@blamejs/exceptd-skills 0.18.22 → 0.18.23

package/data/zeroday-lessons.json

@@ -17,7 +17,7 @@
       "rebuild_after_days": 365,
       "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
     },
-    "entry_count": 619
+    "entry_count": 719
   },
   "CVE-2026-31431": {
     "name": "Copy Fail",
@@ -33858,5 +33858,3705 @@
         "gap": "NIS2 vulnerability-handling expects prompt remediation, but Ivanti CSA 4.6 was already flagged End-of-Life when the flaw was disclosed, leaving organizations with no vendor-supported patch path other than full migration."
       }
     }
+  },
+  "CVE-2026-58644": {
+    "name": "Microsoft SharePoint Deserialization of Untrusted Data Vulnerability (CVE-2026-58644)",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unauthenticated attacker sends a crafted serialized .NET payload to an internet-facing SharePoint endpoint; unsafe deserialization triggers a gadget chain that executes attacker code as the SharePoint service account, typically followed by a web-shell drop.",
+      "privileges_required": "none (unauthenticated network attacker)",
+      "complexity": "low — network-reachable, no authentication and no user interaction required per the CVSS vector.",
+      "ai_factor": "Not AI-discovered — coordinated disclosure via Microsoft MSRC. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply the MSRC security update immediately, enable AMSI integration for SharePoint, and restrict inbound access to the SharePoint web front-end.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2026-07-16)",
+        "adequacy": "Patch is authoritative, but the 3-day due date means unpatched internet-facing instances are likely already compromised; assume-breach triage is needed alongside patching."
+      },
+      "detection": {
+        "what_would_have_worked": "Alert on w3wp.exe spawning shells, new .aspx files under the web root, and anonymous POSTs carrying serialized objects.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Detection catches post-exploitation web shells but not the initial deserialization itself."
+      },
+      "response": {
+        "what_would_have_worked": "Rotate SharePoint machine keys and service credentials, hunt for planted web shells, and rebuild if compromise is confirmed.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Machine-key rotation is essential because a leaked ValidationKey enables forged payloads even after patching."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "The KEV due date is 3 days; a standard 30-day flaw-remediation SLA leaves internet-facing SharePoint exploitable for weeks after weaponization."
+      }
+    }
+  },
+  "CVE-2026-25089": {
+    "name": "Fortinet FortiSandbox OS Command Injection Vulnerability (CVE-2026-25089)",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unauthenticated attacker sends crafted HTTP requests with malicious JSON to the FortiSandbox web management UI; input handled by the 'start VNC' feature is later executed as an OS command (a second-order injection), yielding command execution on the appliance.",
+      "privileges_required": "none (unauthenticated, network-reachable web UI)",
+      "complexity": "low — a single crafted HTTP request reaches the vulnerable handler with no authentication",
+      "ai_factor": "Not AI-discovered — reported via Fortinet PSIRT (FG-IR-26-141). No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Upgrade to FortiSandbox 4.4.9+/5.0.6+ and remove the management interface from internet exposure (management-plane network segmentation, trusted-host restrictions).",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 26-04 (KEV remediation, added 2026-07-16)",
+        "adequacy": "Patching closes the flaw, but the exploitation window opened before the KEV listing, so exposure reduction (segmenting the admin plane) is the load-bearing control until every instance is patched."
+      },
+      "detection": {
+        "what_would_have_worked": "Alert on unauthenticated requests to the FortiSandbox web UI and on unexpected shell/child processes spawned by the web service; egress monitoring from the appliance.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Second-order injection means the trigger and execution are separated in time, so request-only signatures may miss it without process-level telemetry."
+      },
+      "response": {
+        "what_would_have_worked": "Follow CISA Forensics Triage Requirements: isolate the appliance, capture volatile state, rotate any credentials/secrets it held, and rebuild from a known-good image if compromise is confirmed.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "A compromised security appliance can taint the very telemetry used to detect the intrusion, so out-of-band forensics is required."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SC-7": {
+        "covered": true,
+        "adequate": false,
+        "gap": "A security appliance whose management UI is internet-reachable defeats boundary protection; the FortiSandbox admin plane must not be exposed to untrusted networks."
+      }
+    }
+  },
+  "CVE-2026-39808": {
+    "name": "Fortinet FortiSandbox OS Command Injection Vulnerability (CVE-2026-39808)",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unauthenticated attacker sends crafted HTTP requests to the FortiSandbox management interface; unsanitized arguments reach an OS command, yielding remote code execution on the appliance.",
+      "privileges_required": "none (unauthenticated, network-reachable management interface)",
+      "complexity": "low — CVSS AC:L, single crafted request, no user interaction",
+      "ai_factor": "Not AI-discovered — disclosed via Fortinet PSIRT (FG-IR-26-100). No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply the FortiSandbox fixed build per FG-IR-26-100 and restrict the management interface to a dedicated admin network/VPN.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 26-04 / BOD 22-01 (KEV remediation, added 2026-07-16)",
+        "adequacy": "Patching alone is insufficient if the management interface remains internet-exposed during the patch window; network isolation is the load-bearing compensating control."
+      },
+      "detection": {
+        "what_would_have_worked": "Alert on unexpected child processes from the appliance web daemon and on anomalous outbound connections from the security appliance.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Appliance telemetry is often limited; host-level process visibility on a closed appliance may be unavailable to defenders."
+      },
+      "response": {
+        "what_would_have_worked": "Isolate the appliance, capture forensic triage per CISA guidance, rotate any credentials/secrets the appliance held, rebuild from known-good firmware.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "A compromised inspection appliance can taint the very telemetry used to scope the breach; assume full compromise."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "The KEV due date (2026-07-19) is three days from listing; a standard 30-day flaw-remediation SLA leaves the appliance exploitable across the entire observed active-exploitation window."
+      }
+    }
+  },
+  "CVE-2026-46817": {
+    "name": "Oracle E-Business Suite Improper Privilege Management Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unauthenticated attacker sends crafted HTTP requests to the Oracle Payments File Transmission (ibytransmit) endpoint, abusing missing authentication and improper privilege management to read arbitrary server files and ultimately take over the Payments component.",
+      "privileges_required": "none (unauthenticated network attacker over HTTP)",
+      "complexity": "low — the endpoint is reachable pre-auth and the exploit calls an internal Java function directly with no special conditions",
+      "ai_factor": "Not AI-discovered — disclosed through Oracle's May 2026 Critical Patch Update. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply the Oracle May 2026 CPU for EBS 12.2.x and remove the Payments servlet from internet exposure (reverse-proxy allowlist / WAF virtual patch on the ibytransmit path).",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2026-07-15)",
+        "adequacy": "Patch alone closes the flaw but the six-week gap between patch release and first exploitation means unpatched, internet-exposed instances were already at risk; network isolation is needed as a compensating control."
+      },
+      "detection": {
+        "what_would_have_worked": "Alert on unauthenticated requests to ibytransmit and on file-read responses containing /etc/passwd or other OS paths from the EBS host.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Detection catches probing but the takeover is fast; without blocking, detection only shortens dwell time."
+      },
+      "response": {
+        "what_would_have_worked": "Isolate exposed EBS instances, rotate Payments and integration credentials, and perform CISA forensic-triage collection per BOD 26-04 guidance.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Credential rotation is essential post-compromise because Payments takeover can expose downstream financial integration secrets."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "The KEV due date (2026-07-18) was three days after listing, against an exploitation window that opened six weeks after the May patch — a standard flaw-remediation SLA is far too slow for an unauthenticated ERP takeover already probed in the wild."
+      }
+    }
+  },
+  "CVE-2023-4346": {
+    "name": "KNX Association KNX Protocol Connection Authorization Option 1 Overly Restrictive Account Lockout Mechanism Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An attacker who can reach the KNX bus over the network (or physically) interfaces with the installation, purges devices that lack additional security options, and sets a BCU key that cannot be reset without the current key, locking legitimate operators out.",
+      "privileges_required": "none (unauthenticated network or physical access to the KNX installation)",
+      "complexity": "low — abuses the documented Connection Authorization / BCU-key workflow, no exploit primitive required",
+      "ai_factor": "Not AI-discovered — coordinated ICS disclosure (CISA ICSA-23-236-01). No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Enable KNX Data Secure / IP Secure (the additional security options) on all devices and isolate the KNX/KNXnet-IP bus from untrusted networks",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2026-07-15)",
+        "adequacy": "Enabling security options prevents the purge/lock, but devices already provisioned without it must be re-commissioned physically."
+      },
+      "detection": {
+        "what_would_have_worked": "Monitoring for unexpected BCU-key changes and device purges on the KNX bus",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Most building-automation deployments have no bus-level telemetry, so detection is unlikely before lockout."
+      },
+      "response": {
+        "what_would_have_worked": "Physical re-provisioning of locked devices and segmenting the bus off untrusted networks",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Recovery is manual and per-device; no remote reset path exists once the BCU key is set."
+      }
+    },
+    "framework_coverage": {
+      "NIS2-Art21-network-security": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Network-security measures for essential entities seldom treat the building-automation/OT bus as in-scope, leaving the KNX segment flat and reachable."
+      }
+    }
+  },
+  "CVE-2026-56155": {
+    "name": "Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "A low-privileged local principal abuses an over-permissive DKM container ACL in AD FS to access the federation master key or elevate to administrator, enabling token-signing forgery that can be chained with an RCE in ransomware-style intrusions.",
+      "privileges_required": "low (authenticated local access to the AD FS server)",
+      "complexity": "low — the weakness is a static, insufficiently-granular ACL requiring no race or memory-corruption primitive",
+      "ai_factor": "Not AI-discovered — reported via Microsoft MSRC as an exploited zero-day. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Install the July 2026 AD FS update and set the RemediateDkmAcl registry key to harden the DKM container ACL rather than waiting for the October 2026 auto-remediation.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2026-07-14)",
+        "adequacy": "Patch installs an audit mode but does not change permissions automatically; operators must opt into remediation, so applying the update without the registry key leaves the ACL exposed."
+      },
+      "detection": {
+        "what_would_have_worked": "Monitor AD FS Admin event log for Event ID 1132 and alert on unexpected DKM container ACL reads / token-signing anomalies.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Event 1132 only fires after the update is installed in audit mode; pre-patch environments have no native signal."
+      },
+      "response": {
+        "what_would_have_worked": "Rotate AD FS token-signing/DKM keys, hunt for forged SAML tokens, and review federated sign-ins to Microsoft 365 / Entra ID.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Key rotation is essential post-exposure because a stolen DKM key remains valid until rotated."
+      }
+    },
+    "framework_coverage": {
+      "ISO-27001-2022-A.5.16-Federated": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Federated-identity management guidance assumes the token-signing key material is protected; it does not detect the insufficiently-granular ACL that exposes the AD FS DKM key to lateral privilege elevation."
+      }
+    }
+  },
+  "CVE-2026-56164": {
+    "name": "Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unauthenticated attacker sends a crafted SOAP payload to /_vti_bin/client.svc targeting User Profiles administrative endpoints, omitting the X-RequestDigest header and adding routing headers to reach an unvalidated code path, elevating privileges over the network.",
+      "privileges_required": "none (unauthenticated network attacker)",
+      "complexity": "low — a single crafted unauthenticated HTTP/SOAP request with specific headers triggers the bypass.",
+      "ai_factor": "Not AI-discovered — found by Mandiant/Google FLARE during incident response. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply the July 14 2026 SharePoint security update; restrict internet exposure of on-prem SharePoint and enforce AMSI integration where available.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2026-07-14)",
+        "adequacy": "Patch closes the missing-auth path, but zero-day exploitation preceded the fix, so patching alone did not protect early victims — pre-patch compensating controls and compromise assessment were also needed."
+      },
+      "detection": {
+        "what_would_have_worked": "Alert on unauthenticated /_vti_bin/client.svc SOAP calls missing X-RequestDigest and on anomalous User Profiles administrative activity.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Detection is retrospective for a zero-day and depends on SharePoint request-level logging that many operators do not capture by default."
+      },
+      "response": {
+        "what_would_have_worked": "Follow CISA Forensics Triage Requirements: hunt for unauthorized admin objects, rotate SharePoint machine keys/service credentials, and assess for persistence.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Key rotation is essential because SharePoint auth-context material may be exfiltrated during exploitation."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "The 3-day KEV due date reflects that this was exploited as a zero-day before any patch existed; a standard 30-day flaw-remediation SLA is far longer than the observed exploitation window."
+      }
+    }
+  },
+  "CVE-2026-15409": {
+    "name": "SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "A remote unauthenticated attacker sends a crafted request to the SMA1000 Work Place interface that coerces the appliance into making server-side requests to attacker-chosen destinations, enabling internal reconnaissance, cloud-metadata theft, or pivoting through the trusted appliance.",
+      "privileges_required": "none (unauthenticated, network-reachable)",
+      "complexity": "low — single crafted request, no authentication and no user interaction",
+      "ai_factor": "Not AI-discovered — disclosed by SonicWall PSIRT. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply the SNWLID-2026-0008 fixed firmware and restrict the Work Place interface to trusted networks plus strict egress filtering from the appliance.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2026-07-14)",
+        "adequacy": "Patch closes the request-forgery path, but without appliance egress filtering an unpatched or newly-found SSRF still reaches internal targets."
+      },
+      "detection": {
+        "what_would_have_worked": "Alert on appliance-originated outbound connections to internal ranges or metadata endpoints and on Work Place access without a valid session.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Egress anomaly detection catches exploitation attempts that perimeter inbound controls miss."
+      },
+      "response": {
+        "what_would_have_worked": "Follow CISA Forensics Triage Requirements, rotate any credentials the appliance could reach, and review outbound logs for pivot activity.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "SSRF pivots may have already touched internal services before patching."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SC-7": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Perimeter boundary controls do not stop an SSRF that turns the trusted appliance itself into the request origin, letting outbound calls reach internal services the firewall would otherwise block."
+      }
+    }
+  },
+  "CVE-2026-15410": {
+    "name": "SonicWall SMA1000 Appliances Code Injection Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An attacker holding administrator access to the SMA1000 AMC injects OS command syntax into an accepted management field, causing the appliance to execute attacker-chosen commands at the underlying OS level.",
+      "privileges_required": "high (authenticated AMC administrator)",
+      "complexity": "low — once admin access exists, the injection uses ordinary management input; the barrier is obtaining/abusing the admin session.",
+      "ai_factor": "Not AI-discovered — reported via SonicWall PSIRT. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply the SNWLID-2026-0008 firmware fix and restrict AMC exposure to a management-only network with tightly controlled admin accounts.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2026-07-14)",
+        "adequacy": "Patching closes the injection, but because any admin credential yields OS RCE, admin-account hardening and console isolation are needed alongside the patch."
+      },
+      "detection": {
+        "what_would_have_worked": "Alert on unexpected child processes spawned by AMC service accounts and on admin logins from anomalous source IPs.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Appliance logging often lacks process-level telemetry, so command execution may only be visible via downstream network artifacts."
+      },
+      "response": {
+        "what_would_have_worked": "Follow CISA forensic-triage guidance, rotate admin credentials, and rebuild the appliance if OS execution is confirmed.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "A confirmed OS-level compromise of a VPN appliance generally warrants full reimaging rather than in-place cleanup."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "The KEV due date is three days after listing; a standard flaw-remediation SLA measured in weeks leaves the internet-facing AMC exploitable well past the observed exploitation window."
+      }
+    }
+  },
+  "CVE-2008-4128": {
+    "name": "Cisco IOS Cross-Site Request Forgery Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An attacker lures an already-authenticated IOS administrator to a crafted page that forces requests to /level/15/exec/- and /level/15/exec/-/configure/http, executing privilege-15 and configuration commands through the router HTTP admin server.",
+      "privileges_required": "none (unauthenticated attacker; relies on an authenticated admin session and user interaction)",
+      "complexity": "low — the forged request is a static crafted page, though it requires an admin with an active HTTP-admin session",
+      "ai_factor": "Not AI-discovered — third-party disclosed against Cisco IOS HTTP admin, re-listed by CISA KEV. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Disable the IOS HTTP server (no ip http server / restrict to a mgmt ACL) and retire end-of-support 12.4 devices",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2026-07-13)",
+        "adequacy": "No vendor patch exists for the retired train, so disabling the admin server / replacing the device is the only durable fix — patching alone is not an option."
+      },
+      "detection": {
+        "what_would_have_worked": "Monitor for /level/15/exec/ URIs and unexpected privilege-15 command execution from the HTTP interface",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Legacy IOS logging of HTTP-driven exec commands is sparse, limiting detection fidelity."
+      },
+      "response": {
+        "what_would_have_worked": "Reset device credentials, audit running-config for injected aliases/HTTP config, and rebuild on a supported platform",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Config tampering can persist across sessions, so a full config review is required."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-CM-7": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Least-functionality is the real fix here: the IOS HTTP admin server should be disabled, but CM-7 baselining rarely reaches retired edge routers still exposing /level/15/exec, so the CSRF surface persists."
+      }
+    }
+  },
+  "CVE-2020-14644": {
+    "name": "Oracle WebLogic Server Remote Code Execution Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unauthenticated attacker sends a crafted serialized Java object over the WebLogic T3 or IIOP protocol; WebLogic deserializes it through a vulnerable gadget chain and executes attacker code as the server process, resulting in full takeover.",
+      "privileges_required": "none (unauthenticated network access to the T3/IIOP port)",
+      "complexity": "low — mass-scannable, public gadget chains, no user interaction",
+      "ai_factor": "Not AI-discovered — reported via Oracle coordinated disclosure and fixed in the July 2020 CPU. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply the July 2020 Oracle CPU; where patching lags, restrict or disable T3/IIOP and firewall the admin/managed-server ports to a trusted management segment.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-09-18)",
+        "adequacy": "Patch closes the specific gadget, but new deserialization gadgets recur in WebLogic; protocol-level filtering of T3/IIOP is the durable compensating control."
+      },
+      "detection": {
+        "what_would_have_worked": "Alert on unauthenticated T3/IIOP sessions carrying serialized-object magic bytes and on the WebLogic JVM spawning shells or writing JSP files.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Network detection is feasible but T3 is opaque to most WAFs, so process-spawn and file-write telemetry on the host is the more reliable signal."
+      },
+      "response": {
+        "what_would_have_worked": "Isolate the server, hunt for dropped JSP webshells and persistence, rotate WebLogic and downstream datastore credentials.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "RCE-as-server-account means any secret the server could read must be treated as compromised."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SC-7": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Boundary protection does not help when T3/IIOP management ports are exposed to the app tier or internet, which is common for WebLogic; the deserialization sink stays reachable."
+      }
+    }
+  },
+  "CVE-2022-21445": {
+    "name": "Oracle ADF Faces Deserialization of Untrusted Data Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unauthenticated attacker sends a crafted HTTP request to an ADF Faces resource-loader endpoint carrying a serialized Java gadget (LambdaIdentity); the server deserializes it without validation, executing arbitrary commands and taking over the WebLogic-hosted application.",
+      "privileges_required": "none (unauthenticated, network via HTTP)",
+      "complexity": "low — single crafted request against an internet-facing endpoint with public PoCs available",
+      "ai_factor": "Not AI-discovered — reported to Oracle PSIRT by a human researcher. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply the Oracle April 2022 CPU to ADF/WebLogic; front the app with a WAF stripping serialized-object payloads and block internet exposure of ADF resource endpoints.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-09-18)",
+        "adequacy": "Patch alone is sufficient only if applied promptly; the CPU cadence means most estates were exposed for a long window, so compensating WAF/egress controls were needed in the interim."
