@blamejs/exceptd-skills 0.19.34 → 0.19.36

package/CHANGELOG.md

@@ -1,5 +1,33 @@
 # Changelog
 
+## 0.19.36 — 2026-08-28
+
+The catalog describes findings again rather than the process that recorded them. Entries were written from a research bundle of facts, and that bundle's vocabulary reached the shipped prose: 1,691 sentences across 678 records opened with "the packet records", "the packet's affected list" or "packet facts for", naming an artefact no operator has ever seen. They now state the fact directly — "a vendor fix is available and there is no live-patch path" rather than "the packet records a vendor fix as available". Most sit in the control-requirement descriptions and their supporting evidence, with a few in exploitation and complexity notes.
+
+Comparisons that only held inside the run that produced them are gone rather than reworded. A record saying an entry carried "the highest RWEP in this batch" or "the lowest base score of this batch" was ranking it against a set the reader cannot enumerate, so the ranking goes and the standalone claim stays. No replacement comparison was invented in its place.
+
+Where a sentence scoped a negative finding to the moment it was written — "no campaign was attributed during this curation" — the limit is kept and restated about the record: no public report attributes one. Dropping the clause outright would have promoted "nothing was found" to "nothing exists", which is a stronger claim than the evidence supports.
+
+Attack timelines keep their own numbering. The Shai-Hulud worm's four phases and the Moika dependency-confusion campaign's publishing waves describe the attack, and an IKE phase-1 negotiation is where in the protocol a defect sits; all are subject matter and are untouched.
+
+## 0.19.35 — 2026-08-25
+
+A scan that could not read something no longer reports that it found nothing there. The evidence collectors treated an unreadable file the same as an absent one: a credential store over the size cap, a workflow file without read permission, a lockfile that failed to parse all produced the output of a clean scan. A credential store that exists but went unread now reports its indicator as inconclusive rather than a miss, and its artifact as uncaptured with the reason attached. An unparseable Google Cloud credentials file reports the same way, since a parse that failed says nothing about what the file holds. A file read successfully but empty stays a completed scan, because the collector did read it and there was nothing in it — the two cases were previously indistinguishable, and both read as clean.
+
+The same failure closed in the pipeline collector, where it ran deeper. A workflow file too large or unreadable was skipped in silence, and every indicator it would have flipped stayed at miss. Read, parse and directory-walk failures now travel to the operator as warnings — but a warning changes no verdict on its own, so the gap reaches the indicators too: where the workflow or trust-policy inventory is incomplete, the indicators drawn from it report inconclusive rather than a clean miss, the inventory is marked uncaptured, and the readability precondition no longer attests a file the collector could not open. A repository whose one vulnerable workflow was the file that could not be read was previously reported clean.
+
+Release workflows that resolve dependencies at build time are detected for pip, pnpm and Bundler alongside npm and cargo, so a Python or Ruby publisher no longer reads as clean. Each install command is judged on its own flags: a hash-pinned install no longer vouches for an unpinned one elsewhere in the same file, and commands chained on one line or split across lines with a trailing backslash are read as the commands they are. The requirement file is recognised whether it is attached to the short option or separated from it, and an install is not reported when the file it names is itself hash-pinned, since one hashed requirement puts pip into hash-checking mode for all of them. A bare `pnpm install` is no longer reported, because pnpm enforces the frozen lockfile whenever CI is set; only an explicit opt-out is. Bundler's job-wide frozen setting suppresses the finding only when it is switched on — `bundle config set frozen false` named the setting and disabled it, and was read as though it enabled it. A requirement file is resolved against the job's working directory as well as the repository root, so a hash-pinned file in a subdirectory is no longer reported as unpinned; where copies resolve in several directories, every one of them has to be pinned. Findings point at the line their command starts on.
+
+Capping an upstream-catalog refresh now bounds every source. The RFC index, ATLAS and ICS-ATT&CK commands accepted the cap and discarded it, so a run asked to import a bounded batch imported the whole upstream index — and the RFC index is an order of magnitude larger than any other source the refresh reads. The cap bounds new additions only; context fields on rows already curated are still completed. The ICS-ATT&CK refresh also stops importing a cross-listed enterprise technique it cannot assign an ICS tactic to. Those rows arrived with an empty tactic and were counted as missing context by the next audit, so the import spent the gap budget on itself; they are skipped now, and the run reports how many and which.
+
+A mistyped flag on the upstream freshness probe is refused with a non-zero exit instead of being ignored. A misspelled air-gap flag previously left the check running as though nothing had been passed, so a run believed to be offline reached the network.
+
+Diagnostics no longer disappear when output is piped. The catalog validator's enum-mismatch and entry-count-drift messages and the skill linter's help and unknown-argument text were written to a stream the process could exit before draining, which a terminal hid and a CI log collector did not.
+
+A malformed analyze result no longer aborts the closing phase. The evidence bundle, notification deadlines, exception language and downstream chaining are still produced, and the shape problem is reported alongside them naming the part of the result that was wrong. That holds for a single unusable entry among good ones as well as for a malformed result overall: the unusable entries are dropped and counted, the rest still reach the advisory. Catalog scoring validation likewise reports a null or non-object entry and continues through the rest of the catalog rather than stopping at the first one, and asking for the documented gaps behind an attack pattern without supplying a gap catalog returns the same answer an empty one gives instead of raising.
+
+The manifest snapshot gate reports where it used to crash or wave through. A baseline written before a surface field existed ended the run with a stack trace on precisely the case the gate exists to report; it is now recorded as an additive change. A corrupt value where a list belongs stops the gate with the skill and field named, rather than reporting that skill's entire surface as newly added and passing.
+
 ## 0.19.34 — 2026-08-23
 
 Comment volume across the shipped JavaScript falls from 16,627 lines to 5,585, against 36,875 lines of code that are byte-for-byte unchanged. What went is the reasoning that produced a line rather than the constraint on it: pull-request references, version histories, "this used to", and module docblocks that toured a file's exports above the exports themselves. What stayed is what the code cannot say for itself — units and nullability on an exported function, the specification clause an emitter satisfies, the trap whose deletion invites a specific dangerous edit, and the cross-file coupling no grep will surface.

package/bin/exceptd.js

@@ -544,11 +544,7 @@ function main() {
     // Strip only `--prefetch` (the alias). `--no-network` must reach prefetch.js:
     // dropping it leaves prefetch fetching, so a cold cache hits every upstream.
     effectiveCmd = "prefetch";
-    const wantedNoNetwork = rest.includes("--no-network");
     effectiveRest = rest.filter(a => a !== "--prefetch");
-    if (wantedNoNetwork && !effectiveRest.includes("--no-network")) {
-      // Unreachable while the filter above spares --no-network.
-    }
   } else if (cmd === "refresh" && rest.includes("--indexes-only")) {
     effectiveCmd = "build-indexes";
     effectiveRest = rest.filter(a => a !== "--indexes-only");
@@ -6937,7 +6933,6 @@ function cmdAiRun(runner, args, runOpts, pretty) {
     if (!handled) {
       // stdin closed with no evidence event. Before erroring, try the raw text as a
       // bare submission — `echo '{...}' | ai-run secrets` pipes the body unwrapped.
