild by Trend Micro's Zero Day Initiative Threat Hunting team. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Update to 7-Zip 24.09+ and enforce Essential-8-style application hardening blocking direct execution of .js/.wsf/.url files extracted from archives.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2025-02-06)",
+        "adequacy": "Patch alone is insufficient without also blocking risky script-file execution, since 7-Zip lacks auto-update and the campaign already ran as a zero-day for months before the fix existed."
+      },
+      "detection": {
+        "what_would_have_worked": "Email-gateway detection of nested/double archives and homoglyph filename spoofing; EDR alerting on script interpreters (wscript/cscript) launched from freshly-extracted archive contents.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Effective when deployed, but homoglyph spoofing is specifically designed to defeat naive extension-based filtering."
+      },
+      "response": {
+        "what_would_have_worked": "Hunt for SmokeLoader C2 indicators and script-interpreter execution chains following archive extraction across the fleet; block identified C2 infrastructure.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Timely only if IOCs from Trend Micro's published analysis are ingested promptly."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-3": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Malicious-code protections that gate on Mark-of-the-Web (SmartScreen prompts, Protected View) are bypassed entirely by the double-archive technique, so endpoint controls relying solely on MotW propagation are insufficient."
+      }
+    }
+  },
+  "CVE-2024-21413": {
+    "name": "Microsoft Outlook Improper Input Validation Vulnerability (MonikerLink)",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An attacker sends an email containing a crafted 'file://' moniker hyperlink with a '!' new-window parameter; when the recipient clicks it, Outlook bypasses Office Protected View and opens the linked remote document in edit mode, enabling NTLM hash leakage via an attacker SMB share or remote code execution.",
+      "privileges_required": "none (unauthenticated remote attacker; requires the recipient to click the crafted link)",
+      "complexity": "low — a single crafted email link is sufficient, no additional conditions",
+      "ai_factor": "Not AI-discovered — discovered and reported by Check Point Research. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply the February 2024 Outlook security update fleet-wide and block outbound SMB (445) to the internet at the perimeter.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2025-02-06)",
+        "adequacy": "Patch availability preceded KEV addition by a year, showing patch-SLA policy alone did not drive timely remediation across the installed base — boundary controls on outbound SMB provide a necessary independent layer."
+      },
+      "detection": {
+        "what_would_have_worked": "Email-gateway detection of moniker-scheme ('file://...!') links in inbound mail, and SIEM alerting on outbound NTLM authentication to non-corporate hosts.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Effective when deployed but requires email-gateway rules specifically tuned for the moniker-link pattern, which many default configurations lack."
+      },
+      "response": {
+        "what_would_have_worked": "Force NTLM credential rotation for any user who triggered an outbound SMB authentication to an untrusted host, and hunt for follow-on RCE indicators.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Timely only if outbound SMB/NTLM telemetry is already being collected and alerted on."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SC-7": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Boundary protection blocking outbound SMB (445) to arbitrary external hosts would have prevented NTLM hash relay/capture even where the client-side Protected View bypass succeeded."
+      }
+    }
+  },
+  "CVE-2022-23748": {
+    "name": "Dante Discovery Process Control Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An attacker with local access places a malicious 'dal_keepalives.dll' in the application directory of the legitimate, signed mDNSResponder.exe (part of Audinate's Dante Application Library for Windows); when the trusted binary runs, it loads the attacker's DLL and executes code in the context of the trusted process.",
+      "privileges_required": "none beyond local access to the filesystem (PR:N); requires the user/attacker to trigger execution of mDNSResponder.exe (UI:R)",
+      "complexity": "low — placing a same-named DLL in the application's search path is sufficient, no additional conditions",
+      "ai_factor": "Not AI-discovered — discovered and reported by Check Point Research (CPR-Zero). No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Update to Dante Application Library for Windows v1.2.1+ (mDNSResponder.exe v1.3.2) and enforce application-hardening controls restricting DLL loading to trusted system paths.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2025-02-06)",
+        "adequacy": "Patch adoption depends on every downstream OEM that bundles Dante Application Library repackaging and redistributing the fix, so patch alone is not a fast or complete remediation path."
+      },
+      "detection": {
+        "what_would_have_worked": "EDR rules alerting on unsigned/unexpected DLLs loaded by signed binaries (image-load monitoring) for mDNSResponder.exe specifically.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Effective when deployed, but broadcast/pro-audio production workstations are frequently outside standard EDR coverage."
+      },
+      "response": {
+        "what_would_have_worked": "Remove the malicious DLL, verify integrity of the Dante Application Library installation, and audit for other side-loadable directories on affected hosts.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Requires awareness that Dante software is present, which is often overlooked in general IT asset inventories."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-CM-7": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Least-functionality/secure-configuration baselines should prevent a signed executable from loading DLLs out of a user-writable application directory; safe DLL search-order hardening wasn't applied."
+      }
+    }
+  },
+  "CVE-2020-29574": {
+    "name": "CyberoamOS (CROS) SQL Injection Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unauthenticated remote attacker submits crafted SQL injection payloads to the CyberoamOS WebAdmin login/authentication endpoint, executing arbitrary SQL statements against the backend database — in observed cases used to create unauthorized administrative accounts on the appliance.",
+      "privileges_required": "none (unauthenticated remote attacker)",
+      "complexity": "low — direct SQL injection against a network-exposed login endpoint, no special conditions",
+      "ai_factor": "Not AI-discovered — reported to and fixed by Sophos. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply the December 2020 hotfix; for appliances that are now EOL/EOS, isolate or decommission the WebAdmin interface from any untrusted network.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2025-02-06)",
+        "adequacy": "The hotfix closed the flaw in 2020, but the product's subsequent EOL/EOS status means operators who never applied it now have no vendor remediation path at all — only isolation or replacement remains."
+      },
+      "detection": {
+        "what_would_have_worked": "WAF/IPS signatures for SQL injection patterns on the WebAdmin login endpoint, and monitoring for unexpected new administrative accounts on the appliance.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Effective when deployed, but EOL appliances are frequently excluded from modern security-monitoring tooling and asset inventories."
+      },
+      "response": {
+        "what_would_have_worked": "Audit all local admin accounts on the appliance for unauthorized additions, rotate credentials, and review WebAdmin access logs for injection payload patterns.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Requires the appliance to be within scope of routine account/log auditing, which EOL devices often are not."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-AC-3": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Unauthenticated SQL injection against the WebAdmin login endpoint bypasses access enforcement entirely at the authentication layer itself, before any access-control policy is evaluated."
+      }
+    }
+  },
+  "CVE-2020-15069": {
+    "name": "Sophos XG Firewall Buffer Overflow Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unauthenticated attacker sends a crafted HTTP/S request to the XG Firewall's clientless-access User Portal Bookmarks feature, triggering a buffer overflow that yields remote code execution on the firewall appliance itself.",
+      "privileges_required": "none (unauthenticated, network-reachable via the WAN-exposed User Portal)",
+      "complexity": "low — a single crafted request against a default-enabled portal feature, no user interaction",
+      "ai_factor": "Not AI-discovered — identified by Sophos's incident-response investigation into active exploitation. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply Hotfix HF062020.1 immediately, or disable/firewall-off the WAN-facing User Portal and clientless VPN bookmark feature when not required.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2025-02-06)",
+        "adequacy": "Patching alone is insufficient for units past end-of-support; Sophos's own required action is to discontinue use if mitigations cannot be applied."
+      },
+      "detection": {
+        "what_would_have_worked": "Monitor firewall-originated outbound connections and User Portal access logs for anomalous bookmark-feature requests preceding data exfiltration or ransomware staging.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Detection on the boundary device itself is inherently weaker once the device is compromised; external network monitoring is a necessary compensating control."
+      },
+      "response": {
+        "what_would_have_worked": "Treat any XG Firewall showing Asnarök/Cring IOCs as fully compromised: rotate all credentials that transited the device, rebuild the appliance from a patched firmware image, and hunt for lateral movement.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Because the compromised device is the network boundary itself, incident response must assume broader network exposure, not just appliance-local compromise."
+      }
+    },
+    "framework_coverage": {
+      "NIS2-Art21-vulnerability-management": {
+        "covered": true,
+        "adequate": false,
+        "gap": "A 2020 hotfix still left units exploitable by ransomware actors in 2025 — patch-management processes did not reach every internet-facing unit within any reasonable SLA."
+      },
+      "AU-Essential-8-Patch": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Essential Eight patch-applications timelines (days, not years) were not met for a large population of still-exploited XG units."
+      }
+    }
+  },
+  "CVE-2024-53104": {
+    "name": "Linux Kernel Out-of-Bounds Write Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An attacker with physical (or emulated/virtual) access presents a malicious or specially crafted UVC device to a target host; the uvcvideo driver mis-sizes its frame buffer for UVC_VS_UNDEFINED frame types, causing an out-of-bounds kernel write that can be leveraged for privilege escalation.",
+      "privileges_required": "none from software, but physical/proximate access to attach a malicious USB device is required",
+      "complexity": "low once a malicious device is built — no remote network vector, but requires physical presence or device-seizure access",
+      "ai_factor": "Not AI-discovered — fixed via routine upstream Linux kernel driver hardening. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply the kernel patch across all affected branches and Android OEM builds; restrict USB device-class allowlists (e.g. via USBGuard or MDM policy) on devices handling sensitive data.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2025-02-05)",
+        "adequacy": "Patch rollout to the fragmented Android OEM ecosystem is slow; USB device-class restriction is a necessary compensating control for devices that cannot be patched quickly."
+      },
+      "detection": {
+        "what_would_have_worked": "Monitor kernel logs for uvcvideo parsing errors or unexpected driver crashes correlated with new USB device attach events, especially on devices in forensic custody.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Kernel-level crash telemetry is not commonly collected on consumer/mobile endpoints, limiting detection coverage."
+      },
+      "response": {
+        "what_would_have_worked": "Treat any device that was connected to an unknown or untrusted UVC peripheral as potentially compromised; re-image and rotate credentials.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Physical-access compromise of a kernel driver is difficult to fully remediate short of a full re-flash, since it can affect the trust root of the device."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-CM-7": {
+        "covered": true,
+        "adequate": false,
+        "gap": "The uvcvideo driver auto-loads for any connected UVC-class device; least-functionality controls should restrict which USB device classes are permitted on managed endpoints, especially locked/seized devices handled by third parties."
+      },
+      "AU-Essential-8-Patch": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Essential Eight patch-OS timelines are typically prioritized by remote exploitability; physical-access LPE bugs used in real device-seizure scenarios need equivalent urgency."
+      }
+    }
+  },
+  "CVE-2024-45195": {
+    "name": "Apache OFBiz Forced Browsing Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unauthenticated attacker directly requests a view-controller endpoint (forced browsing) that bypasses OFBiz's view-authorization checks, then abuses the reachable file-import functionality to plant and execute a malicious server-side file for full remote code execution.",
+      "privileges_required": "none (unauthenticated, network-reachable)",
+      "complexity": "low — a crafted HTTP POST against a documented endpoint, no user interaction",
+      "ai_factor": "Not AI-discovered — found through manual security research by Rapid7. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Upgrade to Apache OFBiz 18.12.16 or later; additionally restrict /webtools/control/* to authenticated/internal network access only as defense-in-depth.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2025-02-04)",
+        "adequacy": "Patch-only reliance is weakened by the CVE's own history of three prior bypassed patches; network-level restriction of admin/webtools paths provides a more durable compensating control."
+      },
+      "detection": {
+        "what_would_have_worked": "Alert on unauthenticated requests to /webtools/control/* endpoints and on unexpected file writes under the OFBiz webapp directories.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Effective if webtools traffic is otherwise rare/internal-only; less effective on internet-facing instances with legitimate anonymous webtools traffic."
+      },
+      "response": {
+        "what_would_have_worked": "Isolate the OFBiz host, review for planted Groovy/FTL files and unauthorized user accounts, and rotate any credentials stored in OFBiz.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "RCE-level compromise requires full forensic review, not just patching, given the near-1.0 EPSS and confirmed mass exploitation."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-AC-3": {
+        "covered": true,
+        "adequate": false,
+        "gap": "The prior three OFBiz authorization patches were each bypassed at the controller/view layer; access-enforcement logic based on view name rather than a default-deny posture repeatedly failed to hold."
+      },
+      "AU-Essential-8-Patch": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Given a near-1.0 EPSS score, Essential Eight's most urgent patch-applications timeline (extreme-risk, days) was necessary but adoption still lagged for many self-hosted OFBiz instances."
+      }
+    }
+  },
+  "CVE-2024-29059": {
+    "name": "Microsoft .NET Framework Information Disclosure Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An attacker sends a crafted HTTP request to a vulnerable .NET Remoting-over-HTTP endpoint to leak a serialized ObjRef URI, then uses that reference to open a raw remoting channel and trigger unsafe deserialization for remote code execution.",
+      "privileges_required": "none (unauthenticated, network-reachable)",
+      "complexity": "low — a small number of crafted HTTP requests against a legacy, un-authenticated remoting endpoint",
+      "ai_factor": "Not AI-discovered — publicly researched by codewhitesec and patched by Microsoft. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply Microsoft's security update for CVE-2024-29059, and disable/remove legacy .NET Remoting over HTTP where it is not actively required.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2025-02-04)",
+        "adequacy": "Patching the information-disclosure flaw closes this specific leak, but any application still using BinaryFormatter-based .NET Remoting retains broader deserialization risk."
+      },
+      "detection": {
+        "what_would_have_worked": "Alert on ObjRef-bearing responses from .NET Remoting endpoints and on subsequent raw TCP connections to previously-unused remoting ports.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Requires deep-packet visibility into legacy remoting protocol traffic, which many network monitoring stacks do not parse by default."
+      },
+      "response": {
+        "what_would_have_worked": "Isolate hosts exposing .NET Remoting, review for unauthorized deserialization activity, and migrate the application off .NET Remoting entirely.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Full remediation requires an application redesign away from a deprecated, inherently risky communication mechanism, not just a patch."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-CM-7": {
+        "covered": true,
+        "adequate": false,
+        "gap": ".NET Remoting over HTTP is a legacy/deprecated communication mechanism; least-functionality controls should disable it wherever the modern replacement (WCF/gRPC) is available."
+      },
+      "AU-Essential-8-App-Hardening": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Essential Eight application-hardening guidance calls for removing/disabling legacy, high-risk application features such as BinaryFormatter-based .NET Remoting."
+      }
+    }
+  },
+  "CVE-2018-9276": {
+    "name": "Paessler PRTG Network Monitor OS Command Injection Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An attacker with PRTG System Administrator access submits malformed parameters in sensor or notification management (e.g. EXE/Script sensor parameters, notification 'Execute Program' actions), which PRTG passes unsanitized to an OS command, yielding command execution on the PRTG core server or a monitored device.",
+      "privileges_required": "high (authenticated PRTG System Administrator access)",
+      "complexity": "low once admin credentials are held — a single crafted configuration change",
+      "ai_factor": "Not AI-discovered — publicly disclosed through independent security research. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Upgrade to PRTG 18.2.39 or later, and restrict/limit which accounts hold System Administrator privileges and can configure EXE/Script sensors or notifications.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2025-02-04)",
+        "adequacy": "Patching closes the specific injection, but least-privilege segregation of admin roles is a necessary compensating control given how often admin credentials are obtained through a separate chained flaw."
+      },
+      "detection": {
+        "what_would_have_worked": "Alert on PRTG Core Service spawning shell/interpreter processes, and on sensor/notification parameter fields containing shell metacharacters.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Effective where PRTG's own process-execution behavior is baselined; less effective if EXE/Script sensors are legitimately in wide use."
+      },
+      "response": {
+        "what_would_have_worked": "Treat command execution on the PRTG host as full compromise: isolate the host, audit all monitored-device credentials stored in PRTG, and rotate them.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "PRTG typically holds credentials for many monitored devices, so a compromise here has a wide blast radius across the monitored estate."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-AC-6": {
+        "covered": true,
+        "adequate": false,
+        "gap": "The PRTG admin console over-trusts authenticated administrators, allowing free-form OS-level parameter strings in sensor/notification configuration without least-privilege sandboxing of the executed command."
+      },
+      "UK-CAF-B2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Exploitation depends on obtaining admin credentials, frequently via the paired CVE-2018-19410 flaw; stronger identity-and-access controls (MFA, credential rotation) would blunt the chain."
+      }
+    }
+  },
+  "CVE-2018-19410": {
+    "name": "Paessler PRTG Network Monitor Local File Inclusion Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unauthenticated attacker crafts an HTTP request to /public/login.htm that overrides the page's include-directive to render the /api/addusers functionality, then supplies parameters to create a new administrator-level account without any authentication.",
+      "privileges_required": "none (unauthenticated, network-reachable)",
+      "complexity": "low — a single crafted HTTP request, no user interaction",
+      "ai_factor": "Not AI-discovered — disclosed by Positive Technologies through manual security research. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Upgrade to PRTG 18.2.41.1652 or later; restrict network access to the PRTG web console to trusted management networks as defense-in-depth.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2025-02-04)",
+        "adequacy": "Patching removes the include-directive flaw, but network-level access restriction is a durable compensating control for any unauthenticated admin-console surface."
+      },
+      "detection": {
+        "what_would_have_worked": "Alert on any PRTG account-creation event that lacks a preceding authenticated admin session, and on requests to /public/login.htm with unexpected 'include' parameters.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Requires PRTG audit logging to be enabled and actively reviewed, which is not the default posture for many deployments."
+      },
+      "response": {
+        "what_would_have_worked": "Audit all PRTG user accounts for unauthorized administrator entries, remove them, rotate credentials, and assume any monitored-device credentials stored in PRTG are compromised.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Because this flaw grants a fully privileged identity, response must treat the entire PRTG instance and everything it monitors as potentially compromised."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-IA-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "A preauth account-creation path entirely bypasses identification and authentication — the /public/ endpoint should never be able to reach account-creation functionality without an authenticated session."
+      },
+      "UK-CAF-B2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Identity-and-access controls were structurally bypassed since the vulnerability itself manufactures a valid administrator identity without authentication."
+      }
+    }
+  },
+  "CVE-2025-24085": {
+    "name": "Apple Multiple Products Use-After-Free Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "A malicious application on the device makes a small number of XPC calls to the mediaplaybackd daemon's CoreMedia Remaker subsystem, triggering a use-after-free in FigRemakerTrack object handling that yields code execution in that privileged process and, ultimately, privilege escalation.",
+      "privileges_required": "none beyond installing/running a malicious application on the device (no further authentication)",
+      "complexity": "low once the malicious app runs — public research reduced the trigger to 3 XPC endpoint calls",
+      "ai_factor": "Not AI-discovered — attributed to Apple's own internal investigation into in-the-wild exploitation. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Update to iOS/iPadOS 18.3 (or the corresponding fixed macOS/tvOS/watchOS/visionOS release) as soon as available; restrict installation of unvetted/sideloaded applications on managed devices.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2025-01-29)",
+        "adequacy": "Patch rollout across a large consumer/enterprise device fleet is not instantaneous; app-vetting/MDM restriction on untrusted app installation is a necessary compensating control for the exploitation window."
