@blamejs/exceptd-skills 0.19.4 → 0.19.6

package/data/zeroday-lessons.json

@@ -2085,7 +2085,29 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "human_researcher",
-    "ai_assist_factor": "low"
+    "ai_assist_factor": "low",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-009",
+        "name": "KERNEL-MODULE-INVENTORY-AND-DISABLE",
+        "description": "On every node running CRI-O, treat the host's loadable-module surface as the blast radius of the container runtime: inventory the modules a node actually needs for its workloads, blocklist the remainder in modprobe configuration, and enforce a locked/signed module set so a modprobe invocation carrying pod-spec-derived arguments cannot pull in a module the node's business function never requires. This is the compensating layer that survives an attacker who legitimately holds pod-create RBAC, because the module load is performed by the runtime on the host — not inside the container — so pod-level confinement (dropped capabilities, seccomp, AppArmor) never observes it. The distinguishing test: from a pod-create-capable service account on a staging CRI-O cluster, submit a pod spec whose attributes drive modprobe toward a module outside the node's approved inventory and confirm the load is refused rather than silently completed on the host; a cluster that passes image-scan and RBAC review still yields node-level module loading if the node's module set is unbounded.",
+        "evidence": "Packet: pod-spec attributes reach the modprobe argument path in CRI-O without validation, so 'an attacker with pod-create RBAC on a cluster using CRI-O can cause arbitrary kernel modules to load on the host node, achieving container-escape-equivalent capability' (CWE-20). CVSS 8.1, RWEP 30, poc_available: true. Not CISA KEV-listed and active_exploitation is unknown — the reason a CVSS/KEV-tiered flaw-remediation cadence deprioritizes it despite node-level impact. The entry records patch_available: true and live_patch_available: true, so a runtime fix and a live-patch path both exist; the module-inventory control is what covers the window before that fix lands and the residual after it.",
+        "gap_closes": [
+          "NIST-800-53-CM-7",
+          "AU-Essential-8-App-Hardening",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-036",
+        "name": "FLEET-CONTROL-PLANE-ADMIN-PRIVILEGE-TIER",
+        "description": "Classify pod-create authority on a CRI-O cluster as fleet-control-plane privilege rather than application-developer privilege. This CVE collapses the distance between the two: the namespace-scoped ability to submit a pod spec is, on an unpatched CRI-O node, the ability to load an arbitrary kernel module on the host. Every identity that holds pod-create on such a cluster — human operators and CI service accounts alike — therefore needs the control-plane tier's handling: an identity separate from application admin roles, just-in-time elevation with an approval step, and access only through a privileged path; and cluster RBAC must be audited for who holds pod-create outside that tier. The CIS Kubernetes admission guidance cited against this entry inspects what a pod requests (assigned capabilities, AppArmor profile) and does not help here, because the escape requires no elevated capability in the pod at all — the privileged action is taken by the runtime on the pod's behalf.",
+        "evidence": "Packet: 'Pod-spec attributes reach modprobe argument path in CRI-O without validation. An attacker with pod-create RBAC on a cluster using CRI-O can cause arbitrary kernel modules to load on the host node, achieving container-escape-equivalent capability.' The gap cited against this entry, CIS Kubernetes Benchmark v1.10.0 item 4.2.13, is scoped as 'Minimize the admission of containers with capabilities assigned (Kubelet / AppArmor profile guidance)'. CWE-20, CVSS 8.1, RWEP 30, poc_available: true.",
+        "gap_closes": [
+          "CIS-Kubernetes-Benchmark-4.2.13"
+        ]
+      }
+    ]
   },
   "CVE-2023-43472": {
     "name": "MLflow path-traversal arbitrary file read",
@@ -2140,7 +2162,31 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "human_researcher",
-    "ai_assist_factor": "low"
+    "ai_assist_factor": "low",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-094",
+        "name": "AI-RUNTIME-API-PATH-TRAVERSAL-VALIDATION",
+        "description": "MLflow's artifact endpoint joins a caller-supplied path onto the artifact root and serves the result, so containment must be enforced on the read direction and not only on uploads and extractions: resolve the requested path to an absolute canonical form, verify the resolved result is still under the artifact root (rejecting absolute paths, ../ segments, and symlinks that leave the root), and do that check before the file handle is opened rather than by filtering the request string. On a tracking server the read half is the higher-value half, because the same host holds the object-store credentials, the tracking database URI, and the operator key material that an arbitrary-file read returns.",
+        "evidence": "Packet: the tracking-server artifact endpoint resolves user-controlled paths under the artifact root without normalization, and an unauthenticated HTTP request carrying ../ reads arbitrary files from the host filesystem (CWE-22, CVSS 7.5). A PoC is public and a patch is available.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.28",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-033",
+        "name": "AI-ML-DEVELOPER-TOOLING-INVENTORY",
+        "description": "An MLflow tracking server is typically stood up by a data-science team rather than by IT, so nothing tells the application-patching program that a network-reachable artifact-read flaw exists on it — the asset is not on the list the patch SLA runs against. The inventory entry for this server must record each listening endpoint, whether any authentication sits in front of the artifact route specifically (this traversal is reachable unauthenticated), and the blast radius of a file read from that host: artifact-store credentials, registered model artifacts, and training-data paths, which is how a file read becomes model-supply-chain tampering. It needs its own patch SLA tier rather than the generic application tier.",
+        "evidence": "Packet: an unauthenticated HTTP request to the tracking server's artifact endpoint reads arbitrary host files. The CVE is not KEV-listed and active exploitation is unknown despite a public PoC and RWEP 35 — the exact profile that never surfaces on a KEV-driven patch queue and so depends on the asset being inventoried to be remediated at all.",
+        "gap_closes": [
+          "NIST-AI-RMF-MEASURE-2.7",
+          "OWASP-ML-Top-10-2023-ML06",
+          "AU-ISM-1546",
+          "NIS2-Art21-network-security"
+        ]
+      }
+    ]
   },
   "CVE-2024-27132": {
     "name": "MLflow Recipe Template Injection XSS to Client-Side RCE",
@@ -2345,7 +2391,28 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "human_researcher",
-    "ai_assist_factor": "low"
+    "ai_assist_factor": "low",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "The Orion authentication-bypass fix has to run on the KEV clock rather than the change window an internal monitoring server normally gets. Exploitation needs nothing but a single HTTP request whose URI matches the SkipI18nStrings pattern to land on Orion's API write endpoints — there is no credential to brute-force, no user to phish and no exploit-development lead time, so exposure lasts exactly as long as the unpatched Orion web surface stays reachable. The packet records a vendor fix as available and no live-patch path, so the mitigation is a scheduled Orion upgrade with the API surface restricted to a management segment (or the web service stopped) until the upgrade lands, not a deferral to the next quarterly maintenance slot.",
+        "evidence": "Packet: cisa_kev true, kev_date 2021-11-03, active_exploitation confirmed, rwep_score 75, cvss 9.8, poc_available true, patch_available true, live_patch_available false, live_patch_notes null, cwe_refs CWE-287. Vector: \"URI pattern matching against SkipI18nStrings triggers bypass — unauthenticated request matching the pattern reaches API write endpoints.\"",
+        "gap_closes": [
+          "AU-Essential-8-Patch"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-037",
+        "name": "FLEET-COMPROMISE-IR-PLAYBOOK",
+        "description": "Orion is a fleet control plane — it reaches, polls and holds credentials for the monitored estate — so the response to this bypass cannot end at the upgrade. The packet records SUNBURST operators using the bypass to exercise API write access against Orion installations that were already compromised, which means patching removes the entry path and leaves whatever was written through the API in place. The playbook's exposure-window steps are what actually apply here: enumerate every API write made against Orion during the window, audit configuration and job/alert-action changes made through it, invalidate the trust state of nodes Orion administers, and rotate every credential Orion custodied or that authenticated through it. That enumeration only exists if Orion's own per-request API telemetry was collected and retained off-box — monitoring programs scoped to the estate Orion watches routinely do not collect it for the monitoring platform itself, which is the monitoring gap this closes. It also closes the supply-chain gap: after a compromise delivered through the vendor product, a vendor patch restores the code but not the trust state of the installation or of the estate reachable from it.",
+        "evidence": "Packet attack_vector: \"URI pattern matching against SkipI18nStrings inside Orion's HTTP routing triggers an authentication bypass — an unauthenticated request that matches the pattern reaches API write endpoints. Used by SUNBURST operators to exercise API write access against compromised Orion installations.\" Packet: cisa_kev true, kev_date 2021-11-03, active_exploitation confirmed, poc_available true, rwep_score 75, cvss 9.8. Citing gaps already record UK-CAF-C1 (Security monitoring) and NIS2-Art21-supply-chain as insufficient for this CVE.",
+        "gap_closes": [
+          "UK-CAF-C1",
+          "NIS2-Art21-supply-chain"
+        ]
+      }
+    ]
   },
   "CVE-2023-3519": {
     "name": "Citrix NetScaler ADC/Gateway unauth RCE (CitrixBleed precursor)",
@@ -2400,7 +2467,30 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "human_researcher",
-    "ai_assist_factor": "low"
+    "ai_assist_factor": "low",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-030",
+        "name": "PERIMETER-DEVICE-ZERODAY-SLA-TIER",
+        "description": "A NetScaler ADC/Gateway is the authentication and TLS-termination boundary for the applications behind it, so the 14/30-day patch windows the citing controls grade against are the wrong clock for it — the device is not protected by the perimeter, it is the perimeter. CVE-2023-3519 argues for a distinct tier: for a pre-authentication defect on an internet-reachable NetScaler, either the fixed build is deployed or the exposed virtual server's public interface is taken offline, within hours of KEV listing, with that shutdown pre-authorized so an on-call engineer can take it without a change window. The tier must also be driven by configured role rather than by product name. Only appliances configured to serve the gateway SAML/formssso path reach the vulnerable nsppe code, so an asset inventory that records 'NetScaler present' cannot select the affected population — it has to record which virtual servers are published and which authentication paths they expose, or the compressed SLA fires against the wrong devices and misses the right ones.",
+        "evidence": "Citrix NetScaler ADC/Gateway, CISA KEV-listed 2023-07-19 with confirmed in-the-wild exploitation and a public PoC available. The packet's attack-vector record: an unauthenticated HTTP POST to /gwtest/formssso reaches the vulnerable nsppe parser — no credential and no prior foothold required — and CISA AA23-201A documented in-wild exploitation by Chinese state-sponsored actors against US critical-infrastructure organizations within weeks of disclosure. RWEP 80 / CVSS 9.8.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "PCI-DSS-4.0-6.3.3",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "The nsppe stack overflow runs before authentication, which means a successful CVE-2023-3519 exploit generates no authentication event to find later and executes with the packet engine's privilege on the appliance. Upgrading to the fixed NetScaler build restores the SAML parser and says nothing about what was installed while the parser was broken. Any NetScaler that served the gateway formssso path from an untrusted network on a vulnerable build must therefore be dispositioned as compromised regardless of what a post-upgrade version scan reports: capture and diff the running configuration against the last known-good, inspect the appliance's web-served directories for files not shipped by the vendor, then rebuild from vendor media at the fixed version rather than upgrading in place, and rotate what the device held — SAML signing and session material, the LDAP/RADIUS bind accounts it authenticated against, the local administrative accounts, and any TLS private key stored on it. Version-based remediation evidence is specifically what fails here, because the attacker's artifacts are not versioned.",
+        "evidence": "Pre-authentication stack buffer overflow (CWE-787) in the NetScaler SAML processing path, reachable by an unauthenticated HTTP POST per the packet's attack-vector record. CISA KEV-listed 2023-07-19, active exploitation confirmed, public PoC available, patch available, RWEP 80. CISA AA23-201A documented state-sponsored exploitation of US critical-infrastructure organizations within weeks of disclosure — meaning estates that patched after that interval applied the fix to devices an adversary had already entered.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      }
+    ]
   },
   "CVE-2024-1709": {
     "name": "ConnectWise ScreenConnect auth-bypass",
@@ -2565,7 +2655,30 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "human_researcher",
-    "ai_assist_factor": "low"
+    "ai_assist_factor": "low",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-028",
+        "name": "CONTAINER-RUNTIME-PATCH-SLA-24H",
+        "description": "The defect sits in containerd's CNI IP-allocation path, and a container receives its address and mask when its network is configured - so upgrading the containerd package on a node does not repair a workload that was already handed a spurious mask. Those containers keep permitting traffic across network namespaces until they are recreated on the fixed runtime, which makes the remediation unit node upgrade plus controlled recreation of every workload that was networked by the vulnerable allocation path, and makes the completion criterion 'no running container was networked by the vulnerable path' rather than 'containerd version is past the fix'. This entry is not KEV-listed and its exploitation status is unknown, so the control's KEV-triggered 24-hour clock does not fire here; what this CVE demonstrates is the recreation half of the control, the part every patch-cadence framework control omits because it assumes installing the fixed package ends the exposure. A vendor fix exists and no live-patch path is registered, so the recreation cannot be deferred in the hope of an in-place remedy.",