+      },
+      "detection": {
+        "what_would_have_worked": "Alert on serialized-object markers (rO0AB / 0xac 0xed) in ADF request bodies and on the WebLogic JVM spawning child OS processes.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Detection catches exploitation attempts but does not prevent the initial deserialization."
+      },
+      "response": {
+        "what_would_have_worked": "Isolate the managed server, rotate WebLogic and downstream data-store credentials, hunt for webshells and persistence dropped post-exploitation.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Post-compromise response cannot undo data already exfiltrated via the RCE."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Oracle's quarterly CPU cadence plus enterprise change windows leaves ADF/WebLogic unpatched for months; the observed exploitation window is far shorter than the typical Fusion Middleware patch SLA."
+      }
+    }
+  },
+  "CVE-2020-0618": {
+    "name": "Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "A low-privileged authenticated user POSTs a crafted __VIEWSTATE payload to an SSRS report-rendering page; SSRS deserializes it insecurely (LosFormatter/ObjectStateFormatter), executing attacker code as the Report Server service account.",
+      "privileges_required": "low (any authenticated SSRS user)",
+      "complexity": "low — public ViewState gadget chains and PoCs make weaponization trivial once the endpoint is reachable",
+      "ai_factor": "Not AI-discovered — reported by MDSec's Soroush Dalili. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply the February 2020 SSRS cumulative update and restrict report-server access to authenticated, network-segmented users only",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-09-18)",
+        "adequacy": "Patch removes the insecure deserialization, but exposed SSRS servers frequently miss BI-tier patch cycles, so network segmentation is needed alongside."
+      },
+      "detection": {
+        "what_would_have_worked": "Alert on child processes of ReportingServicesService.exe/w3wp and on oversized __VIEWSTATE parameters to report endpoints",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Deserialization sinks execute in-process, so only process-lineage and payload-size heuristics catch it."
+      },
+      "response": {
+        "what_would_have_worked": "Isolate the SSRS host, rotate the service-account credentials, and hunt for planted webshells/scheduled tasks",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Service-account code execution can pivot to the SQL data tier, so credential rotation is essential."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "SSRS is often a long-lived internal BI server outside the standard OS patch cadence; a 21-day KEV due date lags the observed exploitation of exposed instances."
+      }
+    }
+  },
+  "CVE-2024-27348": {
+    "name": "Apache HugeGraph-Server Improper Access Control Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unauthenticated attacker submits a crafted Gremlin script to /apis/gremlin that abuses Java reflection/OGNL to escape HugeGraphSecurityManager and run arbitrary OS commands on the server.",
+      "privileges_required": "none (unauthenticated when the Auth system is disabled, the default)",
+      "complexity": "low — a single HTTP POST with a public reflective payload against a default install",
+      "ai_factor": "Not AI-discovered — reported to the Apache HugeGraph PMC by external researchers. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Upgrade to HugeGraph-Server 1.3.0 on Java11 and enable the Auth system; place the server behind authenticated network boundaries and never expose /apis/gremlin to the internet.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-09-18)",
+        "adequacy": "Patching to 1.3.0 removes the sandbox escape, but without also enabling Auth the Gremlin endpoint stays reachable, so the patch alone is insufficient if operators keep the insecure default."
+      },
+      "detection": {
+        "what_would_have_worked": "Alert on /apis/gremlin requests containing reflective class names and on the HugeGraph JVM spawning shell children.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Post-exploitation shell spawns are detectable but occur after code execution has already succeeded."
+      },
+      "response": {
+        "what_would_have_worked": "Isolate the host, rotate any credentials reachable from the server, and rebuild given RCE-level access.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "RCE implies full server compromise; assume persistence until proven otherwise."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "The 2024-10-09 KEV due date trailed real exploitation; SI-2 flaw-remediation SLAs measured in weeks are far longer than the hours-to-days scanning window for an internet-facing preauth RCE."
+      }
+    }
+  },
+  "CVE-2014-0502": {
+    "name": "Adobe Flash Player Double Free Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "A crafted SWF served from a compromised or attacker-controlled page triggers a double free in the Flash plugin, corrupting memory and allowing arbitrary code execution in the browser plugin process.",
+      "privileges_required": "none (unauthenticated drive-by; requires the victim to load a malicious page — UI:R)",
+      "complexity": "low — reliable public exploit code and a stable heap-grooming primitive exist",
+      "ai_factor": "Not AI-discovered — surfaced via in-the-wild detection and Adobe PSIRT. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Remove Flash from endpoints (EoL) or, historically, apply the APSB14-07 update; enforce click-to-play / plugin blocking on browsers.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-09-17)",
+        "adequacy": "Patching is impossible post-EoS; only full removal closes the surface, which patch-centric controls do not guarantee."
+      },
+      "detection": {
+        "what_would_have_worked": "EDR on plugin-process anomalies (Flash spawning children, unexpected outbound C2) and web-proxy detection of SWF served from low-reputation domains.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Detection catches post-exploitation but not the initial memory corruption."
+      },
+      "response": {
+        "what_would_have_worked": "Isolate affected hosts, uninstall Flash fleet-wide, hunt for RokRAT-style implants and C2 beacons.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Response is reactive; the durable fix is eliminating the plugin."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "SI-2 flaw remediation has no patch path for an EoL plugin; only removal mitigates, which SI-2 alone does not compel."
+      }
+    }
+  },
+  "CVE-2013-0648": {
+    "name": "Adobe Flash Player Code Execution Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "The attacker lures a user to a page serving a malicious SWF that abuses the ExternalInterface ActionScript functionality, corrupting memory and executing arbitrary code in the Flash Player process.",
+      "privileges_required": "none (unauthenticated), but user interaction is required to load the malicious SWF",
+      "complexity": "low — a single crafted SWF and a lured click trigger the flaw; no authentication needed.",
+      "ai_factor": "Not AI-discovered — surfaced from February 2013 targeted attacks and disclosed by Adobe in APSB13-08. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Remove Flash Player entirely (the product is EoL) and block Flash content at the browser and gateway.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-09-17)",
+        "adequacy": "Because the product is end-of-life, patching is not an option; only decommissioning removes the exposure."
+      },
+      "detection": {
+        "what_would_have_worked": "Flag SWF loads from untrusted origins and Flash plugin process crashes or child-process spawns.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Signature-based SWF detection lags novel obfuscation; removal is more reliable than detection."
+      },
+      "response": {
+        "what_would_have_worked": "Isolate hosts that rendered untrusted Flash, hunt for dropped payloads, and uninstall Flash fleet-wide.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Response is moot once Flash is removed; the control objective is elimination."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-CM-7": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Least-functionality controls that still permit the Flash browser plugin leave this client-side RCE reachable; the plugin must be removed, not merely patched."
+      }
+    }
+  },
+  "CVE-2013-0643": {
+    "name": "Adobe Flash Player Incorrect Default Permissions Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "A victim's Firefox browser loads attacker-controlled SWF content; the Flash Player sandbox fails to properly restrict privileges, letting the SWF execute arbitrary code outside the sandbox. Delivered via drive-by / targeted web content in February 2013.",
+      "privileges_required": "none (unauthenticated remote attacker), but requires user interaction to load the SWF",
+      "complexity": "low — a crafted SWF served to a vulnerable Flash/Firefox client is sufficient",
+      "ai_factor": "Not AI-discovered — disclosed to Adobe during the February 2013 Flash zero-day response. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Uninstall/disable the Flash Player plugin (now EoL) and block SWF content at the web gateway; where transitional use was required, apply the APSB13-08 update.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-09-17)",
+        "adequacy": "Because the product is end-of-life, patching is no longer possible; only removal of Flash eliminates the risk."
+      },
+      "detection": {
+        "what_would_have_worked": "Web-proxy alerting on SWF delivery and endpoint monitoring for anomalous Flash Player process behavior.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Targeted SWF payloads were tailored per campaign, limiting signature-based detection."
+      },
+      "response": {
+        "what_would_have_worked": "Purge Flash from managed endpoints, hunt for post-exploitation second-stage payloads, and reimage confirmed-compromised hosts.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Client compromise typically leads to credential theft, so credential rotation is warranted after any confirmed hit."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-CM-7": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Least-functionality/removal of the end-of-life Flash Player plugin is the only durable fix; a control that merely inventories software does not force removal of an unsupported client component."
+      }
+    }
+  },
+  "CVE-2014-0497": {
+    "name": "Adobe Flash Player Integer Underflow Vulnerablity",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An integer underflow during SWF parsing corrupts heap memory; a victim who loads an attacker-controlled Flash object (drive-by or malvertising) triggers arbitrary code execution in the browser context.",
+      "privileges_required": "none (unauthenticated; requires the victim to view a malicious page)",
+      "complexity": "low — CVSS AC:L; reliable exploitation was packaged into exploit-kit/drive-by delivery in the wild",
+      "ai_factor": "Not AI-discovered — reported by Kaspersky Lab. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Uninstall/disable Adobe Flash Player (now EoL) and migrate off Flash content; historically, applying the APSB14-04 update.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-09-17)",
+        "adequacy": "Because the product is end-of-life, only removal is durable; any residual Flash install remains exploitable."
+      },
+      "detection": {
+        "what_would_have_worked": "EDR alerting on Flash Player process spawning children or dropping executables; web-proxy detection of malicious SWF delivery.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Detection is retrospective; the exploit executes in-process before most signatures fire."
+      },
+      "response": {
+        "what_would_have_worked": "Remove Flash from all endpoints, reimage confirmed-compromised hosts, hunt for exploit-kit follow-on payloads.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Follow-on malware from drive-by chains is the real damage; scoping must extend beyond the browser."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-CM-7": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Least-functionality controls that still permit the Flash Player browser plugin leave a memory-corruption RCE surface exposed; the plugin should have been disabled/removed."
+      }
+    }
+  },
+  "CVE-2024-6670": {
+    "name": "Progress WhatsUp Gold SQL Injection Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unauthenticated attacker sends a SQL injection payload to a WhatsUp Gold web endpoint to read the stored encrypted user password, then authenticates to the admin console and abuses monitoring tooling for code execution and lateral movement.",
+      "privileges_required": "none (unauthenticated network attacker)",
+      "complexity": "low — a single crafted request with a public PoC available",
+      "ai_factor": "Not AI-discovered — reported by Sina Kheirkhah of Summoning Team. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Upgrade to WhatsUp Gold 2024.0.0 and remove the console from internet/management-network exposure; enforce parameterized queries at the app tier.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-09-16)",
+        "adequacy": "Patch removes the injection but any credential exposed before patching must be rotated, since attackers retained the recovered admin password."
+      },
+      "detection": {
+        "what_would_have_worked": "WAF/SQLi alerting on WhatsUp Gold endpoints and monitoring for anomalous admin logins immediately following unauthenticated requests.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Detection is useful but the credential leak is instantaneous, so blocking is preferable to alerting."
+      },
+      "response": {
+        "what_would_have_worked": "Rotate all WhatsUp Gold and monitored-device credentials, hunt for ransomware staging, and review poller/task configurations for backdoors.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Because the flaw is ransomware-linked, response must assume credential compromise and lateral movement have already occurred."
+      }
+    },
+    "framework_coverage": {
+      "SOC2-CC6-logical-access": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Logical-access controls assume the admin password stays secret, but an unauthenticated SQLi extracts it — the control's trust boundary is bypassed rather than enforced."
+      }
+    }
+  },
+  "CVE-2024-43461": {
+    "name": "Microsoft Windows MSHTML Platform Spoofing Vulnerability (CVE-2024-43461)",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "Void Banshee lured victims with a .URL that used CVE-2024-38112 to open attacker content in MSHTML/IE, then used CVE-2024-43461 to spoof the downloaded HTA's filename as a PDF so the victim ran it, dropping Atlantida stealer.",
+      "privileges_required": "none (unauthenticated); user interaction required (victim opens the spoofed file)",
+      "complexity": "low — social-engineering delivery plus a reliable filename-padding spoof, no memory-corruption exploit",
+      "ai_factor": "Not AI-discovered — reported by Trend Micro ZDI; exploited by Void Banshee APT. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply the September 2024 Windows update and disable/remove the MSHTML/IE-mode rendering path",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-09-16)",
+        "adequacy": "Patching fixes the spoof, but the chained CVE-2024-38112 MSHTML surface should be disabled to remove the class."
+      },
+      "detection": {
+        "what_would_have_worked": "EDR alerting on mshta.exe executing files delivered as PDFs and on .url mhtml: handler use",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Detection catches execution after the user is already deceived; extension-based filters do not."
+      },
+      "response": {
+        "what_would_have_worked": "Credential rotation and stealer-focused IR after any Atlantida execution",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Infostealer impact (browser creds/wallets) may already have exfiltrated before response."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-3": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Malicious-code protection keyed on file extension/type is defeated precisely because the vulnerability misrepresents the extension to both the user and naive filters."
+      }
+    }
+  },
+  "CVE-2024-8190": {
+    "name": "Ivanti Cloud Services Appliance OS Command Injection Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An attacker with admin access to the CSA console injects OS commands through the DateTimeTab.php TIMEZONE parameter to run arbitrary code on the appliance; admin access is often obtained by chaining the CVE-2024-8963 authentication bypass.",
+      "privileges_required": "low-to-high (application admin; in practice supplied by the chained CVE-2024-8963 bypass)",
+      "complexity": "low — a public PoC automates authentication and command injection end to end",
+      "ai_factor": "Not AI-discovered — Ivanti PSIRT disclosure with Horizon3.ai analysis. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Migrate off the EoL CSA 4.6.x line to 5.0.x (which removed the vulnerable functionality) or remove CSA from service; restrict admin-console exposure.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-09-13)",
+        "adequacy": "Patch 519 addresses 4.6.x but the line is EoL; only migration to 5.0.x is a durable fix."
+      },
+      "detection": {
+        "what_would_have_worked": "Alert on requests to DateTimeTab.php and unexpected shell processes spawned by the appliance web service; deploy the Emerging Threats CSA command-injection signature.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Appliance is closed; network IDS at the boundary is the primary detection surface."
+      },
+      "response": {
+        "what_would_have_worked": "Rebuild the appliance, rotate credentials/secrets it held, and hunt for web shells and lateral movement.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Given nation-state exploitation, assume full compromise and rebuild rather than clean in place."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Flaw remediation SLAs are outpaced by exploitation that began days after disclosure on an end-of-life 4.6.x appliance line that receives no further security fixes."
+      }
+    }
+  },
+  "CVE-2024-38217": {
+    "name": "Microsoft Windows Mark of the Web (MOTW) Protection Mechanism Failure Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An attacker delivers a crafted .lnk file whose target path forces Windows to rewrite/canonicalize the shortcut, which drops the Zone.Identifier ADS and removes the Mark-of-the-Web so subsequently opened files skip Protected View and SmartScreen prompts.",
+      "privileges_required": "none (unauthenticated), but requires the victim to open the delivered file (UI:R)",
+      "complexity": "low — the LNK-stomping crafting is trivial once the technique is known.",
+      "ai_factor": "Not AI-discovered — reported by Elastic Security Labs. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply the September 2024 Windows update; enforce macro blocking and Attack Surface Reduction rules that do not depend solely on MOTW tagging.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-09-10)",
+        "adequacy": "Patch restores MOTW integrity, but any defense that keyed purely on MOTW needs a defense-in-depth layer since MOTW can be stripped by design flaws."
+      },
+      "detection": {
+        "what_would_have_worked": "Hunt for LNK files with non-canonical target paths and for internet-sourced files missing a Zone.Identifier ADS.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Detection requires ADS-aware tooling that many endpoint stacks do not inspect by default."
+      },
+      "response": {
+        "what_would_have_worked": "Quarantine delivered LNK/archive lures and re-scan payloads independent of MOTW state.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Response depends on catching the initial lure since post-execution the MOTW signal is already gone."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-3": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Malicious-code protection that keys off MOTW/Protected View is directly undermined when the mark is stripped, so signature/behavioral gating never triggers on the downloaded payload."
+      }
+    }
+  },
+  "CVE-2024-38014": {
+    "name": "Microsoft Windows Installer Improper Privilege Management Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "A local low-privileged user triggers a Windows Installer repair, which briefly runs an elevated process; by hijacking that elevated context (or racing the rollback temp files with symlinks/oplocks) the attacker obtains a SYSTEM shell.",
+      "privileges_required": "low (local authenticated user)",
+      "complexity": "low — reliable public technique using the built-in MSI repair flow",
+      "ai_factor": "Not AI-discovered — reported by SEC Consult (Michael Baer). No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply the September 2024 cumulative update and set AlwaysInstallElevated to disabled.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-09-10)",
+        "adequacy": "Patch removes the repair-flow race; least-privilege alone cannot stop it because the flaw escalates from an already-authorized standard user."
+      },
+      "detection": {
+        "what_would_have_worked": "EDR rules for msiexec spawning SYSTEM command interpreters and standard-user writes to C:\\Config.msi.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Behavioral detection catches exploitation even before patch deployment."
+      },
+      "response": {
+        "what_would_have_worked": "Investigate the host for the preceding initial-access malware, since EoP is a post-compromise step.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "SYSTEM escalation implies an attacker already had code execution."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-AC-6": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Least-privilege alone does not help — the flaw lets an already-present low-privileged user escalate to SYSTEM, defeating the privilege boundary the control assumes."
+      }
+    }
+  },
+  "CVE-2024-38226": {
+    "name": "Microsoft Publisher Protection Mechanism Failure Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "A user is lured into opening a malicious Publisher file; the security-feature bypass causes Office to run embedded macros even though macro-blocking policy would normally stop untrusted content, giving the attacker code execution in the user's context.",
+      "privileges_required": "low (local user opening a file)",
+      "complexity": "low — a crafted document plus routine social engineering; user interaction is required.",
+      "ai_factor": "Not AI-discovered — fixed by Microsoft PSIRT. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Install the September 2024 Office update and reinforce with attachment sandboxing plus blocking Publisher files from untrusted sources at the mail gateway.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-09-10)",
+        "adequacy": "Because the flaw defeats macro policy itself, patching plus gateway/EDR layering is needed rather than relying on the bypassed Office control."
+      },
+      "detection": {
+        "what_would_have_worked": "EDR rules flagging Publisher spawning script interpreters or unusual child processes after opening a downloaded file.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Detection depends on post-execution behavior since the blocking prompt the user expects never fires."
+      },
+      "response": {
+        "what_would_have_worked": "Isolate the host, hunt for macro-dropped payloads, and reset any credentials exposed to the executed macro.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Follow-on payloads determine scope; the bypass itself is only the initial-access enabler."
+      }
+    },
+    "framework_coverage": {
+      "AU-Essential-8-App-Hardening": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Essential Eight application hardening relies on macro-execution restrictions in Office, exactly the enforcement this flaw defeats, so the mitigation is silently bypassed."
+      }
+    }
+  },
+  "CVE-2024-40766": {
+    "name": "SonicWall SonicOS Improper Access Control Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unauthenticated remote attacker reaches SonicOS management access to obtain unauthorized resource access (or crash the firewall); ransomware affiliates chained this with reused local-user credentials on SSL VPN to gain rapid internal footholds.",
+      "privileges_required": "none (unauthenticated network attacker against the management/VPN interface)",
+      "complexity": "low — network-reachable improper access control with no user interaction",
+      "ai_factor": "Not AI-discovered — disclosed by SonicWall PSIRT. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Upgrade to fixed SonicOS AND reset all local user passwords, restrict management/SSL-VPN to trusted sources, enforce MFA",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-09-09)",
+        "adequacy": "Patching alone was demonstrably insufficient: Akira/Fog kept compromising 'patched' firewalls where migrated local credentials were never reset."