+      },
+      "detection": {
+        "what_would_have_worked": "Monitor mobile threat-defense/EDR telemetry for mediaplaybackd crashes or anomalous XPC activity correlated with third-party app execution.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Consumer iOS devices have limited third-party endpoint telemetry compared to managed enterprise fleets, so detection coverage is inconsistent."
+      },
+      "response": {
+        "what_would_have_worked": "For high-risk individuals (journalists, executives, dissidents) suspected of targeting, use Apple's Lockdown Mode and forensic tools (e.g. MVT) to check for compromise indicators, and re-provision the device.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Given the targeted/spyware-style exploitation pattern, standard consumer response (just updating) does not address whether a specific high-value target was already compromised before the patch."
+      }
+    },
+    "framework_coverage": {
+      "NIS2-Art21-vulnerability-management": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Organizations issuing managed Apple devices must push emergency OS updates fleet-wide within days of a KEV-listed, actively-exploited zero-day, which MDM enrollment and update-compliance enforcement do not always guarantee."
+      },
+      "AU-Essential-8-Patch": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Essential Eight's patch-OS timeline (48 hours for extreme-risk vulnerabilities) is difficult to meet for a distributed device fleet without forced MDM update enforcement."
+      }
+    }
+  },
+  "CVE-2025-23006": {
+    "name": "SonicWall SMA1000 Appliances Deserialization Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unauthenticated attacker sends a crafted serialized object to the SMA1000 AMC/CMC management console, which deserializes it without validation and executes attacker-controlled OS commands.",
+      "privileges_required": "none (unauthenticated, pre-auth deserialization sink)",
+      "complexity": "low — a single crafted request to a known management endpoint achieves code execution with no authentication or user interaction",
+      "ai_factor": "Not AI-discovered — reported to SonicWall PSIRT following Microsoft Threat Intelligence Center notification of active exploitation. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply the 12.4.3-02854 hotfix immediately, and restrict AMC/CMC management interfaces to a trusted management network rather than exposing them to the internet.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2025-01-24)",
+        "adequacy": "Patch alone is insufficient for the window between zero-day exploitation and hotfix release; network-level isolation of the management console is the compensating control that would have blocked pre-patch exploitation."
+      },
+      "detection": {
+        "what_would_have_worked": "Monitor AMC/CMC access logs for unauthenticated deserialization traffic and unexpected child-process spawns from the management service.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Most SMA1000 deployments lack deep application-layer logging on the management plane, so this class of exploitation is easy to miss without vendor-supplied detection guidance."
+      },
+      "response": {
+        "what_would_have_worked": "Isolate the appliance, rotate all credentials/certificates it held, and hunt for webshells or backdoors given the confirmed chaining with CVE-2025-40602 for root access.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Because the flaw yields root-level command execution, a compromised appliance must be treated as fully untrusted and rebuilt, not just patched in place."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Patch was released only after MSTIC flagged in-the-wild zero-day exploitation; a standard flaw-remediation SLA does not cover a pre-auth appliance flaw already being exploited before the fix shipped."
+      }
+    }
+  },
+  "CVE-2020-11023": {
+    "name": "JQuery Cross-Site Scripting (XSS) Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An attacker supplies HTML containing crafted <option> elements — which survives common sanitization — to a page that passes untrusted content through jQuery's DOM manipulation methods, causing the browser to execute attacker-controlled JavaScript in the victim's session.",
+      "privileges_required": "none (unauthenticated attacker against any user who views attacker-influenced content), but requires user interaction (UI:R) to load the affected page",
+      "complexity": "high — the attacker must find an application sink that still passes sanitized-but-untrusted HTML through a vulnerable jQuery DOM method",
+      "ai_factor": "Not AI-discovered — root cause identified and patched by the jQuery project in 2020; in-the-wild correlation to C2 infrastructure surfaced via EclecticIQ threat research in 2024. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Upgrade to jQuery 3.5.0 or later, and apply output encoding/DOM-based sanitization independent of jQuery's own HTML prefiltering for any untrusted content.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2025-01-23)",
+        "adequacy": "Upgrading the library is necessary but not sufficient on its own — applications must also avoid trusting jQuery's HTML prefilter as a sanitization boundary for genuinely untrusted input."
+      },
+      "detection": {
+        "what_would_have_worked": "Content Security Policy (CSP) with script-src restrictions and browser-side XSS telemetry to catch injected script execution even when the DOM sink is exploited.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "CSP is a strong compensating control but is frequently absent or misconfigured (e.g. 'unsafe-inline') on legacy applications old enough to still bundle jQuery <3.5.0."
+      },
+      "response": {
+        "what_would_have_worked": "Audit all pages for jQuery version and DOM-manipulation call sites, then rotate session tokens for any users who may have loaded attacker-controlled content.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Stored XSS response requires tracing which users viewed the malicious content, which is often not logged in front-end-only architectures."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "A five-year-old client-side library flaw remained unpatched in production long enough to appear in attacker C2 infrastructure, showing flaw-remediation tracking rarely extends to bundled front-end JS dependencies."
+      }
+    }
+  },
+  "CVE-2024-50603": {
+    "name": "Aviatrix Controllers OS Command Injection Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unauthenticated attacker sends shell metacharacters within the cloud_type or src_cloud_type parameter to the Aviatrix Controller's /v1/api endpoint, which passes the value unsanitized into an OS command, yielding arbitrary code execution on the multi-cloud network control plane.",
+      "privileges_required": "none (unauthenticated, remote)",
+      "complexity": "low — a single crafted API request achieves code execution, and a public Nuclei template automates discovery and exploitation",
+      "ai_factor": "Not AI-discovered — reported through standard vulnerability disclosure to Aviatrix PSIRT. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Upgrade to 7.1.4191 or 7.2.4996 immediately, and restrict the Controller's management API to a private network rather than the public internet.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2025-01-16)",
+        "adequacy": "Patching alone is insufficient given the sub-week exploitation surge after public tooling appeared; network isolation of the control-plane API is the compensating control that stops exploitation regardless of patch timing."
+      },
+      "detection": {
+        "what_would_have_worked": "Monitor Controller API access logs for shell metacharacters in cloud_type/src_cloud_type parameters and outbound connections to known mining pools or C2 infrastructure.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Many deployments lacked API-layer logging granular enough to catch parameter-level injection attempts before compromise."
+      },
+      "response": {
+        "what_would_have_worked": "Isolate the compromised controller, rotate all cloud provider credentials it held, and hunt for XMRig/Sliver artifacts and any resulting lateral movement into the cloud control plane.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Because the controller typically holds privileged cloud-provider credentials, response must assume compromise of connected cloud accounts, not just the appliance itself."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SC-7": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Aviatrix Controller instances left reachable from the internet had no boundary protection to stop unauthenticated command injection against a cloud-network control plane."
+      }
+    }
+  },
+  "CVE-2025-21335": {
+    "name": "Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free Vulnerability (CVE-2025-21335)",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "A local low-privilege attacker (on the host or via a guest VM) triggers a use-after-free in the Hyper-V NT Kernel Integration VSP component, causing the kernel to operate on freed memory and allowing escalation to SYSTEM.",
+      "privileges_required": "low (local access with standard user privileges required to trigger the VSP interaction)",
+      "complexity": "low — the use-after-free is triggered through normal integration-service interaction with no special conditions required, per the CVSS AC:L rating",
+      "ai_factor": "Not AI-discovered — reported to and patched by Microsoft via MSRC. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply the January 2025 cumulative update on all Hyper-V hosts, and restrict who can run code on hosts/guests that could reach the VSP interaction path.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2025-01-14)",
+        "adequacy": "Patching closes the specific use-after-free, but confirmed in-the-wild exploitation before disclosure means organizations needed emergency prioritization rather than routine patch-cycle timing."
+      },
+      "detection": {
+        "what_would_have_worked": "Kernel-level EDR telemetry watching for anomalous SYSTEM-token acquisition by processes with no legitimate elevation path, correlated with Hyper-V integration-service activity.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Kernel use-after-free exploitation on virtualization hosts is difficult to detect without specialized kernel telemetry most environments lack."
+      },
+      "response": {
+        "what_would_have_worked": "Isolate the affected host, capture a memory image before rebooting, and audit for any lateral movement or persistence established with the newly acquired SYSTEM privileges.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Because SYSTEM access on a Hyper-V host can affect all hosted guest VMs, response scope must extend to every workload the host was virtualizing."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Microsoft confirmed active exploitation at time of disclosure, meaning routine patch-cycle SLAs did not cover the exposure window for this Hyper-V component."
+      }
+    }
+  },
+  "CVE-2025-21334": {
+    "name": "Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free Vulnerability (CVE-2025-21334)",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "A local low-privilege attacker (on the host or via a guest VM) triggers a use-after-free in the Hyper-V NT Kernel Integration VSP component, causing the kernel to operate on freed memory and allowing escalation to SYSTEM.",
+      "privileges_required": "low (local access with standard user privileges required to trigger the VSP interaction)",
+      "complexity": "low — the use-after-free is triggered through normal integration-service interaction with no special conditions required, per the CVSS AC:L rating",
+      "ai_factor": "Not AI-discovered — reported to and patched by Microsoft via MSRC. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply the January 2025 cumulative update on all Hyper-V hosts, and restrict who can run code on hosts/guests that could reach the VSP interaction path.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2025-01-14)",
+        "adequacy": "Patching closes the specific use-after-free, but confirmed in-the-wild exploitation before disclosure means organizations needed emergency prioritization rather than routine patch-cycle timing."
+      },
+      "detection": {
+        "what_would_have_worked": "Kernel-level EDR telemetry watching for anomalous SYSTEM-token acquisition by processes with no legitimate elevation path, correlated with Hyper-V integration-service activity.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Kernel use-after-free exploitation on virtualization hosts is difficult to detect without specialized kernel telemetry most environments lack."
+      },
+      "response": {
+        "what_would_have_worked": "Isolate the affected host, capture a memory image before rebooting, and audit for any lateral movement or persistence established with the newly acquired SYSTEM privileges.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Because SYSTEM access on a Hyper-V host can affect all hosted guest VMs, response scope must extend to every workload the host was virtualizing."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Microsoft confirmed active exploitation at time of disclosure, meaning routine patch-cycle SLAs did not cover the exposure window for this Hyper-V component."
+      }
+    }
+  },
+  "CVE-2025-21333": {
+    "name": "Microsoft Windows Hyper-V NT Kernel Integration VSP Heap-based Buffer Overflow Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "A local low-privilege attacker triggers a heap-based buffer overflow in the Hyper-V NT Kernel Integration VSP component by supplying malformed/oversized data through the integration-service path, corrupting kernel heap memory to escalate to SYSTEM.",
+      "privileges_required": "low (local access with standard user privileges required to trigger the VSP interaction)",
+      "complexity": "low — the overflow is triggered through normal integration-service interaction with no special conditions required, per the CVSS AC:L rating, and a public exploit automates it",
+      "ai_factor": "Not AI-discovered — reported to and patched by Microsoft via MSRC. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply the January 2025 cumulative update on all Hyper-V hosts, and restrict who can run code on hosts/guests that could reach the VSP interaction path.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2025-01-14)",
+        "adequacy": "Patching closes the specific overflow, but public PoC availability plus confirmed in-the-wild exploitation before disclosure means organizations needed emergency prioritization rather than routine patch-cycle timing."
+      },
+      "detection": {
+        "what_would_have_worked": "Kernel-level EDR telemetry watching for anomalous SYSTEM-token acquisition by processes with no legitimate elevation path, correlated with Hyper-V integration-service activity, plus signature detection for the public Exploit-DB 52436 tooling.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Kernel heap-overflow exploitation on virtualization hosts is difficult to detect without specialized kernel telemetry most environments lack, though the public PoC gives defenders a concrete artifact to signature."
+      },
+      "response": {
+        "what_would_have_worked": "Isolate the affected host, capture a memory image before rebooting, and audit for any lateral movement or persistence established with the newly acquired SYSTEM privileges.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Because SYSTEM access on a Hyper-V host can affect all hosted guest VMs, response scope must extend to every workload the host was virtualizing."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "A public PoC (Exploit-DB 52436) exists for this confirmed-exploited kernel flaw, meaning routine patch-cycle SLAs left an exposure window during which attackers had both an exploit and evidence of active use."
+      }
+    }
+  },
+  "CVE-2024-55591": {
+    "name": "Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unauthenticated attacker opens a WebSocket connection to the FortiOS/FortiProxy Node.js console (jsconsole) and supplies a crafted local_access_token that bypasses normal session validation, then issues CLI commands to create a new super-admin account and take full control of the device.",
+      "privileges_required": "none (unauthenticated, remote)",
+      "complexity": "low — a single crafted WebSocket request achieves super-admin access, and a public PoC automates the full chain",
+      "ai_factor": "Not AI-discovered — discovered through Fortinet's PSIRT process following observed exploitation. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply the FortiOS/FortiProxy fixed releases immediately, and restrict administrative interfaces (HTTP/HTTPS admin access) to trusted management networks rather than the internet, per Fortinet's own mitigation guidance.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2025-01-14)",
+        "adequacy": "Patching alone is insufficient given exploitation began before public disclosure; disabling internet-facing admin access is the compensating control that blocks exploitation regardless of patch timing."
+      },
+      "detection": {
+        "what_would_have_worked": "Alert on any new local admin/super-admin account creation and on WebSocket connections to the jsconsole path from untrusted source IPs.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Fortinet's own log review guidance was needed to catch this because the bypass mimics legitimate low-level device management traffic."
+      },
+      "response": {
+        "what_would_have_worked": "Treat any device confirmed vulnerable as compromised, audit for unauthorized admin accounts and config changes, rotate all credentials, and rebuild given the KEV entry's ransomware association.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Because the flaw grants super-admin (full device control), response must assume complete device compromise and any onward network access the device enabled, not just account removal."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-IA-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "The Node.js websocket module's local_access_token path allowed session validation to be bypassed entirely, defeating identification-and-authentication controls that assume the standard admin login path is the only route to privileged access."
+      }
+    }
+  },
+  "CVE-2024-12686": {
+    "name": "BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) OS Command Injection Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An attacker who already holds administrative access to a PRA/RS site (obtained here via a stolen BeyondTrust cloud API key) uploads a specially crafted file through the admin console; the backend fails to neutralize embedded OS command sequences, so the commands execute with the privileges of the site user.",
+      "privileges_required": "high (existing administrative privileges required)",
+      "complexity": "high — requires prior admin-level access, obtained in this case through a separate vendor-side API key compromise rather than direct exploitation of an unauthenticated user",
+      "ai_factor": "Not AI-discovered — found and disclosed by BeyondTrust during incident investigation. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Vendor-side API key scoping/rotation and short-lived credentials, plus prompt patch deployment to self-hosted PRA/RS instances once BT24-11 shipped",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2025-01-13)",
+        "adequacy": "Patch deployment alone would not have stopped the zero-day phase of the Silk Typhoon intrusion, which relied on a compromised vendor API key rather than a public exploit."
+      },
+      "detection": {
+        "what_would_have_worked": "Anomaly detection on admin-console file uploads followed by process execution, and monitoring of API key usage patterns against BeyondTrust cloud infrastructure",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Few customer environments monitor vendor-side SaaS API key behavior, leaving this class of supply-chain pivot largely invisible until the vendor itself detects it."
+      },
+      "response": {
+        "what_would_have_worked": "Immediate API key revocation, tenant isolation, and forensic review of all admin-console file-upload activity across affected Remote Support SaaS instances",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "BeyondTrust's own incident response revoked the key and notified affected customers, but the Treasury Department still lost access to sanctions-related documents before containment."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-AC-6": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Least-privilege scoping alone does not stop an attacker who already holds legitimate admin credentials (via a stolen vendor API key) from injecting OS commands through the file-upload handler."
+      },
+      "NIS2-Art21-vulnerability-management": {
+        "covered": true,
+        "adequate": false,
+        "gap": "EU operators relying on BeyondTrust PRA/RS as a privileged-access gateway need vendor-supply-chain risk monitoring, not just internal patch cadence, since the compromise originated at the vendor."
+      }
+    }
+  },
+  "CVE-2023-48365": {
+    "name": "Qlik Sense HTTP Tunneling Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unauthenticated attacker sends a specially-crafted HTTP request with manipulated headers to the Qlik Sense Proxy, tunneling the request through to internal-only repository service endpoints; the elevated internal session is then used to register a new admin user or schedule an external task, achieving remote code execution.",
+      "privileges_required": "none (unauthenticated, exploited by tunneling HTTP requests through malformed headers)",
+      "complexity": "low — the technique is publicly documented by Praetorian and has been weaponized at scale by the CACTUS ransomware crew",
+      "ai_factor": "Not AI-discovered — found by Praetorian security researchers. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply the August 2023 Patch 2 (or later) fix and restrict internet exposure of the Qlik Sense Proxy to trusted networks",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2025-01-13)",
+        "adequacy": "Patching alone was insufficient once already — the initial fix for CVE-2023-41265 was bypassed, so patch verification/regression testing is a necessary companion control."
+      },
+      "detection": {
+        "what_would_have_worked": "Monitor for new local admin account creation and Scheduler-spawned downloader activity (AnyDesk, Plink, UEMS) on Qlik Sense hosts",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Detection would have caught the post-exploitation ransomware staging but not the initial unauthenticated tunneling request itself."
+      },
+      "response": {
+        "what_would_have_worked": "Isolate the Qlik Sense host, rotate all local credentials, and hunt for Plink RDP tunnels and disabled endpoint protection",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Effective if executed before ransomware deployment; CACTUS operators moved from initial access to encryption quickly in observed intrusions."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "This is an incomplete fix for CVE-2023-41265 — flaw remediation that patches the symptom but not the underlying HTTP-tunneling primitive leaves the product re-exploitable within weeks."
+      },
+      "NIS2-Art21-vulnerability-handling": {
+        "covered": true,
+        "adequate": false,
+        "gap": "EU operators running Qlik Sense as BI infrastructure face ransomware-grade impact from an incomplete vendor fix; vulnerability handling must include bypass verification, not just patch application."