+        "evidence": "Packet attack_vector: 'Integer overflow in the containerd CNI IP-allocation path. A crafted CIDR specification overflows the uint32 mask conversion, causing the container to receive a spurious mask that allows traffic to leak across network namespaces.' Packet fields: cwe_refs CWE-200; cvss 5.9; rwep_score 30; cisa_kev false; kev_date null; active_exploitation unknown; poc_available true; patch_available true; live_patch_available false; live_patch_notes null. Citing gaps include AU-Essential-8-Patch and ISO-27001-2022-A.8.8.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-018",
+        "name": "SCANNER-PAPER-COMPLIANCE-TEST",
+        "description": "Two green reports coexist with this vulnerability. A CIS-Kubernetes 5.3 assessment passes by finding NetworkPolicy objects present and a policy-capable CNI, and a vulnerability scan passes by finding the containerd package at or past the fixed version. Neither verdict can see the failure: the container is handed a spurious mask by the allocation path, so traffic crosses network namespaces without any NetworkPolicy being violated - the leak is underneath the layer the benchmark inspects - and a package-version check says nothing about containers still running with a mask the vulnerable path gave them. The operational test has to touch the data plane: from a pod, attempt to reach an address in a neighbouring namespace's range that policy is supposed to forbid and confirm the packet is dropped, and enumerate running containers' allocated masks against the ranges their namespaces were meant to receive. Any assessment that reports boundary protection satisfied on the strength of policy-object presence plus a version string is paper compliance against exactly this defect.",
+        "evidence": "Packet attack_vector: 'Integer overflow in the containerd CNI IP-allocation path. A crafted CIDR specification overflows the uint32 mask conversion, causing the container to receive a spurious mask that allows traffic to leak across network namespaces.' Packet vector: 'Integer overflow in CNI IP-allocation path - container receives spurious mask, leaks across network namespaces.' Packet fields: cwe_refs CWE-200 (information disclosure), cvss 5.9, poc_available true, patch_available true. Citing gaps include CIS-Kubernetes-Benchmark-5.3 (Network Policies and CNI), NIST-800-53-SC-7 (Boundary Protection) and NIS2-Art21-network-security.",
+        "gap_closes": [
+          "CIS-Kubernetes-Benchmark-5.3",
+          "NIST-800-53-SC-7",
+          "NIS2-Art21-network-security"
+        ]
+      }
+    ]
   },
   "CVE-2026-30623": {
     "name": "Anthropic MCP SDK stdio command-injection",
@@ -2687,7 +2800,30 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "human_researcher",
-    "ai_assist_factor": "low"
+    "ai_assist_factor": "low",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-054",
+        "name": "BACKUP-TIER-NETWORK-ISOLATION",
+        "description": "A BeeStation is a consumer NAS whose whole purpose is holding the primary and backup copy of a household's or a branch site's data, and the packet's attack path reaches it with no credential and no user interaction — a pre-auth chain against the BeeStation Manager web management surface ending in OS command execution on the box that holds the data. Applied to this product, the control means the BeeStation Manager web surface answers only from an operator subnet or an authenticated VPN: not from the general user VLAN, and not from the internet via a UPnP mapping or a home-router port forward, which is how consumer NAS hardware at remote-worker and small-branch sites normally acquires exposure. The appliance's outbound path should be constrained too, so a rooted BeeStation cannot reach arbitrary destinations with the data it holds. Reachability is the entire exploit precondition for a pre-auth CWE-78 flaw, and it is the only lever an operator holds between a public exploit chain and a firmware update landing on a device that no enterprise console manages — the packet records a vendor patch but no live-patch path, so the appliance has to be taken through the update to remediate. The distinguishing test: from a general user VLAN and from an external address, attempt to load the BeeStation Manager web surface; anything that answers is within reach of the published chain, and \"the NAS is on the internal network\" is an assertion about topology, not a demonstration that the management surface is unreachable from untrusted segments.",
+        "evidence": "Packet: CVE-2025-12686, \"Synology BeeStation unauth RCE (Pwn2Own Ireland 2025)\", CWE-78, attack vector recorded as a pre-auth RCE chain on the Synology BeeStation Manager web management surface, demonstrated as a full chain on consumer NAS hardware at Pwn2Own Ireland 2025. CVSS 9.8, RWEP 45, poc_available true, cisa_kev false, active_exploitation unknown, patch_available true, live_patch_available false (live_patch_notes null). UK-CAF-B4 (system security) is already recorded as an insufficient control citing this CVE.",
+        "gap_closes": [
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-018",
+        "name": "SCANNER-PAPER-COMPLIANCE-TEST",
+        "description": "For this entry the paper-compliance failure is not a mis-compared version string but an asset that never enters the scan at all. Consumer NAS hardware arrives at remote-worker and small-branch sites outside the procurement and agent-deployment path, so an estate can report zero outstanding criticals while a BeeStation with a CVSS 9.8 pre-auth command-injection flaw and a public exploit chain runs unlisted on the same network. The operational test for this CVE: does the vulnerability-management programme enumerate the BeeStation as an asset and resolve its BeeStation Manager firmware build against CVE-2025-12686, or does the compliance verdict come from an endpoint-management console whose coverage is defined as managed workstations and servers? A second, independent failure: with cisa_kev false and active_exploitation unknown, a queue that escalates only on KEV listing leaves this CVE unranked despite a demonstrated working exploit chain, so the enumeration has to be paired with a severity input that does not depend on a KEV entry appearing. The distinguishing test: pick a site known to run a BeeStation and query the vulnerability register for that appliance's firmware build — an empty result, not a low-severity result, is the finding, and it is what a patch-management attestation against NIST-800-53-SI-2 or ISO 27001 A.8.8 will not reveal.",
+        "evidence": "Packet: CVE-2025-12686 is a pre-auth RCE chain (CWE-78) on the Synology BeeStation Manager web management surface, demonstrated on consumer NAS hardware at Pwn2Own Ireland 2025. CVSS 9.8, RWEP 45, poc_available true, cisa_kev false, active_exploitation unknown, patch_available true. AU-Essential-8-Patch, ISO-27001-2022-A.8.8, NIST-800-53-SI-2 and NIS2-Art21-vulnerability-management are all already recorded as insufficient controls citing this CVE.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "ISO-27001-2022-A.8.8",
+          "AU-Essential-8-Patch",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      }
+    ]
   },
   "CVE-2025-62847": {
     "name": "QNAP QTS/QuTS hero RCE (Pwn2Own Ireland 2025, chain 1/3)",
@@ -2797,7 +2933,30 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "human_researcher",
-    "ai_assist_factor": "low"
+    "ai_assist_factor": "low",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-054",
+        "name": "BACKUP-TIER-NETWORK-ISOLATION",
+        "description": "On the QNAP TS-453E the appliance is simultaneously the file store and the restore source, so code execution on it is code execution on the copy of the data an operator would recover from. This CVE is not a standalone entry point — the packet records it as component 2/3 of a chain with CVE-2025-62847 and CVE-2025-62849 — which means the shared precondition for every link is network reachability of the QTS / QuTS hero web management surface. Applying the control to this product: the QTS / QuTS hero management surface must answer only from an operator subnet or an authenticated VPN, never from a general user VLAN and never through a UPnP mapping or branch-router port forward, and the appliance's own outbound path must be constrained so a rooted NAS cannot reach arbitrary destinations. Because a vendor patch exists but no live-patch path is registered for this entry, the appliance has to be taken through a firmware update to remediate — isolation is what covers the interval, and it collapses all three chain components at once rather than one CVE id at a time. The distinguishing test: from a user VLAN and from an external address, attempt to load the TS-453E's QTS / QuTS hero web management surface; anything that answers is inside the chain's reach, and a policy that merely records \"NAS appliances sit on the internal network\" has not demonstrated the management plane is unreachable from untrusted segments.",
+        "evidence": "Packet: CVE-2025-62848, \"QNAP QTS/QuTS hero RCE (Pwn2Own Ireland 2025, chain 2/3)\", CWE-94 code injection on the QNAP TS-453E appliance, demonstrated by the DEVCORE Research Team at Pwn2Own Ireland 2025 and chained with CVE-2025-62847 and CVE-2025-62849. CVSS 9.8, RWEP 40, poc_available true, cisa_kev false, active_exploitation unknown, patch_available true, live_patch_available false (live_patch_notes null). NIS2-Art21-network-security (security of network and information systems) and UK-CAF-B4 (system security) are both already recorded as insufficient controls citing this CVE.",
+        "gap_closes": [
+          "NIS2-Art21-network-security",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-018",
+        "name": "SCANNER-PAPER-COMPLIANCE-TEST",
+        "description": "A remediation register that closes this appliance on the strength of one ingested CVE id is paper compliance, because the packet describes a three-CVE chain and the appliance's exploitability is a property of the installed QTS / QuTS hero build, not of any single id. The operational test for this entry: does the vulnerability register resolve the TS-453E's actual installed firmware build against all three chain ids — CVE-2025-62847, CVE-2025-62848 and CVE-2025-62849 — and does it record which build closes each, rather than reporting \"remediated\" from whichever id the feed happened to deliver first? A second failure mode is prioritisation rather than detection: with cisa_kev false and active_exploitation unknown, a queue that escalates only on KEV listing never surfaces this CVE at all, even though the packet records a CVSS 9.8 code-injection flaw with a working public exploit chain demonstrated against the hardware. The distinguishing test: query the register for the TS-453E firmware build and confirm all three chain ids resolve to a closed state on that same build; a register showing one closed and the siblings absent is reporting on its feed coverage, not on whether the appliance can still be chained to privileged execution.",
+        "evidence": "Packet: CVE-2025-62848 is component 2/3 of the DEVCORE chain, chained with CVE-2025-62847 and CVE-2025-62849 on the QNAP TS-453E. poc_available true, CVSS 9.8, RWEP 40, cisa_kev false, active_exploitation unknown, patch_available true. NIST-800-53-SI-2 (flaw remediation), ISO-27001-2022-A.8.8 (management of technical vulnerabilities) and AU-Essential-8-Patch are all already recorded as insufficient controls citing this CVE.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "ISO-27001-2022-A.8.8",
+          "AU-Essential-8-Patch"
+        ]
+      }
+    ]
   },
   "CVE-2025-62849": {
     "name": "QNAP QTS/QuTS hero RCE (Pwn2Own Ireland 2025, chain 3/3)",
@@ -3057,7 +3216,39 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "low"
+    "ai_assist_factor": "low",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "Fortinet's own follow-up on this CVE is the proof case for the control: devices compromised through sslvpnd before patching were left with read-only symlinks in the SSL-VPN language-file directory that continue to grant filesystem read access on fully patched firmware. For FortiOS and FortiProxy the remediation verdict therefore cannot be 'the appliance is on a fixed build'. Every appliance that exposed the SSL-VPN web surface while on a vulnerable build has to be triaged as a compromise: enumerate the SSL-VPN language-file directory and the other web-served paths for entries that are not vendor content, diff the running configuration against a known-good export, and where anything is found — or where the pre-patch exposure window cannot be bounded — reimage the appliance rather than upgrade in place, then rotate the local administrative credentials, API tokens, VPN user secrets, RADIUS and LDAP bind secrets, and any certificate material held on the device. A device whose exposure window predates the patch should be rebuilt even when the symlink hunt comes back clean, because the same code execution could place persistence somewhere the published hunt does not look.",
+        "evidence": "Fortinet FortiOS / FortiProxy, CISA KEV-listed 2024-02-09 with confirmed in-the-wild exploitation, public PoC available, RWEP 85 / CVSS 9.8. Per the packet's attack-vector record: an out-of-bounds write in the sslvpnd daemon's HTTP request handling, reachable by an unauthenticated crafted HTTP request to the SSL-VPN web surface; mass-scanning began within hours of the 2024-02-08 vendor disclosure; and Fortinet's 2025-04-11 follow-up advisory documented attackers who compromised devices before patching leaving read-only symlinks in the SSL-VPN language-file directory that grant persistent filesystem read on fully patched firmware — the packet states plainly that patch alone is insufficient.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "AU-ISM-1546"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-030",
+        "name": "PERIMETER-DEVICE-ZERODAY-SLA-TIER",