-      const raw = (process.stdin._consumed || "") || buf;
       const allText = process.stdin._allText;
       if (allText && allText.trim()) {
         try {

package/data/_indexes/_meta.json

@@ -1,14 +1,14 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-08-23T11:56:28.977Z",
+  "generated_at": "2026-08-29T06:18:09.344Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 64,
   "source_hashes": {
-    "manifest.json": "592a1040e06e609cfc5fa7b690343735f4ad2f52ed3607c526b9ec057f9373eb",
+    "manifest.json": "9b93ad6ffcdecdbb039fb8de8fd73bc2289f6f0f55fb39ca4077f824e4646eb6",
     "README.md": "bc575c178c21e3d07f1491710e24b26cad3a3cee012c43641b6ea7e83468e64e",
     "data/atlas-ttps.json": "a14089671efcb4f06dd0f82d688fe49276c1370e167e4483d76e9c0a40ef41eb",
     "data/attack-techniques.json": "2179122ff8347bc691f245d5fd2601ca81fd1d6f790feae44abca86d3c08f865",
-    "data/cve-catalog.json": "cac36e318f4ab524f8c578180fcedf32d2cb9a12fa541be876162975806be7cf",
+    "data/cve-catalog.json": "ea4f8d911c00a68c2510eada2b82216ae3d25ba6569814e96dc525d2e0df54fa",
     "data/cwe-catalog.json": "b1e0db672d1de7cb3d36cac05059f0302b3be4f88636e6beb47d57ec0d972928",
     "data/d3fend-catalog.json": "9a4a356a1446d7db8be8b6684fa789802405a96cdaf769f06db4136bd07db6ac",
     "data/dlp-controls.json": "791f6a46b19b0c0fa2f46630ac8b398afb7ec9c2f2019056828c8820fe255f19",
@@ -16,7 +16,7 @@
     "data/framework-control-gaps.json": "5d407cd31e4cdbc34fe37253c374488158d7c15f597158930b4ac9729e666bb3",
     "data/global-frameworks.json": "20b18a851b3ab82e57cd159b49476d69fe544f02523398b2015189ab81c7c3f8",
     "data/rfc-references.json": "6e9017eca910ab7e4bee85ad7c23927fd6ec766f34be7fce49ebf020cec3381a",
-    "data/zeroday-lessons.json": "fbf03302ccf8f758f00541ce0e21b5ae6980eac8357564fe5825a09ddf0b4c18",
+    "data/zeroday-lessons.json": "818a8f588b6c31e820c616519a7a7cffec69f44e31c2690658f986384b8e989f",
     "skills/kernel-lpe-triage/skill.md": "0f79c641cef6e5f4a942eb94f43c460562bf83dfb67ae112d146c39c6b320fb0",
     "skills/ai-attack-surface/skill.md": "c97335e14cd34bd1cd3c9d2cbd397f33569a07292b2f2f7721483575eb4459f7",
     "skills/mcp-agent-trust/skill.md": "6195c93a6cadb213051214742890fa2bf4e39bae377a654d4195f0c90bd8b896",

package/data/cve-catalog.json

@@ -15639,7 +15639,7 @@
     "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2017-0146 (no NVD CWE assignment, CVSS 8.8) + CISA KEV (added 2022-03-25, ransomware: Known) + Microsoft Security Bulletin MS17-010 (KB4013389). CWE-20 assigned editorially from the CISA KEV record's own cwes field, since NVD supplies none.",
     "ai_assisted_weaponization": false,
-    "active_exploitation_notes": "MS17-010 recorded 'Publicly disclosed: No' and 'Exploited: No' for this CVE when it published on 14 March 2017. CISA added it to KEV on 2022-03-25 with knownRansomwareCampaignUse 'Known', and that record is the evidence of in-the-wild and ransomware use relied on here. No vendor or incident-response report resolved during this curation attributes a specific named campaign to CVE-2017-0146 as distinct from the other five SMBv1 defects MS17-010 fixed, so no intrusion set is named.",
+    "active_exploitation_notes": "MS17-010 recorded 'Publicly disclosed: No' and 'Exploited: No' for this CVE when it published on 14 March 2017. CISA added it to KEV on 2022-03-25 with knownRansomwareCampaignUse 'Known', and that record is the evidence of in-the-wild and ransomware use relied on here. No public vendor or incident-response report attributes a specific named campaign to CVE-2017-0146 as distinct from the other five SMBv1 defects MS17-010 fixed, so no intrusion set is named.",
     "attack_refs": [
       "T1210",
       "T1021.002",
@@ -15746,7 +15746,7 @@
     "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2017-0213 (NVD-CWE-noinfo, CVSS 7.3) + CISA KEV (added 2022-03-28, ransomware: Known) + Microsoft Security Update Guide advisory CVE-2017-0213, 'Windows COM Elevation of Privilege Vulnerability', published 2017-05-09. Reported by Google Security Research per Exploit-DB 42020. CWE-843 assigned editorially from the type confusion the exploit and the vendor fix description both name, since NVD records NVD-CWE-noinfo and the CISA KEV record carries an empty cwes array.",
     "ai_assisted_weaponization": false,
-    "active_exploitation_notes": "Microsoft's Security Update Guide entry, published 2017-05-09 as 'Windows COM Elevation of Privilege Vulnerability', recorded the flaw as neither publicly disclosed nor exploited at release. CISA added it to KEV on 2022-03-28 with a 2022-04-18 due date and knownRansomwareCampaignUse 'Known', and that KEV record is the evidence of in-the-wild and ransomware use relied on here; no vendor or incident-response report resolved during this curation ties CVE-2017-0213 to a named intrusion set, so none is asserted. Operationally this is a second-stage flaw: it converts an existing interactive foothold into SYSTEM and does not provide initial access.",
+    "active_exploitation_notes": "Microsoft's Security Update Guide entry, published 2017-05-09 as 'Windows COM Elevation of Privilege Vulnerability', recorded the flaw as neither publicly disclosed nor exploited at release. CISA added it to KEV on 2022-03-28 with a 2022-04-18 due date and knownRansomwareCampaignUse 'Known', and that KEV record is the evidence of in-the-wild and ransomware use relied on here; no published vendor or incident-response report ties CVE-2017-0213 to a named intrusion set, so none is asserted. Operationally this is a second-stage flaw: it converts an existing interactive foothold into SYSTEM and does not provide initial access.",
     "attack_refs": [
       "T1068",
       "T1559.001"
@@ -15852,7 +15852,7 @@
     "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2017-12615 (CWE-434, CVSS 8.1) + CISA KEV (added 2022-03-25, ransomware: Known) + the Apache Tomcat 7 security advisory page at https://tomcat.apache.org/security-7.html, which records the fix in 7.0.81 and credits the report to iswin from 360-sg-lab on 26 July 2017.",
     "ai_assisted_weaponization": false,
-    "active_exploitation_notes": "CISA added this to KEV on 2022-03-25 with a 2022-04-15 due date and knownRansomwareCampaignUse 'Known'; that record is the evidence of in-the-wild and ransomware use relied on here, and no named campaign report was resolved during this curation. EPSS on 2026-08-17 is 0.99607 at the 99.946th percentile, and a maintained Nuclei template for this id has been in the public template tree throughout, so any internet-reachable Tomcat 7 on Windows accepting PUT is discoverable by an unauthenticated request that requires no prior knowledge of the target.",
+    "active_exploitation_notes": "CISA added this to KEV on 2022-03-25 with a 2022-04-15 due date and knownRansomwareCampaignUse 'Known'; that record is the evidence of in-the-wild and ransomware use relied on here, and no named campaign report is cited. EPSS on 2026-08-17 is 0.99607 at the 99.946th percentile, and a maintained Nuclei template for this id has been in the public template tree throughout, so any internet-reachable Tomcat 7 on Windows accepting PUT is discoverable by an unauthenticated request that requires no prior knowledge of the target.",
     "attack_refs": [
       "T1190",
       "T1505.003",
@@ -15963,7 +15963,7 @@
     "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2017-12617 (CWE-434, CVSS 8.1) + CISA KEV (added 2022-03-25, ransomware: Unknown) + the Apache Tomcat security advisory pages at https://tomcat.apache.org/security-9.html (fixed in 9.0.1, released 30 September 2017) and https://tomcat.apache.org/security-8.html (fixed in 8.5.23 on 1 October 2017 and 8.0.47 on 4 October 2017).",
     "ai_assisted_weaponization": false,
-    "active_exploitation_notes": "CISA added this to KEV on 2022-03-25 with a 2022-04-15 due date and knownRansomwareCampaignUse recorded as 'Unknown', so CISA makes no ransomware claim for this id and the KEV listing itself is the evidence of in-the-wild use relied on here. No named campaign report was resolved during this curation. EPSS on 2026-08-17 is 0.99988 at the 99.984th percentile, against a flaw covered simultaneously by a Metasploit module, two Exploit-DB entries and a maintained scanning template.",
+    "active_exploitation_notes": "CISA added this to KEV on 2022-03-25 with a 2022-04-15 due date and knownRansomwareCampaignUse recorded as 'Unknown', so CISA makes no ransomware claim for this id and the KEV listing itself is the evidence of in-the-wild use relied on here. No named campaign has been publicly reported. EPSS on 2026-08-17 is 0.99988 at the 99.984th percentile, against a flaw covered simultaneously by a Metasploit module, two Exploit-DB entries and a maintained scanning template.",
     "attack_refs": [
       "T1190",
       "T1505.003",
@@ -16174,7 +16174,7 @@
     "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2017-6316 (NVD-CWE-noinfo, CVSS 9.8) + CISA KEV (added 2022-03-25) + Citrix advisory CTX225990, which NVD lists as the vendor reference and which is access-restricted. Reported by xort of Critical Start per Exploit-DB 42345 and 42346. CWE-78 assigned editorially from the shell-metacharacter injection both exploits demonstrate, since NVD supplies no weakness id.",