+      }
+    }
+  },
+  "CVE-2024-55550": {
+    "name": "Mitel MiCollab Path Traversal Vulnerability (CVE-2024-55550)",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An attacker holding existing MiCollab administrative access supplies directory-traversal sequences to an admin-console file-read parameter, reading local system files outside the intended admin-access scope.",
+      "privileges_required": "high (authenticated administrative access required)",
+      "complexity": "low once admin access is held — the traversal technique itself is simple and publicly documented",
+      "ai_factor": "Not AI-discovered — found by watchTowr Labs during independent MiCollab security research. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Upgrade to MiCollab 9.8 SP2 (9.8.2.12) or later and restrict admin-console access to trusted management networks",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2025-01-07)",
+        "adequacy": "Patching this CVE alone is insufficient without also patching CVE-2024-41713, since the pair is exploited together to escalate from unauthenticated to admin-level file read."
+      },
+      "detection": {
+        "what_would_have_worked": "Alert on traversal sequences in admin-console request paths and unusual file-read targets outside the admin UI's expected file set",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Effective at catching this specific technique but requires MiCollab-aware logging rules most environments do not have by default."
+      },
+      "response": {
+        "what_would_have_worked": "Review admin-console access logs for anomalous file-read requests and rotate any configuration secrets that could have been disclosed",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "The disclosure itself is limited to non-sensitive information, so response impact is lower than the paired CVE-2024-41713."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-AC-6": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Admin-scope containment is insufficient here because the flaw is exploited by an attacker who already holds administrative privileges, letting them read files outside the intended admin-access boundary."
+      },
+      "NIS2-Art21-vulnerability-management": {
+        "covered": true,
+        "adequate": false,
+        "gap": "EU operators of MiCollab UC platforms need to treat chained low/critical CVE pairs as a single high-severity remediation item, not two independent low-priority tickets."
+      }
+    }
+  },
+  "CVE-2024-41713": {
+    "name": "Mitel MiCollab Path Traversal Vulnerability (CVE-2024-41713)",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unauthenticated attacker sends a request containing a novel '..;/' traversal bypass to the NuPoint Unified Messaging endpoint, escaping the intended directory scope to reach internal AXIS2 SOAP services and read provisioning/configuration data or trigger limited administrative actions.",
+      "privileges_required": "none (unauthenticated)",
+      "complexity": "low — a public PoC exists and the traversal payload is a single crafted HTTP request",
+      "ai_factor": "Not AI-discovered — found by watchTowr Labs during independent security research. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Upgrade to MiCollab 9.8 SP2 (9.8.2.12) or later and restrict NuPoint/NPM endpoints from unauthenticated internet exposure",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2025-01-07)",
+        "adequacy": "Patching closes the specific traversal bypass but does not by itself address the broader exposure of UC administrative services to the internet."
+      },
+      "detection": {
+        "what_would_have_worked": "WAF/IDS signatures for ..;/ and similar encoded traversal sequences targeting NPM/axis2-AWC endpoints",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Effective once the specific bypass pattern is known, but the novelty of the ..;/ encoding meant no signature existed before watchTowr's disclosure."
+      },
+      "response": {
+        "what_would_have_worked": "Review NPM/axis2 access logs for traversal patterns, rotate exposed provisioning credentials, and isolate the MiCollab server pending patching",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Necessary given the flaw was exploited within days of disclosure and chained with the admin file-read CVE-2024-55550 for deeper access."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SC-7": {
+        "covered": true,
+        "adequate": false,
+        "gap": "The vulnerability itself is a boundary-bypass primitive (a novel ..;/ traversal sequence unrecognized by the application's path-sanitization boundary), so standard boundary-protection assumptions failed to hold."
+      },
+      "NIS2-Art21-vulnerability-management": {
+        "covered": true,
+        "adequate": false,
+        "gap": "EU operators of MiCollab as unified-communications infrastructure need emergency out-of-cycle patch processes for unauthenticated critical flaws, not standard change-management timelines."
+      }
+    }
+  },
+  "CVE-2020-2883": {
+    "name": "Oracle WebLogic Server Unspecified Vulnerability (CVE-2020-2883)",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unauthenticated attacker with network access to a WebLogic server's T3 or IIOP listener sends a crafted serialized Java object; the Oracle Coherence library deserializes it, executing the attacker's payload with the privileges of the WebLogic process.",
+      "privileges_required": "none (unauthenticated, network access to T3/IIOP is sufficient)",
+      "complexity": "low — a public GitHub PoC and the generic ysoserial tool make exploitation straightforward",
+      "ai_factor": "Not AI-discovered — reported by a third-party researcher via Trend Micro ZDI. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply the April 2020 Critical Patch Update, and independently disable or firewall the T3/IIOP protocol from untrusted networks as a compensating control",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2025-01-07)",
+        "adequacy": "Patch-only remediation is insufficient in practice — CISA's 2025 KEV addition, five years after the patch, shows unpatched or network-exposed legacy instances remain exploitable at scale."
+      },
+      "detection": {
+        "what_would_have_worked": "Network-layer inspection of T3/IIOP traffic for serialized Java object patterns and known gadget-chain class references",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Effective when deployed, but few organizations run deep-packet inspection on internal middleware protocols like T3/IIOP."
+      },
+      "response": {
+        "what_would_have_worked": "Isolate the compromised WebLogic instance, hunt for webshells/cryptominers dropped in the domain directory, and rotate any credentials the server had access to",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Standard IR steps apply; the long exploitation tail suggests many affected instances are unmanaged/forgotten assets that never receive timely response."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SC-7": {
+        "covered": true,
+        "adequate": false,
+        "gap": "The most effective compensating control — disabling or firewalling the T3/IIOP protocol from untrusted networks — is a boundary-protection measure, not a patch; many affected servers left T3/IIOP internet-reachable long after patching."
+      },
+      "NIS2-Art21-network-security": {
+        "covered": true,
+        "adequate": false,
+        "gap": "EU operators running WebLogic as middleware need network-layer segmentation of T3/IIOP as a standing control, independent of patch status."
+      }
+    }
+  },
+  "CVE-2024-3393": {
+    "name": "Palo Alto Networks PAN-OS Malicious DNS Packet Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unauthenticated attacker sends a specially crafted DNS packet through the firewall's data plane; on devices with DNS Security logging enabled, parsing the packet crashes the firewall and forces a reboot, with repeated attempts pushing the device into maintenance mode.",
+      "privileges_required": "none (unauthenticated, network-reachable data plane)",
+      "complexity": "low in principle, but requires the target to have a DNS Security or Advanced DNS Security license with logging enabled — a common but not universal production configuration",
+      "ai_factor": "Not AI-discovered — found and disclosed by Palo Alto Networks. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply the PAN-OS 10.1.15 / 10.2.14 / 11.1.5 / 11.2.3+ patch, or apply the interim workaround of disabling DNS Security logging",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-12-30)",
+        "adequacy": "The interim workaround (disabling logging) reduces the firewall's DNS-threat visibility as a side effect, so it is a stopgap, not a durable fix."
+      },
+      "detection": {
+        "what_would_have_worked": "Monitor firewall uptime/reboot telemetry and data-plane crash logs for repeated unscheduled reboots correlated with inbound DNS traffic",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Detects the symptom (reboot) but by the time it fires the perimeter defense is already degraded."
+      },
+      "response": {
+        "what_would_have_worked": "Failover to a redundant firewall pair, apply the emergency patch or workaround, and review whether the outage window was used to mask other intrusion attempts",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "High-availability firewall pairs mitigate the direct outage but do not by themselves close the underlying flaw."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-4": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Perimeter monitoring needs to detect repeated malformed-packet-triggered reboots as an availability incident, since the firewall itself becomes the outage rather than merely logging an alert."
+      },
+      "UK-CAF-D1": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Response and recovery planning must account for the firewall entering maintenance mode under repeated attack, since the perimeter defense device itself becomes unavailable."
+      }
+    }
+  },
+  "CVE-2021-44207": {
+    "name": "Acclaim Systems USAHERDS Use of Hard-Coded Credentials Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "USAHERDS ships with a static, product-wide ASP.NET MachineKey (ValidationKey/DecryptionKey). An attacker who obtains the actual key value — APT41 acquired it through undisclosed means — can forge a __VIEWSTATE payload that passes MAC validation; the server deserializes it, executing attacker code.",
+      "privileges_required": "none for exploitation once the static key is known, but the attacker must first obtain the actual key value through a separate vulnerability, leak, or reverse engineering",
+      "complexity": "high — the key is not publicly disclosed by any advisory, so real-world exploitation (as by APT41) required independent acquisition of the key material",
+      "ai_factor": "Not AI-discovered — found and disclosed by Mandiant. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Deploy the vendor patch that removes the hardcoded key and regenerate a unique MachineKey per installation",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-12-23)",
+        "adequacy": "A version-number patch alone is inadequate unless each deployment's MachineKey is individually rotated, since the vulnerability is the shared key material itself, not a code logic bug."
+      },
+      "detection": {
+        "what_would_have_worked": "Monitor IIS logs for anomalous ViewState deserialization activity and unexpected new files/scheduled tasks on the USAHERDS web server",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Effective for catching post-exploitation activity but cannot detect the initial forged-ViewState request without deep ASP.NET-specific instrumentation most organizations lack."
+      },
+      "response": {
+        "what_would_have_worked": "Rotate the MachineKey, hunt for APT41 DEADEYE malware and webshells, and review lateral movement from the compromised host into the broader state-government network",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Matches Mandiant's documented response to the actual APT41 campaign, which required full incident response across multiple state agencies."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-IA-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Static, product-wide cryptographic key material (the ASP.NET MachineKey) undermines authentication assurance for every deployment sharing the same hardcoded value, regardless of individual organizations' IA controls."
+      },
+      "NIS2-Art21-vulnerability-management": {
+        "covered": true,
+        "adequate": false,
+        "gap": "EU-equivalent public-sector operators of niche vertical software need vendor attestation that cryptographic key material is unique per deployment, which standard vulnerability management processes rarely verify."
+      }
+    }
+  },
+  "CVE-2024-12356": {
+    "name": "BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) Command Injection Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unauthenticated attacker sends a crafted WebSocket-upgrade HTTP request with malicious Sec-WebSocket-Protocol / X-Ns-Company header values that are concatenated unsanitized into a shell command run as the appliance's site user, yielding remote command execution on the PAM appliance itself.",
+      "privileges_required": "none (unauthenticated network request)",
+      "complexity": "low — a single crafted HTTP request with malformed headers triggers command execution; a public Metasploit module fully automates it",
+      "ai_factor": "Not AI-discovered — identified by BeyondTrust after detecting compromise of its own hosted infrastructure. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Vendor patch (24.3.1+) plus network isolation of the PAM appliance's management/API surface from downstream sensitive systems",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-12-19)",
+        "adequacy": "Patch alone is insufficient because the breach chain relied on a stolen vendor API key, not a defect any customer-side patch would have closed"
+      },
+      "detection": {
+        "what_would_have_worked": "Anomaly detection on PAM/remote-support API key usage from unfamiliar source contexts, and WAF/IDS signatures for shell metacharacters in WebSocket upgrade headers",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Most customers had no visibility into vendor-side API key misuse, which is the layer where this campaign actually pivoted"
+      },
+      "response": {
+        "what_would_have_worked": "Immediate API-key rotation, appliance isolation, and forensic review of PRA/RS session logs for any of the 17 known-compromised SaaS instances",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Response depended on BeyondTrust's own disclosure timeline; affected customers had limited independent means of detecting the compromise"
+      }
+    },
+    "framework_coverage": {
+      "UK-CAF-B4": {
+        "covered": true,
+        "adequate": false,
+        "gap": "The actual breach vector was a compromised vendor SaaS API key, not a direct customer-side flaw; CAF B4 (supply chain) requires modeling vendor-side compromise blast radius for privileged remote-access providers, which most customers had not done."
+      }
+    }
+  },
+  "CVE-2022-23227": {
+    "name": "NUUO NVRmini2 Devices Missing Authentication Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unauthenticated attacker uploads a specially crafted encrypted TAR archive to the NVRmini2 user-import handler, which has no authentication check, to create an arbitrary administrator account; combined with a separate directory-traversal bug in the device's bundled BusyBox (CVE-2011-5325), the same upload chain overwrites files under the web root to achieve root-level code execution.",
+      "privileges_required": "none (unauthenticated network request)",
+      "complexity": "low — a public PoC and Metasploit module fully automate both the account-creation and file-overwrite chain",
+      "ai_factor": "Not AI-discovered — found and disclosed by independent researcher Pedro Ribeiro. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "No vendor patch exists; the only effective prevention is removing NVRmini2 devices from the network or air-gapping them behind a dedicated management VLAN",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-12-18)",
+        "adequacy": "Because NUUO has never fixed the flaw, patch-based remediation guidance is inapplicable — CISA's own required action is decommissioning, not patching"
+      },
+      "detection": {
+        "what_would_have_worked": "Monitoring for unauthenticated TAR uploads to the NVR's HTTP interface and alerting on new administrator accounts appearing outside change-management windows",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Most NVRmini2 deployments (small business, physical security) lack any network monitoring layer capable of catching this"
+      },
+      "response": {
+        "what_would_have_worked": "Immediate device isolation, credential/user-database review, and firmware reflash or hardware replacement",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Reflashing does not fix the underlying flaw since it exists in all released firmware; full replacement is the only durable response"
+      }
+    },
+    "framework_coverage": {
+      "ISO-27001-2022-A.8.8": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Technical vulnerability management assumes an eventual vendor patch — NUUO has not responded to disclosure and the flaw persists in the latest firmware, so remediation-SLA-based controls cannot be satisfied and must fall back to decommissioning."
+      }
+    }
+  },
+  "CVE-2021-40407": {
+    "name": "Reolink RLC-410W IP Camera OS Command Injection Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An authenticated attacker sends a crafted HTTP request to the camera's SetDdns network-configuration API with shell metacharacters embedded in the DDNS domain field, which the device passes unsanitized into a system-level command, achieving OS command execution.",
+      "privileges_required": "low (authenticated device-admin session required)",
+      "complexity": "low — a single crafted API request triggers the injection once authenticated",
+      "ai_factor": "Not AI-discovered — found and disclosed by Cisco Talos researcher Francesco Benvenuto. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply the vendor firmware fix (released 2022-01-19) and disable remote admin access on cameras that don't need it",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-12-18)",
+        "adequacy": "A patch has existed for years, but consumer/SMB camera fleets commonly run unpatched firmware indefinitely, which is why this was still being exploited enough to warrant a 2024 KEV addition"
+      },
+      "detection": {
+        "what_would_have_worked": "Alerting on SetDdns API calls containing shell metacharacters and monitoring outbound connections from camera management VLANs",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Most deployments have no logging or monitoring on the camera's local management interface"
+      },
+      "response": {
+        "what_would_have_worked": "Isolate the camera, capture firmware/process state, reflash to patched firmware, and rotate any credentials used on the device",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Feasible once detected, but detection is the weak link for unmonitored IoT camera fleets"
+      }
+    },
+    "framework_coverage": {
+      "AU-Essential-8-Patch": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Many affected cameras remain on end-of-life firmware years after the fix shipped; Essential 8's patch-application pillar requires an inventory and update mechanism that consumer IoT vendors typically don't provide."
+      }
+    }
+  },
+  "CVE-2019-11001": {
+    "name": "Reolink Multiple IP Cameras OS Command Injection Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An authenticated admin submits shell metacharacters in the addr1 field of the camera's TestEmail notification-test feature, which the device executes directly as an OS command running as root, giving the attacker full device control.",
+      "privileges_required": "low (authenticated admin session required)",
+      "complexity": "low — a single crafted form submission, fully scripted in the public PoC",
+      "ai_factor": "Not AI-discovered — found via the VDOO community disclosure effort and independent researcher mcw0. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply a vendor firmware fix if available for the specific model, or replace/isolate devices where no fix exists",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-12-18)",
+        "adequacy": "No confirmed firmware fix is documented for all affected models; CISA's required action itself defaults to discontinuing use if mitigation is unavailable"
+      },
+      "detection": {
+        "what_would_have_worked": "Alerting on TestEmail configuration submissions containing shell metacharacters and monitoring for unexpected root-level process spawns on the camera",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Consumer/SMB camera deployments almost never have this level of local monitoring"
+      },
+      "response": {
+        "what_would_have_worked": "Isolate and remove the device from the network, rotate any shared/admin credentials, and replace with a supported model",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Without a patch, response is limited to containment and replacement rather than remediation"
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "No confirmed vendor firmware fix has been identified for all affected models, and CISA's own required action notes the product may be EoL/EoS; flaw remediation cannot be satisfied where no patch exists."
+      }
+    }
+  },
+  "CVE-2018-14933": {
+    "name": "NUUO NVRmini Devices OS Command Injection Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unauthenticated attacker sends a crafted request to upgrade_handle.php invoking the writeuploaddir command with shell metacharacters embedded in the uploaddir parameter, resulting in direct OS command execution on the NVR.",
+      "privileges_required": "none (unauthenticated network request)",
+      "complexity": "low — public Exploit-DB PoCs and a Metasploit module fully automate exploitation",
+      "ai_factor": "Not AI-discovered — publicly disclosed by independent security researchers via Exploit-DB. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "No vendor patch exists for this end-of-life product line; the only effective prevention is removing the device from the network or isolating it on a dedicated management VLAN",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-12-18)",
+        "adequacy": "Patch-based remediation is not possible; CISA's required action is discontinuing use of the product, which many deployments have not done"
+      },
+      "detection": {
+        "what_would_have_worked": "Monitoring for unauthenticated requests to upgrade_handle.php outside scheduled firmware-upgrade windows",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Most physical-security NVR deployments have no network monitoring layer capable of catching this"
+      },
+      "response": {
+        "what_would_have_worked": "Immediate device isolation and replacement, since no firmware fix can remediate the flaw",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Reflashing does not help — the flaw is present in all released firmware for this product line"
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "NUUO has declared the NVRmini line end-of-life with no fix; flaw-remediation SLAs cannot be met where no vendor patch exists, so the required action is decommissioning rather than patching."