+        "description": "Mass scanning for this bug started within hours of Fortinet's disclosure and KEV listing followed the next day, so the exposure window was shorter than every patch clock the citing controls grade against — and shorter even than the 7-day federal deadline attached to the KEV entry. The tier this CVE argues for: on a FortiGate or FortiProxy whose SSL-VPN web surface is reachable from the internet, the mitigation clock starts at vendor disclosure rather than at KEV listing or at scanner detection, and taking the SSL-VPN portal offline or restricting it to known client source ranges must be a pre-authorized action an on-call engineer can execute without waiting for a change window, since that is the only mitigation available in the interval between disclosure and a tested firmware upgrade. The tier also has to be written into the SLA policy explicitly for firewalls, which are routinely classified in an asset register as a security control rather than as an asset carrying its own patch obligation — a classification that leaves the single most exposed device in the estate on the slowest clock.",
+        "evidence": "FortiOS / FortiProxy SSL-VPN pre-authentication out-of-bounds write, CVSS 9.8, RWEP 85, public PoC available. The packet records mass-scanning beginning within hours of the 2024-02-08 vendor disclosure, CISA KEV listing on 2024-02-09 with a 7-day federal remediation deadline, and confirmed active exploitation — exploitation preceded the deadline the strictest citing framework would have set.",
+        "gap_closes": [
+          "PCI-DSS-4.0-6.3.3",
+          "DORA-Art-9"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-031",
+        "name": "FIREWALL-EGRESS-TELEMETRY-SEPARATE-TRUST-ZONE",
+        "description": "The post-patch symlink persistence this CVE is known for can only be scoped if the pre-patch exposure window can be bounded, and on FortiOS the record of that window lives on the device the attacker controlled. Exploitation is pre-authentication, so there is no login event to correlate against; the only signal is in the SSL-VPN portal request logs and the appliance's own session records, both of which sit on local storage within reach of code executing in sslvpnd. FortiGate and FortiProxy must therefore forward SSL-VPN portal request logs, administrative session logs and outbound session records to a collector in a separate trust zone — reached with credentials the appliance's administrators do not hold, on a management path the appliance cannot administer — with retention long enough to span the interval between a vendor disclosure and the estate finishing its upgrade cycle, which for this CVE meant covering a window that had already opened before the advisory published. Without that, the answer to 'was this appliance touched before we patched' is supplied by the appliance itself, and a device that was compromised is not a trustworthy witness to its own compromise.",
+        "evidence": "Unauthenticated code execution in the sslvpnd daemon on FortiOS / FortiProxy per the packet's attack-vector record, with no authentication step to generate a log event. CISA KEV-listed 2024-02-09, confirmed in-the-wild exploitation, public PoC available, RWEP 85. Fortinet's 2025-04-11 follow-up advisory established that compromise predating the patch persists onto patched firmware — so the forensic question is retrospective, and answering it requires telemetry that survived the compromise of the device that produced it.",
+        "gap_closes": [
+          "NIS2-Art21-network-security"
+        ]
+      }
+    ]
   },
   "CVE-2025-10585": {
     "name": "Google Chrome V8 Type Confusion Zero-Day (TAG-disclosed)",
@@ -6081,7 +6272,11 @@
         "name": "NPM-CI-IGNORE-SCRIPTS-DEFAULT",
         "description": "Equivalent posture for Bundler / Go: refuse postinstall / init-hook execution from new or recently-updated dependencies by default in CI.",
         "evidence": "MAL-2026-RUBYGEMS-BUFFERZONECORP-SLEEPER — Go module init hooks rewrote GOPROXY and go.sum.",
-        "gap_closes": []
+        "gap_closes": [
+          "NIS2-Art21-supply-chain",
+          "NIST-800-218-SSDF-PO.4.2",
+          "AU-Essential-8-App-Hardening"
+        ]
       }
     ],
     "compliance_exposure_score": {
@@ -6346,14 +6541,20 @@
         "name": "MCP-SERVER-CONFIG-ALLOWLIST",
         "description": "MCP server inventory + allowlist limits the adversarial-content surface that can reach the IDE agent.",
         "evidence": "CVE-2025-55319 — external MCP server messages were a documented delivery path.",
-        "gap_closes": []
+        "gap_closes": [
+          "OWASP-LLM-Top-10-LLM05",
+          "UK-CAF-B4"
+        ]
       },
       {
         "id": "NEW-CTRL-071",
         "name": "AI-DISCOVERY-CREDIT-IN-COMPLIANCE-EVIDENCE",
         "description": "Record AI-defender contribution.",
         "evidence": "CVE-2025-55319 — ZeroPath disclosure; framework attribution gap.",
-        "gap_closes": []
+        "gap_closes": [
+          "ISO-IEC-42001-AIMS-A.6.2.5",
+          "NIST-AI-RMF-MEASURE-2.7"
+        ]
       }
     ],
     "compliance_exposure_score": {
@@ -6867,7 +7068,41 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "A hosting fleet running cPanel & WHM or WP2 must be driven to the fixed release on a KEV-tied clock measured in hours, and applied fleet-wide rather than server-by-server on a rolling window. The bypass needs no credentials and targets the login flow itself, while the panel is by design internet-reachable so tenants can log in — so an unpatched host is a fully exposed control-plane takeover for the entire time it waits, and a rolling schedule simply means the last host in the queue stays open longest. Because no live-patch primitive is registered for this entry, the fix is a vendor update requiring a service restart or reboot, so that restart has to be pre-authorized against the KEV clock instead of deferred to the next tenant-notified maintenance slot. Hosts that cannot be updated inside the SLA must have their panel and WHM listeners restricted to operator networks and be booked as unremediated.",
+        "evidence": "Packet: CISA KEV-listed 2026-04-30 with active_exploitation=confirmed; RWEP 83, CVSS 9.1, poc_available=true. The vector states WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel (CWE-306, missing authentication for a critical function). patch_available=true, live_patch_available=false, and live_patch_notes state the vendor patch typically requires service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-handling"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "A panel host that was internet-reachable while unpatched must go through compromise assessment and credential rotation rather than patch-and-continue. Because the bypass hands an unauthenticated caller the control panel itself, the attacker inherits the panel's own legitimate capabilities — creating accounts and API tokens, rewriting mail and DNS records, writing files into tenant document roots, installing cron persistence — and none of that is removed by the update. The default response is configuration export, rebuild or restore of the panel host from known-good state, rotation of every tenant, reseller and API credential the panel issued, and an audit of accounts, cron entries and tenant webroots created since the KEV listing date. Anti-malware scanning is not the test here: the artifacts left behind are ordinary panel objects and ordinary web content, not malware signatures.",
+        "evidence": "Packet: CISA KEV-listed 2026-04-30 with active_exploitation=confirmed, poc_available=true and RWEP 83, so an exposed unpatched host is an exploitation opportunity rather than a hypothetical. The vector states the authentication bypass in the login flow allows unauthenticated remote attackers to gain unauthorized access to the control panel of WebPros cPanel & WHM and WP2 — the attacker operates as a panel principal rather than through a memory-corruption payload (CWE-306). patch_available=true with live_patch_available=false; the packet's remediation is a vendor patch requiring service restart or system reboot, which closes the entry path but makes no statement about actions already taken through it.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "CIS-Controls-v8-10.1"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-036",
+        "name": "FLEET-CONTROL-PLANE-ADMIN-PRIVILEGE-TIER",
+        "description": "WHM is the fleet control plane for every tenant site, mailbox, database and DNS zone on the host, and this flaw is the argument for making its administration a distinct privilege tier instead of the same login surface at a higher permission level. The WHM root and reseller surface should be reachable only from a PAM jumphost or operator network, behind FIDO2 step-up and just-in-time elevation with a separate identity from tenant accounts, so that a defect in the login flow does not present the whole hosting estate to an anonymous internet caller. Splitting the surfaces also bounds the damage where the tenant-facing cPanel login has to stay internet-exposed for customers: that side gets patched under the KEV clock, while the administrative plane is never an unauthenticated caller's first hop in the first place.",
+        "evidence": "Packet: CWE-306, missing authentication for a critical function — the vector records an authentication bypass in the login flow of WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) allowing unauthenticated remote attackers to gain unauthorized access to the control panel. CISA KEV-listed 2026-04-30, active_exploitation=confirmed, CVSS 9.1, RWEP 83, poc_available=true. The citing gaps recorded for this entry include NIST-800-53-AC-6 (Least Privilege) and UK-CAF-B2 (Identity and access control), both of which the packet marks as insufficient here.",
+        "gap_closes": [
+          "UK-CAF-B2",
+          "NIST-800-53-AC-6"
+        ]
+      }
+    ]
   },
   "CVE-2024-1708": {
     "name": "ConnectWise ScreenConnect Path Traversal Vulnerability",
@@ -6927,7 +7162,29 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "Upgrading the ScreenConnect server to the fixed build removes the traversal but not what the traversal already wrote. CVE-2024-1708 is an arbitrary file-write primitive: chained with the companion authentication bypass it plants a web shell in a ScreenConnect-served directory, and that file is application content rather than product code, so the vendor update leaves it in place and running. Any ScreenConnect instance that was reachable from an untrusted network on a vulnerable build must therefore be handled as compromised rather than as remediated: export the configuration, session history and extension inventory for forensics, rebuild the host from known-good media, reinstall at the fixed version, and rotate everything the server held or brokered — the relay/agent join material, the ScreenConnect administrative and integrated-identity accounts, and any credential a technician entered through a remote session during the exposure window. Deleting the one web shell that was found and then patching is not equivalent, because the same write primitive places files anywhere the service account can reach, and the read half of the traversal means configuration secrets on the host should be assumed disclosed.",
+        "evidence": "ConnectWise ScreenConnect, CISA KEV-listed 2026-04-28 with confirmed in-the-wild exploitation and a public PoC available. The packet's attack-vector record states the path traversal (CWE-22) lets an attacker write or read files outside the intended directory and was used with the companion authentication bypass to drop a web shell — i.e. attacker-planted files persist independently of the vendor patch. RWEP 83 against CVSS 7.5: the gap between the two is exactly the post-exploitation persistence that a base score for an information-disclosure-shaped traversal does not carry.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "ISO-27001-2022-A.8.8",
+          "CIS-Controls-v8-10.1"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-037",
+        "name": "FLEET-COMPROMISE-IR-PLAYBOOK",
+        "description": "ScreenConnect is a fleet control plane, not an ordinary web application: its access agents run with service-level privilege on every managed endpoint and execute what the server tells them to. An incident-response plan scoped to 'the ScreenConnect host' therefore has the wrong blast radius, because a web shell reached through this traversal gives the attacker the same command channel into the managed estate that the legitimate operator has. The playbook must be written and rehearsed before the event and must cover: revocation and re-issue of the relay/agent trust material so existing agent installations cannot be driven by attacker-held server identity; an audit of session, command and file-transfer history plus any extension or extension directory added since the exposure window opened; quarantine criteria for endpoints that received a session or a queued command during that window; and rotation of every credential used through a remote session, including the customer-side administrative accounts a technician authenticated with. Recovery timing must assume the ScreenConnect server itself is unavailable during the response, since it is the system being rebuilt.",
+        "evidence": "ConnectWise ScreenConnect path traversal, CISA KEV-listed 2026-04-28, active exploitation confirmed, public PoC available, RWEP 83. The packet records the traversal being used with the companion authentication bypass to drop a web shell on the server that brokers remote sessions to managed endpoints, which places every endpoint reachable from that server inside the incident scope rather than outside it.",
+        "gap_closes": [
+          "UK-CAF-D1"
+        ]
+      }
+    ]
   },
   "CVE-2025-29635": {
     "name": "D-Link DIR-823X Command Injection Vulnerability",
@@ -6987,7 +7244,30 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "For a DIR-823X the KEV clock has to terminate in a verified per-unit outcome, because the failure mode of consumer-router patching is not a missed deadline, it is an open-ended 'awaiting firmware' state that never resolves. The packet records a vendor fix as available, no live-patch path, and a fix that per the KEV requiredAction typically requires a service restart or system reboot — for this device class that means a firmware flash and reboot on each unit, performed by whoever physically owns it. The packet's own vector text also states the impacted product could be end-of-life and/or end-of-service and that users should discontinue use, so the SLA must resolve to either a confirmed fixed firmware level on the specific unit or that unit's removal from service. With confirmed in-the-wild exploitation and a public PoC against a device that is always internet-facing by construction, 'firmware pending' is not a compliant resting state.",
+        "evidence": "Packet: cisa_kev true, kev_date 2026-04-24, active_exploitation confirmed, cvss 9.8, rwep_score 77, poc_available true, patch_available true, live_patch_available false, live_patch_notes \"No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.\", cwe_refs CWE-77. Vector: \"... The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.\"",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-030",
+        "name": "PERIMETER-DEVICE-ZERODAY-SLA-TIER",