     "ai_assisted_weaponization": false,
-    "active_exploitation_notes": "CISA added this to KEV on 2022-03-25 with a 2022-04-15 due date and knownRansomwareCampaignUse recorded as 'Unknown'. That KEV listing is CISA's evidence of in-the-wild use and is the only exploitation evidence relied on here — no vendor bulletin, incident-response report or named campaign was resolved during this curation, and Citrix's own advisory CTX225990 is access-restricted. Treat the exposure assessment as resting on the artefact position rather than on incident reporting: two working exploits have been public since July 2017 against a pre-auth root path, and EPSS on 2026-08-17 is 0.72596 (99.393rd percentile).",
+    "active_exploitation_notes": "CISA added this to KEV on 2022-03-25 with a 2022-04-15 due date and knownRansomwareCampaignUse recorded as 'Unknown'. That KEV listing is CISA's evidence of in-the-wild use and is the only exploitation evidence relied on here — no vendor bulletin, incident-response report or named campaign is publicly available, and Citrix's own advisory CTX225990 is access-restricted. Treat the exposure assessment as resting on the artefact position rather than on incident reporting: two working exploits have been public since July 2017 against a pre-auth root path, and EPSS on 2026-08-17 is 0.72596 (99.393rd percentile).",
     "attack_refs": [
       "T1190",
       "T1059"
@@ -16277,7 +16277,7 @@
     "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2017-6334 (CWE-78, CVSS 8.8) + CISA KEV (added 2022-03-25, required action: disconnect end-of-life product). Discovered by SivertPL per Exploit-DB 41459 and the Metasploit module credit. No NETGEAR advisory appears in NVD's reference set for this CVE; the CISA KEV record is the coordinating advisory cited here in its place.",
     "ai_assisted_weaponization": false,
-    "active_exploitation_notes": "CISA added this to KEV on 2022-03-25 with a 2022-04-15 due date and knownRansomwareCampaignUse recorded as 'Unknown', and that listing is the only exploitation evidence relied on here — no vendor bulletin, botnet report or incident write-up was resolved during this curation, and no named campaign is asserted. The KEV record's required action for this CVE is 'The impacted product is end-of-life and should be disconnected if still in use', rather than the 'Apply updates per vendor instructions' text CISA uses where a vendor fix exists — so CISA's own instruction is removal. EPSS on 2026-08-17 is 0.72199 at the 99.382nd percentile.",
+    "active_exploitation_notes": "CISA added this to KEV on 2022-03-25 with a 2022-04-15 due date and knownRansomwareCampaignUse recorded as 'Unknown', and that listing is the only exploitation evidence relied on here — no vendor bulletin, botnet report or incident write-up is cited, and no named campaign is asserted. The KEV record's required action for this CVE is 'The impacted product is end-of-life and should be disconnected if still in use', rather than the 'Apply updates per vendor instructions' text CISA uses where a vendor fix exists — so CISA's own instruction is removal. EPSS on 2026-08-17 is 0.72199 at the 99.382nd percentile.",
     "attack_refs": [
       "T1190",
       "T1059",
@@ -32591,7 +32591,7 @@
     "type": "flash-runtime-memory-corruption-rce-in-pdf-and-swf",
     "blast_radius": 25,
     "poc_available": false,
-    "poc_description": "No obtainable public exploit code was located for this CVE. No Metasploit module references it — the Flash modules in rapid7/metasploit-framework cover later bugs (the newfunction issue tracked as CVE-2010-1297, the 2011 AVM2 issues) and none carries CVE-2009-1862. No Exploit-DB entry resolves to it; the Flash entries returned by search are indexed to other CVEs. Malicious PDF and SWF samples were in circulation during the July 2009 attacks, but samples are not published exploit code and the technique was never released as a reusable artefact. Honest reading: the capability barrier for this specific CVE is higher than for its neighbours in this batch, which is reflected in the comparatively low EPSS of 0.25006.",
+    "poc_description": "No obtainable public exploit code was located for this CVE. No Metasploit module references it — the Flash modules in rapid7/metasploit-framework cover later bugs (the newfunction issue tracked as CVE-2010-1297, the 2011 AVM2 issues) and none carries CVE-2009-1862. No Exploit-DB entry resolves to it; the Flash entries returned by search are indexed to other CVEs. Malicious PDF and SWF samples were in circulation during the July 2009 attacks, but samples are not published exploit code and the technique was never released as a reusable artefact. Honest reading: the capability barrier for this specific CVE is high, which is reflected in the comparatively low EPSS of 0.25006.",
     "iocs": {
       "behavioral": [
         "AcroRd32.exe or Acrobat.exe loading authplay.dll on a host where no business workflow uses Flash content inside PDFs — the load itself is the exposure signal",
@@ -33188,7 +33188,7 @@
     "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2010-0840 (no CWE assigned by NVD and none in the KEV record; CWE-269 assigned editorially — the flaw is a privilege check attributing a frame to the wrong class, i.e. improper privilege management, not memory corruption; CVSS 9.8) + CISA KEV (added 2022-05-25, due 2022-06-15) + Oracle Java SE and Java for Business Critical Patch Update Advisory, March 2010 + ZDI-10-056, credited to Sami Koivu.",
     "ai_assisted_weaponization": false,
-    "active_exploitation_notes": "Microsoft maintains a threat description for Exploit:Java/CVE-2010-0840 that describes the family as activating when a user with a vulnerable JRE visits a hacked website, and as running an executable carried in the JAR, fetched from a URL hardcoded in the exploit, or specified by the hosting HTML — a commodity drive-by loader profile, not a targeted one. It became a staple Java vector in browser exploit kits of the 2010-2012 era. CISA added it to KEV on 2022-05-25 with a 2022-06-15 due date. The 2026 EPSS pair, 0.96319 at the 99.876th percentile, is the highest in this batch and reflects a fully commoditized, platform-independent exploit.",
+    "active_exploitation_notes": "Microsoft maintains a threat description for Exploit:Java/CVE-2010-0840 that describes the family as activating when a user with a vulnerable JRE visits a hacked website, and as running an executable carried in the JAR, fetched from a URL hardcoded in the exploit, or specified by the hosting HTML — a commodity drive-by loader profile, not a targeted one. It became a staple Java vector in browser exploit kits of the 2010-2012 era. CISA added it to KEV on 2022-05-25 with a 2022-06-15 due date. The 2026 EPSS pair, 0.96319 at the 99.876th percentile, reflects a fully commoditized, platform-independent exploit.",
     "attack_refs": [
       "T1189",
       "T1203",
@@ -33747,7 +33747,7 @@
       "UK-CAF-B4": "B4 (System Security) evidence for desktop software is patch currency against a build Adobe no longer supports, and the CAF asset register does not descend to a font engine inside a document reader on every workstation. The question that decides exposure — whether untrusted PDFs are rendered by an install carrying an unpatched CoolType.dll, on any of the several update tracks Reader and Acrobat occupy — is not one B4 evidence answers.",
       "AU-Essential-8-App-Hardening": "PDF-reader hardening is explicitly in scope, which makes this the right control family, and the hardening actions assessors collect evidence for — disabling JavaScript, blocking web advertisements — do nothing against this flaw, because the font parser is reached by rendering rather than by script. An estate can hold a fully evidenced PDF-hardening attestation and still open a crafted document straight into CoolType.dll.",
       "ISO-27001-2022-A.8.7": "A.8.7 (protection against malware) is satisfied by deployed anti-malware with current definitions. For a zero-day whose artefact is a structurally valid PDF and a structurally valid font, that produces no protection during the exposure window, and the control offers no alternative measure — such as rendering untrusted documents in an isolated viewer — that would have. A.8.7 as written treats malware protection as a detection problem when the applicable measure here was containment.",
-      "ISO-27001-2022-A.8.8": "A.8.8 requires exposure to be evaluated and acted on, with no tier for exploit maturity. The CVSS 7.3 base score is the lowest of the three Adobe entries in this batch, while this one has a Metasploit module and Exploit-DB 16619 dating to autumn 2010 and sits at EPSS 0.82485 (99.635th percentile). Ranking by base score inverts the correct order against CVSS 9.x items with no public exploit."
+      "ISO-27001-2022-A.8.8": "A.8.8 requires exposure to be evaluated and acted on, with no tier for exploit maturity. The CVSS base score is 7.3, while this entry has a Metasploit module and Exploit-DB 16619 dating to autumn 2010 and sits at EPSS 0.82485 (99.635th percentile). Ranking by base score inverts the correct order against CVSS 9.x items with no public exploit."