+      }
+    }
+  },
+  "CVE-2024-55956": {
+    "name": "Cleo Multiple Products Unauthenticated File Upload Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unauthenticated attacker imports a file that lands in the Cleo product's default Autorun directory; the platform's default configuration automatically executes files placed there as Bash or PowerShell commands, giving the attacker code execution on the host with no credentials required.",
+      "privileges_required": "none (unauthenticated network request)",
+      "complexity": "low — the exploitation mechanic requires only placing a file where the platform's default configuration will auto-execute it",
+      "ai_factor": "Not AI-discovered — active exploitation first identified by Huntress threat-intelligence researchers. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply the vendor patch (5.8.0.24+) and disable Autorun-directory auto-execution as a compensating control during the zero-day window",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-12-17)",
+        "adequacy": "Patching alone is insufficient for the zero-day window itself — disabling auto-execution of unauthenticated file drops was the only mitigation available before the fix shipped"
+      },
+      "detection": {
+        "what_would_have_worked": "Monitoring the Autorun directory for unexpected file creation and alerting on PowerShell/Bash child processes spawned by the Cleo Java process",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Huntress-style managed detection caught this quickly, but self-monitored deployments without EDR on the MFT host missed it for days"
+      },
+      "response": {
+        "what_would_have_worked": "Immediate isolation of the Cleo host, hunting for the Malichus Java backdoor, and forensic review of all files landed via unauthenticated import since December 3, 2024",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Cl0p's campaign moved from initial access to data exfiltration quickly, so response speed was critical and many victims were compromised before detection"
+      }
+    },
+    "framework_coverage": {
+      "AU-Essential-8-App-Hardening": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Application hardening (disabling unnecessary auto-execution features like Autorun-directory command execution) would have closed this vector even before the vendor patch existed."
+      }
+    }
+  },
+  "CVE-2024-35250": {
+    "name": "Microsoft Windows Kernel-Mode Driver Untrusted Pointer Dereference Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "A local attacker with code execution on the host issues a crafted IOCTL_KS_PROPERTY request to the Kernel Streaming Service driver, manipulating the RequestorMode field to bypass a security check so the driver dereferences an attacker-controlled pointer, elevating the calling process to SYSTEM.",
+      "privileges_required": "low (requires existing local code execution as a standard user)",
+      "complexity": "low — a public PoC and Metasploit module fully automate the elevation once local code execution is achieved",
+      "ai_factor": "Not AI-discovered — found by DEVCORE researchers and demonstrated at Pwn2Own Vancouver 2024. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply the June 2024 Patch Tuesday cumulative update, which requires a reboot to take effect",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-12-16)",
+        "adequacy": "The patch is fully effective once applied and rebooted, but the reboot requirement is exactly what causes real-world deployment lag on servers with strict maintenance windows"
+      },
+      "detection": {
+        "what_would_have_worked": "EDR rules for anomalous DeviceIoControl calls to MSKSSRV.SYS and unexpected SYSTEM-level token elevation on endpoints",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Most EDR products did not ship specific detections for this driver's IOCTL abuse pattern until after public PoC release"
+      },
+      "response": {
+        "what_would_have_worked": "Isolate the host, capture a memory image before reboot, and hunt for known PoC/Metasploit artifacts and unexpected SYSTEM processes",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Standard EoP response is effective but depends on detection triggering in the first place, which is the weaker link here"
+      }
+    },
+    "framework_coverage": {
+      "NIS2-Art21-patch-management": {
+        "covered": true,
+        "adequate": false,
+        "gap": "EU operators running unpatched Windows kernel-mode driver updates past the reboot-requiring maintenance window remain exploitable for privilege escalation; Art. 21 patch management must account for reboot-dependent kernel fixes specifically."
+      }
+    }
+  },
+  "CVE-2024-20767": {
+    "name": "Adobe ColdFusion Improper Access Control Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unauthenticated attacker sends crafted requests to the ColdFusion admin API/PMS servlet to read arbitrary files on the server filesystem, exposed only because the admin panel itself was reachable from the internet.",
+      "privileges_required": "none (unauthenticated, but only reachable if the admin panel is internet-exposed)",
+      "complexity": "high — CVSS AC:H reflects the nonstandard prerequisite that the admin panel be exposed to the internet",
+      "ai_factor": "Not AI-discovered — reported to Adobe via standard vendor disclosure. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply APSB24-14 and, independently, never expose the ColdFusion admin panel to the internet (restrict to internal/VPN access).",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-12-16)",
+        "adequacy": "Patching alone is insufficient if the admin panel remains internet-facing; network segmentation is the compensating control."
+      },
+      "detection": {
+        "what_would_have_worked": "Alert on any external source reaching CFIDE/adminapi or PMS servlet paths, and on reads of config files like password.properties.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Detection is a fallback; the primary control is not exposing the admin interface at all."
+      },
+      "response": {
+        "what_would_have_worked": "Rotate any credentials/keys stored in exposed config files, review admin-panel access logs for prior exploitation, restrict panel access.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Credential rotation is necessary once exposure is confirmed, since file read alone can leak reusable secrets."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SC-7": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Boundary protection was insufficient — the vulnerability is only reachable because the ColdFusion admin panel was exposed to the internet in the first place."
+      },
+      "NIS2-Art21-vulnerability-management": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Vulnerability handling processes did not flag an internet-facing admin interface as an unacceptable exposure ahead of exploitation."
+      }
+    }
+  },
+  "CVE-2024-50623": {
+    "name": "Cleo Multiple Products Unrestricted File Upload Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unauthenticated attacker sends a crafted POST request with a path-traversal filename to the Cleo Synchronization endpoint, writing an arbitrary file into the autorun directory that Cleo executes automatically, yielding remote code execution.",
+      "privileges_required": "none (unauthenticated)",
+      "complexity": "low — CVSS AC:L, no special conditions beyond network reachability",
+      "ai_factor": "Not AI-discovered — identified via active-exploitation telemetry and reported to Cleo. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply the fully-patched 5.8.0.24 release (not just 5.8.0.21) and restrict MFT appliance management/sync ports to trusted networks.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-12-13)",
+        "adequacy": "The vendor's first patch (5.8.0.21) was itself insufficient, so patch-and-forget was not adequate — verification of full remediation was required."
+      },
+      "detection": {
+        "what_would_have_worked": "Monitor the Cleo autorun directory for new files and alert on any child process spawned by the Cleo Java process.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Detection would have caught exploitation faster than the multi-day gap observed before mass compromise was identified."
+      },
+      "response": {
+        "what_would_have_worked": "Isolate compromised MFT hosts, rotate all credentials handled by the file-transfer service, and hunt for ransomware staging activity given confirmed ransomware use.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Given confirmed ransomware follow-on activity, rapid isolation is essential to prevent lateral movement from the compromised MFT host."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "The initial vendor fix shipped in 5.8.0.21 was itself incomplete and was bypassed (tracked separately as CVE-2024-55956), so patch-SLA compliance alone did not close the exposure window."
+      },
+      "DORA-Art10": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Financial-sector file-transfer exposure via MFT appliances was not adequately tested for resilience against this exploitation chain."
+      }
+    }
+  },
+  "CVE-2024-49138": {
+    "name": "Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "A local attacker with low privileges triggers a heap-based buffer overflow in the CLFS kernel driver via crafted log-file structures, escalating to SYSTEM privileges — commonly used as a precursor step before ransomware deployment.",
+      "privileges_required": "low (requires existing local code execution as a standard user)",
+      "complexity": "low — CVSS AC:L, no special access conditions beyond local code execution",
+      "ai_factor": "Not AI-discovered — reported by CrowdStrike via standard vendor disclosure. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply the December 2024 Patch Tuesday update promptly, since this was exploited as a zero-day before release.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-12-10)",
+        "adequacy": "Patching is necessary but was not sufficient pre-disclosure; endpoint detection for anomalous SYSTEM escalation is a needed compensating control against the next CLFS zero-day in this recurring pattern."
+      },
+      "detection": {
+        "what_would_have_worked": "EDR rules for unexpected SYSTEM-privilege child processes spawned from standard-user sessions and anomalous .blf file activity.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Behavioral detection is important given this is the fifth actively-exploited CLFS LPE since 2022 — signature-based defenses lag each new variant."
+      },
+      "response": {
+        "what_would_have_worked": "Isolate hosts showing SYSTEM-token anomalies, hunt for ransomware staging or lateral movement toward domain controllers.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Given CLFS LPE flaws are routinely chained into ransomware deployment, rapid isolation is critical to prevent domain-wide impact."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Standard OS patch-SLA cadence did not cover this flaw, which was already being exploited as a zero-day before the fix shipped."
+      },
+      "AU-Essential-8-Patch": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Patch-operating-system control is necessarily reactive to a pre-disclosure zero-day exploitation window."
+      }
+    }
+  },
+  "CVE-2024-51378": {
+    "name": "CyberPanel Incorrect Default Permissions Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unauthenticated attacker sends a GET request (instead of POST) to a DNS/FTP reset-status endpoint to bypass authentication middleware, then injects shell metacharacters in the statusfile parameter to execute arbitrary OS commands.",
+      "privileges_required": "none (unauthenticated)",
+      "complexity": "low — CVSS AC:L, no special conditions beyond crafting the HTTP request",
+      "ai_factor": "Not AI-discovered — publicly disclosed via researcher blog post. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply the vendor patch (commit 1c0c6cb) and restrict CyberPanel's admin/API ports to trusted networks.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-12-04)",
+        "adequacy": "Patch-only is inadequate for internet-facing control panels at scale; the mass 22,000-instance compromise occurred within days, faster than typical patch cycles."
+      },
+      "detection": {
+        "what_would_have_worked": "Alert on GET requests to endpoints expected to require POST-only auth, and on shell metacharacters in URL parameters.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Would have caught exploitation attempts that patch-SLA timing alone missed during the mass-exploitation window."
+      },
+      "response": {
+        "what_would_have_worked": "Given confirmed ransomware use (PSAUX), isolate affected hosts immediately, restore from backup, and rotate all credentials on the panel.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Ransomware follow-on activity means response must assume full host compromise, not just the initial command execution."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-AC-3": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Access enforcement was implemented only for POST requests, so a simple HTTP-verb logic flaw bypassed authentication entirely."
+      },
+      "NIS2-Art21-vulnerability-handling": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Vulnerability handling did not anticipate that authentication middleware scoped only to POST requests was trivially bypassable via GET."
+      }
+    }
+  },
+  "CVE-2024-11680": {
+    "name": "ProjectSend Improper Authentication Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unauthenticated attacker sends crafted requests to options.php to modify ProjectSend's site configuration, enabling self-registration and permissive upload types, then registers an account and uploads a webshell for remote code execution.",
+      "privileges_required": "none (unauthenticated)",
+      "complexity": "low — CVSS AC:L, no special conditions beyond reaching options.php",
+      "ai_factor": "Not AI-discovered — reported by Synacktiv researchers. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply the patch (commit 193367d, r1720+) and restrict admin-configuration endpoints from unauthenticated access at the reverse-proxy layer.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-12-03)",
+        "adequacy": "Patch-only is inadequate given mass scanning predated the KEV addition; a WAF rule blocking unauthenticated options.php writes is a needed compensating control."
+      },
+      "detection": {
+        "what_would_have_worked": "Alert on unauthenticated POST to options.php and on new-account creation followed immediately by file upload.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Detection would catch the account-creation + webshell-upload chain even if the initial config-write request is missed."
+      },
+      "response": {
+        "what_would_have_worked": "Remove attacker-created accounts, delete planted webshells/XSS payloads, and restore configuration from a known-good backup.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Configuration tampering means a simple file-delete is insufficient — full config review is needed post-compromise."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-AC-3": {
+        "covered": true,
+        "adequate": false,
+        "gap": "The configuration endpoint (options.php) lacked authentication enforcement, allowing unauthenticated modification of security-relevant settings."
+      },
+      "NIS2-Art21-vulnerability-management": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Vulnerability management did not catch mass in-the-wild scanning that predated the CISA KEV addition."
+      }
+    }
+  },
+  "CVE-2024-11667": {
+    "name": "Zyxel Multiple Firewalls Path Traversal Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An attacker sends a crafted URL to the ZLD web management interface that traverses outside the intended directory scope, allowing arbitrary file download or upload — used by Helldown ransomware affiliates as initial access into victim networks.",
+      "privileges_required": "none (unauthenticated)",
+      "complexity": "low — CVSS AC:L, no special conditions beyond reaching the management interface",
+      "ai_factor": "Not AI-discovered — reported to and disclosed by Zyxel. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply ZLD V5.39 and restrict firewall web-management access to trusted internal/VPN-only networks.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-12-03)",
+        "adequacy": "Patching the firmware is necessary but the recurring lesson from perimeter-appliance KEV entries is that management interfaces should never be internet-facing regardless of patch level."
+      },
+      "detection": {
+        "what_would_have_worked": "Alert on directory-traversal sequences in requests to the firewall's web management interface.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Would catch exploitation attempts even against unpatched devices during the remediation window."
+      },
+      "response": {
+        "what_would_have_worked": "Given confirmed ransomware use, treat any exploited firewall as a full network compromise: isolate, rotate all VPN/admin credentials, and hunt for lateral movement.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Firewall compromise via this flaw is a documented Helldown precursor to full-network ransomware deployment, so response must assume broader compromise."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SC-7": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Boundary protection was insufficient — the ZLD web management interface was reachable from the internet, the precondition for this exploitation chain."
+      },
+      "NIS2-Art21-network-security": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Network security controls did not restrict firewall management-plane access to trusted administrative networks only."
+      }
+    }
+  },
+  "CVE-2023-45727": {
+    "name": "North Grid Proself Improper Restriction of XML External Entity (XXE) Reference Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unauthenticated attacker submits a specially crafted XML request containing external entity declarations to a Proself endpoint, causing the server to disclose arbitrary local files including account information.",
+      "privileges_required": "none (unauthenticated)",
+      "complexity": "low — CVSS AC:L, no special conditions beyond submitting malformed XML",
+      "ai_factor": "Not AI-discovered — disclosed via Japan's JVN coordinated-disclosure process. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply the vendor patch (5.63/1.66/1.09) and disable external entity resolution in the XML parser as defense-in-depth.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-12-03)",
+        "adequacy": "Patch-only is adequate here since exploitation requires no special network exposure beyond normal service reachability, but disabling XXE parser-wide is a stronger structural fix than a point patch."
+      },
+      "detection": {
+        "what_would_have_worked": "Inspect inbound XML payloads for DOCTYPE/ENTITY declarations and alert on file-path-like content in entity definitions.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "No public PoC exists, so detection rules must be derived from the vulnerability class itself (XXE) rather than a specific known payload."
+      },
+      "response": {
+        "what_would_have_worked": "Review server logs for anomalous XML requests, assess exposure of any account/configuration data reachable via the flaw, and notify affected account holders if confirmed.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Because the flaw discloses account information, response should include a data-exposure assessment, not just technical remediation."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Patch-SLA cadence lagged the observed in-the-wild exploitation window for this XXE flaw."
+      },
+      "NIS2-Art21-vulnerability-management": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Vulnerability management processes did not surface XXE-capable unauthenticated endpoints as high-priority exposure."
+      }
+    }
+  },
+  "CVE-2023-28461": {
+    "name": "Array Networks AG and vxAG ArrayOS Missing Authentication for Critical Function Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An attacker sends an unauthenticated HTTP request with a crafted flags attribute in the header to the Array AG/vxAG SSL VPN portal, which grants filesystem browsing access and, through a vulnerable URL, remote code execution on the gateway.",
+      "privileges_required": "none (unauthenticated network attacker)",
+      "complexity": "low — no special conditions beyond reaching the SSL VPN portal over the network",
+      "ai_factor": "Not AI-discovered — found and patched by Array Networks in 2023; later weaponized in the wild by the China-linked group Earth Kasha. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply ArrayOS AG 9.4.0.484 (or later) promptly, plus restrict SSL VPN portal management/administrative paths from untrusted networks as a compensating control.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-11-25)",
+        "adequacy": "Patching alone is adequate for the flaw itself, but the 20-month gap between patch availability and CISA KEV listing shows organizations were not tracking this appliance class for vulnerability remediation."
+      },
+      "detection": {
+        "what_would_have_worked": "Monitor SSL VPN gateway access logs for unauthenticated requests bearing non-standard 'flags' HTTP headers and unexpected filesystem-read patterns.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Most organizations do not instrument appliance-level HTTP header anomalies, so this class of preauth abuse is rarely caught before file access or webshell drop occurs."
+      },
+      "response": {
+        "what_would_have_worked": "Isolate the gateway, rotate all credentials that transited the VPN, and hunt for webshells/persistence dropped via the file-browse primitive before restoring service.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Effective once triggered, but VPN gateways are frequently a blind spot for endpoint detection tooling, delaying response."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Flaw remediation existed as a vendor patch (9.4.0.484) since March 2023, but SSL VPN gateways are commonly deprioritized for patching since they sit outside standard endpoint patch cycles, leaving a 20+ month exploitation window before CISA KEV listing."
+      }
+    }
+  },
+  "CVE-2024-44309": {
+    "name": "Apple Multiple Products Cross-Site Scripting (XSS) Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "A user is lured to attacker-controlled web content that manipulates cookie state management to trigger a cross-site scripting attack in Safari/WebKit; observed in a targeted campaign against Intel-based Macs, chained with a separate code-execution flaw.",
+      "privileges_required": "none (unauthenticated attacker), but requires user interaction (visiting malicious content)",
+      "complexity": "low — reaching the flaw only requires the victim to load crafted web content",
+      "ai_factor": "Not AI-discovered — found by Google TAG researchers Clément Lecigne and Benoît Sevens. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply Safari 18.1.1/iOS 17.7.2 or 18.1.1/macOS 15.1.1/visionOS 2.1.1 promptly once released; enterprise MDM-enforced auto-update reduces the post-patch exposure window.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-11-21)",
+        "adequacy": "Effective only after the emergency patch shipped; the pre-disclosure zero-day window was unaddressable by patch-management controls alone."
+      },
+      "detection": {
+        "what_would_have_worked": "Endpoint/browser telemetry for anomalous cookie manipulation combined with threat-intel indicators from the associated targeted campaign.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Consumer and most enterprise Mac fleets lack browser-internal exploit telemetry, so detection relied on the vendor/researcher disclosure rather than customer-side monitoring."
+      },
+      "response": {
+        "what_would_have_worked": "For high-risk/targeted individuals, forensic triage of the device and Safari state, credential rotation, and applying the emergency update fleet-wide.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Adequate for confirmed targets but the targeted nature of the campaign means most organizations had no signal to trigger a response before the patch."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Apple shipped a fix in Safari 18.1.1/iOS 17.7.2/18.1.1/macOS 15.1.1, but the flaw was exploited as a zero-day before any patch existed, so flaw remediation alone could not have prevented initial exploitation."