+      },
+      "detection": {
+        "what_would_have_worked": "Alert on SSL VPN logins from unfamiliar ASNs and sudden internal scanning/encryption behavior",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Sub-hour dwell time leaves a very narrow detection-to-response window."
+      },
+      "response": {
+        "what_would_have_worked": "Isolate the firewall, rotate all credentials, hunt for Akira/Fog persistence, restore from clean backups",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Given encryption within ~55 minutes, response is largely post-impact unless prevention held."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Flaw remediation closed the access-control bug, but the observed ransomware window (<1h) and the credential-reuse follow-on mean patch-only remediation without a mandatory local-user password reset leaves the device compromisable."
+      }
+    }
+  },
+  "CVE-2017-1000253": {
+    "name": "Linux Kernel PIE Stack Buffer Corruption Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "A local user executes a specially-linked PIE binary so that its later PT_LOAD segments are mapped above mm->mmap_base into the stack gap; the resulting stack corruption is leveraged to escalate to root on unpatched long-term kernels.",
+      "privileges_required": "low (local unprivileged user able to execute a binary)",
+      "complexity": "low — deterministic on affected kernels with a crafted binary; public technical details from Qualys",
+      "ai_factor": "Not AI-discovered — reported by Qualys as part of the Stack Clash research. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Backport commit a87938b2e246 / apply the distro kernel update; where reboot is deferred, apply a kpatch/Ksplice/kGraft live patch.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-09-09)",
+        "adequacy": "Patch fully closes the primitive, but the reboot requirement is why unpatched long-term kernels lingered for years; live-patching is the practical bridge."
+      },
+      "detection": {
+        "what_would_have_worked": "Monitor for anomalous local root escalations, unexpected PIE binaries, and kernel oops/stack-corruption events during ELF loads.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Detection is post-escalation; exploitation is quiet, so host EDR + auditd on execve of untrusted binaries is the main signal."
+      },
+      "response": {
+        "what_would_have_worked": "Treat any host that ran the exploit as root-compromised: reimage or thoroughly hunt for persistence and rotate host-stored credentials/keys.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Local root undermines all host trust boundaries, so containment must assume full host compromise."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "The fix was upstreamed without a security classification, so advisory-driven flaw remediation did not backport it to long-term kernels for over two years, leaving a durable local-root LPE."
+      }
+    }
+  },
+  "CVE-2016-3714": {
+    "name": "ImageMagick Improper Input Validation Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An attacker uploads a crafted MVG/MSL/SVG image whose coder fields contain shell metacharacters; when a server passes the file to ImageMagick's delegate command, the metacharacters are executed as an OS command, yielding remote code execution.",
+      "privileges_required": "none (unauthenticated where uploads are accepted anonymously)",
+      "complexity": "low — public PoCs and a Metasploit module make weaponization trivial",
+      "ai_factor": "Not AI-discovered — found by Mail.Ru Security Team researchers. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Upgrade ImageMagick past 6.9.3-10 / 7.0.1-1 and deploy a restrictive policy.xml disabling the vulnerable coders (MVG, MSL, EPHEMERAL, HTTPS, TEXT, SHOW, WIN, PLT); validate uploaded file content, not just extension.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-09-09)",
+        "adequacy": "Even patched builds benefit from a hardened policy.xml and sandboxing, since new coder-based bypasses have recurred."
+      },
+      "detection": {
+        "what_would_have_worked": "Monitor for image-processing workers spawning shells and for MVG/MSL delegate strings in uploaded content.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Detection is reactive; a single processed image already yields code execution."
+      },
+      "response": {
+        "what_would_have_worked": "Contain the image-processing host, rotate secrets reachable from it, and audit for webshells or cron/persistence dropped via the RCE.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Response cannot recover data exfiltrated during the exploitation window."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-3": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Malicious-code protection that signature-scans uploads does not catch a crafted MVG/MSL image whose payload is a delegate command-injection string rather than known malware, so the file reaches the vulnerable ImageMagick coder."
+      }
+    }
+  },
+  "CVE-2024-7262": {
+    "name": "Kingsoft WPS Office Path Traversal Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "A victim opens (or single-clicks a link inside) a malicious WPS spreadsheet that invokes the custom ksoqing protocol; promecefpluginhost.exe fails to validate the supplied plugin path and loads an attacker-controlled DLL, executing the SpyGlace backdoor.",
+      "privileges_required": "none (unauthenticated victim opening a document / single click)",
+      "complexity": "low — the weaponized document and public PoCs reduce exploitation to a single user interaction",
+      "ai_factor": "Not AI-discovered — found by ESET Research analyzing APT-C-60. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Upgrade to WPS Office 12.2.0.16412+ and block/harden the ksoqing custom protocol handler",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-09-03)",
+        "adequacy": "Patch closes the path-validation gap, but organizations with unmanaged WPS installs remain exposed until users update."
+      },
+      "detection": {
+        "what_would_have_worked": "Monitor promecefpluginhost.exe for DLL loads from user-writable/remote paths and flag ksoqing:// protocol invocations",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "The loader is a signed vendor binary, so only load-path and protocol-handler telemetry surfaces the abuse."
+      },
+      "response": {
+        "what_would_have_worked": "Isolate the endpoint, hunt for the SpyGlace DLL and its persistence, and reimage on confirmed backdoor",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Espionage backdoors persist quietly, so post-exploitation hunting is required beyond patching."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "WPS Office is user-installed productivity software often outside enterprise patch tooling, so the fix lags the one-click in-the-wild exploitation."
+      }
+    }
+  },
+  "CVE-2021-20124": {
+    "name": "Draytek VigorConnect Path Traversal Vulnerability (CVE-2021-20124)",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unauthenticated attacker sends a directory-traversal request to the VigorConnect WebServlet download endpoint and retrieves arbitrary files from the host with root privileges.",
+      "privileges_required": "none (unauthenticated)",
+      "complexity": "low — a single crafted HTTP GET with ../ traversal against an internet-exposed endpoint",
+      "ai_factor": "Not AI-discovered — found and disclosed by Tenable Research. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply the DrayTek fix or remove/upgrade VigorConnect, and restrict the management portal to trusted networks only.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-09-03)",
+        "adequacy": "Patching addresses the traversal, but because the flaw is only reachable when the portal is exposed, network isolation is the durable control."
+      },
+      "detection": {
+        "what_would_have_worked": "Alert on traversal patterns in WebServlet request URIs and on file reads returning system files.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Detection catches enumeration but the read is a single benign-looking GET, so signatures on ../ sequences are essential."
+      },
+      "response": {
+        "what_would_have_worked": "Rotate any credentials or keys stored on the appliance and audit for follow-on access using leaked material.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "File disclosure of credentials enables downstream authenticated attacks; assume harvested secrets are compromised."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SC-7": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Boundary protection is the real mitigation here — the file-read is only exploitable when the WebServlet is internet-reachable, yet SC-7 controls frequently leave device-management portals exposed."
+      }
+    }
+  },
+  "CVE-2021-20123": {
+    "name": "DrayTek VigorConnect Path Traversal Vulnerability (CVE-2021-20123)",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unauthenticated attacker sends a crafted request to the DownloadFileServlet endpoint using directory-traversal sequences, causing VigorConnect to return arbitrary files from the OS with root privileges.",
+      "privileges_required": "none (unauthenticated, no user interaction)",
+      "complexity": "low — a single crafted GET with ../ sequences suffices; public PoC exists",
+      "ai_factor": "Not AI-discovered — found by Tenable Research. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Upgrade to VigorConnect 1.6.1; remove the management portal from the public Internet and restrict to a management VLAN/VPN.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-09-03)",
+        "adequacy": "Patching alone is insufficient while the management interface remains Internet-exposed; network isolation is the decisive control."
+      },
+      "detection": {
+        "what_would_have_worked": "WAF/IPS signatures for traversal patterns against DownloadFileServlet; alerting on access to system credential files.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Signature detection helps but is bypassable via encoding variants."
+      },
+      "response": {
+        "what_would_have_worked": "Rotate any credentials readable from the host, review access logs for traversal reads, take the portal off the edge.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Reactive; exposure removal is the durable fix."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SC-7": {
+        "covered": true,
+        "adequate": false,
+        "gap": "SC-7 boundary protection does not by itself force a device-management portal off the public Internet, which is the decisive exposure here."
+      }
+    }
+  },
+  "CVE-2024-7965": {
+    "name": "Google Chromium V8 Inappropriate Implementation Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "A user visits a crafted HTML page that exploits an inappropriate implementation in V8 to corrupt the heap in the renderer, typically chained with a sandbox escape for full code execution.",
+      "privileges_required": "none (unauthenticated), user interaction required to visit the page",
+      "complexity": "low — a single malicious page reaches the flaw; exploitation is drive-by.",
+      "ai_factor": "Not AI-discovered — reported by an external researcher via Google's Chrome VRP. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Force-update Chrome to 128.0.6613.84+ and mandate browser relaunch fleet-wide.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-08-28)",
+        "adequacy": "The updated binary does not protect users until the browser is relaunched; patch deployment must be paired with enforced restart."
+      },
+      "detection": {
+        "what_would_have_worked": "Monitor for renderer-process crashes and anomalous browser child processes.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Crash telemetry is noisy and post-hoc; it rarely catches a clean exploit."
+      },
+      "response": {
+        "what_would_have_worked": "Investigate hosts that visited attacker-controlled pages and confirm the browser version post-update.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Response depends on knowing which sites were visited, which is often unavailable."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Even with an available patch, the interval between the emergency Chrome release and enterprise-wide browser update rollout leaves a window that observed in-the-wild exploitation can hit."
+      }
+    }
+  },
+  "CVE-2024-38856": {
+    "name": "Apache OFBiz Incorrect Authorization Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "OFBiz checks authorization against the requestUri but renders the screen named by overrideViewUri. An unauthenticated attacker prefixes a public endpoint (e.g. forgotPassword) and overrides the view to ProgramExport, then posts a Base64-encoded Groovy program that executes as the OFBiz process user.",
+      "privileges_required": "none (unauthenticated)",
+      "complexity": "low — a single crafted HTTP POST using published PoC parameters",
+      "ai_factor": "Not AI-discovered — reported by SonicWall Capture Labs. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Upgrade to OFBiz 18.12.15; until patched, block or authenticate the /webtools ProgramExport endpoint and put OFBiz behind a WAF rule matching the override-view chain.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-08-27)",
+        "adequacy": "Patching is definitive; the near-zero PoC-to-exploitation window means compensating WAF/endpoint controls were needed immediately, not just at the next maintenance window."
+      },
+      "detection": {
+        "what_would_have_worked": "Alert on requests where overrideViewUri targets ProgramExport, on groovyProgram parameters, and on child processes spawned by the Java/OFBiz service.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Base64-encoded Groovy hides command content, so process-level and decode-aware detection outperforms raw string matching."
+      },
+      "response": {
+        "what_would_have_worked": "Isolate the host, review OFBiz access logs for ProgramExport hits, rotate application/database credentials, and rebuild if RCE is confirmed.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "RCE runs as the OFBiz user with database access, so data-exposure assessment and credential rotation are required after any confirmed hit."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-AC-3": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Access enforcement is bypassed because authorization is checked on requestUri while rendering follows overrideViewUri — the control assumes a single consistent decision point, which this split defeats."
+      }
+    }
+  },
+  "CVE-2024-7971": {
+    "name": "Google Chromium V8 Type Confusion Vulnerability (CVE-2024-7971)",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "A victim visits an attacker-controlled page that runs crafted JavaScript triggering a V8 type confusion; the resulting heap corruption yields renderer RCE, which Citrine Sleet chained with a Windows sandbox escape to deploy the FudModule rootkit.",
+      "privileges_required": "none (unauthenticated; requires victim to load a malicious page — CVSS UI:R)",
+      "complexity": "low — CVSS AC:L; a single crafted HTML page triggers the bug, though the full kernel-rootkit chain is sophisticated",
+      "ai_factor": "Not AI-discovered — reported by Microsoft Threat Intelligence and Google. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Update Chrome/Chromium browsers to 128.0.6613.84+ and enforce auto-update; block known Citrine Sleet infrastructure.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-08-26)",
+        "adequacy": "Patching closes the window after disclosure but cannot protect against the pre-patch zero-day period; defense-in-depth (sandbox integrity, EDR on rootkit behavior) is needed."
+      },
+      "detection": {
+        "what_would_have_worked": "EDR detection of the sandbox escape and FudModule rootkit load; monitoring for the crypto-themed C2 domains named in the Microsoft report.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Renderer-stage exploitation is hard to see; detection realistically starts at the post-escape rootkit stage."
+      },
+      "response": {
+        "what_would_have_worked": "Reimage compromised hosts, hunt for FudModule and BYOVD artifacts, rotate credentials for crypto/finance staff.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "A kernel rootkit undermines host trust; assume full compromise of affected endpoints."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-3": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Malicious-code protection at the endpoint did not stop a memory-corruption chain that escaped the browser sandbox and loaded a kernel rootkit (FudModule)."
+      }
+    }
+  },
+  "CVE-2024-39717": {
+    "name": "Versa Director Dangerous File Type Upload Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An attacker who has (or obtains) high-privilege Provider-Data-Center admin access uploads a Java/JSP payload disguised as a .png via the Change Favicon function; in observed intrusions attackers reached the exposed management ports and then loaded the memory-resident VersaMem web shell to steal credentials.",
+      "privileges_required": "high (Provider-Data-Center-Admin / System-Admin) — but exposed management ports and credential capture let attackers chain to full compromise",
+      "complexity": "low — a single crafted upload once the admin UI is reachable",
+      "ai_factor": "Not AI-discovered — in-the-wild activity identified by Lumen Black Lotus Labs. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Upgrade to Versa Director 22.1.4+ and firewall management ports 4566/4570 to trusted networks only, blocking the initial reachability the exploit depends on.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-08-23)",
+        "adequacy": "Patch is necessary but the observed VersaMem web shell is memory-resident, so patched hosts must also be rebooted and hunted to evict any pre-existing implant."
+      },
+      "detection": {
+        "what_would_have_worked": "Monitor for .png uploads containing non-image content, unexpected JARs in the Tomcat process, and outbound connections to SOHO egress IPs.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Because VersaMem lives in memory and hooks authentication, disk-based file-integrity monitoring alone misses it."
+      },
+      "response": {
+        "what_would_have_worked": "Reboot to clear the in-memory web shell, rotate all credentials that transited the Director since June 2024, and review captured-credential exposure.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Credential capture means downstream tenant and device secrets should be treated as compromised."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SC-7": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Versa's own guidance was to firewall management ports 4566/4570, but many operators left them internet-reachable; the boundary control was available yet not enforced, enabling the initial upload."
+      }
+    }
+  },
+  "CVE-2021-31196": {
+    "name": "Microsoft Exchange Server Remote Code Execution Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An attacker with valid Exchange authentication reaches an internet-facing OWA/ECP back-end endpoint and triggers server-side code execution, then persists via an ASPX web shell in an Exchange virtual directory.",
+      "privileges_required": "low (authenticated Exchange user — PR:H per CVSS, but obtainable via credential theft or chaining with an Exchange SSRF)",
+      "complexity": "low — public PoCs exist and Exchange back-end endpoints are reliably reachable",
+      "ai_factor": "Not AI-discovered — coordinated researcher disclosure in the ProxyOracle/ProxyShell wave. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply the July 2021 Exchange cumulative-update/security patch and restrict OWA/ECP exposure",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-08-21)",
+        "adequacy": "Patching closes the RCE, but unpatched, internet-facing Exchange remains a top ransomware entry point."
+      },
+      "detection": {
+        "what_would_have_worked": "Alert on w3wp spawning shells and on new ASPX files in Exchange virtual directories",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Web-shell detection catches post-exploitation, not the initial code execution."
+      },
+      "response": {
+        "what_would_have_worked": "Web-shell hunt, credential reset, and assume-breach IR on the Exchange host",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Exchange compromise often precedes lateral movement, so scoping must extend to the domain."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SC-7": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Perimeter controls do not block the attack because Exchange OWA/ECP must be internet-reachable for mail flow, so the vulnerable endpoints stay exposed."
+      }
+    }
+  },
+  "CVE-2022-0185": {
+    "name": "Linux Kernel Heap-Based Buffer Overflow Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unprivileged local user opens a filesystem that falls back to legacy Filesystem Context handling and supplies an over-length parameter, overflowing the kernel heap in legacy_parse_param to corrupt adjacent objects and escalate to root, including breaking out of a container.",
+      "privileges_required": "none (unprivileged local user when unprivileged user namespaces are enabled; otherwise namespaced CAP_SYS_ADMIN)",
+      "complexity": "low — public PoCs reliably weaponize the overflow on affected kernels",
+      "ai_factor": "Not AI-discovered — reported by the Crusaders of Rust CTF team. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Patch to a fixed kernel (or apply a livepatch) and, as an interim mitigation, disable unprivileged user namespaces (kernel.unprivileged_userns_clone=0 / user.max_user_namespaces=0).",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-08-21)",
+        "adequacy": "Patch alone requires a reboot; the namespace-hardening mitigation removes the exploit precondition immediately and should be applied in parallel."
+      },
+      "detection": {
+        "what_would_have_worked": "Monitor for kernel oops in legacy_parse_param and for unprivileged processes creating user namespaces followed by fs-context syscalls.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Exploitation is local and fast; auditd/eBPF syscall telemetry is the practical detection surface."
+      },
+      "response": {
+        "what_would_have_worked": "Treat any host showing the syscall pattern as potentially root-compromised; rebuild container hosts and rotate secrets.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Container escape means blast radius extends to co-tenant workloads on the same node."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-CM-7": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Least-functionality does not disable unprivileged user namespaces by default on many distros, leaving the exploit precondition present unless kernel.unprivileged_userns_clone is explicitly hardened."
+      }
+    }
+  },
+  "CVE-2021-33045": {
+    "name": "Dahua IP Camera Authentication Bypass Vulnerability (CVE-2021-33045)",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An attacker sends a crafted login packet to an internet-exposed Dahua device specifying the loopback device as the client, which causes the firmware to bypass identity authentication and grant a session without valid credentials.",
+      "privileges_required": "none (unauthenticated network attacker)",
+      "complexity": "low — a single malformed login handshake bypasses authentication.",
+      "ai_factor": "Not AI-discovered — reported to Dahua PSIRT by external researcher. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply Dahua firmware updates and remove cameras from direct internet exposure behind VPN/segmentation.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-08-21)",
+        "adequacy": "Patching helps only where firmware is still maintained; end-of-support and OEM-rebadged units require network isolation or replacement."
+      },
+      "detection": {
+        "what_would_have_worked": "Monitor for loopback-device fields in remote login handshakes and for unauthenticated session establishment on camera ports.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Camera telemetry is rarely centralized, so detection depends on network-level inspection of the proprietary protocol."
+      },
+      "response": {
+        "what_would_have_worked": "Factory-reset compromised devices, rotate credentials, and check for botnet persistence/outbound C2.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Reset is only durable if the device is also removed from direct exposure and patched."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SC-7": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Boundary protection is routinely absent for cameras placed directly on the internet or in flat networks; the auth bypass reaches the device's login service with no perimeter mediation."