     },
     "patch_available": true,
     "patch_required_reboot": false,
@@ -37103,7 +37103,7 @@
     "framework_control_gaps": {
       "NIST-800-53-SI-2": "SI-2 flaw remediation is met by any organisation that took the July 2015 IE cumulative, and the control has nothing to say about the period Microsoft itself flagged: MS15-065 records the CVE as already publicly disclosed and exploited on the day it shipped. The residual SI-2 gap is now categorical rather than temporal — Internet Explorer 11 left support on 15 June 2022, so a host still running it has no remediation stream to be current with, and SI-2 offers no way to record 'flaw remediation is not available for this component'.",
       "NIST-800-53-CM-7": "CM-7 least functionality is the control that should have removed the exposure outright, because for most organisations by 2015 Internet Explorer was a legacy compatibility component rather than the browsing tool. Implementations stop at disabling unused services and ports and rarely reach 'this browser must not render arbitrary internet content'. An estate that passes CM-7 with a documented service baseline can still have IE11 as an installed, launchable, default-capable browser on every workstation, which is the entire delivery precondition for this drive-by.",
-      "NIS2-Art21-patch-management": "Article 21 patch management handles the 2015 cumulative fine. It fails on the shape of the current risk: the CVE has an EPSS of 0.44851 (percentile 0.98661 as of 2026-08-13) — one of the highest in this batch — and the population still exposed is IE11 kept alive for a legacy application, which is a lifecycle decision, not a patch decision. Article 21 requires patching proportionate to risk and does not require a dated retirement plan for a browser its vendor stopped supporting in 2022.",
+      "NIS2-Art21-patch-management": "Article 21 patch management handles the 2015 cumulative fine. It fails on the shape of the current risk: the CVE has an EPSS of 0.44851 (percentile 0.98661 as of 2026-08-13), and the population still exposed is IE11 kept alive for a legacy application, which is a lifecycle decision, not a patch decision. Article 21 requires patching proportionate to risk and does not require a dated retirement plan for a browser its vendor stopped supporting in 2022.",
       "UK-CAF-B4": "B4 (System Security) expects software to be maintained so vulnerabilities are minimised. A CAF assessment on an estate that has applied every IE cumulative reads green while IE11 sits on every desktop, out of support since 15 June 2022, still able to open an arbitrary URL. B4 gives no test that separates 'patched to the last release the vendor ever made' from 'supported', which is the distinction that decides this entry.",
       "AU-Essential-8-Patch": "The patch-applications control covers web browsers explicitly and would have driven the July 2015 cumulative promptly. Its maturity model also requires applications to be vendor-supported, and Internet Explorer 11 fails that outright — so on a current assessment the honest finding is a supported-software failure. Patch-latency metrics computed against a product that receives no patches produce a compliant-looking number from an unmaintained component.",
       "AU-Essential-8-App-Hardening": "User application hardening is written around blocking web-browser features that deliver exploits — Flash, Java, ads. Every one of those levers is orthogonal here: the exploit is script in the browser's own JIT engine, and it works with advertising blocked and every plug-in removed. Hardening the browser cannot remove a defect in the JavaScript engine itself, which is why the control's clean attestation coexists with full exposure on any IE11 install that reaches the page.",
@@ -42453,7 +42453,7 @@
       "NIST-800-53-SI-2": "Flaw remediation here has to route the fix correctly: the vulnerable component is the Windows MSDT stack and the fix is the June 2022 cumulative update, while the exploit arrives as a Word document. An SI-2 programme that assigned this to the Office update ring — the natural reading of an advisory titled around a Word attack — deployed a patch that does not contain the fix and closed the item. The KEV due date was 2022-07-05 and EPSS still sits at 0.99374 (99.937th percentile as of 2026-08-13), so this misroute has a four-year tail.",
       "NIST-800-53-CM-7": "Least functionality is the control that would have removed this before the patch existed, by unregistering the ms-msdt URL protocol handler that almost no managed estate needs. CM-7 baselines enumerate services, ports and installed software; they do not enumerate registered URL protocol handlers, so ms-msdt sat in every image as an unreviewed, attacker-reachable entry point and no CM-7 assessment would have flagged it.",
       "NIST-800-53-SI-3": "Malicious-code protection on this path is macro policy, and no macro is involved. The document reaches MSDT through the remote-template relationship and the ms-msdt URI, so an estate with macros blocked from the internet — the standard SI-3 posture in 2022 — was fully exposed, and in RTF form the code ran from the preview pane before any content-scanning decision on an opened document was reached.",
-      "NIS2-Art21-patch-management": "The KEV listing on 2022-06-14 and a due date of 2022-07-05 fall inside the June 2022 patch cycle, so a monthly Article 21 cadence is nominally adequate for the first time in this batch. It fails on routing rather than on speed: the entity must recognise that a Word-delivered attack is remediated by a Windows update, and estates whose workstation OS ring and Office ring are governed separately patched the wrong one.",
+      "NIS2-Art21-patch-management": "The KEV listing on 2022-06-14 and a due date of 2022-07-05 fall inside the June 2022 patch cycle, so a monthly Article 21 cadence is nominally adequate. It fails on routing rather than on speed: the entity must recognise that a Word-delivered attack is remediated by a Windows update, and estates whose workstation OS ring and Office ring are governed separately patched the wrong one.",
       "NIS2-Art21-vulnerability-handling": "Vulnerability handling would have had to act in the gap between public disclosure in late May 2022 and the June cumulative update — the window in which the only remedy was the protocol-handler workaround. Article 21 requires a handling process but sets no expectation that an entity deploy a vendor-documented registry workaround ahead of a patch, so a compliant process waited for the update while public exploits circulated.",
       "UK-CAF-B4": "B4 system security expects hardened, maintained end-user devices. Both levers that matter here sit outside what B4 assessments examine: whether an OS-level URL protocol handler nobody uses is registered, and whether the June 2022 cumulative update reached every host including the ones that download but defer restarts. A B4-compliant workstation build in mid-2022 had ms-msdt registered by default.",
       "AU-Essential-8-App-Hardening": "User application hardening is the Essential Eight control aimed squarely at this delivery path, and its content is about blocking Office macros, OLE and web-content features. None of those fire: the exploit uses a legitimate remote-template relationship and a registered protocol handler. An estate at Maturity Level 3 for application hardening was exploitable exactly as an estate at Level 0 was.",
@@ -132032,7 +132032,7 @@
       "live_patch_available": 0,
       "reboot_required": 0
     },
-    "rwep_notes": "RWEP 80. cisa_kev (+25) + poc_available (+20) + active_exploitation confirmed (+20) + blast_radius 30 (effectively every HTTP/2 server, proxy and CDN — internet-wide) - patch_available (-15). The highest-RWEP entry in this batch: KEV-listed, mass-exploited availability flaw against shared web infrastructure.",
+    "rwep_notes": "RWEP 80. cisa_kev (+25) + poc_available (+20) + active_exploitation confirmed (+20) + blast_radius 30 (effectively every HTTP/2 server, proxy and CDN — internet-wide) - patch_available (-15). KEV-listed, mass-exploited availability flaw against shared web infrastructure.",
     "epss_score": null,
     "epss_date": null,
     "cwe_refs": [
@@ -138209,7 +138209,7 @@
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No primary source attributes the in-the-wild exploit code or its weaponization to any AI tool or AI-assisted workflow. Exploitation is described as crafting a malicious VHD/VHDX and socially engineering a user into mounting it; no AI-generation claim is made by Microsoft, ESET, Trend Micro, or ZDI.",
     "active_exploitation": "confirmed",
-    "active_exploitation_notes": "KEV-confirmed (CISA added 2025-03-11, due 2025-04-01); exploited as a zero-day in limited, targeted attacks before the March 2025 Patch Tuesday fix. One of six Windows file-system zero-days patched together; reported as chained for info-disclosure with CVE-2025-24984 and adjacent to the RCE chain CVE-2025-24985/CVE-2025-24993. No public threat-actor attribution is tied specifically to CVE-2025-24991 (the named actors in this batch — PipeMagic/RansomEXX on CVE-2025-24983 and EncryptHub/LARVA-208 on CVE-2025-26633 — attach to sibling CVEs). CISA KEV lists known-ransomware-use as Unknown for this CVE. KEV-confirmed; no public actor attribution specific to this CVE.",