+      }
+    }
+  },
+  "CVE-2024-44308": {
+    "name": "Apple Multiple Products Code Execution Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "A victim on an Intel-based Mac loads attacker-controlled web content that triggers a register-corruption bug in JavaScriptCore's DFG JIT compiler, leading to arbitrary code execution; observed chained with the CVE-2024-44309 cookie XSS flaw in a targeted campaign.",
+      "privileges_required": "none (unauthenticated attacker), but requires user interaction (visiting malicious content)",
+      "complexity": "high — requires a reliable JIT-exploitation primitive tailored to Intel-based Mac hardware",
+      "ai_factor": "Not AI-discovered — found by Google TAG researchers Clément Lecigne and Benoît Sevens. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply Safari 18.1.1/iOS 17.7.2 or 18.1.1/macOS 15.1.1/visionOS 2.1.1 promptly; enable Lockdown Mode for high-risk individuals to disable JIT compilation entirely.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-11-21)",
+        "adequacy": "Patch closes the specific bug but the zero-day exploitation window predates any obligation; Lockdown Mode is a stronger structural mitigation but is not the default configuration."
+      },
+      "detection": {
+        "what_would_have_worked": "Endpoint crash/telemetry monitoring for anomalous Safari/WebKit process behavior consistent with JIT exploitation.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Consumer and most enterprise fleets lack the low-level instrumentation to catch JIT-corruption exploitation before compromise."
+      },
+      "response": {
+        "what_would_have_worked": "Forensic imaging of targeted devices, credential rotation, and fleet-wide emergency patch rollout once Apple's advisory published.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Adequate for confirmed targets identified via the Google TAG disclosure, but most organizations had no independent detection signal."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Apple's fix landed in Safari 18.1.1/iOS/macOS point releases, but the JIT memory-corruption bug was exploited as a zero-day, so patch-cadence controls could not prevent initial compromise."
+      }
+    }
+  },
+  "CVE-2024-21287": {
+    "name": "Oracle Agile Product Lifecycle Management (PLM) Incorrect Authorization Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unauthenticated attacker sends a crafted HTTP request to the Agile PLM Framework's Process Extension SDK component, which fails to correctly enforce authorization, resulting in unauthorized access to PLM data/files.",
+      "privileges_required": "none (unauthenticated network attacker)",
+      "complexity": "low — the flaw is remotely exploitable over HTTP with no special conditions",
+      "ai_factor": "Not AI-discovered — reported by Joel Snape and Lutz Wolf of CrowdStrike. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply Oracle's out-of-band patch promptly and restrict network access to the Agile PLM SDK/Process Extension endpoints to trusted internal networks.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-11-21)",
+        "adequacy": "Patching closes the flaw, but exploitation was already confirmed pre-patch, so network segmentation of the enterprise application is a necessary compensating control."
+      },
+      "detection": {
+        "what_would_have_worked": "Application-layer logging and anomaly detection on Agile PLM SDK endpoints for unauthenticated access patterns.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Enterprise PLM systems rarely have the same monitoring maturity as internet-facing web apps, so this class of exploitation is often missed until data exfiltration is discovered downstream."
+      },
+      "response": {
+        "what_would_have_worked": "Audit accessed files/data for sensitive IP exposure, rotate any exposed credentials, and apply the Oracle patch across all Agile PLM deployments.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Effective once triggered, but the niche nature of the product means incident responders may lack familiarity with its logging/forensic surface."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-AC-3": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Access enforcement failed because the Process Extension SDK component did not correctly authorize requests, allowing unauthenticated access to data that should require a session."
+      }
+    }
+  },
+  "CVE-2024-38813": {
+    "name": "VMware vCenter Server Privilege Escalation Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An attacker with network access to vCenter Server sends a specially crafted packet that abuses an improper privilege-drop check, escalating to root; observed chained with the CVE-2024-38812 heap overflow for a full unauthenticated-to-root compromise.",
+      "privileges_required": "low (network access to vCenter Server, typically combined with an initial-access flaw)",
+      "complexity": "high — requires reliable exploitation of the privilege-drop condition, usually as the second stage of a chain",
+      "ai_factor": "Not AI-discovered — disclosed and patched by Broadcom/VMware; in-the-wild exploitation attributed to UNC5221 by Mandiant. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply vCenter Server 7.0 U3s / 8.0 U3b promptly and restrict network access to vCenter management interfaces to trusted management networks only.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-11-20)",
+        "adequacy": "Patching closes the specific defect, but network segmentation of the management plane is a necessary compensating control given the confirmed nation-state chaining with CVE-2024-38812."
+      },
+      "detection": {
+        "what_would_have_worked": "Monitor vpxd process behavior and privilege transitions for anomalies correlated with unexpected inbound management-plane traffic.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "vCenter's internal service telemetry is not commonly forwarded to SIEM in most deployments, limiting real-time detection of this specific escalation."
+      },
+      "response": {
+        "what_would_have_worked": "Isolate the affected vCenter instance, rebuild from a known-good state, and rotate all credentials managed through vCenter (ESXi hosts, SSO).",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Full recovery is disruptive given vCenter's central role in virtualization management, making prevention far more cost-effective than response."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-AC-6": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Least-privilege enforcement within vCenter's own service architecture failed due to the improper privilege-drop condition, which is a defect in the product itself rather than a misconfiguration operators can fully compensate for."
+      }
+    }
+  },
+  "CVE-2024-38812": {
+    "name": "VMware vCenter Server Heap-Based Buffer Overflow Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unauthenticated attacker with network access to vCenter Server sends a malformed DCE/RPC request (crafted ndr_cstring field) to the DCERPC service on TCP/2012, triggering a heap overflow that yields remote code execution as the vpxd user.",
+      "privileges_required": "none (unauthenticated network attacker)",
+      "complexity": "low — reaching the vulnerable DCERPC service over the network is sufficient once a working exploit exists",
+      "ai_factor": "Not AI-discovered — disclosed and patched by Broadcom/VMware; in-the-wild exploitation attributed to UNC5221 by Mandiant. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply vCenter Server 7.0 U3s / 8.0 U3b promptly and firewall TCP/2012 (and other vCenter management ports) from any network beyond the dedicated management segment.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-11-20)",
+        "adequacy": "Patching is fully effective against this specific overflow, but the rapid public PoC-to-exploitation timeline shows network segmentation is a necessary parallel control, not a substitute."
+      },
+      "detection": {
+        "what_would_have_worked": "Network intrusion detection for malformed DCERPC/TCP-2012 traffic and vpxd crash/restart monitoring.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Few organizations run deep-packet inspection on internal management-plane traffic, so detection commonly relies on post-compromise indicators rather than the exploit attempt itself."
+      },
+      "response": {
+        "what_would_have_worked": "Isolate and forensically image the vCenter appliance, rebuild from a patched known-good state, and rotate all credentials/certificates managed through vCenter.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Recovery is high-impact and disruptive given vCenter's role as the virtualization control plane, reinforcing that prevention (patch + segmentation) is far cheaper than response."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SC-7": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Boundary protection/network segmentation should isolate the vCenter management network (including TCP/2012) from untrusted or general-purpose network segments, but this is frequently under-enforced in practice."
+      }
+    }
+  },
+  "CVE-2024-9474": {
+    "name": "Palo Alto Networks PAN-OS Management Interface OS Command Injection Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "A PAN-OS administrator session on the management web interface can inject OS commands executed with root privileges; in the observed mass-exploitation campaign, this was chained with the CVE-2024-0012 authentication bypass so an unauthenticated attacker with network access to an internet-exposed management interface could achieve root command execution directly.",
+      "privileges_required": "none when chained with CVE-2024-0012 auth bypass (otherwise low/PAN-OS admin)",
+      "complexity": "low — public PoC and documented chaining with CVE-2024-0012 make exploitation straightforward against exposed management interfaces",
+      "ai_factor": "Not AI-discovered — disclosed and patched by Palo Alto Networks; in-the-wild mass exploitation confirmed by Unit 42. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply the PAN-OS hotfix for the affected branch and, as the vendor's primary mitigation, restrict the management interface to trusted internal IP addresses only — never expose it to the internet directly or via a dataplane interface with a management profile.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-11-18)",
+        "adequacy": "Patching addresses the command-injection flaw itself, but the vendor advisory is explicit that the network-exposure configuration is the dominant risk factor, so patching without also restricting management-interface access leaves the door open to related chained flaws."
+      },
+      "detection": {
+        "what_would_have_worked": "Monitor management-interface authentication and administrative API logs for anomalous sequences (auth-bypass-style access followed immediately by command execution), and alert on new local admin accounts or outbound connections from the management plane.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Firewall management-plane logging is often under-monitored relative to traffic/policy logging, delaying detection of this class of abuse."
+      },
+      "response": {
+        "what_would_have_worked": "Isolate the affected firewall's management plane, rebuild/reimage from a patched known-good configuration, rotate all credentials and certificates managed through the device, and hunt for persistence (webshells, new admin accounts) across the fleet.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Given the KEV ransomware flag, response must assume follow-on lateral movement and ransomware deployment beyond the firewall itself."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SC-7": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Boundary protection guidance directly addresses this threat: the vendor's own advisory states risk is greatest when the management interface is reachable from the internet or an untrusted network, which is a configuration control independent of patching."
+      }
+    }
+  },
+  "CVE-2024-1212": {
+    "name": "Progress Kemp LoadMaster OS Command Injection Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unauthenticated attacker sends a crafted request to the LoadMaster management web interface, injecting OS commands that execute in the context of the web service; a subsequent sudo-abuse step escalates from the default admin account to root.",
+      "privileges_required": "none (unauthenticated network access to the management interface)",
+      "complexity": "low — a single crafted HTTP request achieves command execution, no authentication or user interaction needed",
+      "ai_factor": "Not AI-discovered — found and disclosed by Rhino Security Labs. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Patch to LMOS 7.2.59.2 / 7.2.54.8 / 7.2.48.10 or later, combined with restricting the management interface to trusted internal networks only.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-11-18)",
+        "adequacy": "Patch alone is sufficient once applied, but the roughly seven-month window of silent in-the-wild exploitation before KEV listing shows network isolation of the management plane is a necessary compensating control while unpatched."
+      },
+      "detection": {
+        "what_would_have_worked": "Monitoring the LoadMaster management interface for command-injection-pattern requests and unexpected child-process spawning on the appliance.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Most LoadMaster deployments lack host-based telemetry on the appliance itself, making this detection layer uncommon in practice."
+      },
+      "response": {
+        "what_would_have_worked": "Immediate isolation of the appliance from the network, credential rotation for any downstream systems the LoadMaster had access to, and forensic review for sudo-abuse root escalation artifacts.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Effective if executed promptly, but detection latency for appliance compromises is typically high, extending attacker dwell time."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SC-7": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Boundary protection didn't stop exploitation because the LoadMaster management interface was reachable from untrusted networks; restricting management-plane access was vendor guidance, not an enforced default."
+      }
+    }
+  },
+  "CVE-2024-0012": {
+    "name": "Palo Alto Networks PAN-OS Management Interface Authentication Bypass Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unauthenticated attacker with network access to the PAN-OS management web interface gains administrator privileges, then chains CVE-2024-9474 for full root-equivalent compromise of the firewall.",
+      "privileges_required": "none (unauthenticated network access to the management interface)",
+      "complexity": "low — the bypass requires only network reachability to the management interface, no credentials or user interaction",
+      "ai_factor": "Not AI-discovered — identified via Palo Alto Networks PSIRT / Unit42 investigation of active exploitation. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Patch to a fixed PAN-OS release and restrict the management interface to trusted internal IP addresses per Palo Alto's best-practice deployment guide.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-11-18)",
+        "adequacy": "Restricting management-interface exposure is a well-documented mitigation, but adoption was inconsistent enough that mass exploitation still occurred against internet-exposed devices."
+      },
+      "detection": {
+        "what_would_have_worked": "Monitoring for unauthenticated configuration changes, new admin accounts, and webshell deployment on PAN-OS management interfaces.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Effective when firewall management-plane audit logging is enabled and reviewed, but many operators don't centrally monitor appliance management-plane activity."
+      },
+      "response": {
+        "what_would_have_worked": "Immediate firewall isolation, credential rotation, admin-account audit, and forensic review for webshells or configuration tampering following the CVE-2024-9474 chain.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Effective if executed promptly; ransomware operators known to use this chain move quickly from initial access to network-wide impact."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-AC-3": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Access enforcement on the management plane failed because the interface itself lacked authentication for privileged actions, not because an access policy was misconfigured."
+      }
+    }
+  },
+  "CVE-2024-9465": {
+    "name": "Palo Alto Networks Expedition SQL Injection Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unauthenticated attacker sends an SQL-injection payload to the Expedition web application, dumping the database contents including PAN-OS firewall password hashes, usernames, device configurations, and API keys.",
+      "privileges_required": "none (unauthenticated network access to Expedition)",
+      "complexity": "low — a single unauthenticated crafted request extracts sensitive database contents",
+      "ai_factor": "Not AI-discovered — found and disclosed by Horizon3.ai. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Patch to Expedition 1.2.96 or later, and avoid exposing Expedition to untrusted networks since it is a migration/configuration tool holding firewall credentials.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-11-14)",
+        "adequacy": "Patching closes the injection flaw, but the underlying design issue — a migration tool storing plaintext-recoverable firewall credentials — remains a high-value target requiring its own hardened deployment posture."
+      },
+      "detection": {
+        "what_would_have_worked": "Web application firewall rules or logging tuned to detect SQL-injection payload patterns against Expedition endpoints.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Effective when WAF coverage extends to internal migration/admin tooling, which is inconsistently applied in practice."
+      },
+      "response": {
+        "what_would_have_worked": "Immediate rotation of all firewall credentials and API keys ever stored in the affected Expedition instance, plus review of downstream PAN-OS devices for unauthorized configuration changes.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Necessary but resource-intensive at scale, since one compromised Expedition instance can expose credentials for many downstream firewalls."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-AC-6": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Least-privilege wasn't enforced at the Expedition database layer, which stored recoverable firewall credentials and API keys reachable via a single unauthenticated SQLi."
+      }
+    }
+  },
+  "CVE-2024-9463": {
+    "name": "Palo Alto Networks Expedition OS Command Injection Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unauthenticated attacker sends a crafted request to the Expedition web application, injecting OS commands that execute as root, exposing every firewall credential and API key the tool ever handled.",
+      "privileges_required": "none (unauthenticated network access to Expedition)",
+      "complexity": "low — a single unauthenticated crafted request achieves root command execution",
+      "ai_factor": "Not AI-discovered — found and disclosed by Horizon3.ai. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Patch to Expedition 1.2.96 or later and avoid running Expedition's web service as root, alongside restricting network exposure of the tool.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-11-14)",
+        "adequacy": "Patching fixes the injection point, but running the service as root magnifies the blast radius of any future injection-class bug in the same tool."
+      },
+      "detection": {
+        "what_would_have_worked": "Logging and alerting on shell-metacharacter patterns and unexpected child-process spawning from the Expedition web service.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Effective if host-based monitoring is deployed on the Expedition host, which is inconsistent for internal admin tooling."
+      },
+      "response": {
+        "what_would_have_worked": "Immediate rotation of every firewall credential and API key stored in the affected Expedition instance, and audit of downstream PAN-OS devices for unauthorized changes.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Necessary but resource-intensive since a single compromised Expedition instance can expose credentials for many downstream firewalls."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-AC-6": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Least-privilege wasn't enforced on the Expedition process, which ran the vulnerable code path as root, maximizing the impact of the injection."
+      }
+    }
+  },
+  "CVE-2024-49039": {
+    "name": "Microsoft Windows Task Scheduler Privilege Escalation Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "After gaining code execution inside a sandboxed AppContainer (e.g. via a browser renderer exploit), an attacker invokes privileged Task Scheduler RPC functions to escape the sandbox and escalate to Medium integrity, with no user interaction required beyond the initial browser compromise.",
+      "privileges_required": "low (code execution inside a sandboxed AppContainer process)",
+      "complexity": "low once initial sandboxed execution is achieved — the RPC abuse itself requires no further user interaction",
+      "ai_factor": "Not AI-discovered — identified via ESET's tracking of the RomCom threat-actor campaign. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply the November 2024 Patch Tuesday update; keep browsers (especially Firefox, given the CVE-2024-9680 chain) fully patched to prevent the initial sandboxed foothold.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-11-12)",
+        "adequacy": "Patching both ends of the chain (browser + OS) is required since either alone leaves the attack path partially open until both vendors ship fixes."
+      },
+      "detection": {
+        "what_would_have_worked": "EDR rules for anomalous RPC calls from AppContainer-sandboxed processes to Task Scheduler service endpoints.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Sandbox-escape-specific telemetry is not part of most default EDR rule sets, making this detection layer uncommon."
+      },
+      "response": {
+        "what_would_have_worked": "Endpoint isolation, memory/process forensics for RomCom backdoor artifacts, and browser/OS patch verification across the fleet.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Effective but requires fast triage given the zero-click nature of the chained exploit once a user simply browses to a malicious page."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-4": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Endpoint anomaly detection wasn't tuned to catch AppContainer-to-service RPC escalation, which requires sandbox-escape-specific telemetry most EDR baselines lack."
+      }
+    }
+  },
+  "CVE-2024-43451": {
+    "name": "Microsoft Windows NTLMv2 Hash Disclosure Spoofing Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "A phishing email delivers a malicious .url shortcut file; minimal interaction (even right-clicking, deleting, or moving it) forces the victim's machine to initiate an SMB authentication handshake to an attacker server, leaking the user's NTLMv2 hash for pass-the-hash reuse or offline cracking.",
+      "privileges_required": "none (unauthenticated relative to the target; requires only that the victim receive and minimally interact with the file)",
+      "complexity": "low — the required interaction is far below opening/executing the file, which is what made this an effective zero-day phishing lure",
+      "ai_factor": "Not AI-discovered — identified via CERT-UA and ClearSky Cyber Security tracking of the UAC-0194 campaign. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply the November 2024 Patch Tuesday update; block outbound SMB (445) to the internet at the network boundary; filter .url attachments at the email gateway.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-11-12)",
+        "adequacy": "Patching closes the specific hash-leak path, but SMB egress filtering is the more durable compensating control against the broader class of forced-authentication techniques."
+      },
+      "detection": {
+        "what_would_have_worked": "Alerting on outbound SMB connections to external IPs and on delivery of .url files via email.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Effective when egress monitoring and email-gateway file-type filtering are both deployed, which is inconsistent across organizations."
+      },
+      "response": {
+        "what_would_have_worked": "Force password/hash resets for potentially exposed accounts and hunt for SparkRAT indicators on endpoints that interacted with the phishing lure.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Effective if the exposed account set can be scoped quickly; delay increases risk of hash reuse via pass-the-hash before rotation completes."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SC-7": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Boundary/egress filtering didn't block outbound SMB (445) to external IPs, which is what let the forced-authentication hash-leak succeed."