+      }
+    }
+  },
+  "CVE-2021-33044": {
+    "name": "Dahua IP Camera Authentication Bypass Vulnerability (CVE-2021-33044)",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unauthenticated remote attacker sends a crafted login packet specifying the NetKeyboard authentication type, which bypasses the credential check and grants an authenticated session to the camera or NVR.",
+      "privileges_required": "none (unauthenticated, network-reachable)",
+      "complexity": "low — single malformed login packet, widely automated by botnets",
+      "ai_factor": "Not AI-discovered — disclosed by Dahua PSIRT. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Update to fixed firmware per Dahua advisory 957 and remove cameras/NVRs from direct internet exposure behind a segmented VLAN/VPN.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-08-21)",
+        "adequacy": "Patch closes the NetKeyboard bypass, but many deployed devices never receive firmware updates, so network isolation is essential."
+      },
+      "detection": {
+        "what_would_have_worked": "Monitor for NetKeyboard-type logins and unexpected outbound connections from camera subnets.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Segmentation plus egress monitoring catches compromised devices even when firmware stays vulnerable."
+      },
+      "response": {
+        "what_would_have_worked": "Factory-reset affected devices, rotate credentials, and isolate the CCTV VLAN.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Reset is only durable once patched firmware is applied."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-IA-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "The authentication mechanism itself is bypassable via the NetKeyboard packet type, so an identification/authentication control that assumes credentials are checked provides no protection."
+      }
+    }
+  },
+  "CVE-2024-23897": {
+    "name": "Jenkins Command Line Interface (CLI) Path Traversal Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An attacker sends a Jenkins CLI command whose argument contains '@' followed by a server file path; the args4j parser substitutes the file's contents, disclosing secrets such as the Jenkins master key that are then used to achieve remote code execution.",
+      "privileges_required": "none (unauthenticated for partial reads; Overall/Read for full-file reads)",
+      "complexity": "low — turnkey public PoCs automate the read-then-RCE chain against exposed controllers.",
+      "ai_factor": "Not AI-discovered — reported by Yaniv Nizry of SonarSource. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Upgrade to Jenkins 2.442 / LTS 2.426.3 (which disable expandAtFiles) or, as interim mitigation, disable CLI access and remove the controller from untrusted networks.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-08-19)",
+        "adequacy": "Patching stops the read, but because secrets may already be exfiltrated, credential and key rotation is required alongside the upgrade."
+      },
+      "detection": {
+        "what_would_have_worked": "Inspect Jenkins access logs for CLI requests containing '@'-prefixed paths and monitor for reads of secret.key/master.key.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Detection catches exploitation attempts but not silent secret theft that already occurred before logging was tuned."
+      },
+      "response": {
+        "what_would_have_worked": "Rotate all Jenkins-stored credentials and signing keys, review pipeline integrity, and hunt for downstream use of leaked secrets.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "A CI compromise can taint every artifact built during the exposure window, so response must extend to the software supply chain."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Public PoCs landed within hours of disclosure; any remediation SLA slower than same-day left internet-facing controllers readable long before patch windows closed."
+      }
+    }
+  },
+  "CVE-2024-28986": {
+    "name": "SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability (CVE-2024-28986)",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An attacker sends a crafted serialized Java object to Web Help Desk; unsafe deserialization instantiates a gadget chain that runs arbitrary OS commands as the WHD service account.",
+      "privileges_required": "none reported in the wild (originally reported unauthenticated; SolarWinds could only reproduce authenticated)",
+      "complexity": "low — a single crafted request drives the deserialization gadget when the host is reachable",
+      "ai_factor": "Not AI-discovered — external researcher disclosure to SolarWinds. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply WHD 12.8.3 Hotfix 1 and remove WHD from direct internet exposure",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-08-15)",
+        "adequacy": "Patch is necessary but the recurring WHD deserialization class means network isolation and deserialization allow-listing are needed alongside it."
+      },
+      "detection": {
+        "what_would_have_worked": "Alert on the WHD/Tomcat Java process spawning cmd/powershell/sh and on serialized-object payloads inbound",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Requires process-lineage telemetry many WHD hosts do not ship by default."
+      },
+      "response": {
+        "what_would_have_worked": "Isolate host, rotate WHD service and integrated-system credentials, hunt for web shells/tooling",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "WHD often holds broad AD/service credentials, so blast radius extends beyond the host."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Flaw remediation via WHD 12.8.3 Hotfix 1 is correct, but the 3-week KEV due window is slow against a CVSS 9.8 deserialization RCE already being exploited on internet-facing help-desk servers."
+      }
+    }
+  },
+  "CVE-2024-38107": {
+    "name": "Microsoft Windows Power Dependency Coordinator Privilege Escalation Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "A local, authenticated attacker triggers a use-after-free in the Windows Power Dependency Coordinator driver to corrupt kernel memory and elevate to SYSTEM, chaining it after an initial foothold to gain full host control.",
+      "privileges_required": "low (local authenticated standard user)",
+      "complexity": "low — reliable enough to be exploited in the wild; requires only local code execution",
+      "ai_factor": "Not AI-discovered — reported to Microsoft and fixed in August 2024. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply the August 2024 Windows security updates; enforce application control (WDAC/AppLocker) to limit which local code can run and reach the driver.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-08-13)",
+        "adequacy": "Patch closes the UAF, but between patch release and endpoint rollout the only mitigation is limiting local code execution."
+      },
+      "detection": {
+        "what_would_have_worked": "EDR rules for privilege-transition to SYSTEM from a medium-integrity parent and anomalous pdc.sys interactions.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Kernel-driver UAFs leave little payload signature; behavioral token-elevation telemetry is the primary detection."
+      },
+      "response": {
+        "what_would_have_worked": "Treat the endpoint as SYSTEM-compromised: isolate, hunt for follow-on persistence and credential theft, and reimage if confirmed.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "SYSTEM privilege enables credential dumping and defense evasion, so response must assume broader host compromise."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Staged monthly Windows patching leaves endpoints exposed for weeks after the KEV add, during which the SYSTEM-grade LPE is already being used post-foothold."
+      }
+    }
+  },
+  "CVE-2024-38106": {
+    "name": "Microsoft Windows Kernel Privilege Escalation Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "After gaining initial low-privilege code execution (e.g. via a Chromium renderer sandbox escape), the attacker triggers a Windows Kernel race condition to corrupt kernel state and elevate to SYSTEM. Exploitation depends on repeatedly winning the race.",
+      "privileges_required": "low (local, requires an existing foothold)",
+      "complexity": "high — success requires winning a kernel race condition, per the CISA KEV note",
+      "ai_factor": "Not AI-discovered — found in-the-wild by Microsoft threat intelligence. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply the August 2024 cumulative update; reduce initial-access surface (browser hardening, application allowlisting) so an attacker cannot reach the kernel-race trigger.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-08-13)",
+        "adequacy": "Because it was a zero-day, patching offered no protection during the pre-disclosure window; layered exploit-mitigation and least-privilege were the only pre-patch defenses."
+      },
+      "detection": {
+        "what_would_have_worked": "EDR behavioral detection of SYSTEM token theft / handle-duplication from a sandboxed child process and browser-to-kernel chaining.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Detection can surface the escalation attempt but not stop a successful race win."
+      },
+      "response": {
+        "what_would_have_worked": "Reimage compromised hosts, rotate credentials cached on the machine, and hunt for post-SYSTEM persistence and lateral movement.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "SYSTEM-level compromise implies full host takeover; response must assume total credential exposure."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-4": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Standard endpoint monitoring rarely flags a race-condition kernel EoP; without behavioral SYSTEM-token-theft detection the escalation step is invisible, and no patch existed to remediate during the zero-day window."
+      }
+    }
+  },
+  "CVE-2024-38193": {
+    "name": "Microsoft Windows Ancillary Function Driver for WinSock Privilege Escalation Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "A local, low-privileged process abuses a use-after-free in afd.sys (the WinSock Ancillary Function Driver) to corrupt kernel memory and elevate to SYSTEM, after which Lazarus installs the FudModule rootkit to disable security monitoring.",
+      "privileges_required": "low (local authenticated user / initial foothold)",
+      "complexity": "low — reliable exploitation demonstrated in the wild and in public PoCs",
+      "ai_factor": "Not AI-discovered — found in-the-wild by Gen Digital (Avast) researchers. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply the August 2024 Windows cumulative update and reboot; enforce least-privilege to limit the initial foothold",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-08-13)",
+        "adequacy": "Patch closes the UAF, but as a zero-day it was exploited before fixes existed, so behavioral kernel-integrity controls matter."
+      },
+      "detection": {
+        "what_would_have_worked": "Kernel-integrity/attack-surface-reduction telemetry flagging afd.sys IOCTL abuse and rootkit-driven callback tampering",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "FudModule disables EDR callbacks, so detection must occur at or before the escalation, not after."
+      },
+      "response": {
+        "what_would_have_worked": "Isolate and reimage affected hosts, rotate credentials, and hunt for FudModule persistence across the environment",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "A rootkit foothold undermines trust in the host, so reimaging is the reliable response."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-3": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Signature-based malicious-code protection is precisely what FudModule disables post-escalation, so it cannot be relied on to catch this chain."
+      }
+    }
+  },
+  "CVE-2024-38213": {
+    "name": "Microsoft Windows SmartScreen Security Feature Bypass Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An attacker stages a payload on a WebDAV share and lures the user to copy-paste it locally; the copied file lacks Mark-of-the-Web, so opening it skips SmartScreen and Protected View, executing without reputation checks.",
+      "privileges_required": "none (unauthenticated remote attacker, but requires user interaction to copy and open the file)",
+      "complexity": "low — the bypass is reliable, though it depends on social-engineering the user into a copy-paste and open",
+      "ai_factor": "Not AI-discovered — found by Trend Micro ZDI Threat Hunting. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply the August 2024 Windows cumulative update, block outbound WebDAV/WebClient service, and restrict search-ms/UNC lure handling.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-08-13)",
+        "adequacy": "The patch restores MotW tagging, but the WebClient/WebDAV exposure and user copy-paste behaviour remain viable delivery paths for other loaders."
+      },
+      "detection": {
+        "what_would_have_worked": "Hunt for locally-executed files that lack Zone.Identifier despite a remote origin, and for WebDAV connections preceding execution.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Because the bypass strips the very artifact detections key on, detection must shift to WebDAV network telemetry and process lineage."
+      },
+      "response": {
+        "what_would_have_worked": "Isolate infected hosts, remove DarkGate persistence, and rotate credentials harvested by the loader.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "DarkGate is a full loader; treat initial access as leading to broader compromise."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-3": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Malicious-code protection leans on SmartScreen/Protected View reputation checks that this bypass specifically defeats, so SI-3 controls that assume MotW is enforced are silently undermined."
+      }
+    }
+  },
+  "CVE-2024-38178": {
+    "name": "Microsoft Windows Scripting Engine Memory Corruption Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "A victim using Edge in Internet Explorer mode loads attacker-controlled JavaScript (delivered via a compromised ad service); the JScript9 JIT performs an incorrect type optimization, producing a type confusion that leads to remote code execution and RokRAT deployment.",
+      "privileges_required": "none (unauthenticated; requires the victim to load attacker content in IE mode — UI:R)",
+      "complexity": "high — high attack complexity (AC:H); a reliable exploit requires the JIT type-confusion primitive and IE-mode reachability",
+      "ai_factor": "Not AI-discovered — attributed to APT37 activity reported by AhnLab and NCSC. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply the August 2024 cumulative update and disable Edge Internet Explorer mode / legacy WebView where not required.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-08-13)",
+        "adequacy": "Patching cannot pre-empt a zero-day; disabling the legacy engine removes the reachable attack surface entirely."
+      },
+      "detection": {
+        "what_would_have_worked": "EDR alerting on iexplore/WebView spawning script hosts, in-memory injection into system32 binaries, and outbound connections to Yandex/pCloud C2.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Detects post-exploitation behavior of RokRAT, not the initial type confusion."
+      },
+      "response": {
+        "what_would_have_worked": "Isolate hosts, hunt for RokRAT in-memory implants and cloud-API C2, force patching and IE-mode removal fleet-wide.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Reactive; surface removal is the durable control."
+      }
+    },
+    "framework_coverage": {
+      "AU-Essential-8-App-Hardening": {
+        "covered": true,
+        "adequate": false,
+        "gap": "App-hardening maturity leaves Edge IE mode / legacy WebView enabled by default, keeping the JScript9 engine reachable even on patched systems."
+      }
+    }
+  },
+  "CVE-2024-38189": {
+    "name": "Microsoft Project Remote Code Execution Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An attacker delivers a malicious Microsoft Project file; when the victim opens it (with internet-macro blocking disabled) the flaw yields code execution in the user's context.",
+      "privileges_required": "none (unauthenticated attacker), user interaction required to open the file",
+      "complexity": "low — crafting a malicious .mpp and social-engineering the open is straightforward, though it depends on weakened macro policy.",
+      "ai_factor": "Not AI-discovered — coordinated disclosure via Microsoft MSRC. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply the August 2024 Microsoft update and enforce 'Block macros from running in Office files from the Internet'.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-08-13)",
+        "adequacy": "Patch plus enforced macro-blocking is needed; the exploit specifically targets environments where the macro safeguard is off."
+      },
+      "detection": {
+        "what_would_have_worked": "Alert on Microsoft Project spawning shell or script interpreters.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Behavioral detection catches post-exploitation but not the initial file parse."
+      },
+      "response": {
+        "what_would_have_worked": "Isolate the host, collect the malicious .mpp, and review Office macro-policy state across the fleet.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Response is reactive; enforced macro policy prevents recurrence."
+      }
+    },
+    "framework_coverage": {
+      "AU-Essential-8-App-Hardening": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Configuring Microsoft Office to block internet-origin macros is the compensating control that neutralizes this file-borne RCE, but it is only effective where the baseline is actually enforced."
+      }
+    }
+  },
+  "CVE-2024-32113": {
+    "name": "Apache OFBiz Path Traversal Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unauthenticated attacker embeds path-traversal sequences in the OFBiz controller URI to escape the intended request-to-view mapping and reach restricted screen/controller endpoints, which is then chained to code execution.",
+      "privileges_required": "none (unauthenticated)",
+      "complexity": "low — a crafted HTTP request with traversal segments, per public PoC",
+      "ai_factor": "Not AI-discovered — reported to the Apache OFBiz project (OFBIZ-13006). No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Upgrade to OFBiz 18.12.13; until patched, apply WAF rules blocking traversal sequences to /webtools/control and restrict endpoint exposure.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-08-07)",
+        "adequacy": "Patching corrects the controller path handling; WAF traversal filters are a stopgap that can be bypassed with alternate encodings."
+      },
+      "detection": {
+        "what_would_have_worked": "Alert on traversal encodings ('..;/', '%2e%2e') in /webtools/control requests and on anonymous access to normally-authenticated endpoints.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Multiple traversal encodings exist, so decode-normalized detection is more reliable than literal string matching."
+      },
+      "response": {
+        "what_would_have_worked": "Review OFBiz access logs for traversal patterns reaching restricted endpoints, rotate credentials, and rebuild confirmed-compromised hosts.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Because the traversal chains to RCE, treat any confirmed hit as full host compromise."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-AC-3": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Traversal in the controller lets requests reach endpoints the access model intended to protect, bypassing the authorization mapping the control relies on."
+      }
+    }
+  },
+  "CVE-2024-36971": {
+    "name": "Android Kernel Remote Code Execution Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "A local attacker manipulates UDP-socket destination-cache state so that __dst_negative_advice() releases a dst entry out of RCU order, causing a use-after-free that is groomed into kernel memory corruption and privilege escalation.",
+      "privileges_required": "low (local code execution on the device; CVSS AV:L/PR:L)",
+      "complexity": "high — reliable kernel-heap grooming of a race-condition UAF requires sophistication, consistent with TAG-observed targeted use",
+      "ai_factor": "Not AI-discovered — root cause tracked by Clement Lecigne (Google TAG). No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply the kernel fix / September 2024 Android security patch level; on servers, update to fixed stable kernels and reboot.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-08-07)",
+        "adequacy": "Patch delivery on fragmented Android OEM fleets lags disclosure, so the exposure window is long even when a fix exists."
+      },
+      "detection": {
+        "what_would_have_worked": "Kernel crash/exploit telemetry and mobile EDR flagging privilege-escalation behavior on managed devices.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Kernel-level LPE is largely invisible to userspace controls; detection is limited."
+      },
+      "response": {
+        "what_would_have_worked": "Force OS updates via MDM, retire devices that cannot receive the patch, investigate targeted users for follow-on spyware.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "TAG-observed targeting suggests spyware chains; scope beyond the single device to the targeted individual."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Kernel flaw remediation on mobile/embedded fleets depends on OEM backport cadence; the observed targeted exploitation preceded broad OTA availability, outrunning any patch SLA."
+      }
+    }
+  },
+  "CVE-2018-0824": {
+    "name": "Microsoft COM for Windows Deserialization of Untrusted Data Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An attacker delivers a crafted serialized COM object via a file or script; the Windows COM runtime unsafely deserializes it (UnmarshalPwn), yielding privilege escalation and code execution on unpatched hosts.",
+      "privileges_required": "low — typically a local/medium-integrity foothold escalated to SYSTEM (UI:R indicates a delivered file/script)",
+      "complexity": "low — a reliable public PoC exists and the technique is a well-known post-exploitation primitive",
+      "ai_factor": "Not AI-discovered — reported by Code White researchers. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply the May 2018 Microsoft security update and retire or isolate unsupported Windows builds that can no longer receive it.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-08-05)",
+        "adequacy": "Patch fully fixes supported builds, but legacy/unsupported Windows versions remain exploitable, so isolation or replacement is required there."
+      },
+      "detection": {
+        "what_would_have_worked": "EDR rules for anomalous COM object instantiation and known UnmarshalPwn tooling, plus alerting on unexpected SYSTEM-level child processes.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Because the primitive rides legitimate COM marshalling, behavioral EDR is more reliable than signatures."
+      },
+      "response": {
+        "what_would_have_worked": "Rebuild compromised hosts, rotate local and cached-domain credentials, and confirm the OS patch level after re-imaging.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "As an escalation primitive it usually appears mid-intrusion, so response must assume prior initial access."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "The flaw was patched in 2018 but reached KEV in 2024, meaning long-lived unpatched Windows hosts remained exploitable for years — flaw-remediation programs that leave legacy Windows 7/Server 2008/2012 systems unpatched miss this LPE-to-RCE primitive."
+      }
+    }
+  },
+  "CVE-2024-37085": {
+    "name": "VMware ESXi Authentication Bypass Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "After gaining a foothold with sufficient AD permissions, ransomware operators delete and re-create the 'ESXi Admins' group in Active Directory; the AD-joined ESXi host re-grants full administrative access by group name, giving the attacker hypervisor control to encrypt all hosted VMs.",
+      "privileges_required": "low-to-high (post-compromise AD account able to create/modify the ESXi-admin group)",
+      "complexity": "low — a few AD group operations, no exploit primitive; publicly documented by Microsoft",
+      "ai_factor": "Not AI-discovered — found by Microsoft threat researchers. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply ESXi 8.0 U3 / VMSA-2024-0013 mitigations, bind hypervisor admin to a specific verified group and remove name-based AD trust",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-07-30)",
+        "adequacy": "Patch/mitigation stops the re-grant, but AD-integrated ESXi should also be isolated from tier-0 AD compromise paths."
+      },
+      "detection": {
+        "what_would_have_worked": "Alert on creation/modification of any group named 'ESXi Admins' and on new ESXi admin logins",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Detection depends on AD auditing that many environments do not forward for hypervisor-admin groups."