+    "active_exploitation_notes": "KEV-confirmed (CISA added 2025-03-11, due 2025-04-01); exploited as a zero-day in limited, targeted attacks before the March 2025 Patch Tuesday fix. One of six Windows file-system zero-days patched together; reported as chained for info-disclosure with CVE-2025-24984 and adjacent to the RCE chain CVE-2025-24985/CVE-2025-24993. No public threat-actor attribution is tied specifically to CVE-2025-24991 (the named actors attach to sibling CVEs — PipeMagic/RansomEXX on CVE-2025-24983 and EncryptHub/LARVA-208 on CVE-2025-26633). CISA KEV lists known-ransomware-use as Unknown for this CVE. KEV-confirmed; no public actor attribution specific to this CVE.",
     "affected": "Microsoft Windows — see vendor advisory in verification_sources for exact affected/fixed builds.",
     "affected_versions": [
       "Windows 10 Version 1507 (RTM)",
@@ -139308,7 +139308,7 @@
       "Fixed in Langflow OSS 1.10.1",
       "Exploitable in default deployments — no non-default configuration is required for the unauthenticated chain"
     ],
-    "complexity_notes": "The lowest-friction entry in this batch: AC:L, PR:N, UI:N, CVSS 9.8, and the entire exploit is two HTTP requests against a default install with no fingerprinting, no heap grooming and no race. CISA's SSVC recorded exploitation \"active\", automatable \"yes\" and technicalImpact \"total\" on the publication date itself. Worth recording that the CVE is a composition rather than a single defect: the public PoCs and ACN's bulletin decompose it into CVE-2026-9103 (missing authentication on /api/v1/auto_login, CVSS 9.8) and CVE-2026-8481 (code injection on /api/v1/validate/code, CVSS 9.9), which matters for remediation verification — confirming one component is closed does not confirm the chain is. EPSS was 0.019 (77th percentile) on the KEV add date and the Nuclei template already records 0.171 (96.8th percentile), so the catalog's stored EPSS lags the actual exploitation picture by roughly twenty percentile points; prioritise on KEV plus PoC availability, not on the stored EPSS. Recurrence is the other planning factor: /api/v1/validate/code was already the sink for CVE-2025-3248 (KEV-listed, in this catalog), so this is at minimum the second KEV-listed unauthenticated RCE through the same endpoint, and the endpoint should be treated as structurally hostile rather than as a patched surface.",
+    "complexity_notes": "Exploitation is low-friction: AC:L, PR:N, UI:N, CVSS 9.8, and the entire exploit is two HTTP requests against a default install with no fingerprinting, no heap grooming and no race. CISA's SSVC recorded exploitation \"active\", automatable \"yes\" and technicalImpact \"total\" on the publication date itself. Worth recording that the CVE is a composition rather than a single defect: the public PoCs and ACN's bulletin decompose it into CVE-2026-9103 (missing authentication on /api/v1/auto_login, CVSS 9.8) and CVE-2026-8481 (code injection on /api/v1/validate/code, CVSS 9.9), which matters for remediation verification — confirming one component is closed does not confirm the chain is. EPSS was 0.019 (77th percentile) on the KEV add date and the Nuclei template already records 0.171 (96.8th percentile), so the catalog's stored EPSS lags the actual exploitation picture by roughly twenty percentile points; prioritise on KEV plus PoC availability, not on the stored EPSS. Recurrence is the other planning factor: /api/v1/validate/code was already the sink for CVE-2025-3248 (KEV-listed, in this catalog), so this is at minimum the second KEV-listed unauthenticated RCE through the same endpoint, and the endpoint should be treated as structurally hostile rather than as a patched surface.",
     "patch_available": true,
     "patch_required_reboot": false,
     "live_patch_available": false,
@@ -139503,7 +139503,7 @@
     "_kev_short_description": "Cisco Secure Firewall Management Center (FMC) formerly known as Firepower Management Center contains a use of hard-coded password vulnerability that could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems.",
     "type": "hardcoded-credentials-auth-bypass",
     "poc_available": false,
-    "poc_description": "No public exploit code located. GitHub repository search for \"CVE-2026-20316\" returns zero results, and projectdiscovery/nuclei-templates has no matching template; there is no Exploit-DB entry and no Metasploit module. Horizon3.ai, whose researcher Jimi Sebree reported the flaw, deliberately withheld a PoC — the firm built a NodeZero Rapid Response test for customer validation instead of publishing one, and its public page does not disclose the account name or the credential. SOC Prime's analysis states directly that no public CVE-2026-20316 PoC has been identified. That said, poc_available:false understates the weaponization risk more here than for any other entry in this batch: the \"exploit\" is knowledge of a static username and password, so there is no exploit code to write — the moment the credential is extracted from an appliance image or leaks from the intrusion set already using it, exploitation is a normal login. Cisco PSIRT confirmed active exploitation in July 2026, so at least one party already holds it.",
+    "poc_description": "No public exploit code located. GitHub repository search for \"CVE-2026-20316\" returns zero results, and projectdiscovery/nuclei-templates has no matching template; there is no Exploit-DB entry and no Metasploit module. Horizon3.ai, whose researcher Jimi Sebree reported the flaw, deliberately withheld a PoC — the firm built a NodeZero Rapid Response test for customer validation instead of publishing one, and its public page does not disclose the account name or the credential. SOC Prime's analysis states directly that no public CVE-2026-20316 PoC has been identified. That said, poc_available:false understates the weaponization risk here: the \"exploit\" is knowledge of a static username and password, so there is no exploit code to write — the moment the credential is extracted from an appliance image or leaks from the intrusion set already using it, exploitation is a normal login. Cisco PSIRT confirmed active exploitation in July 2026, so at least one party already holds it.",
     "ai_discovered": false,
     "ai_discovery_notes": "Human researcher, explicitly credited: Cisco's advisory cisco-sa-fmc-static-cred-BET3Cjh names Jimi Sebree of Horizon3.ai as the reporter, and Horizon3's attack-research team published a corresponding entry. Cisco is the CNA and published the record on 2026-07-29; the CVE Program record's credits array is empty but the vendor advisory carries the acknowledgement, so the attribution is firm. There is a second, independent discovery track worth recording: Cisco states separately that \"in July 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability\" — meaning a threat actor had located the same static credential before or concurrently with the coordinated report, which is the expected outcome for embedded credentials since anyone who obtains an appliance image can extract them offline. No primary source attributes discovery, extraction or exploitation to AI tooling, and finding a hard-coded credential in a firmware image is exactly the class of work that has been routine for manual reverse engineers for two decades.",
     "ai_assisted_weaponization": false,
@@ -139518,7 +139518,7 @@
       "Cisco Secure FMC 10.0.0 through 10.0.1",
       "Affected regardless of device configuration, per Cisco; exposure is reduced but not eliminated when the management interface has no public internet access"
     ],
-    "complexity_notes": "AC:L with no privileges and no user interaction, because authenticating with a static credential requires no technique at all once the credential is known — the only barrier is possession, and Cisco confirmed in July 2026 that at least one party has it. The CVSS 3.1 base score of 5.3 (C:L/I:N/A:N) is the most misleading number in this batch and Cisco says so in the advisory itself: PSIRT assigned a Security Impact Rating of High rather than Medium precisely because the account can be combined with other Cisco Secure FMC vulnerabilities to elevate privileges. Score it as a chain entry point, not as bounded low-confidentiality information disclosure — the asset is the management plane for the organisation's firewall estate, so read access to device inventory and policy is reconnaissance for the entire perimeter. CISA agreed with the elevated reading operationally, adding it to KEV on 2026-07-29, the same day Cisco published, with a three-day due date under BOD 26-04 and an SSVC record of exploitation \"active\" plus automatable \"yes\". EPSS at 0.0079 (52.7th percentile) reflects the absence of public exploit code rather than the difficulty of using a known password and should not drive prioritisation here. Two operational complications compound the risk: there is no workaround, and the 7.3 train has no hotfix, so a subset of affected deployments cannot reach a fixed state without a version migration.",
+    "complexity_notes": "AC:L with no privileges and no user interaction, because authenticating with a static credential requires no technique at all once the credential is known — the only barrier is possession, and Cisco confirmed in July 2026 that at least one party has it. The CVSS 3.1 base score of 5.3 (C:L/I:N/A:N) is misleading and Cisco says so in the advisory itself: PSIRT assigned a Security Impact Rating of High rather than Medium precisely because the account can be combined with other Cisco Secure FMC vulnerabilities to elevate privileges. Score it as a chain entry point, not as bounded low-confidentiality information disclosure — the asset is the management plane for the organisation's firewall estate, so read access to device inventory and policy is reconnaissance for the entire perimeter. CISA agreed with the elevated reading operationally, adding it to KEV on 2026-07-29, the same day Cisco published, with a three-day due date under BOD 26-04 and an SSVC record of exploitation \"active\" plus automatable \"yes\". EPSS at 0.0079 (52.7th percentile) reflects the absence of public exploit code rather than the difficulty of using a known password and should not drive prioritisation here. Two operational complications compound the risk: there is no workaround, and the 7.3 train has no hotfix, so a subset of affected deployments cannot reach a fixed state without a version migration.",