+      }
+    }
+  },
+  "CVE-2021-41277": {
+    "name": "Metabase GeoJSON API Local File Inclusion Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unauthenticated attacker submits a `file://` URL to Metabase's custom-map GeoJSON API, which loads the target path without scheme or path validation, disclosing arbitrary local files and process environment variables (including cloud credentials).",
+      "privileges_required": "none (unauthenticated network access to the Metabase API)",
+      "complexity": "low — a single unauthenticated GET request with a `file://` URL achieves file disclosure",
+      "ai_factor": "Not AI-discovered — reported to Metabase via coordinated disclosure. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Upgrade to Metabase 0.40.5/1.40.5 or later; restrict Metabase instances from being directly internet-exposed and place them behind authentication at the network layer.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-11-12)",
+        "adequacy": "The patch fully closes the flaw, but the three-year exploitation tail shows patch availability alone doesn't guarantee remediation without active internet-exposure scanning of deployed instances."
+      },
+      "detection": {
+        "what_would_have_worked": "Monitoring Metabase access logs for `file://` scheme usage in the `/api/geojson` endpoint.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Effective when centralized logging of self-hosted analytics tools is in place, which is inconsistent for internally-run BI platforms."
+      },
+      "response": {
+        "what_would_have_worked": "Rotate any cloud/database credentials that were ever exposed as environment variables to the Metabase process, and audit for follow-on cloud API abuse.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Necessary but often overlooked, since operators may not realize environment-variable credentials were reachable via a BI tool's file-read bug."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "The roughly three-year gap between the 2021 patch and 2024 KEV listing shows unpatched internet-exposed instances persisted well past any reasonable flaw-remediation SLA."
+      }
+    }
+  },
+  "CVE-2021-26086": {
+    "name": "Atlassian Jira Server and Data Center Path Traversal Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unauthenticated attacker sends a crafted HTTP GET request with encoded path-traversal sequences at a Jira static-resource endpoint, escaping the intended webapp root to read /WEB-INF/web.xml and potentially other sensitive files.",
+      "privileges_required": "none (unauthenticated remote request)",
+      "complexity": "low — a single crafted HTTP GET request with an encoded traversal sequence, no race conditions or multi-step chaining required.",
+      "ai_factor": "Not AI-discovered — reported to Atlassian via standard PSIRT disclosure. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Upgrade to Jira Server/DC 8.5.14, 8.13.6, or 8.16.1+; a WAF/reverse-proxy rule blocking traversal sequences and direct /WEB-INF/ access is an effective compensating control pending patch.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-11-12)",
+        "adequacy": "Patch alone doesn't retroactively invalidate any configuration secrets already disclosed prior to remediation."
+      },
+      "detection": {
+        "what_would_have_worked": "Web-server / WAF logging alerting on requests containing traversal sequences or targeting /WEB-INF/web.xml directly.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Effective only if traversal-sequence detection rules are already tuned; encoded variants can evade naive signature matching."
+      },
+      "response": {
+        "what_would_have_worked": "Rotate any credentials or secrets referenced in disclosed configuration files; review access logs for the exploitation window.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Effective if logs retain sufficient history to identify the exploitation window; short retention periods limit this."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Fixes existed years before the KEV listing; SI-2 SLAs tracking vendor severity rather than active-exploitation status left a MEDIUM-scored bug unpatched until mass exploitation forced attention."
+      },
+      "AU-Essential-8-Patch": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Essential Eight patch-applications guidance targets prompt remediation for exploited internet-facing services; a years-old MEDIUM CVE quietly returning to active-exploitation status falls outside routine patch-cadence triage."
+      }
+    }
+  },
+  "CVE-2014-2120": {
+    "name": "Cisco Adaptive Security Appliance (ASA) Cross-Site Scripting (XSS) Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An attacker crafts a URL targeting the ASA WebVPN login page with a script-injection payload in an unspecified parameter; a decade after disclosure, actors including AndroxGh0st began chaining it with other Cisco flaws to attempt file upload and backdooring.",
+      "privileges_required": "none (unauthenticated, but requires a victim to load the crafted link, or chaining into a broader automated exploitation toolkit)",
+      "complexity": "low — standard reflected-XSS payload crafting; the nontrivial part is that it was rediscovered as useful within a decade-old, still-deployed appliance.",
+      "ai_factor": "Not AI-discovered — originally reported to Cisco PSIRT in 2014; 2024 renewed exploitation surfaced via PSIRT monitoring and third-party (CloudSEK) reporting. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Upgrade to a fixed ASA software release; decommission EOL ASA hardware still exposing WebVPN to the internet.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-11-12)",
+        "adequacy": "Patch alone doesn't address appliances that are EOL and no longer receive fixes; those require replacement, not remediation."
+      },
+      "detection": {
+        "what_would_have_worked": "WAF/IPS signatures for script-injection payloads on the WebVPN login page, and monitoring for anomalous file-write attempts following login-page requests.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Requires signature coverage extended to a decade-old CVE, which most monitoring baselines exclude by default."
+      },
+      "response": {
+        "what_would_have_worked": "Isolate the appliance, review logs for chained exploitation (unexpected PHP file writes), and rotate any credentials exposed via the WebVPN portal.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Effective only if log retention covers the exploitation window on an appliance that may be lightly monitored."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "A 2014 flaw resurfacing a decade later shows patch-verification programs rarely re-check advisories on EOL-adjacent devices; SI-2 needs a KEV-relisting trigger, not just first-disclosure tracking."
+      },
+      "UK-CAF-C1": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Renewed exploitation of a decade-old, MEDIUM-severity XSS wasn't detected by most operators until Cisco publicly revised its bulletin; CAF C1 security monitoring needs signature coverage extended to old CVEs."
+      }
+    }
+  },
+  "CVE-2024-5910": {
+    "name": "Palo Alto Networks Expedition Missing Authentication Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An attacker with network access to Expedition sends a request to its admin password-reset function, which performs no authentication check, resetting the admin password and gaining access to imported firewall configuration secrets and credentials.",
+      "privileges_required": "none (unauthenticated network access to Expedition)",
+      "complexity": "low — a single request to a missing-authentication function resets the admin password.",
+      "ai_factor": "Not AI-discovered — disclosed via Palo Alto Networks PSIRT; public exploitation analysis by Horizon3.ai. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Upgrade Expedition to 1.2.92+; restrict network access to the Expedition management interface to trusted administrative hosts only.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-11-07)",
+        "adequacy": "Patch alone doesn't rotate credentials already imported and potentially exposed prior to remediation; a credential-rotation step is also required."
+      },
+      "detection": {
+        "what_would_have_worked": "Alerting on admin password-reset events not initiated by a known administrator, and on Expedition logins from unfamiliar source IPs.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Effective only if Expedition's own audit logging is enabled and monitored, which is not default for a tool often treated as a one-off migration utility."
+      },
+      "response": {
+        "what_would_have_worked": "Rotate all credentials imported into Expedition (firewall admin accounts, API keys) and review firewall configuration-change history for unauthorized modifications.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Full remediation requires coordinated rotation across every downstream firewall Expedition had access to, not just the Expedition instance itself."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-IA-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Expedition's admin password-reset function lacked identification/authentication entirely; IA-2 controls assumed at the app layer were absent by design."
+      },
+      "NIS2-Art21-vulnerability-handling": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Expedition is itself security infrastructure whose compromise cascades to every firewall it manages, raising the bar beyond routine vulnerability-handling timelines."
+      }
+    }
+  },
+  "CVE-2024-51567": {
+    "name": "CyberPanel Incorrect Default Permissions Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unauthenticated attacker sends a crafted request to CyberPanel's /dataBases/upgrademysqlstatus endpoint, bypassing the method-only secMiddleware check and injecting shell metacharacters into the statusfile property to execute arbitrary commands as root; the PSAUX ransomware operation automated this against 22,000+ exposed instances.",
+      "privileges_required": "none (unauthenticated)",
+      "complexity": "low — one crafted request bypasses the method-only secMiddleware check and injects a shell-metacharacter payload; PSAUX operators fully automated it via ak47.py.",
+      "ai_factor": "Not AI-discovered — documented via independent researcher analysis and fixed by the CyberPanel maintainer. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Upgrade past the 5b08cd6 fix commit immediately; restrict CyberPanel's admin interface from public internet exposure.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-11-07)",
+        "adequacy": "Patch alone doesn't recover instances already ransomed before remediation; a decryptor or backup-restore path is separately required."
+      },
+      "detection": {
+        "what_would_have_worked": "Alerting on requests to /dataBases/upgrademysqlstatus containing shell metacharacters, and on unexpected process execution (ak47.py/actually.sh) from the CyberPanel web process.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Effective only where host-based EDR or web-server logging is deployed on the control-panel host, which many low-cost hosting deployments lack."
+      },
+      "response": {
+        "what_would_have_worked": "Isolate compromised hosts, use the LeakIX/Chocapikk decryption tool if the .psaux encryption weakness applies, and rebuild from clean backups otherwise.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "The decryption tool only works against the specific PSAUX encryption weakness; a robust backup strategy remains the reliable recovery path."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-AC-3": {
+        "covered": true,
+        "adequate": false,
+        "gap": "secMiddleware only validated the HTTP method (POST), not caller identity — an AC-3 access-enforcement gap at the exact function performing privileged database operations."
+      },
+      "UK-CAF-D1": {
+        "covered": true,
+        "adequate": false,
+        "gap": "CAF D1 response-and-recovery planning is what actually determined outcomes for the 22,000 compromised instances — patching alone doesn't undo an existing PSAUX ransomware infection."
+      }
+    }
+  },
+  "CVE-2024-43093": {
+    "name": "Android Framework Privilege Escalation Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "A malicious or compromised app on the device supplies a Unicode-normalized path to ExternalStorageProvider's shouldHideDocument() filter, bypassing the restricted-directory check to reach files it should not be able to access, escalating local privileges with user interaction required.",
+      "privileges_required": "low (a co-located app with minimal permissions)",
+      "complexity": "low technically, but requires getting a malicious or compromised app installed and user interaction — the real-world bar is social engineering or a spyware app, not exploit-development difficulty.",
+      "ai_factor": "Not AI-discovered — fixed via Google/AOSP internal security review; in-the-wild use surfaced by mobile-security researchers. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply the March 2025 Android Security Bulletin patch; restrict install sources to vetted app stores and use mobile threat-defense tooling to block known spyware implants.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-11-07)",
+        "adequacy": "Patch delivery depends on OEM/carrier update cadence, which frequently lags the AOSP fix by months for non-Pixel devices."
+      },
+      "detection": {
+        "what_would_have_worked": "Mobile EDR/threat-defense monitoring for anomalous content-provider access patterns and known spyware indicators.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Most consumer and even enterprise mobile fleets lack this level of on-device monitoring, which is why targeted campaigns went undetected for extended periods."
+      },
+      "response": {
+        "what_would_have_worked": "Forensic imaging of suspected-compromised devices, especially for high-risk individuals (journalists, activists), and coordination with mobile-security researchers for spyware identification.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Requires specialized forensic capability rarely available to the individuals most targeted by this class of campaign."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-CM-7": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Bypassing shouldHideDocument() grants an app filesystem reach beyond its declared, least-functionality scope inside the OS content-provider layer."
+      },
+      "AU-ISM-1546": {
+        "covered": true,
+        "adequate": false,
+        "gap": "The ISM's patch-timeframe control for extreme-risk vulnerabilities is difficult to meet given fragmented Android OEM patch-distribution timelines."
+      }
+    }
+  },
+  "CVE-2019-16278": {
+    "name": "Nostromo nhttpd Directory Traversal Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unauthenticated attacker sends a crafted HTTP request whose traversal sequence escapes the served directory inside the http_verify() authentication code path on a non-chrooted nhttpd instance, spawning a shell and achieving remote code execution.",
+      "privileges_required": "none (unauthenticated remote request)",
+      "complexity": "low — a single crafted HTTP request combining directory traversal with the server's authentication-check code path yields a shell.",
+      "ai_factor": "Not AI-discovered — publicly disclosed by independent researchers in 2019. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply the developer-confirmed patch or, given the project's largely unmaintained status, decommission and replace nhttpd with an actively supported web server.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-11-07)",
+        "adequacy": "Because the project is effectively abandoned, 'patch' in practice means migration off the software rather than an in-place update."
+      },
+      "detection": {
+        "what_would_have_worked": "Network IDS/IPS signatures for traversal sequences in HTTP requests to nhttpd, and outbound-connection monitoring for unexpected reverse shells from the web-server host.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Effective only where the host is inventoried and monitored at all; EOL software is frequently forgotten and excluded from monitoring scope."
+      },
+      "response": {
+        "what_would_have_worked": "Isolate the compromised host, rebuild from a known-clean image, and migrate off the unmaintained nhttpd software entirely.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Rebuilding without replacing the vulnerable software leaves the host re-exploitable."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-CM-7": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Least-functionality controls should have flagged an EOL, non-chrooted web server as prohibited software years before the 2024 KEV listing."
+      },
+      "UK-CAF-B4": {
+        "covered": true,
+        "adequate": false,
+        "gap": "CAF B4 secure configuration explicitly expects removal of unsupported internet-facing software; the real fix here is decommissioning, not patching."
+      }
+    }
+  },
+  "CVE-2024-8957": {
+    "name": "PTZOptics PT30X-SDI/NDI Cameras OS Command Injection Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An attacker who can reach the camera's CGI API (directly if authenticated, or unauthenticated by first chaining CVE-2024-8956's weak-authentication bypass) sets the ntp_addr configuration parameter to a value containing shell metacharacters, which execute as OS commands when the ntp_client service starts.",
+      "privileges_required": "high standalone (CVSS assumes authenticated access to the CGI API) — but effectively none when chained with CVE-2024-8956's authentication bypass, which is how it was exploited in the wild.",
+      "complexity": "low once chained — a single crafted request to /cgi-bin/param.cgi with a malicious ntp_addr value.",
+      "ai_factor": "AI-assisted discovery — GreyNoise's Sift LLM flagged anomalous honeypot traffic that led researchers to identify this OS command-injection chain paired with CVE-2024-8956. Defender-side AI discovery of in-the-wild exploitation; no evidence the attacker used AI to develop the exploit."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Update camera firmware to 6.3.40+; place NDI/PTZ camera management interfaces on an isolated management VLAN not reachable from the general network or internet.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-11-04)",
+        "adequacy": "Patch alone doesn't compensate for the broader class of exposed CGI configuration endpoints on IoT/NDI devices; network segmentation remains necessary."
+      },
+      "detection": {
+        "what_would_have_worked": "Anomaly-based network monitoring (of the kind GreyNoise's Sift provides) for unusual CGI request patterns against camera management interfaces, since no prior signature existed for this novel chain.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Most organizations lack anomaly-based detection at this depth for IoT device traffic; this discovery only happened because GreyNoise runs a large honeypot network with AI-assisted triage."
+      },
+      "response": {
+        "what_would_have_worked": "Isolate and factory-reset affected cameras, rotate any credentials exposed via CVE-2024-8956, and confirm firmware version post-recovery.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Effective assuming the organization has an inventory of deployed camera devices and firmware versions, which many conferencing/AV deployments lack."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-3": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Traditional signature-based malicious-traffic detection missed this novel 0-day chain entirely; only anomaly-based AI detection (GreyNoise Sift) caught it."
+      },
+      "AU-Essential-8-App-Hardening": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Essential Eight application-hardening guidance targets exactly this class of exposed CGI configuration endpoint on network video devices."
+      }
+    }
+  },
+  "CVE-2024-8956": {
+    "name": "PTZOptics PT30X-SDI/NDI Cameras Authentication Bypass Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unauthenticated remote attacker sends requests to the camera's /cgi-bin/param.cgi endpoint without an HTTP Authorization header; the CGI script fails to enforce authentication and returns or accepts configuration values including credentials.",
+      "privileges_required": "none (unauthenticated network access to the camera's CGI web interface)",
+      "complexity": "low — a single crafted HTTP request with no Authorization header is sufficient",
+      "ai_factor": "AI-assisted discovery — GreyNoise's internal LLM tool 'Sift' flagged the anomalous honeypot traffic that led researchers to the flaw. No AI involvement in in-the-wild exploitation is documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Firmware update to 6.3.40+ plus network segmentation keeping camera management interfaces off the open internet",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-11-04)",
+        "adequacy": "Patch alone is insufficient if cameras remain internet-reachable during the update rollout window across distributed industrial/gov/healthcare fleets."
+      },
+      "detection": {
+        "what_would_have_worked": "Alerting on unauthenticated requests to /cgi-bin/param.cgi and on config-file write activity outside maintenance windows",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Most camera deployments lack any logging/SIEM integration, so this detection path is rarely operationalized."
+      },
+      "response": {
+        "what_would_have_worked": "Rotate all camera credentials, isolate affected devices, and audit for unauthorized configuration changes",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Credential rotation is necessary because leaked hashes remain crackable after patching."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-IA-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "The device relies on the presence of an HTTP Authorization header rather than server-side session validation; simply omitting the header bypasses identification and authentication entirely."
+      }
+    }
+  },
+  "CVE-2024-37383": {
+    "name": "RoundCube Webmail Cross-Site Scripting (XSS) Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An attacker emails a victim an SVG element containing a crafted, whitespace-padded <animate> attribute; Roundcube's HTML sanitizer fails to strip the payload, so when the victim opens or previews the message, injected JavaScript executes in their authenticated session and can inject a fake login form to harvest credentials.",
+      "privileges_required": "none (unauthenticated attacker; only requires the target to view/preview the email)",
+      "complexity": "low — one crafted email, no additional interaction beyond normal message preview",
+      "ai_factor": "Not AI-discovered — reported via standard responsible disclosure to the Roundcube project. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Upgrade to 1.5.7/1.6.7+; email-gateway stripping of SVG animate/script-bearing content as a compensating control",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-10-24)",
+        "adequacy": "Patch is fully effective once deployed, but webmail upgrade cycles lag behind the observed phishing exploitation window."
+      },
+      "detection": {
+        "what_would_have_worked": "Email-gateway detection of SVG animate payloads and anomalous outbound POSTs following message preview",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Few mail gateways inspect SVG-embedded script vectors, so detection coverage was inconsistent during active exploitation."
+      },
+      "response": {
+        "what_would_have_worked": "Forced session/credential reset for users who previewed suspect messages; phishing-awareness notification",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Credential reset is necessary because the fake-login-form technique captures live credentials, not just session tokens."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-3": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Malicious-code/content filtering at the email gateway rarely sanitized SVG animate attributes, so the payload reached the webmail client unfiltered."