+        "description": "A DIR-823X is the trust boundary for everything behind it, so command injection reached through the /goform/set_prohibiting handler is not an application bug on one host — execution on that router owns DNS resolution, routing, and every client session crossing it, and gives a persistent foothold that survives cleanup of anything on the LAN. That is the condition this tier exists for: mitigation within hours of the 2026-04-24 KEV listing, or the alternative the tier explicitly allows — isolate the vulnerable interface by taking the HTTP management surface off the WAN side and restricting it to a trusted internal management segment — instead of the 14/30-day operating-system patch SLA the citing frameworks apply to it today. Note the packet characterizes the caller two ways: the attack_vector field says unauthenticated command execution, while the vector text says an authorized attacker sending a POST to /goform/set_prohibiting. The interface-isolation half of the tier is the right action under either reading, which is why it belongs alongside the patch clock rather than behind it.",
+        "evidence": "Packet vector: \"D-Link DIR-823X contains a command injection vulnerability that allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /goform/set_prohibiting via the corresponding function.\" Packet attack_vector: \"command injection (CWE-77) on the D-Link DIR-823X, giving an unauthenticated attacker command execution on the device.\" Packet: cvss 9.8, rwep_score 77, cisa_kev true, kev_date 2026-04-24, active_exploitation confirmed, poc_available true. Citing gaps already record UK-CAF-B4 (System security) and NIS2-Art21-network-security as insufficient for this CVE.",
+        "gap_closes": [
+          "UK-CAF-B4",
+          "NIS2-Art21-network-security"
+        ]
+      }
+    ]
   },
   "CVE-2024-7399": {
     "name": "Samsung MagicINFO 9 Server Path Traversal Vulnerability",
@@ -7047,14 +7327,38 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
-  },
-  "CVE-2024-57728": {
-    "name": "SimpleHelp Path Traversal Vulnerability",
-    "lesson_date": "2026-05-29",
-    "attack_vector": {
-      "description": "a path-traversal flaw (CWE-22) letting an unauthenticated attacker read or write files outside the intended directory on the remote-support server. CISA KEV-listed 2026-04-24 with confirmed in-the-wild exploitation.",
-      "privileges_required": "none (the flaw is reachable by an unauthenticated attacker on the platform's public interface)",
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "MagicINFO 9 Server instances run digital-signage estates and are typically commissioned once and left alone, outside the cadence that covers the rest of the server fleet — so the KEV clock has to be what pulls them in. Two things defeat the usual triage here: the CVSS score sits below the threshold that most severity-driven patch tiers use to demand urgency, while the real-world priority score is far higher; and the packet's own description has the attacker writing files as system authority, so one unpatched signage server is a full host, not a display. Because the fix lands as a service restart or reboot, the SLA must cover the restart of every signage server, not just the installer run on the ones an operator remembers owning.",
+        "evidence": "Packet records a CISA KEV listing dated 2026-04-24 with active_exploitation 'confirmed', RWEP 77 against CVSS 7.5, and poc_available true. The vector text states the path traversal 'could allow an attacker to write arbitrary files as system authority'. patch_available is true, live_patch_available is false, and live_patch_notes state the vendor patch typically requires service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-patch-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "This exploitation path leaves an artifact behind on purpose: the attacker uploads a file — the packet names a web shell — and then traverses to it to execute it. Patching the upload and traversal handlers removes the delivery route while leaving the uploaded shell sitting on disk and still reachable through ordinary requests, so a patched MagicINFO 9 Server can remain an attacker's foothold. A server that was network-reachable and unpatched during the exposure window must be triaged, not just updated: enumerate files written under its upload and web-serving directories across the exposure window, rotate the credentials and content-distribution keys the server held, and rebuild rather than patch-in-place.",
+        "evidence": "Packet's attack_vector describes 'a path-traversal plus unrestricted-file-upload flaw (CWE-22/CWE-434), letting an unauthenticated attacker upload a file (e.g. a web shell) and traverse to it for code execution', with active_exploitation 'confirmed', CISA KEV listing 2026-04-24, and poc_available true.",
+        "gap_closes": [
+          "NIS2-Art21-patch-management",
+          "UK-CAF-B4"
+        ]
+      }
+    ]
+  },
+  "CVE-2024-57728": {
+    "name": "SimpleHelp Path Traversal Vulnerability",
+    "lesson_date": "2026-05-29",
+    "attack_vector": {
+      "description": "a path-traversal flaw (CWE-22) letting an unauthenticated attacker read or write files outside the intended directory on the remote-support server. CISA KEV-listed 2026-04-24 with confirmed in-the-wild exploitation.",
+      "privileges_required": "none (the flaw is reachable by an unauthenticated attacker on the platform's public interface)",
       "complexity": "low — KEV-listed, actively exploited; treat as weaponized",
       "ai_factor": "No AI involvement documented in discovery or weaponization."
     },
@@ -7107,7 +7411,31 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "The KEV clock here has to run on the SimpleHelp support server itself, not on the endpoints it services: the zip-slip write lands with the privileges of the SimpleHelp server user and converts directly into code execution on that host, so a remediation programme that tracks technician workstations and serviced endpoints but treats the support server as infrastructure will miss the exploited surface entirely. The packet records no live-patch path — the vendor fix requires a service restart or reboot — so the SLA must schedule the SimpleHelp service restart inside the KEV window rather than treating patch download as completion. Until that restart is taken, the file-upload and administrative paths on the server must be restricted rather than counted as remediated, since the packet's own description places the upload behind admin access on the server.",
+        "evidence": "CISA KEV-listed 2026-04-24 with active_exploitation 'confirmed' and poc_available true. RWEP 83 against CVSS 7.5 — the real-world exploit priority sits well above the CVSS band, so a CVSS-threshold-driven patch queue deprioritizes an actively exploited flaw. The catalog vector records that SimpleHelp 'contains a path traversal vulnerability that allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file (i.e. zip slip). This can be exploited to execute arbitrary code on the host in the context of the SimpleHelp server user.' patch_available is true, live_patch_available is false, and live_patch_notes reads: 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.'",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-handling"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-078",
+        "name": "ENDPOINT-MGMT-DEPLOYMENT-CHANNEL-INTEGRITY",
+        "description": "The primitive in this CVE is an arbitrary write anywhere on the filesystem as the SimpleHelp server user — so the exposed asset is not just the web root but every file that remote-support server holds and hands out: session and client artifacts, technician-facing downloads, service configuration and any script the server executes. Treat that content as a privileged distribution channel rather than as application data: file-integrity-monitor the SimpleHelp installation and every directory it serves artifacts from, alert on writes that do not correspond to a sanctioned administrator action or a vendor update, and hold the support server to KEV-priority patching as a management-plane asset. This is the control that still has value after the patch lands, because the fix closes the zip-slip write path but removes nothing already written through it — an attacker file placed before remediation survives the upgrade, and neither signature-based anti-malware nor authentication logging will surface a bespoke artifact dropped through a legitimate upload endpoint.",
+        "evidence": "The catalog vector states the flaw lets an actor 'upload arbitrary files anywhere on the file system by uploading a crafted zip file (i.e. zip slip)' and thereby 'execute arbitrary code on the host in the context of the SimpleHelp server user'; the attack_vector locates the flaw 'on the remote-support server'. KEV-listed 2026-04-24 with active_exploitation 'confirmed' and poc_available true, RWEP 83. The gaps this entry already cites include CIS Controls v8 10.1 (Deploy and Maintain Anti-Malware Software) and UK CAF C1 (Security monitoring) — neither detects an attacker-written artifact that carries no malware signature and arrives over an authenticated upload path.",
+        "gap_closes": [
+          "UK-CAF-C1",
+          "CIS-Controls-v8-10.1"
+        ]
+      }
+    ]
   },
   "CVE-2024-57726": {
     "name": "SimpleHelp Missing Authorization Vulnerability",
@@ -7167,7 +7495,40 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-036",
+        "name": "FLEET-CONTROL-PLANE-ADMIN-PRIVILEGE-TIER",
+        "description": "SimpleHelp is a remote-support control plane, so its server admin role reaches every machine the technician population supports — the technician tier and the server-admin tier are not two shades of the same application user. This CVE collapses the distance between them: the entry records that low-privileged technicians can create API keys with excessive permissions and use those keys to escalate to the server admin role. Server administration of SimpleHelp needs to be classified as its own privilege tier — identity separate from every other admin role, jumphost-only access with hardware-key step-up, just-in-time elevation with approval — and the technician surface must not be able to mint or hold API keys at all. A framework that enumerates one admin role for this product attests accurately while the technician surface remains the real path into it.",
+        "evidence": "SimpleHelp missing authorization (CWE-862), CVSS 8.8, RWEP 83. The entry states low-privileged technicians can create API keys with excessive permissions and that these keys can be used to escalate privileges to the server admin role, on a remote-support server. CISA KEV-listed 2026-04-24 with active_exploitation=confirmed and poc_available=true.",
+        "gap_closes": [
+          "UK-CAF-B2",
+          "NIST-800-53-AC-6"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-037",
+        "name": "FLEET-COMPROMISE-IR-PLAYBOOK",
+        "description": "The escalation product here is a durable credential rather than a session: an API key minted through the missing-authorization flaw still carries server-admin power after the vendor fix is installed. The playbook for this CVE therefore has to enumerate and revoke every API key issued on the SimpleHelp server across the exposure window, audit technician accounts and role assignments for keys they should never have been able to create, and treat every endpoint reached through the server during that window as requiring credential rotation and review — a remote-support server is a path into the machines it supports, so its compromise fans outward rather than stopping at the appliance. Patching closes the minting path and leaves already-minted keys valid, which is precisely the state an audit reading only installed version would score as clean.",
+        "evidence": "Missing authorization (CWE-862) on a remote-support server; the entry records that the API keys created through the flaw can be used to escalate to the server admin role. active_exploitation=confirmed, poc_available=true, CISA KEV-listed 2026-04-24, RWEP 83, CVSS 8.8.",
+        "gap_closes": [
+          "UK-CAF-B2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "SimpleHelp entered CISA KEV on 2026-04-24 with confirmed exploitation and a public PoC and a vendor fix exists, so this runs on the KEV clock rather than a quarterly application-patch cycle. The complication specific to this product is that no live-patch path is registered and the fix typically requires a service restart per the KEV requiredAction, which drops the active remote-support sessions the server exists to carry — the operational argument for deferral is built into the product. The SLA has to pre-authorize that restart instead of letting support availability win, and it has to sequence the restart with revocation of the API keys minted before the fix, or the server returns to service still honoring them.",
+        "evidence": "CISA KEV-listed 2026-04-24 with active_exploitation=confirmed, poc_available=true, RWEP 83, CVSS 8.8. patch_available=true, live_patch_available=false; the entry states the vendor patch typically requires service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-vulnerability-handling",
+          "NIST-800-53-SI-2"
+        ]
+      }
+    ]
   },
   "CVE-2026-20122": {
     "name": "Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability",
@@ -7287,7 +7648,41 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "Catalyst SD-WAN Manager is the fabric controller, so its remediation clock has to start at the KEV listing (2026-04-20) rather than at the next network-appliance maintenance cycle. The packet records no live-patch path for this entry and notes the vendor patch typically needs a service restart or system reboot, so the SLA must be measured at 'manager restarted onto the fixed build', not at 'update staged' — until the restart lands the manager keeps serving the disclosure, and the operator has no interim mitigation recorded here.",
+        "evidence": "cisa_kev true with kev_date 2026-04-20; active_exploitation 'confirmed'; poc_available true; RWEP 77 / CVSS 8.8; patch_available true, live_patch_available false, live_patch_notes: 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.'",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-036",
+        "name": "FLEET-CONTROL-PLANE-ADMIN-PRIVILEGE-TIER",
+        "description": "Because the exposure is on the SD-WAN control plane rather than on one managed router, whatever the manager can show is fabric-wide, and the only pre-patch lever is bounding who can reach the surface at all. Catalyst SD-WAN Manager operators have to be classified above ordinary network admins — jumphost-only reachability for the management interface, step-up authentication per session, and an identity not shared with any other admin role — so a remotely reachable CWE-200 read path is not exposed to every account that happens to hold 'network admin'. Frameworks that collapse the fabric controller into the same admin class as the devices it manages carry no rule that would have constrained this.",