+      },
+      "response": {
+        "what_would_have_worked": "Immediate isolation of ESXi management, AD privileged-account reset, and VM-backup integrity checks",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "By the time it fires, mass VM encryption may already be underway."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-AC-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Account-management controls do not detect that ESXi re-authorizes an AD group purely by name; deleting and re-creating 'ESXi Admins' re-grants full admin outside normal account provisioning review."
+      }
+    }
+  },
+  "CVE-2023-45249": {
+    "name": "Acronis Cyber Infrastructure (ACI) Insecure Default Password Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "A remote unauthenticated attacker uses the shipped default password to access the ACI web portal / PostgreSQL database, then uploads SSH keys to gain root on the appliance and execute arbitrary commands.",
+      "privileges_required": "none (unauthenticated — default credentials)",
+      "complexity": "low — a Metasploit module fully automates the default-credential-to-root chain",
+      "ai_factor": "Not AI-discovered — Acronis vendor investigation of a customer intrusion. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Upgrade to a fixed ACI build and rotate all default credentials; restrict management-plane exposure to the internet.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-07-29)",
+        "adequacy": "The fixed build removes the insecure default, but any appliance that already accepted the default credential must also rotate secrets and check for planted SSH keys."
+      },
+      "detection": {
+        "what_would_have_worked": "Alert on new SSH authorized_keys entries, portal logins from unexpected sources, and crypto-mining process/network signatures.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Default-credential logins look legitimate; SSH-key and mining indicators are the reliable tells."
+      },
+      "response": {
+        "what_would_have_worked": "Remove planted keys, rebuild affected appliances, and rotate all stored credentials and API tokens.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Root access via SSH key implies durable persistence; assume full compromise."
+      }
+    },
+    "framework_coverage": {
+      "PCI-DSS-4.0-2.2.3": {
+        "covered": true,
+        "adequate": false,
+        "gap": "The vendor-default-account requirement is exactly the gap: the appliance shipped with a usable default password that operators did not change, yielding unauthenticated RCE."
+      }
+    }
+  },
+  "CVE-2024-5217": {
+    "name": "ServiceNow Incomplete List of Disallowed Inputs Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unauthenticated attacker submits a crafted jvar_page_title value to /login.do containing Glide/Jelly expression syntax; the GlideExpression sanitizer's incomplete disallowed-input list lets the payload reach server-side template evaluation, yielding remote code execution and data exfiltration.",
+      "privileges_required": "none (unauthenticated network attacker)",
+      "complexity": "low — a single crafted login request triggers evaluation; chaining with CVE-2024-4879 broadens impact.",
+      "ai_factor": "Not AI-discovered — reported by Assetnote. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply the June 2024 ServiceNow patches/hot fixes for all three chained CVEs; restrict instance exposure and enforce IP allowlisting where feasible.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-07-29)",
+        "adequacy": "Patching closes the sanitizer gap, but exposed instances were scanned within days, so patch alone left a live exploitation window that also required WAF/monitoring."
+      },
+      "detection": {
+        "what_would_have_worked": "Alert on /login.do requests with expression-language content in jvar_page_title and on anomalous sys_user bulk reads.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Detection needs application-layer request logging that captures parameter contents, not just access logs."
+      },
+      "response": {
+        "what_would_have_worked": "Assume data exposure: rotate ServiceNow credentials/secrets, review OAuth tokens, and hunt for exfiltration of user tables.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Credential rotation is essential because the exploit's proven goal was dumping user/credential data."
+      }
+    },
+    "framework_coverage": {
+      "PCI-DSS-4.0-6.2.4": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Input-validation control expectations were not met by the GlideExpression sanitizer's incomplete disallowed-input list, allowing template-injection payloads through."
+      }
+    }
+  },
+  "CVE-2024-4879": {
+    "name": "ServiceNow Improper Input Validation Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unauthenticated attacker submits a Jelly/Glide template expression to a public UI macro; the Now Platform evaluates it server-side, giving arbitrary expression/code execution and access to instance data.",
+      "privileges_required": "none (unauthenticated, internet-reachable)",
+      "complexity": "low — a single ${...} payload against a public page, widely automated after public analysis",
+      "ai_factor": "Not AI-discovered — reported to ServiceNow with public analysis by Assetnote. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply the KB1645154 patches/hot fixes and deploy WAF rules blocking Jelly template syntax on public endpoints as an interim virtual patch.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-07-29)",
+        "adequacy": "Patch is definitive; WAF virtual-patching covers the window before self-hosted instances are updated."
+      },
+      "detection": {
+        "what_would_have_worked": "Alert on ${...} Jelly syntax in requests to unauthenticated UI pages and on anomalous GlideRecord/bulk queries.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Payload signatures are distinctive and detectable at the WAF/log layer."
+      },
+      "response": {
+        "what_would_have_worked": "Assume data exposure, rotate instance credentials/integration tokens, and hunt for chained exploitation of related ServiceNow CVEs.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Preauth RCE implies full instance data was reachable."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SC-7": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Internet-facing Now Platform instances present the vulnerable UI macros pre-authentication, so boundary controls that assume login-gated access do not apply."
+      }
+    }
+  },
+  "CVE-2024-39891": {
+    "name": "Twilio Authy Information Disclosure Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An attacker submitted large batches of phone numbers to an unauthenticated Authy API endpoint, which replied indicating whether each number was registered, enabling mass enumeration of Authy users for downstream phishing and SIM-swap targeting.",
+      "privileges_required": "none (unauthenticated public API)",
+      "complexity": "low — a trivial script iterating phone numbers against an open endpoint.",
+      "ai_factor": "Not AI-discovered — identified by Twilio following in-the-wild abuse. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Require authentication and enforce abuse-rate limiting on the endpoint (as Twilio ultimately did) so anonymous bulk lookups are impossible.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-07-23)",
+        "adequacy": "Securing the endpoint stops future enumeration, but data already leaked to ShinyHunters cannot be recalled, so user-facing anti-phishing guidance is also needed."
+      },
+      "detection": {
+        "what_would_have_worked": "API abuse monitoring alerting on high-volume phone-number lookups from single sources.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Without pre-existing rate/abuse telemetry the enumeration ran undetected until the leak surfaced."
+      },
+      "response": {
+        "what_would_have_worked": "Notify affected users, push app updates, and warn of imminent smishing/social-engineering attempts.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Response mitigates downstream harm but cannot undo the disclosure of the phone-number dataset."
+      }
+    },
+    "framework_coverage": {
+      "GDPR-Art32": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Security-of-processing obligations were unmet because personal data (phone-number registration status) was disclosable without authentication or abuse-rate controls."
+      }
+    }
+  },
+  "CVE-2012-4792": {
+    "name": "Microsoft Internet Explorer Use-After-Free Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "A victim using IE 6-8 visits a crafted (often watering-hole) page whose script grooms the heap and accesses a freed CDwnBindInfo object, giving the attacker arbitrary code execution in the browser context.",
+      "privileges_required": "none (unauthenticated; requires the victim to browse to attacker-controlled/compromised content)",
+      "complexity": "low — reliable public exploit code (Metasploit) exists, though it depends on the victim visiting a malicious page",
+      "ai_factor": "Not AI-discovered — surfaced through December 2012 in-the-wild watering-hole attacks and Microsoft/vendor analysis. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply MS13-008 and, decisively, retire end-of-life Internet Explorer 6-8",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-07-23)",
+        "adequacy": "The product is EOL; only disconnecting/replacing IE fully removes the exposure, so the patch is a stopgap."
+      },
+      "detection": {
+        "what_would_have_worked": "Detect iexplore.exe spawning child processes and heap-spray patterns in served HTML",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Memory-only UAF exploitation evades signature AV, limiting endpoint detection."
+      },
+      "response": {
+        "what_would_have_worked": "Isolate affected hosts, hunt for dropped implants from the watering-hole, migrate off IE",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Drive-by delivery from a trusted site means many users may be hit before response begins."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Flaw remediation shipped as MS13-008, but the impacted IE is end-of-life; SI-2 does not force retirement of the unsupported browser that still renders attacker HTML."
+      }
+    }
+  },
+  "CVE-2022-22948": {
+    "name": "VMware vCenter Server Incorrect Default File Permissions Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "A user with non-administrative access to vCenter Server reads sensitive files exposed by incorrect default file permissions, harvesting configuration data and secrets that enable privilege escalation and lateral movement in the virtualization estate.",
+      "privileges_required": "low (non-administrative authenticated vCenter access)",
+      "complexity": "low — exploitation is reading over-permissioned files; no memory corruption or special tooling",
+      "ai_factor": "Not AI-discovered — reported to VMware and fixed in VMSA-2022-0009. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply the VMSA-2022-0009 updates that correct the file permissions; audit appliance file ACLs and restrict non-admin access to the management plane.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-07-17)",
+        "adequacy": "Patch corrects the ACLs, but any secrets read before patching should be considered exposed and rotated."
+      },
+      "detection": {
+        "what_would_have_worked": "Audit-log review of non-administrative accounts accessing sensitive appliance files and subsequent anomalous authentications.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "File reads by an authorized-but-low-privileged account are quiet; detection relies on downstream credential-misuse signals."
+      },
+      "response": {
+        "what_would_have_worked": "Rotate any credentials/secrets stored on the vCenter appliance and review privileged authentications for misuse.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Because the flaw yields secrets, response must assume harvested credentials and rotate them."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-AC-6": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Least-privilege role design cannot remediate a vendor-shipped incorrect-default-permission that exposes secrets to non-administrative accounts; only the vendor patch or an explicit ACL fix closes it."
+      }
+    }
+  },
+  "CVE-2024-28995": {
+    "name": "SolarWinds Serv-U Path Traversal Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unauthenticated attacker sends a crafted HTTP request to the Serv-U web client with traversal sequences (mixed Windows/Unix separators and encodings) in path parameters, causing the server to read and return files outside the served directory, including config and credential files.",
+      "privileges_required": "none (unauthenticated, network via HTTP)",
+      "complexity": "low — a single crafted GET with public PoCs; trivially scriptable for mass scanning",
+      "ai_factor": "Not AI-discovered — reported by researcher Hussein Daher. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply Serv-U 15.4.2 Hotfix 2; restrict inbound access to the Serv-U web interface to trusted networks and place it behind a VPN/WAF that normalizes and blocks traversal sequences.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-07-17)",
+        "adequacy": "Patching closes the flaw, but exposed appliances were scanned within days, so network restriction was needed immediately as a compensating control."
+      },
+      "detection": {
+        "what_would_have_worked": "Alert on Serv-U requests containing traversal tokens and on reads of sensitive host paths returned by the service.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Detection reveals reconnaissance/exfiltration attempts but does not stop file disclosure."
+      },
+      "response": {
+        "what_would_have_worked": "Rotate any credentials or keys stored in files readable from the Serv-U host; review access logs for successful traversal reads.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Once config/credential files are read, response must assume those secrets are compromised."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-AC-3": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Access-enforcement controls are bypassed because the traversal reads files entirely outside the application's authorization model, requiring no valid account."
+      }
+    }
+  },
+  "CVE-2024-34102": {
+    "name": "Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE) Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unauthenticated attacker POSTs a crafted XML document referencing an external entity to Magento's guest-cart REST/GraphQL endpoint; the parser resolves the entity (CosmicSting), leaking the encryption key and files, and chained with object injection achieves remote code execution and skimmer/webshell deployment.",
+      "privileges_required": "none (unauthenticated, no user interaction)",
+      "complexity": "low — public PoCs and mass-scanning make weaponization trivial",
+      "ai_factor": "Not AI-discovered — reported by researcher 'spacewasp'; exploitation analyzed by Sansec/Assetnote. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply Adobe's June 2024 patch (APSB24-40) and the isolated CosmicSting hotfix, and rotate the Magento crypt key after patching",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-07-17)",
+        "adequacy": "Patching alone is insufficient if the encryption key was already leaked pre-patch, so key rotation is mandatory."
+      },
+      "detection": {
+        "what_would_have_worked": "WAF/log detection of XML DOCTYPE/external-entity payloads to cart APIs and outbound OAST callbacks during parsing",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Blind XXE exfiltrates via out-of-band channels, so egress and callback monitoring is needed."
+      },
+      "response": {
+        "what_would_have_worked": "Rotate crypt keys and admin credentials, scan for injected skimmers/webshells, and audit for unauthorized admin accounts",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Leaked keys enable persistent admin-session forgery, so credential and key rotation is essential."
+      }
+    },
+    "framework_coverage": {
+      "PCI-DSS-4.0-6.3.3": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Payment-card patch requirements lag the near-immediate skimmer deployment on compromised commerce sites."
+      }
+    }
+  },
+  "CVE-2024-36401": {
+    "name": "OSGeo GeoServer GeoTools Eval Injection Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unauthenticated attacker sends an OGC request (WFS/WMS/WPS) whose property name is a JXPath expression; GeoServer evaluates it via the GeoTools/commons-jxpath path and executes arbitrary code.",
+      "privileges_required": "none (unauthenticated against a default GeoServer install)",
+      "complexity": "low — a single crafted OGC request with a public expression payload",
+      "ai_factor": "Not AI-discovered — reported via the GeoServer/GeoTools GHSA advisory process. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Upgrade to GeoServer 2.22.6/2.23.6/2.24.4/2.25.2, or as a stopgap remove the gt-complex-x.y.jar, and place OGC endpoints behind authentication/network controls.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-07-15)",
+        "adequacy": "The jar-removal workaround can break functionality, so patching is the durable fix; unauthenticated OGC exposure should still be reduced at the boundary."
+      },
+      "detection": {
+        "what_would_have_worked": "Alert on OGC request parameters containing exec()/Runtime references and on the GeoServer JVM spawning children.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Signatures on expression payloads help but obfuscated JXPath can evade naive rules; process-lineage monitoring is more robust."
+      },
+      "response": {
+        "what_would_have_worked": "Isolate the host, remove dropped miners/webshells, and rebuild given confirmed RCE.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Widespread commodity exploitation means assume secondary payloads (miners, backdoors) landed."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "The 2024-08-05 KEV due date lagged the near-immediate mass exploitation of a preauth RCE affecting every default GeoServer install; SI-2 remediation windows are too slow for this exposure."
+      }
+    }
+  },
+  "CVE-2024-23692": {
+    "name": "Rejetto HTTP File Server Template Engine Injection Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unauthenticated attacker sends an HTTP request whose 'search' parameter contains HFS template macros with an empty Host header to bypass filtering; the server evaluates the injected {.exec.}/{.chr.} macros and runs arbitrary OS commands.",
+      "privileges_required": "none (unauthenticated, no user interaction)",
+      "complexity": "low — single crafted HTTP request; weaponized Metasploit module and exploit-db PoCs are public",
+      "ai_factor": "Not AI-discovered — disclosed by a Positive Technologies researcher. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Migrate off the unsupported 2.3m branch (e.g. to HFS 3.x) or decommission it; restrict the service with authentication and take it off the public Internet.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-07-09)",
+        "adequacy": "No patch exists for the EoL branch, so migration/removal — not patching — is the only durable fix."
+      },
+      "detection": {
+        "what_would_have_worked": "IPS/WAF signatures for HFS macro tokens and empty Host headers; alerting on hfs.exe spawning cmd.exe/powershell.exe.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Signatures help but macro obfuscation via {.chr.} can evade naive rules."
+      },
+      "response": {
+        "what_would_have_worked": "Isolate the host, hunt for dropped miners/loaders and new persistence, rebuild and migrate to a supported file server.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Reactive; the surface persists until the EoL software is removed."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "SI-2 flaw remediation has no vendor patch to apply for EoL HFS 2.3m; only decommission/migration mitigates."
+      }
+    }
+  },
+  "CVE-2024-38080": {
+    "name": "Microsoft Windows Hyper-V Privilege Escalation Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "A local attacker who already has code execution as a standard user triggers an integer overflow in Windows Hyper-V to elevate to SYSTEM, enabling full host compromise.",
+      "privileges_required": "low (authenticated local user)",
+      "complexity": "low — once the attacker has a foothold, the overflow is triggered locally with no user interaction.",
+      "ai_factor": "Not AI-discovered — coordinated disclosure via Microsoft MSRC. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply the July 2024 cumulative update and reboot Hyper-V hosts.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-07-09)",
+        "adequacy": "Patching is authoritative, but as a local-EoP it is most valuable when paired with strong initial-access prevention so an attacker never reaches the escalation primitive."
+      },
+      "detection": {
+        "what_would_have_worked": "Detect standard-user processes acquiring SYSTEM tokens and anomalous Hyper-V driver interaction.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Token-elevation detection is high-value but requires deep endpoint telemetry."
+      },
+      "response": {
+        "what_would_have_worked": "Contain the affected host, reset credentials exposed to a SYSTEM-level attacker, and verify patch/reboot state.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "SYSTEM-level access implies full host compromise; rebuild may be warranted."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-AC-6": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Least-privilege limits initial access but cannot stop a local user from escalating to SYSTEM once this Hyper-V integer overflow is reachable."
+      }
+    }
+  },
+  "CVE-2024-38112": {
+    "name": "Microsoft Windows MSHTML Platform Spoofing Vulnerability (CVE-2024-38112)",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "A victim opens a crafted .url internet-shortcut whose URL uses the 'mhtml:' scheme and an '!x-usc:' directive; Windows invokes the retired Internet Explorer/MSHTML engine to render attacker-hosted HTML/HTA, spoofing the perceived file type and executing code (Void Banshee delivered the Atlantida stealer this way).",
+      "privileges_required": "none (unauthenticated remote), requires user to open the .url file",
+      "complexity": "high — the CVSS vector marks AC:H, reflecting the crafted mhtml/!x-usc handler chain plus required user interaction",
+      "ai_factor": "Not AI-discovered — reported by Check Point Research (Haifei Li); campaign analysis by Check Point/Trend Micro. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply the July 2024 Windows update and disable/remove the legacy Internet Explorer/MSHTML rendering path and mshta.exe execution via application control.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-07-09)",
+        "adequacy": "Patching removes the mhtml handler abuse, but disabling the retired IE engine and mshta is needed to blunt the broader legacy-component attack surface."
+      },
+      "detection": {
+        "what_would_have_worked": "Hunt for .url files containing 'mhtml:' and '!x-usc:', and alert on explorer.exe spawning iexplore.exe/mshta.exe followed by HTA execution.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "The .url lure looks benign, so process-lineage and file-content detection outperform extension-based filtering."
+      },
+      "response": {
+        "what_would_have_worked": "Isolate the host, hunt for the Atlantida stealer / infostealer artifacts, rotate credentials that may have been harvested, and reimage confirmed hits.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "The payload is a credential-stealer, so mass credential rotation is required after any confirmed execution."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-CM-7": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Least-functionality that fully removes/disables the legacy Internet Explorer/MSHTML rendering path would have blunted the technique; leaving the retired engine reachable kept the attack surface alive."
+      }
+    }
+  },
+  "CVE-2024-20399": {
+    "name": "Cisco NX-OS Command Injection Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An attacker who already holds Administrator credentials passes crafted input as the argument of an affected NX-OS configuration CLI command; insufficient argument validation lets the input execute as an arbitrary root command on the underlying Linux OS, escaping the restricted CLI.",
+      "privileges_required": "high (authenticated Administrator credentials required)",
+      "complexity": "low — CVSS AC:L once admin access is held; a crafted CLI argument suffices",
+      "ai_factor": "Not AI-discovered — discovered by Sygnia during a Velvet Ant investigation. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply Cisco's fixed NX-OS release and enforce phishing-resistant MFA plus strict least-privilege on switch admin accounts.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-07-02)",
+        "adequacy": "Patch alone is insufficient because the real leverage is stolen admin credentials; credential hardening and monitoring are co-equal controls."