+      }
+    }
+  },
+  "CVE-2024-20481": {
+    "name": "Cisco ASA and FTD Denial-of-Service Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unauthenticated remote attacker sends a large number of VPN authentication requests to the RAVPN service, exhausting device resources and causing a denial of service that may require a device reload to fully restore.",
+      "privileges_required": "none (unauthenticated network access to the RAVPN listener)",
+      "complexity": "low — bulk authentication traffic is sufficient, no crafted exploit payload required",
+      "ai_factor": "Not AI-discovered — identified by Cisco PSIRT following Talos threat-intel observation. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply Cisco's fixed software release; rate-limit or geofence RAVPN authentication attempts",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-10-24)",
+        "adequacy": "No workaround existed pre-patch, so exposed devices remained vulnerable to resource-exhaustion DoS until upgraded."
+      },
+      "detection": {
+        "what_would_have_worked": "Monitoring RAVPN authentication-request rate and source-IP reputation (TOR/anonymizer feeds) for spikes",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Detection alone doesn't prevent the resource exhaustion once the request volume is underway."
+      },
+      "response": {
+        "what_would_have_worked": "Block anonymizer-sourced traffic at the perimeter and reload the affected device to restore RAVPN service",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Reload restores availability but doesn't address the underlying resource-exhaustion flaw without the patch."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SC-7": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Boundary protection assumed the RAVPN authentication path had rate-limiting; resource exhaustion from bulk auth requests bypassed standard perimeter controls."
+      }
+    }
+  },
+  "CVE-2024-47575": {
+    "name": "Fortinet FortiManager Missing Authentication Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unauthenticated remote attacker registers a rogue device against the fgfmd daemon using a crafted certificate/serial number, bypassing FGFM protocol authentication, then sends crafted management-protocol requests to execute arbitrary code or commands on the FortiManager server.",
+      "privileges_required": "none (unauthenticated network access to the fgfmd/FGFM listener)",
+      "complexity": "low — the missing authentication check accepts any crafted device-registration request",
+      "ai_factor": "Not AI-discovered — disclosed by Fortinet PSIRT following observed zero-day exploitation. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply the fixed FortiManager release or, pre-patch, enable fgfm-deny-unknown to block unrecognized device registration",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-10-23)",
+        "adequacy": "Because this was exploited as a zero-day, patching alone couldn't have prevented the earliest attacks — only the interim workaround or network isolation of the FGFM listener could."
+      },
+      "detection": {
+        "what_would_have_worked": "Alerting on new/unrecognized device registrations against fgfmd and unexpected FGFM connections from unmanaged source IPs",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Requires FortiManager-specific logging review most organizations don't baseline routinely."
+      },
+      "response": {
+        "what_would_have_worked": "Isolate FortiManager, audit all managed-device registrations, rotate credentials for every FortiGate under its management",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Full response scope is large because FortiManager compromise can extend to every managed FortiGate device."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-IA-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "fgfmd accepted device-registration requests presenting a self-signed certificate/serial number without verifying prior trust establishment, defeating device-level authentication entirely."
+      }
+    }
+  },
+  "CVE-2024-38094": {
+    "name": "Microsoft SharePoint Deserialization Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An attacker holding Site Owner-level SharePoint permissions (often obtained via a previously compromised privileged account) submits a crafted request that triggers unsafe .NET deserialization in a SharePoint API endpoint, achieving remote code execution and, in observed incidents, planting a webshell for persistence.",
+      "privileges_required": "low-to-high (requires Site Owner-level SharePoint permissions, typically obtained through a prior account compromise)",
+      "complexity": "low once the required SharePoint privilege level is held — a publicly disclosed PoC exists",
+      "ai_factor": "Not AI-discovered — fixed via Microsoft's standard Patch Tuesday process. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply the July 2024 SharePoint security update; enforce least-privilege so service accounts don't hold unnecessary Site Owner rights",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-10-22)",
+        "adequacy": "Patch alone is insufficient without also revoking excess Site Owner privileges from the account used in the observed chain."
+      },
+      "detection": {
+        "what_would_have_worked": "EDR alerting on w3wp.exe spawning shells and file-integrity monitoring on SharePoint web-application directories for new .aspx files",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "The documented intrusion evaded detection for two weeks, indicating existing monitoring wasn't tuned for this webshell pattern."
+      },
+      "response": {
+        "what_would_have_worked": "Isolate the compromised server, remove the webshell, rotate the compromised privileged account's credentials, and hunt for lateral movement (e.g., Impacket usage)",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Full remediation requires addressing both the SharePoint RCE and the upstream domain-admin account compromise that enabled it."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-AC-6": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Least-privilege wasn't enforced in the documented intrusion — an over-privileged (domain admin) service account reached the vulnerable Site-Owner-level endpoint."
+      }
+    }
+  },
+  "CVE-2024-9537": {
+    "name": "ScienceLogic SL1 Unspecified Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An attacker exploits an unspecified remote code execution flaw in a third-party utility bundled with ScienceLogic SL1 to gain unauthorized access to the monitoring platform, in the observed case disrupting monitoring-graph availability and reading customer account/device data.",
+      "privileges_required": "none documented publicly (CVSS vector indicates unauthenticated network exploitation)",
+      "complexity": "unknown / low per CVSS AC:L, though the vulnerable component's identity remains undisclosed by the vendor",
+      "ai_factor": "Not AI-discovered — identified jointly by Rackspace and ScienceLogic during incident investigation. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply the fixed SL1 releases (12.1.3+/12.2.3+/12.3+ or the backported 10.x-11.x remediations)",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-10-21)",
+        "adequacy": "Patching couldn't have prevented the original zero-day exploitation since the flaw was unknown to the vendor at the time of attack."
+      },
+      "detection": {
+        "what_would_have_worked": "Monitoring SL1 portal availability and data-access patterns for anomalies inconsistent with normal monitoring-graph usage",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "The compromise was only noticed via a customer-visible service disruption, indicating detection coverage was reactive rather than proactive."
+      },
+      "response": {
+        "what_would_have_worked": "Joint vendor/customer incident response, credential rotation for exposed accounts, and customer notification",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Because encrypted internal credentials were exposed, rotation is necessary even though the encryption may mitigate immediate reuse risk."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-CM-7": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Component-inventory and least-functionality practices didn't flag an unreviewed bundled third-party utility as an independent attack surface within SL1."
+      }
+    }
+  },
+  "CVE-2024-40711": {
+    "name": "Veeam Backup and Replication Deserialization Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An attacker who has gained network access (commonly via compromised VPN credentials) sends a crafted request to the Veeam.Backup.MountService on TCP/8000 that triggers deserialization of untrusted .NET objects, achieving remote code execution on the backup server; ransomware affiliates chained this with local-account creation and rclone-based exfiltration before deploying ransomware.",
+      "privileges_required": "none-to-low against the Veeam service itself, though observed campaigns first used compromised VPN credentials for network access",
+      "complexity": "low — a public exploit chain exists and was rapidly weaponized by multiple ransomware affiliates",
+      "ai_factor": "Not AI-discovered — reported via responsible disclosure by watchTowr Labs. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply Veeam 12.2+; restrict network reachability of the Veeam backend service to trusted management hosts only",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-10-17)",
+        "adequacy": "Patch is fully effective, but backup infrastructure is frequently deprioritized in patch cadence relative to internet-facing systems, despite being a prime ransomware target."
+      },
+      "detection": {
+        "what_would_have_worked": "Alerting on Veeam.Backup.MountService.exe spawning shell processes, new local-admin account creation, and rclone execution",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Detection is effective if EDR is deployed on the backup server itself, which is sometimes excluded from standard endpoint tooling."
+      },
+      "response": {
+        "what_would_have_worked": "Isolate the Veeam server, remove the rogue local account, rotate all backup-service credentials, and verify backup integrity before any restore",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Full response must also address the initial VPN-credential compromise that gave the attacker network access in the first place."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-AC-6": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Backup servers are frequently granted broad domain-trust/administrative reach; least-privilege segmentation wasn't enforced, letting a single RCE cascade into domain and backup-destruction access."
+      }
+    }
+  },
+  "CVE-2024-9680": {
+    "name": "Mozilla Firefox Use-After-Free Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "A crafted web page triggers a use-after-free in Firefox's Animation timeline handling inside the content process; RomCom operators chained this with a separate Windows Task Scheduler privilege-escalation zero-day (CVE-2024-49039) so a mere page visit resulted in sandbox-escaped code execution and silent backdoor install.",
+      "privileges_required": "none (unauthenticated remote attacker; victim only needs to browse to the malicious page)",
+      "complexity": "low for the victim (zero-click after landing on the page) but high for the attacker to develop — a genuine content-process UAF plus a kernel/OS sandbox-escape zero-day chained together",
+      "ai_factor": "Not AI-discovered — found and reported by ESET researchers tracking the RomCom threat actor. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Emergency patch to Firefox 131.0.2/ESR within the vendor's ~24-hour turnaround, plus site-isolation/sandbox hardening as defense-in-depth against the paired OS-level escape",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-10-15)",
+        "adequacy": "Patch-only prevention is insufficient against a zero-day actively exploited before public disclosure; sandbox integrity depends on a second, independently-patched OS flaw"
+      },
+      "detection": {
+        "what_would_have_worked": "EDR alerting on content-process crash immediately followed by privileged process creation with no user interaction, and outbound connections to newly-registered exploit-hosting domains",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "No prior signature existed for a first-seen exploit chain; behavioral detection of the crash-then-escalate pattern is the only viable signal"
+      },
+      "response": {
+        "what_would_have_worked": "Endpoint isolation and backdoor-artifact hunting (RomCom implant indicators) for any host that browsed flagged domains in the exposure window",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Incident response for a zero-click chain requires retroactive browsing-history correlation since the victim has no visible compromise indicator"
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Standard flaw-remediation SLAs assume disclosed vulnerabilities, not zero-days actively weaponized in a drive-by chain before a patch exists."
+      },
+      "UK-CAF-B4": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Security monitoring tuned to known-bad indicators misses a first-seen exploit chain with no prior signature."
+      }
+    }
+  },
+  "CVE-2024-30088": {
+    "name": "Microsoft Windows Kernel TOCTOU Race Condition Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "A local attacker who already has code execution wins a timing race in the Windows kernel's NtQueryInformationToken handling — the token is validated (check) and then used after it may have changed (use) — to escalate from a standard user to SYSTEM; APT34 leveraged this for post-compromise privilege escalation.",
+      "privileges_required": "low (requires existing local code execution as a standard user)",
+      "complexity": "high — reliably winning a kernel-level timing race requires exploit engineering, though public PoCs have since automated it",
+      "ai_factor": "Not AI-discovered — reported through Microsoft's standard channel; exploitation attributed to APT34 (OilRig). No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "June 2024 cumulative update deployed within CISA's KEV remediation window, combined with reboot-enforced patch compliance for kernel updates",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-10-15)",
+        "adequacy": "Patch alone doesn't address the four-month gap between fix availability (June) and confirmed active nation-state exploitation reported later — organizations that deferred the reboot remained exposed"
+      },
+      "detection": {
+        "what_would_have_worked": "EDR rules for anomalous SYSTEM-level token/privilege changes on hosts with no corresponding legitimate elevation event",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Requires kernel-level telemetry most EDR agents don't expose by default, so most environments have no native detection for this class of race condition"
+      },
+      "response": {
+        "what_would_have_worked": "Isolate and forensically image any host showing unexplained SYSTEM-privilege processes; hunt for OilRig TTPs (webshells, credential dumping tools) post-escalation",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Local privilege escalation is typically a late-stage indicator, meaning initial access already succeeded by the time this is detected"
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Patch-SLA windows (typically 30 days for high severity) exceed the observed exploitation timeline; this flaw was already being used by a nation-state actor before the CISA KEV due date."
+      },
+      "AU-Essential-8-Patch": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Patch Operating Systems (48-hour extreme-risk target) is frequently missed for kernel updates that require coordinated reboot scheduling."
+      }
+    }
+  },
+  "CVE-2024-28987": {
+    "name": "SolarWinds Web Help Desk Hardcoded Credential Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "SolarWinds Web Help Desk ships with a developer login credential hardcoded directly into application code rather than pulled from configuration; any remote attacker who knows the credential (recovered via decompilation, as Horizon3.ai did) can authenticate and read or modify all help-desk ticket data, including tickets carrying reset passwords.",
+      "privileges_required": "none (unauthenticated remote attacker armed with the recovered hardcoded credential)",
+      "complexity": "low — the credential is static and reusable across every unpatched deployment; a public PoC automates the whole flow",
+      "ai_factor": "Not AI-discovered — found by Horizon3.ai human researchers during manual code analysis. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply the 12.8.3 Hotfix 2 patch that removes the hardcoded credential path, plus network-level restriction of WHD admin interfaces to trusted internal ranges",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-10-15)",
+        "adequacy": "Patching removes the specific credential, but any product architecture that embeds authentication material in shipped code needs a supply-chain-level control, not just a point patch"
+      },
+      "detection": {
+        "what_would_have_worked": "Alert on WHD authentication events tied to the internal developer account class, and on bulk ticket API access with no prior session context",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Most WHD deployments don't log at the granularity needed to distinguish the hardcoded developer login from legitimate admin activity"
+      },
+      "response": {
+        "what_would_have_worked": "Rotate every credential that ever appeared in a WHD ticket (password resets, shared service accounts) and audit ticket access logs for the exposure window",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Because ticket data itself often contains secrets, response requires a full credential-rotation sweep, not just patching the application"
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-IA-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Identification and authentication requirements are bypassed entirely by a credential the vendor embedded in the product itself, outside any operator-managed identity control."
+      },
+      "NIST-800-63B-rev4": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Authenticator-management guidance assumes operator-issued credentials that can be rotated; a compiled-in credential cannot be rotated by the operator at all."
+      }
+    }
+  },
+  "CVE-2024-9380": {
+    "name": "Ivanti Cloud Services Appliance (CSA) OS Command Injection Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An attacker with admin access to the Ivanti CSA administrative web console — obtained directly or by chaining a separate CSA authentication-bypass flaw — injects OS commands through the console that are passed unsanitized to the underlying operating system, yielding full remote code execution on the appliance.",
+      "privileges_required": "high on paper (authenticated admin), but low in practice once chained with the paired CSA auth-bypass vulnerability used in the same campaign",
+      "complexity": "low — CISA/FBI documented threat actors chaining this reliably as part of a repeatable multi-CVE intrusion set",
+      "ai_factor": "Not AI-discovered — surfaced by Ivanti during incident response on compromised CSA 4.6 customers. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Upgrade to CSA 5.0.2+ and decommission the end-of-life CSA 4.6.x branch entirely, since no patch exists for it",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-10-09)",
+        "adequacy": "Patching alone is insufficient for the EOL 4.6.x branch — the compliant action is full decommission, which many affected organizations had not completed"
+      },
+      "detection": {
+        "what_would_have_worked": "Monitor CSA admin-console access and outbound traffic for webshell-drop and chained-exploitation patterns described in CISA/FBI AA25-022a",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Appliance-level logging on CSA is limited, and the chained multi-CVE attack path wasn't publicly documented until the joint advisory"
+      },
+      "response": {
+        "what_would_have_worked": "Isolate the appliance, hunt for implanted webshells and harvested credentials, and rotate all credentials the CSA appliance had access to",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Because the chain grants full RCE, response must assume complete appliance compromise and treat any credentials it held as burned"
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "CSA 4.6.x is past end-of-life with no vendor patch available for this branch, so flaw-remediation controls have no compliant remediation path short of migration."
+      },
+      "AU-Essential-8-Patch": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Patch Applications guidance assumes a supported product; CSA 4.6.x's EOL status means the compliant action is decommission, not patch."
+      }
+    }
+  },
+  "CVE-2024-9379": {
+    "name": "Ivanti Cloud Services Appliance (CSA) SQL Injection Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An attacker with admin access to the Ivanti CSA administrative web console — obtained directly or by chaining a separate CSA authentication-bypass flaw — injects arbitrary SQL statements through the console, allowing extraction or modification of appliance database contents including stored credentials.",
+      "privileges_required": "high on paper (authenticated admin), but low in practice once chained with the paired CSA auth-bypass vulnerability used in the same campaign",
+      "complexity": "low — CISA/FBI documented threat actors chaining this reliably alongside CVE-2024-9380 in a repeatable multi-CVE intrusion set",
+      "ai_factor": "Not AI-discovered — surfaced by Ivanti during incident response on compromised CSA 4.6 customers. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Upgrade to CSA 5.0.2+ and decommission the end-of-life CSA 4.6.x branch entirely, since no patch exists for it",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-10-09)",
+        "adequacy": "Patching alone is insufficient for the EOL 4.6.x branch — the compliant action is full decommission"
+      },
+      "detection": {
+        "what_would_have_worked": "Database-layer query monitoring on the CSA appliance for injection patterns correlated with admin-console access from unexpected sources",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Appliance-level database logging is limited by design, and the chained attack path wasn't publicly documented until the joint CISA/FBI advisory"
+      },
+      "response": {
+        "what_would_have_worked": "Assume database contents (including stored credentials) are compromised, rotate them, and hunt for the same threat-actor TTPs described in AA25-022a",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "SQL injection against a credential-storing appliance requires a full credential-rotation response, not just patching"
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "CSA 4.6.x is past end-of-life with no vendor patch available, leaving no compliant remediation path other than decommission."
+      },
+      "PCI-DSS-4.0-6.3.3": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Public-facing application patching requirements don't cover an appliance whose vulnerable branch has no vendor-supplied fix."
+      }
+    }
+  },
+  "CVE-2024-23113": {
+    "name": "Fortinet Multiple Products Format String Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unauthenticated attacker sends crafted packets to the FGFM (FortiGate-to-FortiManager) management service on TCP/541 that contain externally-controlled format-string specifiers, corrupting memory in the fgfmd daemon to achieve remote code execution or crash the service.",
+      "privileges_required": "none (unauthenticated remote attacker on the FGFM management port)",
+      "complexity": "low — multiple public PoCs and nuclei detection templates exist, and FortiGuard confirmed real-world exploitation",
+      "ai_factor": "Not AI-discovered — reported and disclosed through Fortinet PSIRT, with independent research from watchtowr Labs. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Upgrade to FortiOS 7.0.14/7.2.7/7.4.3 or later, or restrict/disable FGFM access from untrusted interfaces as an interim compensating control",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-10-09)",
+        "adequacy": "Patch-SLA timelines for appliance firmware are slower than the observed exploitation window; the interim FGFM-disable workaround is necessary but often skipped since it's not the default guidance"
+      },
+      "detection": {
+        "what_would_have_worked": "Monitor for FGFM (TCP/541) connections from unrecognized peers and for fgfmd crash/restart events indicating exploitation attempts",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Appliance management-plane logging is often excluded from SIEM ingestion, leaving this traffic under-monitored relative to data-plane firewall logs"
+      },
+      "response": {
+        "what_would_have_worked": "Isolate the affected FortiGate/FortiProxy device, assume full compromise of stored credentials and configuration, and rebuild from a known-good firmware image",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Because this is unauthenticated preauth RCE on the management plane, response must assume complete device takeover rather than partial compromise"
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SC-7": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Boundary-protection assumptions fail when the vulnerable service (FGFM) is itself part of the management/boundary plane and reachable without authentication."