+        "evidence": "Packet vector: 'Cisco Catalyst SD-WAN Manager contains an exposure of sensitive information to an unauthorized actor vulnerability that could allow remote attackers to view sensitive information on affected systems.' cwe_refs CWE-200; CVSS 8.8; citing gaps include NIST-800-53-AC-6 (Least Privilege) and NIS2-Art21-network-security.",
+        "gap_closes": [
+          "NIST-800-53-AC-6",
+          "NIS2-Art21-network-security",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-037",
+        "name": "FLEET-COMPROMISE-IR-PLAYBOOK",
+        "description": "Exploitation was confirmed in the wild before the fix, and the flaw class is disclosure — so patching stops further reads but does not invalidate anything already read from the manager. The response has to be fleet-scoped and rehearsed in advance: rotate credentials for every account that authenticated through the SD-WAN Manager during the exposure window, audit configuration pushed to managed edge devices since the exposure window opened, and apply quarantine criteria to downstream devices, instead of closing the finding when the restart completes.",
+        "evidence": "cisa_kev true, kev_date 2026-04-20, active_exploitation 'confirmed', poc_available true; cwe_refs CWE-200 (exposure of sensitive information to an unauthorized actor); RWEP 77; patch_available true.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "ISO-27001-2022-A.8.8"
+        ]
+      }
+    ]
   },
   "CVE-2025-2749": {
     "name": "Kentico Xperience Path Traversal Vulnerability",
@@ -7467,7 +7862,19 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "This is the case where a severity-ranked patch queue and a KEV-driven SLA give opposite answers, and the KEV answer is the correct one. At CVSS 6.1 the ZCS cross-site scripting flaw falls below the high/critical cut most Zimbra operators use to schedule mail-service downtime, yet it is KEV-listed with confirmed in-the-wild exploitation, has a public PoC, and scores RWEP 77 — the same real-world priority as the 9.8-rated RCEs in the same catalog. The remediation is not free: the packet records no live-patch tool for this entry and states that the vendor patch typically requires a service restart or system reboot per the KEV requiredAction, so closing it means booking a mailbox-server outage. That cost is precisely why a CVSS-ranked queue keeps deferring it, and why the SLA has to be pinned to the KEV listing date instead. Until the restart is booked, the exposure is live on every ZCS web-client session.",
+        "evidence": "Packet: cisa_kev true, kev_date 2026-04-20, active_exploitation confirmed, cvss 6.1, rwep_score 77, poc_available true, patch_available true, live_patch_available false, live_patch_notes \"No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.\", cwe_refs CWE-79. Attack vector: \"a cross-site scripting flaw (CWE-79) on the ZCS web client, letting an attacker run script in a victim's authenticated session for session/credential theft and mailbox access.\"",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "ISO-27001-2022-A.8.8"
+        ]
+      }
+    ]
   },
   "CVE-2026-20128": {
     "name": "Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability",
@@ -7707,7 +8114,31 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "ActiveMQ is middleware, so brokers are usually patched on an internal-messaging-tier cadence rather than an edge cadence — but this flaw is reachable by an unauthenticated network attacker against the broker itself, so the clock must start at KEV listing (2026-04-16), not at the next messaging maintenance window. A vendor fix exists, and because the packet records no live-patch path and notes the vendor patch typically requires a service restart or system reboot, the SLA is only meetable if restart authority for every broker instance is pre-approved rather than queued as a separate change. Until each broker is on the fixed build, the mitigation of record must be an inventoried compensating control — closing the broker's listener to any network the operator does not control — not a deferred patch date.",
+        "evidence": "Packet fields for CVE-2026-34197 (Apache ActiveMQ Improper Input Validation Vulnerability): cisa_kev=true with kev_date 2026-04-16; active_exploitation=confirmed; poc_available=true; cvss 9.8; rwep_score 77; attack_vector describes code execution reachable by an unauthenticated network attacker against the message broker; patch_available=true; live_patch_available=false with live_patch_notes stating no live-patch tool is registered and that the vendor patch typically requires service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-125",
+        "name": "SERVICE-INTERNAL-PROTOCOL-DESERIALIZATION-HARDENING",
+        "description": "For this broker the control means treating the ActiveMQ wire-protocol listener as a trust boundary rather than an internal convenience: the defect is improper input validation that becomes code injection (CWE-20 into CWE-94) for a peer that never authenticates. Bind broker listeners to the messaging segment instead of all interfaces, require peer authentication on every wire protocol the broker has enabled — not only the one the applications happen to use — and constrain what content arriving on that port is permitted to construct or evaluate, instead of inheriting safety from the assumption that the broker sits on a trusted network. The distinguishing test: from an unauthenticated host that can route to the broker port on a staging instance, open a connection carrying content the broker's application protocol never legitimately conveys, and confirm the peer is rejected before the broker acts on the content — a broker that passes a patch-level audit while accepting unauthenticated connections on all interfaces still exposes the injection path the moment the next protocol-parsing defect lands.",
+        "evidence": "Packet fields for CVE-2026-34197: cwe_refs CWE-20 and CWE-94; attack_vector states improper input validation leading to code execution reachable by an unauthenticated network attacker against the message broker; vector text reads that Apache ActiveMQ contains an improper input validation vulnerability that allows for code injection; active_exploitation=confirmed; poc_available=true; rwep_score 77.",
+        "gap_closes": [
+          "UK-CAF-B4",
+          "NIST-800-53-AC-6"
+        ]
+      }
+    ]
   },
   "CVE-2009-0238": {
     "name": "Microsoft Office Remote Code Execution",
@@ -7762,7 +8193,30 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "A vendor patch for this Office document-parsing flaw exists and the CVE identifier dates to 2009, yet CISA added it to KEV on 2026-04-14 on the strength of current in-the-wild exploitation. Any remediation queue that sorts or ages by CVE publication date, by 'newly disclosed' status, or by scanner first-seen date buries a CVE-2009 entry beneath every current-quarter finding and it never reaches a patch window, which is exactly why the long-tail estate is still being exploited. The KEV listing date must start the clock instead of the CVE year: on 2026-04-14 every Office installation in the estate is re-evaluated against the fixed build inside the KEV SLA, and any Office build that cannot reach it is cut off from untrusted documents rather than risk-accepted by age. The distinguishing test: query the vulnerability queue for KEV-listed CVEs older than ten years and confirm they carry the same due date as a current-quarter KEV entry — a program whose SLA derives from disclosure age reports 'no overdue criticals' while an actively exploited 2009 Office flaw sits unremediated on the frozen estate.",
+        "evidence": "Packet: CVE-2009-0238, Microsoft Office Remote Code Execution, CWE-94 code injection in Office document parsing, exploitable by an attacker-controlled document for code execution in the Office process. CISA KEV-listed 2026-04-14, active_exploitation confirmed, CVSS 9.8, RWEP 77, poc_available true, patch_available true — the residual exposure is the long-tail unpatched estate, not an absent fix.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-patch-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-120",
+        "name": "DOWNLOAD-PROVENANCE-ENFORCEMENT",
+        "description": "Exploitation here requires the victim to open an attacker-supplied Office document, so on an estate that has not yet reached the fixed build the delivery path is the only enforceable control. Require Mark-of-the-Web on every Office file arriving by mail, web download, or untrusted file share, and require MOTW-tagged documents to open in Protected View — an isolated, reduced-privilege render — instead of the full parsing path that carries the CWE-94 sink at the user's own process privilege. Provenance must survive the container: files extracted from an archive, mounted from an ISO or VHD, or renamed must inherit the tag rather than lose it, and 'Enable Editing' on externally sourced documents must be blocked by policy rather than left to the user. The distinguishing test: mail a MOTW-tagged spreadsheet nested inside a ZIP to a managed workstation, extract it, and confirm the extracted file still opens in Protected View — a user-application-hardening attestation that covers only macro and ActiveX/OLE settings still lets a provenance-stripped document reach the vulnerable parser with full user privileges.",
+        "evidence": "Packet attack vector: an attacker-controlled document reaching Microsoft Office's parser for code execution in the Office process (CWE-94). poc_available true and CISA-confirmed in-the-wild exploitation at the 2026-04-14 KEV listing. AU-Essential-8-App-Hardening (user application hardening) and NIST-800-53-AC-6 (least privilege) are both already recorded as insufficient controls citing this CVE.",
+        "gap_closes": [
+          "AU-Essential-8-App-Hardening",
+          "NIST-800-53-AC-6"
+        ]
+      }
+    ]
   },
   "CVE-2026-32201": {
     "name": "Microsoft SharePoint Server Improper Input Validation Vulnerability",
@@ -7992,7 +8446,30 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "Exchange Server is internet-facing by construction and this CWE-502 sink yields code execution on the mail server itself. A vendor patch exists and the CVE identifier dates to the 2023 cycle, while the KEV listing is 2026-04-13 — so an estate installing the fixed cumulative/security update in response to that listing is patching a host that stayed reachable and exploitable throughout the interval, with a public PoC in circulation. Treat any Exchange server that ran a vulnerable build during confirmed in-the-wild exploitation as compromised until proven otherwise: alongside patching, hunt the OWA/ECP virtual directories and the Exchange install tree for web shells and unexpected .aspx/.dll drops, export and diff transport rules, mailbox permissions, and journaling configuration against last known-good, and rotate the machine account, Exchange service accounts, and every credential that authenticated through the server during the exposure window. Patch-in-place restores the build number and leaves a resident implant and any stolen credential fully operative. The distinguishing test: open a closed Exchange remediation ticket and look for a post-patch persistence sweep and a credential-rotation record — a 'patched within SLA' closure carrying neither is paper remediation of a service that was already being exploited.",
+        "evidence": "Packet: CVE-2023-21529, Microsoft Exchange Server Deserialization of Untrusted Data (CWE-502) reachable by an attacker for remote code execution on the Exchange server. CISA KEV-listed 2026-04-13, active_exploitation confirmed, CVSS 9.8, RWEP 83, poc_available true, patch_available true. AU-Essential-8-Patch, NIST-800-53-SI-2, and NIS2-Art21-vulnerability-handling are already recorded as insufficient controls citing this CVE.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "AU-Essential-8-Patch",
+          "NIS2-Art21-vulnerability-handling"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-040",
+        "name": "OWA-PER-REQUEST-SIEM-INGESTION",
+        "description": "A serialized object arriving in a request body or header is inert to file-based anti-malware — nothing is written to disk before the gadget chain runs inside the Exchange worker process — and it travels over a session that authentication logging records as ordinary, so the endpoint AV control credited for this server never had anything to detect. Ship Exchange's per-request IIS/OWA/ECP access logs (URI stem and query, method, request size, status, user agent, source address, responding backend) to a SIEM outside the Exchange trust zone with at least 90-day retention, and alert on POSTs to Autodiscover, ECP, and PowerShell endpoints with anomalous body sizes or from unexpected sources. Retention depth is the load-bearing part here: the KEV listing landed 2026-04-13 on a CVE from the 2023 cycle, so an investigation opened at patch time must be able to reach back into an exposure window that long. The distinguishing test: pick a date months before the current remediation and try to retrieve the full request line for a single OWA POST from the SIEM — if only the authentication event survives, the deserialization request that established the foothold is unrecoverable.",
+        "evidence": "Packet attack vector: CWE-502 deserialization of untrusted data reachable for remote code execution on the Exchange server; CISA KEV-listed 2026-04-13 with confirmed in-the-wild exploitation, poc_available true, RWEP 83, CVSS 9.8. CIS-Controls-v8-10.1 (Deploy and Maintain Anti-Malware Software) and UK-CAF-B4 (System security) are already recorded as insufficient controls citing this CVE.",
+        "gap_closes": [
+          "CIS-Controls-v8-10.1",
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2023-36424": {
     "name": "Microsoft Windows Out-of-Bounds Read Vulnerability",
@@ -8047,7 +8524,38 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "This entry scores CVSS 5.5 — under the threshold at which most Windows patch programmes take action — while carrying RWEP 77 on the strength of confirmed in-the-wild exploitation, so a severity-ordered queue parks the CLFS driver fix behind 'criticals' nobody is exploiting. The SLA must fire on the KEV listing rather than the score: enumerate every Windows host whose Common Log File System driver predates the fix, deploy the vendor update, and book the restart inside the KEV clock instead of rolling it into the next monthly maintenance window. The packet registers no live-patch path for this entry, so the reboot is the remediation, not an optional follow-up — a host that has taken the update but not restarted is still exposed and must not be counted as remediated.",
+        "evidence": "Packet: cvss 5.5 against rwep_score 77; cisa_kev true, kev_date 2026-04-13, active_exploitation 'confirmed', poc_available true. patch_available true; live_patch_available false, with live_patch_notes 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.'",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-patch-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-003",