     "patch_available": true,
     "patch_required_reboot": true,
     "live_patch_available": false,
@@ -143526,7 +143526,7 @@
       "Windows 8.1, Windows RT 8.1 and Windows Server 2012 R2 (incl. Server Core) < 6.3.9600.20671 — KB5020023 rollup / KB5020010 security-only",
       "Windows Server 2012 (incl. Server Core) < 6.2.9200.23968 — KB5020009 rollup / KB5020003 security-only"
     ],
-    "complexity_notes": "The defining characteristic of this CVE is information scarcity, and it should drive triage more than the score does. CVSS 7.8 with AC:L/PR:L/UI:N describes a straightforward local escalation, but Microsoft published a single FAQ sentence ('an attacker who successfully exploited this vulnerability could gain SYSTEM privileges') and nothing else — no root cause, no affected-function detail, no in-the-wild campaign description — and no third party has filled the gap in the years since: no Exploit-DB entry, no Metasploit module, no Nuclei template, no GitHub PoC, and no Project Zero root-cause analysis, even though Project Zero published analyses for both CVE-2022-41073 and CVE-2022-41128 from the same November 2022 release. The same internal contradiction present across this release applies here: MSRC's temporal vector carries E:U (exploit code unproven) while the record's exploitability index reads 'Exploitation Detected' and CISA added it to KEV the day it shipped. EPSS 0.03021 (86.1st percentile, 2026-08-04) is the highest of the three Windows local-escalation CVEs in this batch and still far below what a confirmed in-the-wild SYSTEM escalation warrants, for the usual reason that EPSS tracks public exploit circulation and none exists. What raises this above a generic local escalation is the component: the CNG Key Isolation Service is hosted in lsass.exe per Microsoft's own CNG documentation, and its purpose is to hold long-lived asymmetric private keys outside application memory to satisfy Common Criteria. Controlled corruption there is not only SYSTEM — it is SYSTEM inside the process that custodies signing and certificate keys, so the correct remediation posture includes key-rotation triage, not just patch confirmation. KEV records ransomware campaign use as 'Unknown' for this one, unlike its Print Spooler and Mark-of-the-Web siblings which are both 'Known'.",
+    "complexity_notes": "The defining characteristic of this CVE is information scarcity, and it should drive triage more than the score does. CVSS 7.8 with AC:L/PR:L/UI:N describes a straightforward local escalation, but Microsoft published a single FAQ sentence ('an attacker who successfully exploited this vulnerability could gain SYSTEM privileges') and nothing else — no root cause, no affected-function detail, no in-the-wild campaign description — and no third party has filled the gap in the years since: no Exploit-DB entry, no Metasploit module, no Nuclei template, no GitHub PoC, and no Project Zero root-cause analysis, even though Project Zero published analyses for both CVE-2022-41073 and CVE-2022-41128 from the same November 2022 release. The same internal contradiction present across this release applies here: MSRC's temporal vector carries E:U (exploit code unproven) while the record's exploitability index reads 'Exploitation Detected' and CISA added it to KEV the day it shipped. EPSS 0.03021 (86.1st percentile, 2026-08-04) is far below what a confirmed in-the-wild SYSTEM escalation warrants, for the usual reason that EPSS tracks public exploit circulation and none exists. What raises this above a generic local escalation is the component: the CNG Key Isolation Service is hosted in lsass.exe per Microsoft's own CNG documentation, and its purpose is to hold long-lived asymmetric private keys outside application memory to satisfy Common Criteria. Controlled corruption there is not only SYSTEM — it is SYSTEM inside the process that custodies signing and certificate keys, so the correct remediation posture includes key-rotation triage, not just patch confirmation. KEV records ransomware campaign use as 'Unknown' for this one, unlike its Print Spooler and Mark-of-the-Web siblings which are both 'Known'.",
     "patch_available": true,
     "patch_required_reboot": true,
     "live_patch_available": false,
@@ -143631,7 +143631,7 @@
       "Windows Server 2012 < 6.2.9200.23968 — KB5020009 rollup / KB5020003 security-only / KB5019958 IE cumulative",
       "Windows 7 SP1 and Windows Server 2008 R2 SP1 < 6.1.7601.26221 — KB5020000 rollup / KB5020013 security-only / KB5019958 IE cumulative"
     ],
-    "complexity_notes": "This is the sharpest of the five and the vendor metadata agrees for once: MSRC rates it Critical and its temporal vector carries E:F (functional exploit code), the only one of the four November 2022 Windows CVEs in this batch not marked E:U. EPSS 0.24623 (97.7th percentile, 2026-08-04) is roughly ten times its siblings' and is unusually well-calibrated, reflecting the published Project Zero trigger PoC and the documented state-actor campaign. AC:L/PR:N/UI:R understates the position slightly in one direction and overstates it in another: the required user interaction is opening a document, which the APT37 lure engineered around a national tragedy three days after it happened, but the exploit needs no second bug — Office is not sandboxed by default, so a single type confusion in GlobOpt::OptArraySrc reaches user-level code execution through arbitrary read/write, an ASLR defeat via leaked jscript9.dll vtable pointers, and a Control Flow Guard bypass through a fake string vtable into VirtualProtect. Two facts should dominate triage over the score. First, the bug is a variant: Project Zero notes it is 'very similar to CVE-2021-34480', another incorrect-JIT-optimisation type confusion patched in 2021, so the JScript9 JIT should be treated as a recurring surface rather than a closed one. Second, and more consequential for anyone assessing residual exposure today, retiring Internet Explorer did not retire the attack surface — the IE11 desktop app was retired on 15 June 2022 and permanently disabled on 14 February 2023, but the MSHTML/Trident platform and jscript9.dll remain shipped in Windows, and the delivery chain deliberately used Office's remote-template fetch to render attacker HTML through that engine without ever launching a browser. Legacy exposure compounds this: Windows 7, 8.1, Server 2008 R2 and Server 2012/2012 R2 were all affected and their fixes arrived through rollup, security-only and IE-cumulative channels that are now ended or ESU-gated.",
+    "complexity_notes": "The vendor metadata agrees for once: MSRC rates this November 2022 Windows CVE Critical and its temporal vector carries E:F (functional exploit code) rather than E:U. EPSS 0.24623 (97.7th percentile, 2026-08-04) is roughly ten times its siblings' and is unusually well-calibrated, reflecting the published Project Zero trigger PoC and the documented state-actor campaign. AC:L/PR:N/UI:R understates the position slightly in one direction and overstates it in another: the required user interaction is opening a document, which the APT37 lure engineered around a national tragedy three days after it happened, but the exploit needs no second bug — Office is not sandboxed by default, so a single type confusion in GlobOpt::OptArraySrc reaches user-level code execution through arbitrary read/write, an ASLR defeat via leaked jscript9.dll vtable pointers, and a Control Flow Guard bypass through a fake string vtable into VirtualProtect. Two facts should dominate triage over the score. First, the bug is a variant: Project Zero notes it is 'very similar to CVE-2021-34480', another incorrect-JIT-optimisation type confusion patched in 2021, so the JScript9 JIT should be treated as a recurring surface rather than a closed one. Second, and more consequential for anyone assessing residual exposure today, retiring Internet Explorer did not retire the attack surface — the IE11 desktop app was retired on 15 June 2022 and permanently disabled on 14 February 2023, but the MSHTML/Trident platform and jscript9.dll remain shipped in Windows, and the delivery chain deliberately used Office's remote-template fetch to render attacker HTML through that engine without ever launching a browser. Legacy exposure compounds this: Windows 7, 8.1, Server 2008 R2 and Server 2012/2012 R2 were all affected and their fixes arrived through rollup, security-only and IE-cumulative channels that are now ended or ESU-gated.",
     "patch_available": true,
     "patch_required_reboot": true,
     "live_patch_available": false,
@@ -144272,7 +144272,7 @@
       "Non-Windows AnyConnect builds are not affected — the defect is in the Windows IPC channel and installer (vpndownloader) component",
       "Superseded product line: Cisco Secure Client 5.x replaces AnyConnect 4.x and is the current supported upgrade path"
     ],