+      },
+      "AU-Essential-8-Patch": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Patch Applications extreme-risk timelines (48 hours) are routinely missed for appliance firmware requiring scheduled maintenance windows."
+      }
+    }
+  },
+  "CVE-2024-43573": {
+    "name": "Microsoft Windows MSHTML Platform Spoofing Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An attacker convinces a victim to open a crafted file that abuses the Windows MSHTML platform to spoof its true content/rendering context, following the same technique family Void Banshee used with CVE-2024-38112/CVE-2024-43461 to disguise malware droppers as benign documents and deliver the Atlantida infostealer.",
+      "privileges_required": "none (unauthenticated remote attacker; requires the victim to open a malicious file)",
+      "complexity": "low — the technique is a refinement of a previously-abused MSHTML spoofing pattern with an established delivery playbook",
+      "ai_factor": "Not AI-discovered — disclosed through Microsoft's standard security-update process. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply the October 2024 cumulative update, plus disabling/restricting the legacy MSHTML/Internet Explorer rendering engine where not business-required",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-10-08)",
+        "adequacy": "Patching this single CVE doesn't retire the broader legacy-MSHTML attack surface that has now produced three related spoofing CVEs abused by the same threat actor"
+      },
+      "detection": {
+        "what_would_have_worked": "Detect execution of the deprecated MSHTML/IE rendering engine triggered by non-browser file types, and flag infostealer-consistent network activity post-execution",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Most environments don't specifically monitor for legacy-engine invocation, since it's expected to be effectively unused"
+      },
+      "response": {
+        "what_would_have_worked": "Assume infostealer compromise (credential theft) on any host that opened a flagged file; rotate credentials and hunt for Atlantida-stealer indicators",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Because the payload is an infostealer, response must include full credential rotation, not just malware removal"
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-3": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Malicious-code protection tuned to known file signatures misses a spoofing technique whose payload is only revealed after the deprecated MSHTML engine renders it deceptively."
+      },
+      "AU-Essential-8-App-Hardening": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Application hardening that doesn't disable/restrict the legacy MSHTML engine leaves this repeatedly-abused spoofing surface exposed."
+      }
+    }
+  },
+  "CVE-2024-43572": {
+    "name": "Microsoft Windows Management Console Remote Code Execution Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An attacker crafts a malicious .msc console file referencing a vulnerable ActiveX control (apds.dll) via the file's StringTable section, smuggling in an old XSS flaw that executes arbitrary JScript inside mmc.exe when the victim opens the file — the 'GrimResource' technique.",
+      "privileges_required": "none (unauthenticated delivery); requires the victim to open the malicious .msc file",
+      "complexity": "low — the technique was fully documented publicly and a crafted file requires no further victim interaction beyond opening it",
+      "ai_factor": "Not AI-discovered — found and disclosed by Elastic Security Labs threat researchers. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "October 2024 Windows security update plus blocking/quarantining .msc file attachments at the email/web gateway",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-10-08)",
+        "adequacy": "Patch alone doesn't help against the roughly four-month zero-day window before the fix shipped; file-type blocking at the perimeter was the only viable interim control."
+      },
+      "detection": {
+        "what_would_have_worked": "EDR alerting on mmc.exe spawning script hosts or unexpected child processes, and detonation-sandbox inspection of unsolicited .msc attachments",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Behavioral detection of anomalous mmc.exe activity was the primary way defenders caught this before Microsoft's fix."
+      },
+      "response": {
+        "what_would_have_worked": "Isolate the host, hunt for GrimResource-pattern .msc samples across the fleet, and rotate any credentials cached on the affected endpoint",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Because initial access frequently led to stealer payloads, credential rotation is a necessary post-incident step, not merely host cleanup."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-CM-7": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Least-functionality/least-privilege baselines rarely block execution of attacker-supplied .msc files by default prior to this patch — MMC did not treat untrusted console files as high-risk content."
+      }
+    }
+  },
+  "CVE-2024-43047": {
+    "name": "Qualcomm Multiple Chipsets Use-After-Free Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "A use-after-free in Qualcomm DSP Services mismanaging HLOS memory maps is exploited locally on an Android device for privilege escalation, chained after physical/forensic-tool access (e.g. Cellebrite UFED) to install spyware.",
+      "privileges_required": "low (local code execution with limited privileges required as a starting point)",
+      "complexity": "high — requires a working local exploit chain and, in observed cases, prior physical device access via forensic-extraction tooling",
+      "ai_factor": "Not AI-discovered — found by Seth Jenkins (Google Project Zero) and Conghui Wang (Amnesty International Security Lab). No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply the October 2024 Qualcomm-based OEM security update as soon as available; restrict physical custody/forensic access to devices issued to high-risk personnel",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-10-08)",
+        "adequacy": "OEM patch propagation lag for Android chipset firmware routinely runs months behind the Qualcomm bulletin, leaving high-risk users exposed regardless of policy."
+      },
+      "detection": {
+        "what_would_have_worked": "Mobile threat-detection tooling (e.g. Mobile Verification Toolkit) scanning for known spyware artifacts and anomalous DSP-service crash logs",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Detection tools for this class of spyware exist but are not standard endpoint-protection coverage for most organizations."
+      },
+      "response": {
+        "what_would_have_worked": "Forensic imaging and analysis (Amnesty/Citizen Lab-style) of any device with unexplained custody gaps, followed by full factory reset and credential rotation",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Only specialized digital-forensics response, not routine IR, reliably confirms and remediates this class of compromise."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "OEM/carrier patch propagation for Android chipset firmware routinely lags the Qualcomm bulletin by months, leaving a long exploitation window for exactly this class of targeted attack."
+      }
+    }
+  },
+  "CVE-2024-45519": {
+    "name": "Synacor Zimbra Collaboration Suite (ZCS) Command Execution Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "Zimbra's postjournal service parses SMTP CC-header content and executes base64-decoded shell commands via `sh` without authentication, letting attackers send a crafted email to drop a webshell on the mail server.",
+      "privileges_required": "none (unauthenticated, remote via crafted SMTP traffic)",
+      "complexity": "low — public PoC exists and mass-exploitation followed within days of disclosure",
+      "ai_factor": "Not AI-discovered — vulnerability and PoC published by the ProjectDiscovery research team; mass-exploitation tracked by Proofpoint. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply the 2024-09-04 Zimbra patches (8.8.15p46 / 9.0.0p41 / 10.0.9 / 10.1.1) before the 2024-09-28 mass-exploitation wave began",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-10-03)",
+        "adequacy": "A roughly 3.5-week gap between patch and mass exploitation was enough time to patch, but most self-hosted deployments missed it; perimeter mail filtering was the only compensating control."
+      },
+      "detection": {
+        "what_would_have_worked": "Mail-gateway inspection for base64-blob CC headers and file-integrity monitoring on the Zimbra webapp directories for unexpected .jsp files",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Most Zimbra deployments lack file-integrity monitoring on webapp directories, so webshell drops went undetected until active abuse."
+      },
+      "response": {
+        "what_would_have_worked": "Isolate the mail server, hunt for unauthorized .jsp files under the Zimbra webapp tree, and rotate all mailbox and admin credentials",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Because postjournal runs with mailbox-server privileges, a full credential rotation and mailbox-access audit is required, not just webshell removal."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Zimbra's official fix shipped 2024-09-04 but mass exploitation began 2024-09-28 — a roughly 3.5-week patch window closed by attackers well before most self-hosted deployments applied it."
+      }
+    }
+  },
+  "CVE-2024-29824": {
+    "name": "Ivanti Endpoint Manager (EPM) SQL Injection Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unauthenticated attacker on the same network sends a crafted goodApp.md5 value to the EPM Core server's /WSStatusEvents/EventHandler endpoint, exploiting SQL injection in RecordGoodApp (PatchBiz.dll) to reach xp_cmdshell and execute arbitrary commands.",
+      "privileges_required": "none (unauthenticated, but requires network adjacency to the EPM Core server)",
+      "complexity": "low — a public working PoC blindly automates the injection-to-RCE chain",
+      "ai_factor": "Not AI-discovered — reported via Trend Micro's Zero Day Initiative by an anonymous researcher; public deep-dive and PoC by Horizon3.ai. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply Ivanti's May 2024 EPM patch and segment EPM Core servers away from general user/endpoint network segments",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-10-02)",
+        "adequacy": "Patch availability alone did not stop exploitation; network segmentation limiting who can reach the EPM Core server on the adjacent network was the necessary compensating control."
+      },
+      "detection": {
+        "what_would_have_worked": "Database-activity monitoring for xp_cmdshell invocations and WAF/IDS signatures on the /WSStatusEvents/EventHandler endpoint",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Few EPM deployments monitor xp_cmdshell usage, so exploitation typically surfaced only after follow-on lateral movement was noticed."
+      },
+      "response": {
+        "what_would_have_worked": "Isolate the EPM Core server, audit for newly created accounts/scheduled tasks pushed via EPM's endpoint-management channel, and rotate the SQL service account credentials",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Because EPM has privileged reach into every managed endpoint, response must include auditing all managed clients for pushed payloads, not just the Core server itself."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Ivanti's fix shipped in May 2024 but active exploitation was still being observed and added to KEV in October 2024 — a five-month unpatched-fleet exposure window well beyond a reasonable SLA."
+      }
+    }
+  },
+  "CVE-2023-25280": {
+    "name": "D-Link DIR-820 Router OS Command Injection Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "A remote, unauthenticated attacker sends a crafted request to the router's ping.ccp CGI handler with shell metacharacters embedded in the ping_addr parameter, achieving root command execution.",
+      "privileges_required": "none (unauthenticated, remote)",
+      "complexity": "low — a public GitHub PoC directly demonstrates the injection",
+      "ai_factor": "Not AI-discovered — publicly disclosed by an independent researcher via a GitHub proof-of-concept. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "No vendor patch exists; the only real prevention is decommissioning/replacing the end-of-life router",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-09-30)",
+        "adequacy": "CISA's own required action for this entry is 'discontinue use' rather than patch — the device cannot be secured in place."
+      },
+      "detection": {
+        "what_would_have_worked": "Network-edge IDS signatures for shell-metacharacter payloads in ping_addr/CGI requests to consumer router management interfaces",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Home/small-office networks running EoL routers typically have no IDS coverage at all, so this class of attack usually goes undetected until the device joins a botnet."
+      },
+      "response": {
+        "what_would_have_worked": "Factory-reset and replace the device; if replacement isn't immediate, isolate it from the internet-facing interface",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Because there is no patch, 'response' here is really decommissioning — any factory reset without replacement leaves the same exploitable firmware in place."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "The product is end-of-life with no vendor patch — flaw remediation as a control is structurally unavailable, and CISA's required action is decommissioning rather than patching."
+      }
+    }
+  },
+  "CVE-2020-15415": {
+    "name": "DrayTek Multiple Vigor Routers OS Command Injection Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unauthenticated remote attacker uploads a crafted configuration file with shell metacharacters in the filename to cgi-bin/mainfunction.cgi/cvmcfgupload using a text/x-python-script content type, achieving command execution as root.",
+      "privileges_required": "none (unauthenticated, remote)",
+      "complexity": "low — a public GitHub PoC directly demonstrates the injection",
+      "ai_factor": "Not AI-discovered — publicly disclosed by the CLP-team researcher group. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply DrayTek firmware 1.5.1 or later and disable/restrict WAN-facing access to the router's administrative CGI endpoints",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-09-30)",
+        "adequacy": "The fix has existed since 2020; four years later devices are still being exploited, showing patch availability without enforcement is insufficient."
+      },
+      "detection": {
+        "what_would_have_worked": "Edge IDS/IPS signatures for text/x-python-script uploads with shell metacharacters to cvmcfgupload, and outbound-connection monitoring for botnet C2 beaconing from router management IPs",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "SMB deployments running these routers rarely monitor router-originated outbound traffic, so compromise is usually detected only via downstream abuse (e.g. spam, DDoS participation)."
+      },
+      "response": {
+        "what_would_have_worked": "Factory-reset and re-flash to the patched firmware, then restrict the administrative interface to a trusted management VLAN",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Simply patching without restricting WAN exposure to the CGI endpoint leaves the device reachable for the next command-injection variant."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "The vendor fix has existed since 2020, yet KEV addition in 2024 shows a four-year unpatched-device population still being actively targeted — patch-management enforcement, not availability, is the gap."
+      }
+    }
+  },
+  "CVE-2019-0344": {
+    "name": "SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "SAP Commerce Cloud's virtualjdbc extension exposes Java serialization over HTTP/RMI/JMXMP; an attacker sends a crafted gadget-chain serialized payload directly to the exposed listener to achieve remote code execution as the 'Hybris' OS user.",
+      "privileges_required": "none (unauthenticated, remote, network access to the exposed listener)",
+      "complexity": "low — generic ysoserial-style gadget chains work without protocol-specific knowledge",
+      "ai_factor": "Not AI-discovered — disclosed and patched by SAP's Product Security Response Team in 2019. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply SAP Security Note 2786035 (2019) and firewall the virtualjdbc/JMXMP listener from any untrusted network",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-09-30)",
+        "adequacy": "A patch has existed since 2019; five years later CISA still found active exploitation, showing patch availability alone does not close long-tail exposure in legacy e-commerce deployments."
+      },
+      "detection": {
+        "what_would_have_worked": "Network monitoring for Java-serialized payloads on the virtualjdbc/JMXMP port and application-layer WAF rules blocking raw Java object streams",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Legacy SAP Commerce deployments rarely have deserialization-aware WAF rules, so exploitation of this five-year-old flaw can still go unnoticed."
+      },
+      "response": {
+        "what_would_have_worked": "Isolate the Commerce Cloud instance, audit for webshells/scheduled tasks planted via the deserialization RCE, and rotate all Hybris service-account and database credentials",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Because the 'Hybris' OS account typically has broad application-server privileges, response must assume full application compromise, not just the initial RCE foothold."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "SAP shipped a fix in 2019, but KEV addition in 2024 shows five years of unpatched exposure among internet-facing instances — patch-SLA enforcement failed long-term, not just at disclosure."
+      }
+    }
+  },
+  "CVE-2024-7593": {
+    "name": "Ivanti Virtual Traffic Manager Authentication Bypass Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unauthenticated attacker exploits a flaw in vTM's authentication algorithm to bypass the admin-panel login entirely and POST a crafted user-creation request, planting a rogue administrator account they then use to log in with full admin privileges.",
+      "privileges_required": "none (unauthenticated attacker reaching the vTM admin management interface)",
+      "complexity": "low — a public PoC script automates the entire bypass-and-account-creation flow",
+      "ai_factor": "Not AI-discovered — reported through Ivanti's own security disclosure process. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Patching to 22.2R1/22.3R3/22.5R2/22.6R2/22.7R2 or later, plus removing the vTM admin panel from direct public-internet exposure (VPN-only/management-network access)",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-09-24)",
+        "adequacy": "Patch alone is insufficient without also restricting network reachability of the admin panel — the underlying design let any reachable unauthenticated client attempt the bypass"
+      },
+      "detection": {
+        "what_would_have_worked": "Alerting on new local-admin account creation events on the vTM appliance and on unauthenticated POST traffic to the LocalUsers management endpoint",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Most organizations don't forward vTM management-plane audit logs to a SIEM, so the rogue-account creation event is invisible until the attacker logs in and acts"
+      },
+      "response": {
+        "what_would_have_worked": "Auditing and removing unauthorized local admin accounts, rotating all vTM credentials, and reviewing TrafficScript rules for attacker-planted changes after any suspected compromise",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Because the attacker ends up with legitimate-looking admin credentials, standard login-anomaly detection may miss the intrusion unless account-creation events are specifically audited"
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-IA-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "IA-2 assumes the identification/authentication mechanism itself is sound; CVE-2024-7593 is a flaw IN the authentication algorithm, so identity verification is bypassed regardless of IA-2 policy configuration."
+      }
+    }
+  },
+  "CVE-2024-8963": {
+    "name": "Ivanti Cloud Services Appliance (CSA) Path Traversal Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unauthenticated attacker sends a specially-encoded URL (a %3F-encoded path segment) against the CSA broker web server, exploiting inconsistent URL-decoding order between the broker and PHP CGI to reach restricted administrative scripts; chained with CVE-2024-8190 this yields authenticated command execution and webshell deployment.",
+      "privileges_required": "none (unauthenticated attacker reaching the CSA broker web interface)",
+      "complexity": "low — the exact bypass URL pattern is publicly documented and has been independently reproduced by multiple security vendors",
+      "ai_factor": "Not AI-discovered — identified and disclosed by Ivanti through its own security research/PSIRT process. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Upgrading to CSA 4.6 Patch 519 or later, or migrating off the End-of-Life CSA 4.6.x line entirely to the supported 5.0.x line",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-09-19)",
+        "adequacy": "Ivanti itself states CSA 4.6.x is EOL and unlikely to receive further security updates, so 'patch' is a dead end for organizations still on that branch — the only durable fix is migration"
+      },
+      "detection": {
+        "what_would_have_worked": "Monitoring CSA broker web-server access logs for %3F-encoded or otherwise anomalous URL paths, and file-integrity monitoring on /gsb/ and /client/ for unexpected PHP files",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "The URL-encoding trick evades naive traversal detection (no literal '../' sequence), so signature-based WAF rules tuned only for classic traversal strings will miss it"
+      },
+      "response": {
+        "what_would_have_worked": "Isolating the appliance, hunting for the documented webshell filenames and C2 infrastructure, and treating any CSA 4.6.x instance that was internet-facing during the exploitation window as compromised",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Because attribution points to sophisticated (suspected nation-state) actors using custom implants, standard antivirus/EDR signatures on the appliance itself are unlikely to catch the intrusion"
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SC-7": {
+        "covered": true,
+        "adequate": false,
+        "gap": "SC-7 boundary protection assumes the appliance correctly parses and enforces path restrictions at its network edge; the URL-decoding-order bug let attackers smuggle traversal past the boundary parser entirely."
+      },
+      "NIS2-Art21-vulnerability-handling": {
+        "covered": true,
+        "adequate": false,
+        "gap": "NIS2 vulnerability-handling expects prompt remediation, but Ivanti CSA 4.6 was already flagged End-of-Life when the flaw was disclosed, leaving organizations with no vendor-supported patch path other than full migration."
+      }
+    }
   }
 }