+        "name": "KERNEL-EXPLOITATION-DETECTION",
+        "description": "An out-of-bounds read is a silent primitive: it leaks kernel memory to seed the escalation stage and, unlike a corruption bug, produces no bugcheck, no crash dump and no failed-write artefact for the host to report, so a fleet can be under active exploitation with a clean event log. Between the KEV listing and the restart that lands the fix, the only coverage is behavioural — alert on anomalous Common Log File System driver activity from processes that have no business touching it, on process token and integrity-level transitions that promote a user-context process to SYSTEM, and on the escalate-then-move-laterally sequence — with alerting fast enough to interrupt a ransomware operator's dwell time rather than surface in the next day's report.",
+        "evidence": "Packet: CWE-125 out-of-bounds read in the Microsoft Windows Common Log File System Driver, described as an information-disclosure primitive within a privilege-escalation chain, with the note that LPEs of this class are routinely paired with an initial-access flaw by ransomware operators. active_exploitation 'confirmed', kev_date 2026-04-13, poc_available true. live_patch_available false, so every host carries a restart-bounded exposure window.",
+        "gap_closes": [
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-018",
+        "name": "SCANNER-PAPER-COMPLIANCE-TEST",
+        "description": "A 2023 CVE identifier that only reaches KEV in 2026 stresses a specific part of vulnerability management: a CVSS 5.5 finding triaged years ago sits at the bottom of the queue or has aged out of it entirely, and nothing in a version-comparison scanner re-opens it on the day CISA lists it. The operational test is therefore not 'is the host patched' but two checks the scan pipeline usually cannot answer: does a previously deprioritised, multi-year-old medium get re-raised at KEV-listing severity, and does the per-host verdict come from the Common Log File System driver's actual file version rather than from the mere presence of a cumulative update or a pending, unrestarted install? A dashboard reporting the estate compliant because every host is on the current rollup, with no KEV-triggered re-open path for aged findings, is paper compliance for exactly this entry.",
+        "evidence": "Packet: CVE identifier issued in the 2023 series with kev_date 2026-04-13 — a multi-year gap between assignment and KEV listing; cvss 5.5 versus rwep_score 77; active_exploitation 'confirmed'; patch_available true with live_patch_available false and a vendor patch that per live_patch_notes typically requires service restart or system reboot.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8"
+        ]
+      }
+    ]
   },
   "CVE-2020-9715": {
     "name": "Adobe Acrobat Use-After-Free Vulnerability",
@@ -8102,7 +8610,30 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "The vendor fix for this Adobe Acrobat and Reader use-after-free has existed for years, yet CISA added the CVE to KEV on 2026-04-13 on the strength of confirmed current in-the-wild exploitation. Any remediation queue that ages or sorts by CVE identifier year, by \"newly disclosed\" status, or by scanner first-seen date buries a CVE-2020 entry beneath every current-quarter finding and it never reaches a patch window — which is precisely why the long-tail estate the packet describes is still being exploited. The KEV listing date has to start the clock instead of the CVE year: from 2026-04-13, every Acrobat and Reader installation in the estate is re-evaluated against the fixed build inside the KEV SLA, and any host that cannot reach it is cut off from untrusted PDFs rather than risk-accepted on the grounds that the CVE is old. One product-specific wrinkle for this entry: the packet records no live-patch path, and notes the vendor patch typically requires a service restart or system reboot per the KEV required action, so the SLA must be satisfied by the restart, not by the installer run — a \"patch deployed\" record against a host whose vulnerable reader process is still resident has not removed the exposure. The distinguishing test: query the vulnerability queue for KEV-listed CVEs whose identifier year is more than five years old and confirm they carry the same due date as a current-quarter KEV entry — a program whose SLA derives from disclosure age reports \"no overdue criticals\" while an actively exploited reader RCE sits unremediated on the long tail.",
+        "evidence": "Packet: CVE-2020-9715, \"Adobe Acrobat Use-After-Free Vulnerability\", CWE-416, exploitable by an attacker-controlled PDF for code execution in the reader process. CISA KEV-listed 2026-04-13, active_exploitation confirmed, CVSS 8.8, RWEP 77, poc_available true, patch_available true, live_patch_available false with live_patch_notes recording that the vendor patch typically requires a service restart or system reboot per the KEV requiredAction. The packet states the legacy re-listing exists because long-tail unpatched/end-of-life estates remain exposed — the residual exposure is an unapplied fix, not an absent one. NIST-800-53-SI-2, ISO-27001-2022-A.8.8, NIS2-Art21-patch-management and AU-Essential-8-Patch are all already recorded as insufficient controls citing this CVE.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management",
+          "AU-Essential-8-Patch"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-120",
+        "name": "DOWNLOAD-PROVENANCE-ENFORCEMENT",
+        "description": "Exploitation of this CVE requires the victim to open an attacker-controlled PDF, so on the long-tail hosts the packet says are still unpatched the delivery path is the only control left that can be enforced. Require content provenance — Mark-of-the-Web — on every PDF arriving by mail, web download, or untrusted file share, and require provenance-tagged PDFs to open in the reader's reduced-privilege protected view rather than the full parsing path that carries the use-after-free sink at the user's own privilege. Provenance must survive the container: a PDF extracted from a ZIP, mounted from an ISO or VHD, or renamed must inherit the tag rather than lose it, and dismissing the protected view on an externally sourced document should be a policy decision rather than a per-user click. This is not a substitute for the vendor patch, which the packet records as available — it is what stands between an attacker-controlled document and the vulnerable parser on the end-of-life and unmanaged hosts that will not reach the fixed build inside the KEV window. The distinguishing test: mail a provenance-tagged PDF nested inside an archive to a managed host, extract it, and confirm the extracted file still opens in the protected view — an endpoint-hardening attestation that covers only macro and script settings still lets a provenance-stripped PDF reach the reader's parser with full user privileges.",
+        "evidence": "Packet attack vector: an attacker-controlled PDF reaching Adobe Acrobat and Reader for code execution in the reader process (CWE-416 use-after-free). poc_available true, active_exploitation confirmed, CISA KEV-listed 2026-04-13, CVSS 8.8, RWEP 77. The packet attributes the residual exposure to long-tail unpatched/end-of-life estates. UK-CAF-B4 (system security) is already recorded as an insufficient control citing this CVE.",
+        "gap_closes": [
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2026-21643": {
     "name": "Fortinet FortiClient EMS SQL Injection Vulnerability",
@@ -8162,31 +8693,63 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
-  },
-  "CVE-2026-34621": {
-    "name": "Adobe Acrobat and Reader Prototype Pollution Vulnerability",
-    "lesson_date": "2026-05-29",
-    "attack_vector": {
-      "description": "a prototype-pollution flaw (CWE-1321) in Acrobat/Reader enabling arbitrary code execution when a crafted PDF is opened. CISA KEV-listed 2026-04-13 with confirmed in-the-wild exploitation.",
-      "privileges_required": "none (the victim renders attacker-controlled content)",
-      "complexity": "low — KEV-listed, actively exploited; treat as weaponized",
-      "ai_factor": "No AI involvement documented in discovery or weaponization."
-    },
-    "defense_chain": {
-      "prevention": {
-        "what_would_have_worked": "Apply the Adobe Acrobat / Reader security update; for managed fleets, push the update and enable Protected Mode / Protected View where available.",
-        "was_this_required": true,
-        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation)",
-        "adequacy": "Browser/app auto-update is definitive and fast for unmanaged endpoints; the gap is managed fleets that gate updates behind a change window slower than the in-the-wild exploitation."
-      },
-      "detection": {
-        "what_would_have_worked": "Endpoint monitoring for PDF reader crashes on content render and for unexpected child processes spawned by the PDF reader after rendering a crafted PDF document.",
-        "was_this_required": false,
-        "framework_requiring_it": null,
-        "adequacy": "Detection backstops endpoints not yet updated; client exploitation is fast and often single-interaction."
-      },
-      "response": {
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "FortiClient EMS is the management server for a Fortinet endpoint-agent estate, and the packet's flaw is an unauthenticated SQL injection on its HTTP surface that escalates to remote code execution at CVSS 9.8, KEV-listed with confirmed in-the-wild exploitation and a public PoC. The remediation clock for this box therefore starts at the KEV listing date, not at the next monthly patch window that the citing frameworks' cadence controls permit. Two packet facts shape how the SLA must be planned: no live-patch tool is registered, and the vendor patch typically requires a service restart or system reboot per the KEV requiredAction - so the deployment window has to be planned with an EMS service outage inside it, and the console's role in managing endpoints is not a reason to defer that restart to a change-approval cycle. An estate that cannot restart EMS inside the window has to pull the management surface out of network reach as the documented compensating control until it can, because there is no in-place mitigation to fall back on.",
+        "evidence": "Packet fields: cisa_kev true, kev_date 2026-04-13, active_exploitation confirmed, cvss 9.8, rwep_score 77, poc_available true, patch_available true, live_patch_available false, live_patch_notes 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.' Packet vector: 'Fortinet FortiClient EMS contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.' Citing gaps include AU-Essential-8-Patch, ISO-27001-2022-A.8.8, NIST-800-53-SI-2 and NIS2-Art21-vulnerability-management.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-078",
+        "name": "ENDPOINT-MGMT-DEPLOYMENT-CHANNEL-INTEGRITY",
+        "description": "An attacker who reaches code execution through this SQL-injection path owns the endpoint-management server itself - the box that distributes software, policy and trust material to every enrolled FortiClient agent. Least privilege scoped to EMS operator accounts, the NIST AC-6 control the framework gap cites, bounds nothing against this CVE, because the packet's attacker never authenticates as an operator at all: the injection is reachable unauthenticated via crafted HTTP requests. What bounds the blast radius is treating the EMS-to-agent path as a privileged supply-chain control plane rather than as ordinary application output: integrity-monitor the agent packages and key material the server distributes, alarm on any agent push or policy change that cannot be traced to a sanctioned admin action, and treat a confirmed EMS compromise as fleet-wide agent code execution until the deployment channel is proven untouched, rather than as a single-server incident closed by patching the console.",
+        "evidence": "Packet attack_vector: 'SQL injection (CWE-89) on the FortiClient EMS management surface escalating to remote code execution. CISA KEV-listed 2026-04-13 with confirmed in-the-wild exploitation.' Packet vector states an unauthenticated attacker may execute unauthorized code or commands via specifically crafted HTTP requests. Packet fields: cvss 9.8, rwep_score 77, active_exploitation confirmed, poc_available true. Citing gap NIST-800-53-AC-6 (Least Privilege).",
+        "gap_closes": [
+          "NIST-800-53-AC-6"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-046",
+        "name": "PEN-TEST-SCOPE-INCLUDES-SECURITY-PRODUCTS",
+        "description": "FortiClient EMS is a defensive product, and scoping documents routinely list the endpoint-security stack among the controls a test must evade rather than among the surfaces a test must attack. That scoping choice is why an unauthenticated SQL injection sitting on the EMS management HTTP surface - the cheapest finding class there is, reachable before any credential - survived to a KEV listing with confirmed exploitation instead of being found internally. The fix is scope language that names the EMS management HTTP surface itself as an in-scope target, tested with the same injection battery applied to any other unauthenticated web application, and a PoC is public for this CVE so the test is directly reproducible against a staging console. The distinguishing question for an assessor: does the last test report contain any request sent to the endpoint-security management plane, or only requests sent to systems it defends?",
+        "evidence": "Packet vector: 'Fortinet FortiClient EMS contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.' Packet fields: cwe_refs CWE-89, cvss 9.8, cisa_kev true with kev_date 2026-04-13, active_exploitation confirmed, poc_available true. Citing gap UK-CAF-B4 (System security).",
+        "gap_closes": [
+          "UK-CAF-B4"
+        ]
+      }
+    ]
+  },
+  "CVE-2026-34621": {
+    "name": "Adobe Acrobat and Reader Prototype Pollution Vulnerability",
+    "lesson_date": "2026-05-29",
+    "attack_vector": {
+      "description": "a prototype-pollution flaw (CWE-1321) in Acrobat/Reader enabling arbitrary code execution when a crafted PDF is opened. CISA KEV-listed 2026-04-13 with confirmed in-the-wild exploitation.",
+      "privileges_required": "none (the victim renders attacker-controlled content)",
+      "complexity": "low — KEV-listed, actively exploited; treat as weaponized",
+      "ai_factor": "No AI involvement documented in discovery or weaponization."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply the Adobe Acrobat / Reader security update; for managed fleets, push the update and enable Protected Mode / Protected View where available.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation)",
+        "adequacy": "Browser/app auto-update is definitive and fast for unmanaged endpoints; the gap is managed fleets that gate updates behind a change window slower than the in-the-wild exploitation."