-    "complexity_notes": "CVSS AV:L/AC:L/PR:L is exactly right and the low complexity is real: the only precondition is valid credentials on the Windows host, and Cisco confirms there are no workarounds. Exploitation is a deterministic, race-free sequence — connect to the loopback IPC listener on TCP/62522, send one crafted 'CAC-nc-install' message naming vpndownloader.exe and an attacker DLL, and the SYSTEM-privileged service performs the file copy and the execution itself. The public PoC ships as a single executable that returns a SYSTEM prompt, and Metasploit carries it as an ExcellentRanking local exploit, so weaponisation cost is effectively zero. That is what separates it from the CVSS-equivalent 7.8 kernel bugs in this batch: no memory-corruption craft, no KASLR bypass, no reliability tuning, no chained prerequisite. A trivial local-to-SYSTEM primitive on a security agent installed fleet-wide across remote workers is the profile CISA records with knownRansomwareCampaignUse=Known, and it is why Cisco reopened the advisory on 2022-10-25 to note fresh exploitation attempts more than two years after the fix was available.",
+    "complexity_notes": "CVSS AV:L/AC:L/PR:L is exactly right and the low complexity is real: the only precondition is valid credentials on the Windows host, and Cisco confirms there are no workarounds. Exploitation is a deterministic, race-free sequence — connect to the loopback IPC listener on TCP/62522, send one crafted 'CAC-nc-install' message naming vpndownloader.exe and an attacker DLL, and the SYSTEM-privileged service performs the file copy and the execution itself. The public PoC ships as a single executable that returns a SYSTEM prompt, and Metasploit carries it as an ExcellentRanking local exploit, so weaponisation cost is effectively zero. That is what separates it from CVSS-equivalent 7.8 kernel bugs: no memory-corruption craft, no KASLR bypass, no reliability tuning, no chained prerequisite. A trivial local-to-SYSTEM primitive on a security agent installed fleet-wide across remote workers is the profile CISA records with knownRansomwareCampaignUse=Known, and it is why Cisco reopened the advisory on 2022-10-25 to note fresh exploitation attempts more than two years after the fix was available.",
     "patch_available": true,
     "patch_required_reboot": true,
     "live_patch_available": false,
@@ -148401,7 +148401,7 @@
     "patch_required_reboot": false,
     "live_patch_available": false,
     "live_patch_tools": [],
-    "live_patch_notes": "There is no patch and there will not be one. CISA ICSA-21-252-02 (Update A) states plainly that \"DOPSoft 2 will not receive an update to mitigate these vulnerabilities because it is an end-of-life product,\" and CISA's KEV required action for this CVE is not \"apply updates per vendor instructions\" but \"the impacted product is end-of-life and should be disconnected if still in use\" — the only KEV entry in this batch carrying that instruction. Delta Electronics' remediation is migration, not remediation in place: move HMI hardware to the DOP-100 family and replace the engineering software with DIAScreen, shipped inside DIAStudio v1.1.2 or later. Until that migration completes the available controls are procedural, and CISA names them as social-engineering defenses: open project files only from trusted sources, do not open unsolicited attachments, and run DOPSoft on an isolated engineering workstation kept off the plant and corporate networks.",
+    "live_patch_notes": "There is no patch and there will not be one. CISA ICSA-21-252-02 (Update A) states plainly that \"DOPSoft 2 will not receive an update to mitigate these vulnerabilities because it is an end-of-life product,\" and CISA's KEV required action for this CVE is not \"apply updates per vendor instructions\" but \"the impacted product is end-of-life and should be disconnected if still in use\". Delta Electronics' remediation is migration, not remediation in place: move HMI hardware to the DOP-100 family and replace the engineering software with DIAScreen, shipped inside DIAStudio v1.1.2 or later. Until that migration completes the available controls are procedural, and CISA names them as social-engineering defenses: open project files only from trusted sources, do not open unsolicited attachments, and run DOPSoft on an isolated engineering workstation kept off the plant and corporate networks.",
     "framework_control_gaps": {
       "NIST-800-53-SI-2": "SI-2 flaw remediation presumes a fix exists to be applied within some timeframe; Delta declared DOPSoft 2 end-of-life and shipped nothing, so the control has no action available. The only response that removes the flaw is decommissioning, which SI-2 does not require and which an OT operator cannot execute on a patch-window timescale because it means replacing the deployed HMI hardware with the DOP-100 family — a capital project, not a maintenance task.",
       "EU-CRA-Art13": "The EU Cyber Resilience Act Art.13 obliges manufacturers to handle vulnerabilities and supply security updates across a declared support period — an obligation that did not exist when Delta ended DOPSoft 2's life in 2021. The operator is left carrying an unfixable out-of-bounds write in the engineering software required to maintain equipment already running on the plant floor, with no vendor duty to remediate. CRA changes the incentive for products placed on the market from now on and offers nothing to the installed base still programming DOP-series HMIs.",
@@ -148939,7 +148939,7 @@
       "SAP Web Dispatcher 7.22EXT, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, 7.87",
       "SAP Content Server 7.53"
     ],
-    "complexity_notes": "CVSS 10.0 with AC:L is not inflated: a single unauthenticated HTTP request with a manipulated Content-Length desynchronises the ICM's memory-pipe request buffer, which is why Onapsis characterised it as full system takeover from one request with no authentication and no user interaction. What raises real-world difficulty above the score is topology dependence rather than exploit difficulty — the desync is exploitable where an HTTP(S) proxy or Web Dispatcher sits between clients and the backend, which Onapsis describes as the standard productive configuration but which is not universal, so a scanner hit needs the intermediary confirmed before it is a finding rather than a probe artefact. Two timing facts drive prioritisation. First, this was weaponisable long before public code existed: SAP and Onapsis disclosed on 2022-02-08, CISA warned publicly and added it to KEV on 2022-08-18, and the Exploit-DB PoC did not publish until 2025-04-02 — so any programme using 'public exploit exists' as its escalation trigger was three years late, which is exactly the CVSS-as-risk failure mode RWEP exists to correct. Second, remediation is gated behind an SAP Support Portal login that CISA calls out in the KEV note, so the fix cannot be verified from outside by a third-party assessor or a customer's own supply-chain questionnaire. EPSS sits at 0.979 (99.9th percentile), the highest in this batch, and the Nuclei template carries the kev tag, meaning opportunistic mass scanning for it is routine.",
+    "complexity_notes": "CVSS 10.0 with AC:L is not inflated: a single unauthenticated HTTP request with a manipulated Content-Length desynchronises the ICM's memory-pipe request buffer, which is why Onapsis characterised it as full system takeover from one request with no authentication and no user interaction. What raises real-world difficulty above the score is topology dependence rather than exploit difficulty — the desync is exploitable where an HTTP(S) proxy or Web Dispatcher sits between clients and the backend, which Onapsis describes as the standard productive configuration but which is not universal, so a scanner hit needs the intermediary confirmed before it is a finding rather than a probe artefact. Two timing facts drive prioritisation. First, this was weaponisable long before public code existed: SAP and Onapsis disclosed on 2022-02-08, CISA warned publicly and added it to KEV on 2022-08-18, and the Exploit-DB PoC did not publish until 2025-04-02 — so any programme using 'public exploit exists' as its escalation trigger was three years late, which is exactly the CVSS-as-risk failure mode RWEP exists to correct. Second, remediation is gated behind an SAP Support Portal login that CISA calls out in the KEV note, so the fix cannot be verified from outside by a third-party assessor or a customer's own supply-chain questionnaire. EPSS sits at 0.979 (99.9th percentile) and the Nuclei template carries the kev tag, meaning opportunistic mass scanning for it is routine.",
     "patch_available": true,
     "patch_required_reboot": false,
     "live_patch_available": false,
@@ -149271,7 +149271,7 @@
       "Other Chromium-derived browsers on their own release lines, including Opera, per the CISA KEV note",
       "Fedora 37 chromium package builds predating the upstream 104.0.5112.101 rebuild"
     ],