+      },
+      "detection": {
+        "what_would_have_worked": "Out-of-band monitoring for unexpected root/bash processes on Nexus devices and integrity checks that do not rely on NX-OS command accounting.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "The exploit runs beneath the CLI-logging layer, so standard command-accounting detection is blind to it."
+      },
+      "response": {
+        "what_would_have_worked": "Forensically image affected switches, hunt for Velvet Ant custom malware, rotate all admin credentials, rebuild from verified images.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "State-actor persistence on network gear survives reboots; assume the device is fully compromised."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-4": {
+        "covered": true,
+        "adequate": false,
+        "gap": "System monitoring is undermined because the exploit executes below the NX-OS command-accounting layer, so detection controls relying on CLI logs miss it."
+      }
+    }
+  },
+  "CVE-2020-13965": {
+    "name": "Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An attacker emails a crafted text/xml attachment; when the victim previews it in a vulnerable Roundcube version, attacker JavaScript runs in the authenticated webmail session and can steal mail, contacts, and session tokens.",
+      "privileges_required": "none for the attacker (unauthenticated email delivery); requires the victim to preview the attachment",
+      "complexity": "low — send an email; exploitation triggers on preview with a public technique",
+      "ai_factor": "Not AI-discovered — reported through Roundcube coordinated disclosure. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Upgrade to Roundcube 1.3.12 / 1.4.5+ which removes text/xml from inline-preview allowed types, and enforce a strict Content-Security-Policy on the webmail app.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-06-26)",
+        "adequacy": "Patch closes the specific vector, but a hardening CSP is needed to blunt the broader class of webmail XSS."
+      },
+      "detection": {
+        "what_would_have_worked": "Mail-gateway rules flagging XML attachments and monitoring for anomalous mailbox forwarding-rule creation or session-token reuse.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Detection helps but the script runs client-side inside the session, so prevention via patch + CSP is primary."
+      },
+      "response": {
+        "what_would_have_worked": "Invalidate sessions, reset affected mailbox credentials, and review forwarding rules and sent-mail for exfiltration.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Because the target is mailbox data, response must assume mail and contacts were read."
+      }
+    },
+    "framework_coverage": {
+      "UK-CAF-C1": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Security monitoring focused on network indicators misses client-side script execution within the webmail DOM, delaying detection of mailbox exfiltration."
+      }
+    }
+  },
+  "CVE-2022-2586": {
+    "name": "Linux Kernel Use-After-Free Vulnerability (CVE-2022-2586)",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "A local user obtains CAP_NET_ADMIN (often via an unprivileged user namespace), creates an nft object referencing a set in another table, deletes that table to free the set, and reclaims the dangling object to corrupt kernel memory and escalate to root.",
+      "privileges_required": "low (local user with CAP_NET_ADMIN in any user or network namespace)",
+      "complexity": "low — reliable public PoC with high success rates",
+      "ai_factor": "Not AI-discovered — found by Team Orca of Sea Security with Trend Micro ZDI. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Patch/reboot to the fixed kernel and disable unprivileged user namespaces where not required",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-06-26)",
+        "adequacy": "Patching removes the UAF; disabling unprivileged userns is the key stopgap until the reboot window."
+      },
+      "detection": {
+        "what_would_have_worked": "Auditd/eBPF monitoring for unprivileged-userns + nftables syscall bursts and unexpected uid-0 escalation",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Kernel-UAF exploitation is fast and quiet; detection is best-effort."
+      },
+      "response": {
+        "what_would_have_worked": "Isolate the host, assume root compromise, rebuild rather than clean",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "A root-level kernel compromise cannot be reliably remediated in place."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-CM-7": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Least-functionality controls rarely disable unprivileged user namespaces (kernel.unprivileged_userns_clone), which is what grants the CAP_NET_ADMIN needed to reach the nf_tables path."
+      }
+    }
+  },
+  "CVE-2022-24816": {
+    "name": "OSGeo GeoServer JAI-EXT Code Injection Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unauthenticated attacker sends a WPS request to the GeoServer WMS/OWS endpoint invoking the ras:Jiffle process with a Jiffle script containing injected Java; the script is compiled by Janino and executed, giving remote code execution on the server.",
+      "privileges_required": "none (unauthenticated on a default GeoServer install)",
+      "complexity": "low — publicly documented request structure and reproduction environments exist",
+      "ai_factor": "Not AI-discovered — reported to the JAI-EXT/GeoServer projects. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Upgrade jt-jiffle/GeoServer to a fixed version, or as a mitigation remove janino-x.y.z.jar from the classpath to disable Jiffle script compilation.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-06-26)",
+        "adequacy": "Removing janino stops compilation immediately for operators who cannot upgrade at once; the version bump is the durable fix."
+      },
+      "detection": {
+        "what_would_have_worked": "Alert on WPS ras:Jiffle requests to the WMS/OWS endpoint and on the GeoServer JVM spawning child shell processes.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "The malicious request rides the legitimate WPS surface, so behavioral process-spawn telemetry is the stronger signal."
+      },
+      "response": {
+        "what_would_have_worked": "Isolate the host, hunt for web shells and outbound C2, and rebuild if execution is confirmed.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Unauth RCE on an internet-facing map server warrants treating the host as compromised."
+      }
+    },
+    "framework_coverage": {
+      "ISO-27001-2022-A.8.8": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Technical-vulnerability management must track transitive dependencies (jt-jiffle inside GeoServer); a top-level GeoServer inventory alone misses the vulnerable component."
+      }
+    }
+  },
+  "CVE-2024-4358": {
+    "name": "Progress Telerik Report Server Authentication Bypass by Spoofing Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unauthenticated attacker reaches the Report Server registration endpoint on an already-configured instance and, via a spoofed request, creates a new administrator account, then commonly chains CVE-2024-1800 deserialization for remote code execution.",
+      "privileges_required": "none (unauthenticated network attacker)",
+      "complexity": "low — invoking the still-reachable registration endpoint is straightforward.",
+      "ai_factor": "Not AI-discovered — reported by Soroush Dalili and Sina Kheirkhah. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Upgrade to Report Server 2024 Q2 (10.1.24.514) or later; restrict the management interface to trusted networks.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-06-13)",
+        "adequacy": "Patching closes the registration bypass, but internet-exposed servers were exploited quickly, so network restriction was also needed pre-patch."
+      },
+      "detection": {
+        "what_would_have_worked": "Alert on post-setup access to the registration endpoint and on unexpected new administrator accounts.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Detection depends on auditing account-creation events that many deployments do not centralize."
+      },
+      "response": {
+        "what_would_have_worked": "Remove rogue admin accounts, rotate secrets, and inspect for CVE-2024-1800 deserialization follow-on / web shells.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Response must assume RCE occurred where the two CVEs were chained."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-AC-3": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Access enforcement failed at the application layer: the registration endpoint remained reachable and trusted a spoofed identity, so no downstream authorization control was consulted."
+      }
+    }
+  },
+  "CVE-2024-26169": {
+    "name": "Microsoft Windows Error Reporting Service Improper Privilege Management Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "A local low-privileged user manipulates Windows Error Reporting registry values so that the WerFaultSecure service, which runs with a null security descriptor, launches an attacker-controlled process with SYSTEM privileges.",
+      "privileges_required": "low (local authenticated user)",
+      "complexity": "low — reliable registry-based technique proven in Black Basta ransomware intrusions",
+      "ai_factor": "Not AI-discovered — in-the-wild tool analyzed by Symantec; reported to Microsoft. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply the March 2024 cumulative update and restrict/monitor writes to the WER registry keys.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-06-13)",
+        "adequacy": "Patch removes the null-DACL path; since it was a zero-day for Black Basta, detection was the only pre-patch defense."
+      },
+      "detection": {
+        "what_would_have_worked": "EDR rules for WerFault processes spawning SYSTEM shells and standard-user WER registry edits.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "This behavior is a strong ransomware pre-encryption indicator."
+      },
+      "response": {
+        "what_would_have_worked": "Treat as active ransomware staging: isolate the host, hunt for Black Basta tooling, and review for lateral movement.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "SYSTEM escalation in this chain precedes encryption."
+      }
+    },
+    "framework_coverage": {
+      "SOC2-CC7-anomaly-detection": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Anomaly-detection controls that do not baseline WER registry manipulation and WerFault SYSTEM children miss the exact behavior ransomware operators used."
+      }
+    }
+  },
+  "CVE-2024-32896": {
+    "name": "Android Pixel Privilege Escalation Vulnerability (CVE-2024-32896)",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "A locally present, crafted application exploits a logic error in the Pixel firmware/Android Framework to bypass a privilege boundary, escalating from an unprivileged context to system-level privileges without additional execution privileges.",
+      "privileges_required": "none (no additional execution privileges) — local access with user interaction",
+      "complexity": "low — a purpose-built app triggers the logic error; the constraint is local presence on the device.",
+      "ai_factor": "Not AI-discovered — fixed by Google/Android security. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Install the June 2024 Pixel security update (patch level 2024-06-05) / Android 14 QPR3 fix and restrict sideloaded apps via MDM.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-06-13)",
+        "adequacy": "Patching removes the flaw, but the zero-day window before OEM delivery means app-vetting and sideload restrictions are needed as compensating controls."
+      },
+      "detection": {
+        "what_would_have_worked": "Mobile threat defense flagging apps that acquire privileges inconsistent with their declared scope.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "On-device firmware escalation is hard to observe without dedicated MTD tooling."
+      },
+      "response": {
+        "what_would_have_worked": "Update affected Pixels, review for unauthorized apps, and re-provision devices suspected of targeted compromise.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Targeted spyware use may warrant device replacement rather than in-place remediation."
+      }
+    },
+    "framework_coverage": {
+      "AU-ISM-1546": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Mobile-device patching guidance cannot close a firmware logic flaw until the OEM update lands, so the control is insufficient against active zero-day use."
+      }
+    }
+  },
+  "CVE-2024-4577": {
+    "name": "PHP-CGI OS Command Injection Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "On Windows Apache + PHP-CGI with a Best-Fit code page, an unauthenticated attacker sends a request whose soft-hyphen (0xAD) is remapped to '-', injecting PHP-CGI options (auto_prepend_file=php://input, allow_url_include=1) so attacker-supplied PHP executes or script source is disclosed.",
+      "privileges_required": "none (unauthenticated, network)",
+      "complexity": "low — trivial once the Best-Fit code-page precondition is met, with public exploit code widely available",
+      "ai_factor": "Not AI-discovered — reported by DEVCORE (Orange Tsai). No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Upgrade PHP to 8.1.29/8.2.20/8.3.8 and migrate off PHP-CGI to PHP-FPM; if unavoidable, add mod_rewrite rules blocking the encoded option pattern",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-06-12)",
+        "adequacy": "Patch closes it, but leaving the CGI SAPI in place keeps the fragile Best-Fit surface; FPM migration is the durable fix."
+      },
+      "detection": {
+        "what_would_have_worked": "Alert on %AD in query strings, PHP-CGI option strings in requests, and php-cgi.exe spawning shells",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "WAFs not decoding Best-Fit will miss the payload, so host-side process telemetry is important."
+      },
+      "response": {
+        "what_would_have_worked": "Isolate host, hunt for web shells/dropped tooling, rotate credentials reachable from the web root",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Rapid mass exploitation means many hosts were hit before patching completed."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SC-7": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Boundary/WAF rules keyed on literal '-' options miss the Best-Fit 0xAD encoding, so perimeter filtering fails to block the argument injection."
+      }
+    }
+  },
+  "CVE-2024-4610": {
+    "name": "Arm Mali GPU Kernel Driver Use-After-Free Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "A local, non-privileged app performs improper GPU memory-processing operations against the Mali kernel driver to access already-freed memory, using the use-after-free to corrupt kernel memory and escalate privileges or escape the app sandbox.",
+      "privileges_required": "low (local non-privileged app / user)",
+      "complexity": "low — Arm confirmed real-world exploitation; a crafted app can trigger it locally",
+      "ai_factor": "Not AI-discovered — disclosed by Arm in its Mali GPU driver bulletin. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Update to Mali driver r41p0 via the device's OEM/firmware update; on managed fleets, enforce minimum patch-level / firmware policy and retire devices that no longer receive updates.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-06-12)",
+        "adequacy": "The driver fix closes the UAF, but it depends on OEMs shipping it; many devices remain exposed, so device-lifecycle policy is the real control."
+      },
+      "detection": {
+        "what_would_have_worked": "Mobile EDR/MTD watching for Mali driver crashes, kernel-memory corruption, and apps escalating beyond their sandbox.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Kernel-driver UAF exploitation on mobile is stealthy; detection is limited and usually only visible via crash telemetry."
+      },
+      "response": {
+        "what_would_have_worked": "Treat a suspected-exploited device as kernel-compromised: wipe/reset, revoke device-bound credentials, and re-enroll.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Kernel compromise on a mobile device undermines all on-device secrets, so full reset and credential rotation is warranted."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Flaw remediation depends on Arm's fix propagating through SoC vendors and Android OEM update chains, so device patch latency vastly exceeds the exploitation window for this KEV-listed mobile LPE."
+      }
+    }
+  },
+  "CVE-2017-3506": {
+    "name": "Oracle WebLogic Server OS Command Injection Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unauthenticated attacker POSTs a crafted SOAP/XML request to the WebLogic WLS-WSAT endpoint; the server deserializes the work-context XML and, via a ProcessBuilder gadget, executes attacker-supplied OS commands, giving remote code execution.",
+      "privileges_required": "none (unauthenticated, network via HTTP)",
+      "complexity": "high — NVD rates AC:H, but public exploit tooling makes practical exploitation reliable against exposed servers",
+      "ai_factor": "Not AI-discovered — reported via Oracle PSIRT by human researchers. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply the Oracle April 2017 CPU; remove or restrict the WLS-WSAT subcomponent and block the /wls-wsat/ path at the perimeter.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-06-03)",
+        "adequacy": "Patching fixes it, but leaving wls-wsat enabled reintroduces risk via related SOAP flaws; disabling the subcomponent is the durable control."
+      },
+      "detection": {
+        "what_would_have_worked": "Alert on POSTs to wls-wsat with XMLDecoder/ProcessBuilder markers and on the WebLogic JVM spawning shell processes.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Detection is reactive; a single crafted request already runs commands."
+      },
+      "response": {
+        "what_would_have_worked": "Isolate the WebLogic host, remove dropped cryptominers/webshells, and rotate credentials reachable from the server.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Given years of exploitation, assume prior compromise and hunt for established persistence."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-CM-7": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Least-functionality guidance rarely mandates disabling/removing the unused WLS-WSAT (SOAP) subcomponent, leaving the command-injection endpoint enabled by default."
+      }
+    }
+  },
+  "CVE-2024-1086": {
+    "name": "Linux Kernel Use-After-Free Vulnerability (CVE-2024-1086)",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unprivileged local user (often via an unprivileged user namespace) crafts nf_tables rules that make nf_hook_slow() double-free on an NF_DROP verdict carrying a drop error resembling NF_ACCEPT, corrupting kernel memory to escalate to root.",
+      "privileges_required": "low (local unprivileged user, user namespaces enabled)",
+      "complexity": "low — a reliable public exploit ('Flipping Pages') bypasses KASLR/SMEP/SMAP across multiple kernels",
+      "ai_factor": "Not AI-discovered — reported by Mingi Cho (Theori); public exploit by Notselwyn. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Upgrade past commit f342de4e2f33 (or apply distro kernel updates/livepatch) and set kernel.unprivileged_userns_clone=0 to remove the reachable attack surface",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-05-30)",
+        "adequacy": "Patch removes the UAF, but reboot lag means disabling unprivileged user namespaces is the fast compensating control."
+      },
+      "detection": {
+        "what_would_have_worked": "Alert on unprivileged processes gaining UID 0 after nf_tables netlink activity and on kernel oops referencing nft_verdict_init/nf_hook_slow",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "In-kernel corruption offers limited userland telemetry, so namespace/netlink monitoring is the main signal."
+      },
+      "response": {
+        "what_would_have_worked": "Isolate the host, rotate credentials, and hunt for ransomware staging following root escalation",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "CISA flags ransomware use, so root escalation should be treated as an active intrusion."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-CM-7": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Least-functionality controls rarely disable unprivileged user namespaces (user.max_user_namespaces), leaving the nf_tables attack surface reachable to any local user."
+      }
+    }
+  },
+  "CVE-2024-24919": {
+    "name": "Check Point Quantum Security Gateways Information Disclosure Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unauthenticated attacker sends a path-traversal request to the gateway's MyCRL endpoint and reads arbitrary appliance files, harvesting credentials and configuration that enable follow-on VPN/lateral access.",
+      "privileges_required": "none (unauthenticated, internet-facing gateway with VPN blades enabled)",
+      "complexity": "low — a single crafted POST with a traversal payload",
+      "ai_factor": "Not AI-discovered — disclosed by Check Point after in-the-wild exploitation. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply the Check Point sk182336 hotfix, then rotate all local accounts, service accounts, and certificates on the gateway because credentials may already be stolen.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-05-30)",
+        "adequacy": "Patching stops the read, but is insufficient alone — any credentials exposed before patching must be assumed compromised and rotated."
+      },
+      "detection": {
+        "what_would_have_worked": "Inspect gateway logs for MyCRL traversal requests and monitor for anomalous VPN/lateral logins using gateway-resident credentials.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "The file read leaves sparse logs; detection often depends on catching the downstream credential reuse."
+      },
+      "response": {
+        "what_would_have_worked": "Rotate all secrets on affected gateways, review VPN session logs, and hunt for lateral movement from harvested accounts.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Because ransomware actors used this for access, treat any pre-patch exposure as a credential breach."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SC-7": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Boundary protection is undermined because the vulnerable component IS the boundary device; SC-7 assumes the gateway is trustworthy, but the traversal turns the VPN concentrator into an unauthenticated file-read oracle."
+      }
+    }
+  },
+  "CVE-2024-4978": {
+    "name": "JAVS Viewer Installer Embedded Malicious Code Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "Users downloaded a trojanized JAVS Viewer 8.3.7 installer from the vendor's supply chain; the installer dropped a malicious fffmpeg.exe that beaconed to a C2 server and executed unauthorized PowerShell, granting attacker control of the courtroom recording host.",
+      "privileges_required": "none from the victim's side beyond running the vendor installer (the CVSS PR:H reflects installer/admin context)",
+      "complexity": "low — running the signed vendor installer is sufficient; no additional exploitation needed",
+      "ai_factor": "Not AI-discovered — investigated and disclosed by Rapid7. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Reinstall from a verified-clean JAVS build, verify authenticode signer continuity before deploying vendor updates, and application-control on binary provenance.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-05-29)",
+        "adequacy": "Updating alone is insufficient — affected hosts must be reimaged and credentials rotated because a backdoor already executed."
+      },
+      "detection": {
+        "what_would_have_worked": "Hash-block fffmpeg.exe (SHA256 421a4ad2...), alert on unexpected authenticode signer for JAVS binaries, and EDR on installer-spawned PowerShell/C2.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Detection requires the published IOCs, which post-date initial distribution."
+      },
+      "response": {
+        "what_would_have_worked": "Reimage affected endpoints, rotate all credentials used on those hosts, and hunt for C2 beacons from the JAVS fleet.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Software update does not remove an already-installed backdoor; reimage is required."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-3": {
+        "covered": true,
+        "adequate": false,
+        "gap": "SI-3 malicious-code protection trusted a signed, vendor-distributed installer and failed to catch the embedded supply-chain backdoor."