+      },
+      "detection": {
+        "what_would_have_worked": "Endpoint monitoring for PDF reader crashes on content render and for unexpected child processes spawned by the PDF reader after rendering a crafted PDF document.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Detection backstops endpoints not yet updated; client exploitation is fast and often single-interaction."
+      },
+      "response": {
         "what_would_have_worked": "Force the browser/application update across the fleet, then run an EDR sweep on endpoints that rendered untrusted a crafted PDF document before the update.",
         "was_this_required": true,
         "framework_requiring_it": "NIST 800-53 IR-4",
@@ -8337,7 +8900,40 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-055",
+        "name": "SECURITY-TOOL-INTEGRITY-VERIFICATION",
+        "description": "Put the FortiClient EMS server itself inside vulnerability-management scope at the SLA of the most privileged software in the estate, instead of wherever 'endpoint security product' falls in the OS-versus-application patch split. The exploited surface is the management server operators deploy in order to secure endpoints, and the flaw is reachable by an unauthenticated caller sending crafted requests — so the EMS build level is itself a security control, not an operations detail. Audits must establish the deployed EMS build from the server rather than from the console's own status view, and must include the trust-anchor-inversion test: send an unauthenticated crafted request to the EMS request handlers on a staging instance and confirm it is refused before any code or command runs. Remediation is a scheduled EMS outage: the entry registers no live-patch path and the vendor patch requires a service restart or reboot, so the security console is offline during its own fix and that window must be planned on the KEV clock rather than deferred to the routine cycle.",
+        "evidence": "Packet: 'Fortinet FortiClient EMS contains an improper access control vulnerability that may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests' (CWE-284). CISA KEV-listed 2026-04-06, active_exploitation: confirmed, CVSS 8.8, RWEP 77, poc_available: true. patch_available: true with live_patch_available: false; live_patch_notes records 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.'",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-078",
+        "name": "ENDPOINT-MGMT-DEPLOYMENT-CHANNEL-INTEGRITY",
+        "description": "Treat the EMS-to-FortiClient agent channel as a privileged supply-chain control plane for the duration of this exposure. Unauthenticated code or command execution on the EMS server hands an attacker the system that distributes configuration and software to every managed endpoint, so the blast radius is the agent fleet rather than one server: integrity-monitor the deployment artifacts and any key material the server holds, and alert on agent pushes and policy changes that do not correspond to a sanctioned admin action. Because the fix requires taking EMS down for a service restart, that monitoring has to span the outage and continue after it — restarting the server applies the patch but does not by itself evict anything placed through the flaw beforehand, and with exploitation confirmed in the wild an internet-reachable EMS instance is a forensic question, not a hypothetical. The distinguishing test: replay the deployment-artifact and key-table integrity baseline after the patch restart and confirm it matches the pre-exposure baseline.",
+        "evidence": "Packet: improper access control (CWE-284) 'allowing an unauthenticated attacker to access functions or data beyond authorization', with the KEV description recording that it 'may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests'. CISA KEV-listed 2026-04-06, active_exploitation: confirmed, CVSS 8.8, RWEP 77, poc_available: true. live_patch_available: false and the vendor patch requires a service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "NIST-800-53-AC-6",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-036",
+        "name": "FLEET-CONTROL-PLANE-ADMIN-PRIVILEGE-TIER",
+        "description": "Classify FortiClient EMS as a fleet control plane and confine its reachability on that basis: the EMS console and its request handlers should be reachable only through a privileged administrative path (PAM jumphost or a dedicated admin segment), with EMS administration held as an identity separate from general IT or application admin roles and elevated just-in-time. Against this CVE the tier's operative benefit is reachability rather than authentication strength — the flaw is exercised pre-authentication via crafted requests, so any deployment that leaves the EMS request surface reachable from general user networks or the internet gives the attacker the entire path no matter how the EMS credentials are governed. Frameworks that enumerate a single 'admin' tier do not distinguish the server that governs every endpoint agent from an application administrator, which is why this network-position requirement has to be stated as its own control. The distinguishing test: from a general user subnet, attempt to reach the EMS request handlers and confirm the connection is refused at the network boundary before authentication is ever reached.",
+        "evidence": "Packet: FortiClient EMS is exploited by 'an unauthenticated attacker to execute unauthorized code or commands via crafted requests' (CWE-284, improper access control). CISA KEV-listed 2026-04-06, active_exploitation: confirmed, CVSS 8.8, RWEP 77, poc_available: true. No live-patch tool is registered for this entry and the vendor patch requires a service restart or system reboot per the KEV requiredAction, so the exposure persists until an EMS restart window can be taken.",
+        "gap_closes": [
+          "NIS2-Art21-network-security",
+          "NIST-800-53-AC-6"
+        ]
+      }
+    ]
   },
   "CVE-2026-3502": {
     "name": "TrueConf Client Download of Code Without Integrity Check Vulnerability",
@@ -8452,7 +9048,31 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-057",
+        "name": "BROWSER-MANAGED-UPDATE-NO-DEFERRAL",
+        "description": "The fix for this Dawn/WebGPU use-after-free reaches endpoints only as a browser security-channel release, so any managed update ring that pins a version or holds the security channel for staging leaves the sandbox-escape link of the chain live fleet-wide. Managed browser policy has to let the security channel land within 24h and force the relaunch that actually replaces the running GPU process — an updated binary on disk beside a browser session that has not been restarted is still executing the vulnerable Dawn code.",
+        "evidence": "KEV-listed 2026-04-01 with confirmed in-the-wild exploitation, a public PoC, and a patch available; the flaw is the sandbox-escape step used after the renderer is already compromised, so it is the link that converts a contained renderer bug into host code execution.",
+        "gap_closes": [
+          "AU-Essential-8-App-Hardening",
+          "NIST-800-53-SI-2",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-018",
+        "name": "SCANNER-PAPER-COMPLIANCE-TEST",
+        "description": "A scan that reports the installed browser version as fixed does not prove this defect is gone. Dawn is Chromium's WebGPU implementation, so the same component ships inside Chromium-derived browsers and inside desktop applications that embed Chromium, each on its own update cadence and none of them moved by the browser's updater. The operational test: does the scan enumerate every Chromium-embedding runtime on the host as a separate versioned asset, record whether WebGPU is reachable in each, and read the version of the running process rather than the installed package?",
+        "evidence": "Patch available and KEV-listed 2026-04-01 with confirmed exploitation; the packet locates the flaw in Dawn/WebGPU rather than in a single vendor application, and exploitation requires prior renderer compromise, so the escape path only matters where a vulnerable Dawn build is actually loaded.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      }
+    ]
   },
   "CVE-2026-3055": {
     "name": "Citrix NetScaler Out-of-Bounds Read Vulnerability",
@@ -8512,7 +9132,30 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-030",
+        "name": "PERIMETER-DEVICE-ZERODAY-SLA-TIER",
+        "description": "When NetScaler is configured as a SAML IDP it is the authentication enforcement point for everything behind it, so its remediation tier cannot be derived from the CVE's severity band. This entry reads as a low-severity information disclosure by CVSS, yet the memory it overreads is authenticated session material and it is KEV-listed with confirmed in-the-wild exploitation — the RWEP score is 77 against a CVSS of 5.5. A vulnerability-management program that sorts by CVSS puts this appliance in the routine maintenance window. The tier requirement for this CVE: the update is due on the KEV clock, or the SAML IDP virtual server is taken out of service until the appliance is on a fixed build. Nothing upstream compensates, because the vulnerable device is the trust boundary the upstream controls delegate to.",
+        "evidence": "Packet: out-of-bounds read (CWE-125) on NetScaler ADC, NetScaler Gateway and NetScaler ADC FIPS/NDcPP when configured as a SAML IDP, leading to memory overread; the attack vector is described as disclosing adjacent memory used to steal authenticated session material. cisa_kev true, kev_date 2026-03-30, active_exploitation confirmed, poc_available true; cvss 5.5 against rwep_score 77.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "Updating this appliance stops the overread but does nothing about what has already left it. The exploited primitive hands an attacker authenticated session material read out of the SAML IDP's memory, and that material stays valid after the fix is applied — the vulnerability is closed while the access it produced is not. Remediation for this CVE must be run as compromise response rather than maintenance: once the appliance is on a fixed build, terminate every active session, rotate and reissue the session and signing secrets the IDP holds, rotate credentials that traversed it, and review the authentications it brokered during the exposure window (from KEV listing back through the earliest plausible exploitation). Patch-in-place with standing sessions is the failure mode this control exists to prevent.",
+        "evidence": "Packet: out-of-bounds read (CWE-125) in the SAML IDP path of NetScaler, disclosing adjacent memory used to steal authenticated session material; active_exploitation confirmed, cisa_kev true with kev_date 2026-03-30, poc_available true. patch_available true, live_patch_available false, live_patch_notes recording no registered live-patch tool and a vendor patch that typically requires service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "UK-CAF-B2",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      }
+    ]
   },
   "CVE-2025-53521": {
     "name": "F5 BIG-IP Stack-Based Buffer Overflow Vulnerability",
@@ -8572,7 +9215,41 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-030",
+        "name": "PERIMETER-DEVICE-ZERODAY-SLA-TIER",
+        "description": "A BIG-IP APM appliance is the trust boundary for the remote-access path it fronts, so the routine 14/30-day windows generic vulnerability-management controls allow are the wrong clock for an unauthenticated stack-based overflow reaching code execution on its data path. This CVE belongs in a perimeter tier: vendor fix deployed within hours of the KEV listing, or the vulnerable virtual server and management interface taken out of untrusted reach until it can be. The packet records no live-patch path for this entry and a vendor fix that requires a service restart or system reboot per the KEV requiredAction, so the SLA has to pre-authorize a failover or downtime window on the appliance itself. Frameworks that grade patch timeliness on a single estate-wide average let a 9.8 pre-auth RCE on the device that terminates remote access sit inside an acceptable-looking metric.",
+        "evidence": "F5 BIG-IP APM stack-based buffer overflow (CWE-121), CVSS 9.8, RWEP 77, exploitable by an unauthenticated attacker for memory-corruption remote code execution on the appliance. CISA KEV-listed 2026-03-27 with confirmed in-the-wild exploitation and poc_available=true. patch_available=true, live_patch_available=false; the entry states the vendor patch typically requires service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "Confirmed in-the-wild exploitation plus a public PoC against an unauthenticated RCE on BIG-IP APM means any appliance that was network-reachable before the fix has to be treated as possibly already running attacker code, not merely as unpatched. The default IR path for this CVE is capture the running configuration off the box, rebuild the appliance from vendor media, and rotate the credentials and keys the appliance held or proxied before it returns to service. Installing the vendor fix removes the overflow; it does not remove anything an operator installed through the overflow beforehand, and the restart the fix requires is a convenient moment for an implant to reload. A compliance verdict of remediated based on the installed version alone is the failure this control exists to prevent.",
+        "evidence": "Unauthenticated memory-corruption RCE on the appliance (CWE-121, CVSS 9.8, RWEP 77), active_exploitation=confirmed, poc_available=true, CISA KEV-listed 2026-03-27. patch_available=true with live_patch_available=false and a vendor patch that typically requires service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "NIS2-Art21-patch-management",
+          "NIST-800-53-SI-2",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-031",
+        "name": "FIREWALL-EGRESS-TELEMETRY-SEPARATE-TRUST-ZONE",