-    "complexity_notes": "CVSS 3.1 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) is the lowest base score of this batch and the number most likely to be misread. The C:N/A:N pair is why the score sits in the medium band — nothing is disclosed and nothing is disrupted — but I:H is doing all the work: the integrity that falls is the browser's decision about where to navigate, which makes this a delivery primitive whose severity is inherited from whatever it chains into. Google's release note credits Google TAG and states an exploit already existed in the wild, so the low base score coexisted with confirmed targeted use, and CISA applied the same 2022-09-08 BOD 22-01 deadline it applied to the 8.8-rated Apple WebKit bug in the same 2022-08-18 tranche. EPSS at 0.0453 (91st percentile) again measures public exploit circulation, and since the Chromium bug remains restricted and no PoC was ever published, it understates a flaw that was operational for an intrusion set before it was patched. AC:L is consistent with the primitive: nothing needs to be groomed or raced, only a page served. The genuinely awkward part for scoping is the description-versus-CPE mismatch — NVD's text scopes the flaw to Chrome on Android while its CPE set covers Chrome on Windows, macOS, Linux and Android, and CISA notes the code affects Edge, Opera and other Chromium browsers. Inventory work driven by the description alone will size the exposed population far too small.",
+    "complexity_notes": "CVSS 3.1 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) is the number most likely to be misread. The C:N/A:N pair is why the score sits in the medium band — nothing is disclosed and nothing is disrupted — but I:H is doing all the work: the integrity that falls is the browser's decision about where to navigate, which makes this a delivery primitive whose severity is inherited from whatever it chains into. Google's release note credits Google TAG and states an exploit already existed in the wild, so the low base score coexisted with confirmed targeted use, and CISA applied the same 2022-09-08 BOD 22-01 deadline it applied to the 8.8-rated Apple WebKit bug in the same 2022-08-18 tranche. EPSS at 0.0453 (91st percentile) again measures public exploit circulation, and since the Chromium bug remains restricted and no PoC was ever published, it understates a flaw that was operational for an intrusion set before it was patched. AC:L is consistent with the primitive: nothing needs to be groomed or raced, only a page served. The genuinely awkward part for scoping is the description-versus-CPE mismatch — NVD's text scopes the flaw to Chrome on Android while its CPE set covers Chrome on Windows, macOS, Linux and Android, and CISA notes the code affects Edge, Opera and other Chromium browsers. Inventory work driven by the description alone will size the exposed population far too small.",
     "patch_available": true,
     "patch_required_reboot": false,
     "live_patch_available": false,
@@ -149383,7 +149383,7 @@
       "Windows 11 version 21H2",
       "Precondition rather than version: Active Directory Certificate Services installed with the default Machine template enrollable by Domain Computers, and ms-DS-MachineAccountQuota at its default value of 10"
     ],
-    "complexity_notes": "CVSS 3.1 8.8 (AV:N/AC:L/PR:L/UI:N) understates this and MSRC knew it — Microsoft rated it Critical despite the 8.8 base, and the CVSS scale caps at S:U because the formal scope boundary does not capture \"any domain user becomes domain admin\". The PR:L is a single ordinary authenticated user with no special rights, AC:L is honest (no race, no grooming, no memory corruption anywhere — the whole chain is legitimate LDAP writes and a legitimate certificate request), and UI:N means no victim participates at all. EPSS at 0.82989 (99.6th percentile) is the highest in this batch and is well-founded for once: Certipy and a purpose-built Metasploit module made this a two-command operation, and it has been standard tradecraft in AD assessment for years. MSRC's own temporal vector at publication read E:U (exploit code unproven), which was already stale on the day it shipped — Lyak's tooling was public at disclosure, so an organisation prioritising on the 7.7 temporal score was reasoning from a metric that never matched reality. The deepest complexity is remediation rather than exploitation: the 2022-05-10 update leaves StrongCertificateBindingEnforcement in Compatibility mode, which logs KDC events 39/41 and allows the authentication anyway, so \"patched\" meant \"auditing\" until an administrator set the key to 2 or until Microsoft's repeatedly-delayed automatic transition on 2025-02-11. Post-patch the class is narrowed rather than eliminated: any principal with GenericWrite over a computer object can still rewrite dNSHostName, so ACL hygiene on computer objects remains load-bearing.",
+    "complexity_notes": "CVSS 3.1 8.8 (AV:N/AC:L/PR:L/UI:N) understates this and MSRC knew it — Microsoft rated it Critical despite the 8.8 base, and the CVSS scale caps at S:U because the formal scope boundary does not capture \"any domain user becomes domain admin\". The PR:L is a single ordinary authenticated user with no special rights, AC:L is honest (no race, no grooming, no memory corruption anywhere — the whole chain is legitimate LDAP writes and a legitimate certificate request), and UI:N means no victim participates at all. EPSS at 0.82989 (99.6th percentile) is well-founded for once: Certipy and a purpose-built Metasploit module made this a two-command operation, and it has been standard tradecraft in AD assessment for years. MSRC's own temporal vector at publication read E:U (exploit code unproven), which was already stale on the day it shipped — Lyak's tooling was public at disclosure, so an organisation prioritising on the 7.7 temporal score was reasoning from a metric that never matched reality. The deepest complexity is remediation rather than exploitation: the 2022-05-10 update leaves StrongCertificateBindingEnforcement in Compatibility mode, which logs KDC events 39/41 and allows the authentication anyway, so \"patched\" meant \"auditing\" until an administrator set the key to 2 or until Microsoft's repeatedly-delayed automatic transition on 2025-02-11. Post-patch the class is narrowed rather than eliminated: any principal with GenericWrite over a computer object can still rewrite dNSHostName, so ACL hygiene on computer objects remains load-bearing.",
     "patch_available": true,
     "patch_required_reboot": true,
     "live_patch_available": false,
@@ -149489,7 +149489,7 @@
       "Windows Server 2022 and Server 2022 (Server Core installation) below build 10.0.20348.524",
       "Windows Server version 20H2 (Server Core installation) — KB5010386"
     ],
-    "complexity_notes": "CVSS 3.1 7.8 with AV:L/AC:L/PR:N/UI:R, and MSRC's FAQ pre-empts the obvious objection: \"The word Remote in the title refers to the location of the attacker. This type of exploit is sometimes referred to as Arbitrary Code Execution (ACE). The attack itself is carried out locally.\" In practice the delivery is a mailed or downloaded RTF, so AV:L should not be read as requiring prior access. AC:L matches the defect shape — an uninitialised pointer freed on a deterministic code path, not a race or a heap groom with timing constraints — though turning the LocalFree into reliable code execution requires heap shaping that the public PoC demonstrates as a crash rather than as a working payload. EPSS at 0.53934 (98.9th percentile) is the second highest in this batch and is credibly driven by the 302-star public PoC plus the KEV listing rather than by any documented campaign. The scoring history is the interesting part: MSRC published this as Important with a temporal vector of E:U (exploit code unproven, remediation official, confidence confirmed) giving 6.8, the public PoC appeared roughly a month later invalidating E:U, and CISA asserted active exploitation six months after that on 2022-08-18. Any organisation that prioritised on the vendor's temporal score at publication would have scheduled this into a routine monthly cycle. A residual consideration for surviving hosts: every affected Windows 10 branch has passed end of servicing (Windows 10 support ended 2025-10-14), so an unpatched machine on one of these builds is outside normal update flow and the February 2022 KB has to be pulled from the Microsoft Update Catalog by hand — assuming migration is not the better answer.",
+    "complexity_notes": "CVSS 3.1 7.8 with AV:L/AC:L/PR:N/UI:R, and MSRC's FAQ pre-empts the obvious objection: \"The word Remote in the title refers to the location of the attacker. This type of exploit is sometimes referred to as Arbitrary Code Execution (ACE). The attack itself is carried out locally.\" In practice the delivery is a mailed or downloaded RTF, so AV:L should not be read as requiring prior access. AC:L matches the defect shape — an uninitialised pointer freed on a deterministic code path, not a race or a heap groom with timing constraints — though turning the LocalFree into reliable code execution requires heap shaping that the public PoC demonstrates as a crash rather than as a working payload. EPSS at 0.53934 (98.9th percentile) is credibly driven by the 302-star public PoC plus the KEV listing rather than by any documented campaign. The scoring history is the interesting part: MSRC published this as Important with a temporal vector of E:U (exploit code unproven, remediation official, confidence confirmed) giving 6.8, the public PoC appeared roughly a month later invalidating E:U, and CISA asserted active exploitation six months after that on 2022-08-18. Any organisation that prioritised on the vendor's temporal score at publication would have scheduled this into a routine monthly cycle. A residual consideration for surviving hosts: every affected Windows 10 branch has passed end of servicing (Windows 10 support ended 2025-10-14), so an unpatched machine on one of these builds is outside normal update flow and the February 2022 KB has to be pulled from the Microsoft Update Catalog by hand — assuming migration is not the better answer.",
     "patch_available": true,
     "patch_required_reboot": true,
     "live_patch_available": false,