+      }
+    }
+  },
+  "CVE-2024-5274": {
+    "name": "Google Chromium V8 Type Confusion Vulnerability (CVE-2024-5274)",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "A user visits a crafted HTML page that triggers a type confusion in V8; the attacker gains code execution and, per the scope-changed CVSS, can affect resources beyond the renderer sandbox.",
+      "privileges_required": "none (unauthenticated), user interaction required to visit the page",
+      "complexity": "low — a single malicious page reaches the flaw; exploitation is drive-by.",
+      "ai_factor": "Not AI-discovered — reported by Google TAG and Chrome Security. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Force-update Chrome to 125.0.6422.112+ and enforce browser relaunch fleet-wide.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-05-28)",
+        "adequacy": "The update is inert until the browser is relaunched; deployment must be paired with enforced restart."
+      },
+      "detection": {
+        "what_would_have_worked": "Monitor for renderer-process crashes and abnormal browser child processes.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Crash telemetry is post-hoc and rarely catches a clean exploit."
+      },
+      "response": {
+        "what_would_have_worked": "Investigate hosts that visited attacker-controlled pages and confirm post-update browser version.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Response depends on browsing history that is often unavailable."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "The gap between Google's emergency release and enterprise browser-relaunch rollout leaves a window that TAG-observed in-the-wild exploitation targets."
+      }
+    }
+  },
+  "CVE-2020-17519": {
+    "name": "Apache Flink Improper Access Control Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unauthenticated attacker sends a GET to the Flink JobManager REST logs endpoint with double-URL-encoded '../' sequences, causing the process to return the contents of any file it can read (config, credentials, /etc/passwd).",
+      "privileges_required": "none (unauthenticated, no auth on the Flink REST interface)",
+      "complexity": "low — a single crafted GET request, widely automated",
+      "ai_factor": "Not AI-discovered — reported to the Apache Flink project. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Upgrade to Flink 1.11.3/1.12.0 and remove the JobManager REST/dashboard from public networks (reverse-proxy auth, network ACLs on port 8081).",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-05-23)",
+        "adequacy": "Patching fixes the traversal, but because Flink's REST interface is unauthenticated by design, network isolation remains necessary to prevent other exposure."
+      },
+      "detection": {
+        "what_would_have_worked": "Alert on '..%252f' sequences to /jobmanager/logs and on the Flink REST port being reachable from untrusted networks.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "The double-encoding is a strong signature, but internet-exposed dashboards are scanned continuously, so exposure reduction matters more than detection."
+      },
+      "response": {
+        "what_would_have_worked": "Assume any secrets/config readable by the JobManager were exfiltrated; rotate credentials and keys, and review access logs for traversal reads.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "File read is limited to the process's access, but that often includes datastore credentials and key material warranting rotation."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SC-7": {
+        "covered": true,
+        "adequate": false,
+        "gap": "The Flink JobManager REST/dashboard (default 8081) is frequently exposed to the internet; boundary protection is the primary missing control since Flink offers no built-in auth on this interface."
+      }
+    }
+  },
+  "CVE-2024-4947": {
+    "name": "Google Chromium V8 Type Confusion Vulnerability (CVE-2024-4947)",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "A victim visits an attacker-controlled page (a fake blockchain/game site in the observed campaign) that runs crafted JavaScript triggering a V8 type confusion, corrupting the heap and executing code inside the renderer sandbox.",
+      "privileges_required": "none (unauthenticated; requires the victim to load a malicious page — CVSS UI:R)",
+      "complexity": "low — CVSS AC:L; a crafted HTML page triggers the type confusion",
+      "ai_factor": "Not AI-discovered — reported by Kaspersky researchers. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Update Chrome/Chromium browsers to 125.0.6422.60+ with auto-update enforced; block the campaign's fake-game delivery domains.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-05-20)",
+        "adequacy": "Patching helps only after disclosure; the pre-patch zero-day window and reliance on user visits require layered browser hardening."
+      },
+      "detection": {
+        "what_would_have_worked": "Web-proxy/DNS blocking of the malicious campaign infrastructure and EDR on renderer exploitation follow-on.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "In-renderer exploitation is hard to observe directly; detection is most effective at the delivery-domain and post-exploitation stages."
+      },
+      "response": {
+        "what_would_have_worked": "Force browser updates, hunt for follow-on payloads on hosts that visited the campaign sites, reset exposed credentials.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Sandbox-contained execution may still stage further exploitation; scope follow-on activity."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-3": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Endpoint malicious-code protection does not reliably stop in-renderer memory-corruption execution delivered from a legitimate-looking site."
+      }
+    }
+  },
+  "CVE-2023-43208": {
+    "name": "NextGen Healthcare Mirth Connect Deserialization of Untrusted Data Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unauthenticated attacker sends a crafted serialized payload to an internet-facing Mirth Connect endpoint; unsafe deserialization leads to OS command execution as the service account, bypassing the incomplete fix for CVE-2023-37679.",
+      "privileges_required": "none (unauthenticated network attacker)",
+      "complexity": "low — a single crafted request with a public Horizon3.ai PoC available",
+      "ai_factor": "Not AI-discovered — discovered by Horizon3.ai. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Upgrade to Mirth Connect 4.4.1+ and restrict the interface listener to trusted HL7 peers via network segmentation.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-05-20)",
+        "adequacy": "Patch is necessary but because the prior fix was incomplete, teams must verify the specific 4.4.1 build and not assume an earlier hotfix sufficed."
+      },
+      "detection": {
+        "what_would_have_worked": "Alert on the Mirth Connect Java process spawning shell/command interpreters and on deserialization-gadget payloads in HTTP bodies.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Given ransomware association, rapid detection of post-exploitation child processes is critical."
+      },
+      "response": {
+        "what_would_have_worked": "Isolate the host, rotate integration and database credentials, assess PHI exposure for breach-notification, and hunt for ransomware precursors.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "PHI exposure triggers regulatory breach-notification duties alongside eviction."
+      }
+    },
+    "framework_coverage": {
+      "GDPR-Art32": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Article 32 'appropriate technical measures' for PHI were undermined by an unauthenticated RCE that grants full access to health-data flows passing through the integration engine."
+      }
+    }
+  },
+  "CVE-2024-4761": {
+    "name": "Google Chromium V8 Out-of-Bounds Memory Write Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "A victim visits an attacker-controlled or compromised web page whose crafted JavaScript triggers an out-of-bounds write in V8, corrupting renderer memory; chained with a sandbox escape this yields code execution on the host.",
+      "privileges_required": "none (unauthenticated); user interaction required (victim loads the page)",
+      "complexity": "high — reliable V8 heap exploitation requires precise memory shaping, but was operationalized as a zero-day",
+      "ai_factor": "Not AI-discovered — reported to Google's Chrome security team. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Force Chrome/Chromium update to 124.0.6367.207+ and relaunch all browser sessions and embedded Chromium runtimes",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-05-16)",
+        "adequacy": "Auto-update helps but only takes effect on relaunch; embedded Chromium apps must be tracked separately."
+      },
+      "detection": {
+        "what_would_have_worked": "EDR alerting on renderer crashes and unexpected child processes spawned from the browser",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Sandbox-escape chains may leave little host-side signal before code execution."
+      },
+      "response": {
+        "what_would_have_worked": "Isolate affected endpoints, hunt for post-exploitation persistence, and force browser relaunch fleet-wide",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Drive-by delivery means many endpoints may be hit simultaneously."
+      }
+    },
+    "framework_coverage": {
+      "ISO-27001-2022-A.8.8": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Technical-vulnerability management often omits embedded Chromium runtimes (Electron apps, WebView) that inherit the same V8 flaw but do not auto-update with the browser."
+      }
+    }
+  },
+  "CVE-2021-40655": {
+    "name": "D-Link DIR-605 Router Information Disclosure Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unauthenticated attacker forges a POST request to /getcfg.php requesting the device account service; the router returns the administrator credentials in cleartext, which are then reused to take over the device.",
+      "privileges_required": "none (unauthenticated)",
+      "complexity": "low — a single crafted request returns the credentials; a public PoC exists",
+      "ai_factor": "Not AI-discovered — public researcher disclosure with PoC. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Retire and replace the EoL DIR-605; until then, block WAN-side access to the management interface and never expose /getcfg.php to the internet.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-05-16)",
+        "adequacy": "No patch exists, so remediation is device replacement; network-boundary controls only reduce exposure."
+      },
+      "detection": {
+        "what_would_have_worked": "Deploy the FortiGuard getcfg.php information-disclosure IPS signature and alert on unauthenticated /getcfg.php requests.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Consumer routers lack native logging; upstream IPS/network monitoring is the only practical detection."
+      },
+      "response": {
+        "what_would_have_worked": "Assume credentials are compromised, change them where the device is retained, and replace the hardware.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Since credentials are disclosed directly, rotation on a still-vulnerable device is only temporary; replacement is required."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-AC-3": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Access enforcement fails at the endpoint: /getcfg.php returns sensitive account data without authenticating or authorizing the requester."
+      }
+    }
+  },
+  "CVE-2014-100005": {
+    "name": "D-Link DIR-600 Router Cross-Site Request Forgery (CSRF) Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An attacker lures an authenticated router administrator to a malicious page that auto-submits forged requests to hedwig.cgi/pigwidgeon.cgi/diagnostic.php, hijacking the admin session to create accounts, enable remote management, or change settings.",
+      "privileges_required": "none for the attacker, but relies on hijacking an authenticated administrator's session (UI/browsing required)",
+      "complexity": "low — a static crafted HTML page performs the forged requests.",
+      "ai_factor": "Not AI-discovered — publicly disclosed by an independent researcher in 2014. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Retire and replace the EOL DIR-600; where still in use, disable remote management and avoid administering the router from a browser used for general web access.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-05-16)",
+        "adequacy": "No patch exists for these EOL revisions, so only device replacement fully removes the risk."
+      },
+      "detection": {
+        "what_would_have_worked": "Monitor for configuration changes and new admin accounts on the router and for cross-origin requests to its CGI endpoints.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Consumer/SMB routers rarely emit centralized logs, limiting detection."
+      },
+      "response": {
+        "what_would_have_worked": "Factory-reset, disable remote management, and replace the device; audit for unauthorized firmware/config.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Reset is temporary on EOL hardware that remains vulnerable to re-exploitation."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "The affected DIR-600 revisions are end-of-life with no forthcoming fix, so flaw-remediation via patching is impossible and the only remedy is device retirement."
+      }
+    }
+  },
+  "CVE-2024-30040": {
+    "name": "Microsoft Windows MSHTML Platform Security Feature Bypass Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An attacker delivers a crafted document that, when opened, causes the MSHTML platform to bypass OLE/mitigation prompts and load malicious content, leading to code execution in the user's context.",
+      "privileges_required": "none (attacker-side), but requires the victim to open the file",
+      "complexity": "low — social-engineering a document open; reliable once delivered",
+      "ai_factor": "Not AI-discovered — reported to Microsoft by vendor/anonymous researchers. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply the May 2024 cumulative update and block/disable OLE object loading in Office plus attachment filtering.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-05-14)",
+        "adequacy": "Patch closes the bypass; app-hardening helps but the flaw specifically defeats the MSHTML feature protections."
+      },
+      "detection": {
+        "what_would_have_worked": "Detect Office/host apps spawning script interpreters or making outbound requests after opening a document.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Process-lineage detection catches post-open execution even against a feature bypass."
+      },
+      "response": {
+        "what_would_have_worked": "Isolate affected hosts, pull the lure document, and hunt for follow-on payloads.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Bypass is typically the first stage of a multi-step intrusion."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-3": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Malicious-code protection that relies on OLE/MSHTML mitigations is exactly what this security-feature bypass defeats, so signature/heuristic AV on the mitigation layer is insufficient."
+      }
+    }
+  },
+  "CVE-2024-30051": {
+    "name": "Microsoft DWM Core Library Privilege Escalation Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "Local code triggers a heap buffer overflow in the DWM Core Library caused by an integer-division size miscalculation in CCommandBuffer::Initialize, corrupting heap memory to gain SYSTEM privileges; QakBot chained it after initial access.",
+      "privileges_required": "low (local authenticated user)",
+      "complexity": "low — reliable public PoCs exist and the flaw was weaponized in commodity malware.",
+      "ai_factor": "Not AI-discovered — reported by Kaspersky/DBAPPSecurity/Google TAG researchers. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Deploy the May 2024 Windows cumulative update and pair it with EDR that blocks the QakBot delivery chain feeding the exploit.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-05-14)",
+        "adequacy": "Patching removes the overflow, but hosts compromised before patching may already have SYSTEM-level implants requiring cleanup."
+      },
+      "detection": {
+        "what_would_have_worked": "EDR alerting on dwmcore.dll heap corruption and on local processes acquiring SYSTEM tokens.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Memory-corruption escalation is only visible with endpoint exploit-protection telemetry, not network monitoring alone."
+      },
+      "response": {
+        "what_would_have_worked": "Isolate infected hosts, eradicate QakBot, and rotate credentials exposed to SYSTEM-level access.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Given ransomware precursor use, response must assume broader intrusion and check for lateral movement."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "This was an actively exploited zero-day at patch release; any remediation cadence slower than the May 2024 Patch Tuesday left endpoints escalatable to SYSTEM during live QakBot campaigns."
+      }
+    }
+  },
+  "CVE-2024-4671": {
+    "name": "Google Chromium Visuals Use-After-Free Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "A crafted HTML page (typically after compromising the renderer) triggers a use-after-free in Chrome's Visuals component, corrupting heap state to attempt escape from the browser sandbox.",
+      "privileges_required": "none (unauthenticated; requires the victim to load attacker-controlled content, and a renderer compromise for the full escape)",
+      "complexity": "high — chained renderer-compromise plus a reliable UAF sandbox escape, consistent with targeted zero-day use",
+      "ai_factor": "Not AI-discovered — reported by an anonymous researcher to Google. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Force Chrome/Chromium update to 124.0.6367.201+ across the fleet and restart browsers",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-05-13)",
+        "adequacy": "Auto-update helps but only after browser restart; unmanaged endpoints remain exposed during the active zero-day window."
+      },
+      "detection": {
+        "what_would_have_worked": "Monitor for renderer crashes and anomalous browser child processes/network callbacks",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Sandbox-escape exploits leave minimal disk artifacts, limiting detection."
+      },
+      "response": {
+        "what_would_have_worked": "Confirm browser versions fleet-wide, isolate suspected-compromised hosts, hunt for post-escape implants",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Targeted zero-day usage may precede any public IoCs, so version assurance is the primary lever."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Flaw remediation depends on the Chrome auto-update reaching every endpoint; unmanaged or air-gapped browsers lag the fix while an active zero-day is in circulation."
+      }
+    }
+  },
+  "CVE-2023-7028": {
+    "name": "GitLab Community and Enterprise Editions Improper Access Control Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unauthenticated attacker submits the GitLab password-reset form supplying multiple email addresses; GitLab delivers the reset link to the attacker-controlled unverified address, letting the attacker set a new password and take over the account when 2FA is absent.",
+      "privileges_required": "none (unauthenticated network access to the GitLab web interface)",
+      "complexity": "low — a single crafted reset request; public PoCs and mass scanning",
+      "ai_factor": "Not AI-discovered — reported through GitLab's bug-bounty program. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Upgrade to the fixed 16.x patch releases; enforce 2FA on all accounts so a hijacked reset email alone cannot complete takeover.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-05-01)",
+        "adequacy": "Patch closes the reset-redirect, but universally-enforced MFA is what neutralizes the impact even on unpatched instances."
+      },
+      "detection": {
+        "what_would_have_worked": "Alert on /users/password requests carrying multiple email parameters and on reset emails sent to addresses differing from the account owner's verified email.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "The abuse is a valid-looking HTTP request; log-based detection of the array-email pattern is the most reliable signal."
+      },
+      "response": {
+        "what_would_have_worked": "Force password resets, invalidate sessions and personal-access-tokens/SSH keys, and review repositories for unauthorized clones or CI/CD changes.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Account takeover on a source platform is a supply-chain event, so response must assume code and secret exposure."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-IA-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Password-only authentication is fully defeated once the reset email is redirected; without enforced MFA the identity control permits complete takeover, so it is inadequate against this flaw."
+      }
+    }
+  },
+  "CVE-2024-29988": {
+    "name": "Microsoft SmartScreen Prompt Security Feature Bypass Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An attacker delivers a file (often inside an archive) crafted so that Windows fails to apply or honor the Mark-of-the-Web; when the user extracts and runs it, SmartScreen does not prompt, and the payload executes. It is chained with WinRAR CVE-2023-38831 and CVE-2024-21412 for full delivery.",
+      "privileges_required": "none (requires user to open the delivered file — UI:R)",
+      "complexity": "low — public PoCs and active tradecraft, though it depends on social-engineering the user to open the file",
+      "ai_factor": "Not AI-discovered — found in-the-wild by Trend Micro ZDI. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply the April 2024 Windows update; block risky archive/file types at the mail/web gateway and enforce application allowlisting so a MotW-bypassed payload still cannot execute.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-04-30)",
+        "adequacy": "Patching restores the prompt, but because the file still relies on user execution, allowlisting/attachment controls are needed as defense in depth."
+      },
+      "detection": {
+        "what_would_have_worked": "Detect internet-origin files executing without a SmartScreen prompt and archive-extraction-to-execution chains associated with Water Hydra/DarkMe.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Detection catches the delivery chain but the bypass removes the built-in user warning."
+      },
+      "response": {
+        "what_would_have_worked": "Isolate the endpoint, remove DarkMe/dropper artifacts, and hunt for the WinRAR/CVE-2024-21412 chain components across the fleet.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Response addresses infected hosts but the initial user-execution vector remains a persistent risk without patch + hardening."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-3": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Malicious-code protection that relies on SmartScreen/MotW mediation is defeated by a bypass that suppresses the very prompt operators expect to warn on internet-origin files."
+      }
+    }
+  },
+  "CVE-2024-4040": {
+    "name": "CrushFTP VFS Sandbox Escape Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unauthenticated attacker sends a request with server-side template-injection syntax to the CrushFTP WebInterface; the server renders the expression, escaping the VFS sandbox to read arbitrary files (config/session data), bypass authentication to gain admin, and execute code.",
+      "privileges_required": "none (unauthenticated, internet-facing)",
+      "complexity": "low — public PoCs and a Metasploit module make exploitation turnkey",
+      "ai_factor": "Not AI-discovered — reported by CrushFTP and analyzed by Airbus CERT/Rapid7. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Upgrade to CrushFTP 10.7.1 / 11.1.0+ and place the WebInterface behind a DMZ/reverse proxy restricting access",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-04-24)",
+        "adequacy": "Patch closes the SSTI, but exposed MFT appliances need network restriction because exploitation began before many could patch."
+      },
+      "detection": {
+        "what_would_have_worked": "Detect template-expression syntax in WebInterface requests and out-of-sandbox file reads, plus anomalous new admin sessions",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Preauth exploitation is fast, so request-content and session-anomaly detection are the practical signals."
+      },
+      "response": {
+        "what_would_have_worked": "Rotate CrushFTP admin credentials and session keys, audit for rogue admin accounts, and hunt for exfiltrated files",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Admin bypass enables persistence, so credential rotation and account audit are required post-patch."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SC-7": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Boundary controls leave the CrushFTP WebInterface publicly reachable, and the SSTI rides normal HTTPS so a firewall does not stop it."
+      }
+    }
+  },
+  "CVE-2024-20359": {
+    "name": "Cisco ASA and FTD Privilege Escalation Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An attacker holding administrator credentials copies a crafted file to the disk0: filesystem; on the next device reload the improperly-validated file executes as root and persists across reboots.",
+      "privileges_required": "low relative to the outcome — administrator-level access on the device is required, but it escalates to persistent root",
+      "complexity": "high — requires prior administrator compromise and a device reload, consistent with the targeted ArcaneDoor operation",
+      "ai_factor": "Not AI-discovered — found by Cisco Talos during the ArcaneDoor investigation. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply the fixed ASA/FTD release, verify image integrity, and tightly control and monitor administrator access to prevent the prerequisite admin foothold.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-04-24)",
+        "adequacy": "Patching blocks new exploitation, but a device compromised before patching keeps its persistent root implant; integrity verification and possible rebuild are required."
+      },
+      "detection": {
+        "what_would_have_worked": "Run Cisco's forensic image-integrity checks (verify, show memory region) to spot Line Runner artifacts and unexpected disk0: files.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Root persistence can subvert on-box logging, so out-of-band integrity verification is the reliable detection."
+      },
+      "response": {
+        "what_would_have_worked": "Isolate the appliance, capture forensic images, rebuild from known-good software, and rotate all device and admin credentials.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Given a state-sponsored persistent implant, assume full device compromise and rebuild rather than clean in place."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-AC-6": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Least privilege assumes administrator accounts are trustworthy, but this flaw lets an admin-level actor escalate to persistent root code execution — a privilege boundary AC-6 does not enforce within the appliance."
+      }
+    }
+  },
+  "CVE-2024-20353": {
+    "name": "Cisco ASA and FTD Web Services Denial of Service Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unauthenticated remote attacker sends a crafted HTTP request to the ASA/FTD management or VPN web server; incomplete HTTP-header error checking triggers an infinite loop (CWE-835) that reloads the device, causing denial of service. In ArcaneDoor it was chained with CVE-2024-20359 for implant persistence.",
+      "privileges_required": "none (unauthenticated, no user interaction)",
+      "complexity": "low — a single crafted HTTP request to an exposed web service triggers the reload",
+      "ai_factor": "Not AI-discovered — identified by Cisco PSIRT/Talos during the ArcaneDoor investigation. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Upgrade ASA/FTD to the fixed releases in cisco-sa-asaftd-websrvs-dos-X8gNucD2; disable HTTP management and restrict WebVPN/management access to trusted sources.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-04-24)",
+        "adequacy": "Patching is necessary but the management/VPN web services should also be restricted, since the appliance is the boundary control itself."
+      },
+      "detection": {
+        "what_would_have_worked": "Monitor for unexpected device reloads/crash loops, review syslog for the web-server process faults, and hunt for Line Dancer/Line Runner implant indicators.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Reload alerts detect the DoS but the paired implant activity requires deeper forensic review."
+      },
+      "response": {
+        "what_would_have_worked": "Follow Cisco's ArcaneDoor forensic guidance (memory capture, integrity verification), rebuild compromised devices, and rotate credentials/certs.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "A reload alone may mask implant persistence; forensic validation is required, not just a reboot."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SC-7": {
+        "covered": true,
+        "adequate": false,
+        "gap": "SC-7 treats the firewall as the boundary, but the vulnerable web service runs on that same edge appliance, so the control cannot protect the device that enforces it."
+      }
+    }
+  },
+  "CVE-2022-38028": {
+    "name": "Microsoft Windows Print Spooler Privilege Escalation Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "After gaining an initial foothold, APT28's GooseEgg tool modifies a Print Spooler JavaScript constraints file and causes the Spooler service to execute it with SYSTEM permissions, spawning attacker-chosen applications, backdoors, and credential-theft tooling.",
+      "privileges_required": "low (authenticated local user / existing foothold)",
+      "complexity": "low — the GooseEgg launcher automates the escalation with no user interaction.",
+      "ai_factor": "Not AI-discovered — reported to Microsoft by the NSA and analyzed by Microsoft Threat Intelligence. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply the October 2022 Print Spooler update and disable the Print Spooler service on systems that do not need to print.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-04-23)",
+        "adequacy": "Patching alone is insufficient culturally because organizations deferred this 7.8 EoP for over a year; disabling the Spooler where unneeded is the durable control."
+      },
+      "detection": {
+        "what_would_have_worked": "Alert on GooseEgg artifacts (execute.bat/doit.bat, wayzgoose*.dll in the spooler drivers path), Print Spooler spawning SYSTEM child processes, and new scheduled tasks tied to the escalation.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "The Microsoft report provides concrete file and behavioral IOCs, but detection is post-escalation."
+      },
+      "response": {
+        "what_would_have_worked": "Contain the host, remove GooseEgg persistence, rotate credentials exposed to a SYSTEM-level actor, and hunt laterally given APT28 attribution.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "SYSTEM access by a state actor implies broad compromise; assume-breach hunting is warranted."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-CM-7": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Print Spooler should be disabled on servers that do not print; leaving the service enabled by default preserves the escalation surface this control is meant to remove."
+      }
+    }
+  },
+  "CVE-2024-3400": {
+    "name": "Palo Alto Networks PAN-OS Command Injection Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unauthenticated attacker sends GlobalProtect requests with a crafted SESSID cookie whose value is written to disk as an attacker-controlled filename; a later process executes that content as an OS command with root privileges. Observed chains deploy the UPSTYLE Python backdoor that reads the device error log for further commands.",
+      "privileges_required": "none (unauthenticated, internet-facing GlobalProtect portal/gateway)",
+      "complexity": "low — a crafted HTTP request with a malicious SESSID cookie; public PoCs and a Metasploit module exist",
+      "ai_factor": "Not AI-discovered — found in incident response by Volexity (UTA0218), analyzed by Palo Alto Unit 42. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply the PAN-OS hotfix (10.2.9-h1/11.0.4-h1/11.1.2-h3 or later); before the fix, enable the vendor Threat Prevention IDs and disable device telemetry as interim mitigation.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-04-12)",
+        "adequacy": "Patching is definitive, but because the flaw was a live zero-day, the interim threat-signature and telemetry-disable mitigations were needed before hotfixes were broadly available."
+      },
+      "detection": {
+        "what_would_have_worked": "Hunt for anomalous files under GlobalProtect/device-telemetry temp paths, crafted SESSID cookie values, UPSTYLE artifacts, and outbound connections from the management plane.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "The backdoor manipulates on-box logs, so external/network telemetry is more trustworthy than the appliance's own logs."
+      },
+      "response": {
+        "what_would_have_worked": "Run Palo Alto's forensic guidance / customer support 'Tech Support File' analysis, assume full device compromise, rotate all secrets and certificates on the firewall, and rebuild from known-good firmware.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Root RCE on the perimeter device means every credential and key it held must be considered exposed."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SC-7": {
+        "covered": true,
+        "adequate": false,
+        "gap": "The compromised device IS the network boundary; boundary protection cannot compensate when the firewall's own preauth GlobalProtect endpoint yields root RCE."
+      }
+    }
+  },
+  "CVE-2024-3273": {
+    "name": "D-Link Multiple NAS Devices Command Injection Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unauthenticated attacker sends a crafted HTTP GET to /cgi-bin/nas_sharing.cgi using the hardcoded 'messagebus' backdoor account (CVE-2024-3272) with a base64-encoded command in the 'system' parameter; the value is passed to a shell and executed as root, and botnets weaponized it to drop Mirai.",
+      "privileges_required": "none (unauthenticated; hardcoded backdoor account requires no password)",
+      "complexity": "low — CVSS AC:L; a single crafted GET request, publicly scripted",
+      "ai_factor": "Not AI-discovered — publicly disclosed by researcher 'netsecfish'. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Retire and replace the EoL D-Link NAS devices; if temporarily retained, remove them from any internet exposure and firewall the management interface.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-04-11)",
+        "adequacy": "No patch is available, so only decommissioning or full network isolation removes the risk; blocking alone at the perimeter is fragile against misconfiguration."
+      },
+      "detection": {
+        "what_would_have_worked": "IDS/WAF signatures for GET /cgi-bin/nas_sharing.cgi with user=messagebus and a base64 system= parameter; monitoring for Mirai C2 egress from NAS subnets.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Signatures are effective given the fixed URI/parameter pattern, but only if the device path is visible to inspection."
+      },
+      "response": {
+        "what_would_have_worked": "Take exposed NAS offline, wipe/replace hardware, hunt for Mirai persistence and lateral movement from the storage subnet.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Compromised EoL firmware cannot be trusted after infection; replacement is the durable response."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "No patch exists for these EoL NAS devices, so flaw remediation cannot apply; the only fix is retirement, which SI-2's patch framing does not compel."
+      }
+    }
+  },
+  "CVE-2024-3272": {
+    "name": "D-Link Multiple NAS Devices Use of Hard-Coded Credentials Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An attacker sends an HTTP GET to /cgi-bin/nas_sharing.cgi using the hardcoded 'messagebus' account (empty password); chained with the companion command-injection flaw this yields unauthenticated remote code execution on end-of-life D-Link NAS devices.",
+      "privileges_required": "none — the hardcoded credential removes any real authentication requirement",
+      "complexity": "low — a single crafted GET request with public exploit code",
+      "ai_factor": "Not AI-discovered — disclosed by researcher netsecfish (VDB-259283). No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Retire and replace the affected DNS-320L/325/327L/340L units and, until then, remove all internet exposure (disable UPnP port-forwarding, firewall the management interface).",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-04-11)",
+        "adequacy": "No patch exists, so prevention depends entirely on decommissioning or full network isolation — patch-centric programs have no valid action here."
+      },
+      "detection": {
+        "what_would_have_worked": "Alert on inbound requests to nas_sharing.cgi carrying user=messagebus or base64 system parameters, and monitor NAS devices for outbound botnet C2.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Detection is a stopgap; the device cannot be fixed, so the finding should drive removal, not just alerting."
+      },
+      "response": {
+        "what_would_have_worked": "Take the device offline, assume full compromise of stored data, rebuild any accounts/keys stored on it, and replace the hardware.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Because the credential is unpatchable, only physical retirement ends the exposure."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "No patch will ever ship — the devices are end-of-life — so flaw-remediation is unattainable; the only remediation is retirement, which asset-owners routinely fail to perform for cheap NAS boxes."
+      }
+    }
+  },
+  "CVE-2024-29748": {
+    "name": "Android Pixel Privilege Escalation Vulnerability (CVE-2024-29748)",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An attacker with local/physical access interrupts a factory reset initiated by a device-admin app, exploiting a logic error so the wipe does not complete, and gains local privilege escalation — defeating remote-wipe/data-protection assurances.",
+      "privileges_required": "none additional (local access); user interaction required",
+      "complexity": "low — a logic error triggered by interrupting the reset flow, no memory-corruption primitive",
+      "ai_factor": "Not AI-discovered — reported by the GrapheneOS project. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply the April 2024 Pixel security update (2024-04-01 patch level) fleet-wide",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-04-04)",
+        "adequacy": "Patching fixes the logic error; organizations relying on remote wipe should not assume a wipe succeeded on unpatched devices."
+      },
+      "detection": {
+        "what_would_have_worked": "MDM alerting on failed/incomplete factory resets and out-of-date Pixel patch levels",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Physical/forensic exploitation leaves little enterprise-visible signal."
+      },
+      "response": {
+        "what_would_have_worked": "Treat any lost/seized unpatched Pixel as potentially unwiped; rotate credentials and revoke device access",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Data may already be extractable if the device was unpatched when it left custody."
+      }
+    },
+    "framework_coverage": {
+      "AU-Essential-8-Patch": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Patch-application timeframes do not account for mobile-OS/firmware, where forensic-extraction exploitation of an unpatched wipe bypass is the real risk."
+      }
+    }
+  },
+  "CVE-2024-29745": {
+    "name": "Android Pixel Information Disclosure Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "With physical possession of a Pixel in the After-First-Unlock state, an attacker reboots it into fastboot mode where USB access is enabled before memory is zeroed, then dumps uninitialized fastboot memory to recover data that the lock screen would otherwise protect.",
+      "privileges_required": "none in software, but requires physical access to the device",
+      "complexity": "high — requires physical possession and specialized forensic tooling",
+      "ai_factor": "Not AI-discovered — reported to Google with GrapheneOS analysis. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply the April 2024 Pixel update (which zeroes memory before enabling USB in fastboot) and power devices fully off — not merely lock — when physical seizure is a risk.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-04-04)",
+        "adequacy": "The firmware fix closes the memory leak, but until patched the only mitigation is a full power-off (Before-First-Unlock state), since a locked-but-booted device remains exposed."
+      },
+      "detection": {
+        "what_would_have_worked": "Detection is impractical for physical forensic extraction; MDM policies can enforce power-off and short lock timeouts to shrink the window.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "There is no device-side telemetry for offline fastboot memory dumps."
+      },
+      "response": {
+        "what_would_have_worked": "Treat a seized/lost unpatched device as data-compromised; rotate any credentials or tokens it stored.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Because extraction is offline and silent, response must assume disclosure occurred."
+      }
+    },
+    "framework_coverage": {
+      "GDPR-Art32": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Security-of-processing controls assume lock-screen protection preserves data confidentiality; the fastboot memory leak undermines confidentiality of personal data on a seized device despite a locked screen."
+      }
+    }
+  },
+  "CVE-2023-24955": {
+    "name": "Microsoft SharePoint Server Code Injection Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An attacker holding Site Owner privileges (often obtained by first exploiting CVE-2023-29357's auth bypass) injects code through a crafted SharePoint API/BDC path that SharePoint evaluates server-side, achieving remote code execution used in ransomware operations.",
+      "privileges_required": "low (Site Owner) — but effectively none when chained with CVE-2023-29357",
+      "complexity": "low — the chained public technique is reliable once the auth bypass grants Site Owner context.",
+      "ai_factor": "Not AI-discovered — demonstrated by STAR Labs (Jang) at Pwn2Own Vancouver 2023. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply the SharePoint security updates for both CVE-2023-24955 and CVE-2023-29357; limit internet exposure and enforce least privilege on Site Owner roles.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-03-26)",
+        "adequacy": "Patching both chained CVEs is required; patching only one leaves the composite unauthenticated-RCE path partially open."
+      },
+      "detection": {
+        "what_would_have_worked": "Alert on SharePoint worker-process (w3wp.exe) spawning command interpreters and on CVE-2023-29357-style auth-bypass API calls.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Requires process-lineage and SharePoint API telemetry that default logging does not provide."
+      },
+      "response": {
+        "what_would_have_worked": "Isolate the server, rotate machine keys/service credentials, and hunt for ransomware staging and web shells given the Known ransomware association.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Because this CVE is tied to ransomware chains, response must assume attempted domain-wide impact."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Ransomware operators weaponized this SharePoint RCE, and the observed exploitation cadence outpaced the flaw-remediation SLAs many operators apply to on-prem SharePoint."
+      }
+    }
+  },
+  "CVE-2019-7256": {
+    "name": "Nice Linear eMerge E3-Series OS Command Injection Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unauthenticated remote attacker sends a crafted HTTP request to an eMerge E3 web endpoint that passes a parameter into a shell command without sanitization, injecting OS commands that execute on the panel and enable botnet enrollment or full takeover.",
+      "privileges_required": "none (unauthenticated, network-reachable)",
+      "complexity": "low — public single-request exploit, heavily automated by botnets",
+      "ai_factor": "Not AI-discovered — disclosed by an independent researcher (Applied Risk). No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply vendor firmware updates and remove the eMerge E3 web interface from internet exposure behind a segmented OT network/VPN.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-03-25)",
+        "adequacy": "Many panels never receive firmware fixes, so network isolation is the durable control."
+      },
+      "detection": {
+        "what_would_have_worked": "Alert on shell metacharacters in requests to the panel and on outbound downloads from the physical-security VLAN.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Egress monitoring flags botnet enrollment even when firmware stays vulnerable."
+      },
+      "response": {
+        "what_would_have_worked": "Isolate and re-image affected panels, block the endpoints at the perimeter, and audit the OT segment.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Re-imaging is only durable with patched firmware plus segmentation."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SC-7": {
+        "covered": true,
+        "adequate": false,
+        "gap": "eMerge E3 access-control panels are frequently exposed directly to the internet; boundary controls that would block the CGI endpoints are commonly absent for physical-security appliances."
+      }
+    }
+  },
+  "CVE-2021-44529": {
+    "name": "Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection Vulnerability",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unauthenticated attacker sends a crafted request to the CSA web interface (/client/index.php), which passes attacker input to code-execution routines via csrf-magic.php, running arbitrary code as the low-privileged 'nobody' user as an initial foothold.",
+      "privileges_required": "none (unauthenticated)",
+      "complexity": "low — a Metasploit module and Exploit-DB entry automate the unauthenticated RCE.",
+      "ai_factor": "Not AI-discovered — reported by researcher Jakub Kramarz. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Upgrade the CSA to 4.6.0-512 or later and remove the management interface from internet exposure.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-03-25)",
+        "adequacy": "Patching closes the injection, but appliances exposed for years may already be compromised, so the CSA should be assumed breached and rebuilt."
+      },
+      "detection": {
+        "what_would_have_worked": "Monitor CSA web logs for unauthenticated POSTs to /client/index.php and for shell activity spawned under 'nobody'.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Appliance-native logging is limited, so exploitation may only be visible via network or downstream host telemetry."
+      },
+      "response": {
+        "what_would_have_worked": "Isolate and rebuild the appliance, rotate managed-endpoint credentials, and hunt for privilege-escalation and persistence following the initial foothold.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "The 'nobody' foothold is routinely chained to escalation and lateral movement, so response must extend beyond the appliance itself."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SC-7": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Boundary protection that exposes the CSA web interface to the internet leaves the unauthenticated injection endpoint directly reachable."
+      }
+    }
+  },
+  "CVE-2023-48788": {
+    "name": "Fortinet FortiClient EMS SQL Injection Vulnerability (CVE-2023-48788)",
+    "lesson_date": "2026-07-11",
+    "attack_vector": {
+      "description": "An unauthenticated attacker sends specially crafted packets to the FortiClient EMS FmDatabaseServer (TCP/8013) with SQL injected into the FCTUID field, enabling and invoking xp_cmdshell to run arbitrary commands as SYSTEM on the EMS host.",
+      "privileges_required": "none (unauthenticated, network)",
+      "complexity": "low — reliable public PoC/Metasploit coverage once TCP/8013 is reachable",
+      "ai_factor": "Not AI-discovered — reported to Fortinet by Microsoft researchers. No AI involvement documented."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Upgrade to FortiClientEMS 7.2.3/7.0.11+ and restrict TCP/8013 (FmDatabaseServer) to trusted management networks",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation, added 2024-03-25)",
+        "adequacy": "Patch is essential; network segmentation of the EMS DB service is a needed compensating control given known ransomware exploitation."
+      },
+      "detection": {
+        "what_would_have_worked": "Alert on the EMS/MSSQL process spawning cmd/powershell and on xp_cmdshell being enabled",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Requires process-lineage and SQL-audit telemetry not enabled by default on many EMS hosts."
+      },
+      "response": {
+        "what_would_have_worked": "Isolate EMS host, disable xp_cmdshell, rotate credentials/managed-endpoint trust, hunt for web shells and lateral movement",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "EMS controls many endpoints, so a compromise can pivot fleet-wide and demands broad containment."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SC-7": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Boundary protection frequently leaves the EMS FmDatabaseServer TCP/8013 reachable; exposing that service to untrusted networks is the precondition for exploitation."
+      }
+    }
   }
 }