+        "description": "Code execution on BIG-IP APM is code execution on the device that writes the access and authentication records for the remote-access path it fronts, so the appliance's local log store cannot answer whether it was hit before the fix landed. Syslog, access-policy and authentication events must already be landing on a collector in a separate trust zone, with different credentials and a different management path, and retained far enough back to cover the window preceding the 2026-03-27 KEV listing. Without that, the rebuild-versus-patch decision this CVE forces is made with no evidence, and the exposure window can only be guessed at from the disclosure date rather than measured.",
+        "evidence": "Confirmed in-the-wild exploitation of an unauthenticated RCE on the appliance (CWE-121, CVSS 9.8, RWEP 77) with poc_available=true, CISA KEV-listed 2026-03-27; remediation requires a service restart or system reboot per the KEV requiredAction with no live-patch path registered.",
+        "gap_closes": [
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2026-33634": {
     "name": "Aquasecurity Trivy Embedded Malicious Code Vulnerability",
@@ -11442,7 +12119,32 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-056",
+        "name": "MOBILE-ENDPOINT-MDM-ENFORCED-KEV-SLA",
+        "description": "Managed Apple devices must be driven to the fixed OS build on an MDM-enforced clock keyed to the KEV listing, with user deferral disabled and the restart forced rather than requested. For this flaw the update is not optional hardening: the packet describes a malicious application writing kernel memory, which is a defect below the app sandbox, so nothing an operator configures on the device changes the outcome until the fixed build is running. The packet records no live-patch tool and states the vendor fix typically requires a service restart or system reboot, so the compliance event to measure is 'rebooted onto the fixed build', not 'update pushed'. The affected list in the packet spans watchOS, iOS, iPadOS, macOS, visionOS and tvOS; visionOS and tvOS are the families most likely to sit outside an update ring built around phones and laptops, so the enforcement scope has to be checked against the full family list rather than assumed.",
+        "evidence": "The packet's vector states that Apple watchOS, iOS, iPadOS, macOS, visionOS and tvOS contain a classic buffer overflow (CWE-120) that could allow a malicious application to cause unexpected system termination or write kernel memory. cisa_kev is true with kev_date 2026-03-20, active_exploitation is confirmed, poc_available is true, and rwep_score is 77 against a CVSS of 8.8. patch_available is true, live_patch_available is false, and live_patch_notes states the vendor patch typically requires a service restart or system reboot per the KEV requiredAction. The cited patch-management controls — Essential Eight 'Patch operating systems', ISO 27001 A.8.8, NIS2 Art. 21 vulnerability handling, NIST SI-2 — express timescale expectations but none ties the estate to the KEV date or removes the user's ability to defer the restart the fix requires.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "NIST-800-53-SI-2",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management"
+        ]
+      },
+      {
+        "id": "MOBILE-OS-MINIMUM-PATCH-LEVEL-ENFORCEMENT",
+        "name": "MOBILE-OS-MINIMUM-PATCH-LEVEL-ENFORCEMENT",
+        "description": "The Apple fleet must treat the OS build that fixes this flaw as an access condition, not a reporting metric: a device below it is denied or quarantined from organizational data rather than listed on a patch-compliance dashboard. The packet's vector makes the second half of this control the load-bearing half — the trigger is a malicious application writing kernel memory, so on any device that cannot yet take the fixed build the operator's remaining lever is constraining what code gets to run at all, which means restricting installation of untrusted or side-loaded applications and holding the device outside the trust boundary until it updates. The distinguishing test is to enrol a device pinned below the fixed build and confirm the policy actually denies it access to protected resources; an estate that surfaces the stale build on a report while the device keeps its mail, VPN and document access has recorded the exposure rather than removed it.",
+        "evidence": "The packet's vector states the flaw could allow a malicious application to cause unexpected system termination or write kernel memory across watchOS, iOS, iPadOS, macOS, visionOS and tvOS — an application-driven kernel write, so the code is running locally and the boundary it crosses is below the application privilege model. That is why the least-privilege control cited against this entry is insufficient: no privilege assignment on the app constrains a kernel memory write, and the UK CAF system-security expectation likewise assumes an OS boundary the packet shows is defective. active_exploitation is confirmed, poc_available is true, cisa_kev is true with kev_date 2026-03-20, and rwep_score is 77. patch_available is true but live_patch_available is false with live_patch_notes stating the vendor patch typically requires a service restart or system reboot, so devices awaiting a reboot window remain in the exposed population and need an access-side control rather than a patch-side one.",
+        "gap_closes": [
+          "NIST-800-53-AC-6",
+          "UK-CAF-B4",
+          "AU-Essential-8-Patch"
+        ]
+      }
+    ]
   },
   "CVE-2025-31277": {
     "name": "Apple Multiple Products Buffer Overflow Vulnerability",
@@ -11497,7 +12199,30 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-056",
+        "name": "MOBILE-ENDPOINT-MDM-ENFORCED-KEV-SLA",
+        "description": "The entry covers Safari, iOS, watchOS, visionOS, iPadOS, macOS and tvOS at once, so a single deferring device in any of those families keeps the maliciously-crafted-web-content path into the CWE-119 memory-corruption primitive open. Because no live patch is registered and the vendor fix takes effect only after a restart or reboot, the exposure lasts exactly as long as a user can postpone the update. Enforce the Apple-OS update through device management with user deferral disallowed and the control's 24h KEV-class deadline measured from the 2026-03-20 listing, and track install completion per device across every OS family named in the entry — tvOS, visionOS and watchOS units counted, not assumed current, since those are the ones no help-desk ticket ever chases.",
+        "evidence": "CISA KEV-listed 2026-03-20 with active_exploitation confirmed; RWEP 77, CVSS 8.8, PoC available. The packet's description covers Apple Safari, iOS, watchOS, visionOS, iPadOS, macOS and tvOS, where processing maliciously crafted web content may lead to memory corruption (CWE-119). patch_available is true but live_patch_available is false, and the packet records that the vendor patch typically requires service restart or system reboot per the KEV requiredAction — so remediation completes only at the restart the deferring user controls.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-121",
+        "name": "MOBILE-ZERO-CLICK-HARDENING",
+        "description": "For the population plausibly inside the targeting set this class of Apple flaw serves — executives, journalists, legal and security staff — the reboot-gated update is not fast enough on its own, because the packet describes the overflow as a sandbox-escape / privilege step inside a chain rather than a standalone bug. Place those users in a reduced-attack-surface mode so untrusted web content, message attachments, fonts and link previews are not processed automatically, narrowing the delivery path into the CWE-119 primitive during the window between the 2026-03-20 KEV listing and completed fleet restart. This has to be a standing posture for the high-risk cohort assigned before the next disclosure, not a reaction to this CVE — the mode only helps if it was already on when the chain arrived.",
+        "evidence": "The packet's attack_vector records the flaw as a buffer overflow (CWE-119) used as a sandbox-escape / privilege step in an exploit chain, and notes that Apple zero-days of this class are typically used in targeted-spyware chains; the KEV description names processing of maliciously crafted web content as the trigger. Exploitation is confirmed in the wild (KEV 2026-03-20), RWEP 77, CVSS 8.8, PoC available. With live_patch_available false, the only vendor remediation lands at restart, leaving a device-by-device exposure window.",
+        "gap_closes": [
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2026-20131": {
     "name": "Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data Vulnerability",
@@ -11557,7 +12282,40 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-030",
+        "name": "PERIMETER-DEVICE-ZERODAY-SLA-TIER",
+        "description": "The perimeter SLA tier has to extend from the firewall to the console that programs it. Cisco Secure Firewall Management Center and Security Cloud Control firewall management push policy, access rules, intrusion configuration, and software to every managed sensor, so unauthenticated remote code execution on the management plane is equivalent to administrative control of the entire enforcement estate — a strictly larger blast radius than the same flaw on one appliance, and the reason a frameworks list that enumerates only firewalls, VPN concentrators, and load-balancers under-tiers this device. On the 2026-03-19 KEV listing the requirement is deployment of the fixed release within hours, or removal of the FMC/SCC management interface from any network segment an attacker can reach (management VRF, jump-host-only ACL), not the routine 14/30-day appliance window; for the SaaS-delivered SCC side, vendor remediation status must be obtained and recorded rather than assumed complete. The distinguishing test: from a general-purpose user VLAN, attempt to open the FMC management HTTPS interface — if it answers, the standard patch window is the only thing standing between an unauthenticated attacker and the firewall control plane.",
+        "evidence": "Packet: CVE-2026-20131, Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management, CWE-502 deserialization of untrusted data yielding unauthenticated remote code execution on the firewall management plane. CISA KEV-listed 2026-03-19, active_exploitation confirmed, CVSS 9.8, RWEP 83, poc_available true, patch_available true.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "NIST-800-53-SI-2",
+          "ISO-27001-2022-A.8.8"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "FMC holds the administrative credentials, the sensor registration keys, and the policy source of truth for every firewall it manages, so unauthenticated code execution on it is a credential-and-configuration compromise of the enforcement fleet rather than a single-host incident — and with a public PoC and confirmed in-the-wild exploitation, an operator patching after 2026-03-19 cannot assume they got there first. The runbook for a KEV-listed, actively exploited FMC/SCC RCE must default to: export and diff the running policy against last known-good (added permit rules, disabled inspection, new remote-access or VPN entries, altered NAT), reimage FMC from vendor media at the fixed release instead of upgrading in place, re-register managed devices with new keys, and rotate FMC local admin, RADIUS/TACACS, and every device credential FMC stored. The distinguishing test: read the FMC incident procedure and check whether it ends at 'upgraded to fixed release' — with no policy diff and no sensor re-registration step, an attacker-inserted firewall rule survives the remediation and keeps the network open behind a device the audit now records as patched.",
+        "evidence": "Packet: unauthenticated remote code execution on the Cisco FMC / SCC firewall management plane via CWE-502 deserialization; CISA KEV-listed 2026-03-19 with active_exploitation confirmed, poc_available true, patch_available true, RWEP 83, CVSS 9.8. AU-Essential-8-Patch and NIS2-Art21-vulnerability-handling are already recorded as insufficient controls citing this CVE.",
+        "gap_closes": [
+          "NIS2-Art21-vulnerability-handling",
+          "AU-Essential-8-Patch"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-031",
+        "name": "FIREWALL-EGRESS-TELEMETRY-SEPARATE-TRUST-ZONE",
+        "description": "In a Cisco Secure Firewall deployment FMC is both the target of this flaw and the event collector for the sensors it manages, so an attacker who reaches unauthenticated code execution on FMC lands on the box holding the connection, intrusion, and audit records that would evidence the intrusion — including FMC's own audit trail of the policy changes they make next. Where the deployment relies on FMC as the event store, that is a single-point forensic dependency on the compromised host. Forward FMC audit and syslog, plus the managed sensors' event streams, to a SIEM in a separate trust zone with separate credentials and a separate authentication path, and alert on FMC audit-log gaps, policy deployments not tied to a change ticket, and sensor event streams that go silent. The distinguishing test: simulate a total FMC outage and confirm the SIEM still holds the managed sensors' events for that window — if firewall telemetry exists only inside FMC, an exploited management plane produces no evidence at all, which is why the anti-malware control credited for this estate (unrunnable on the appliance in the first place) cannot substitute.",
+        "evidence": "Packet: CWE-502 deserialization yielding unauthenticated RCE on the Cisco FMC / SCC firewall management plane, CISA KEV-listed 2026-03-19 with confirmed in-the-wild exploitation and a public PoC (RWEP 83). CIS-Controls-v8-10.1 (Deploy and Maintain Anti-Malware Software) and UK-CAF-B4 (System security) are already recorded as insufficient controls citing this CVE.",
+        "gap_closes": [
+          "CIS-Controls-v8-10.1",
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2025-66376": {
     "name": "Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability",
@@ -11677,7 +12435,31 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "A SharePoint farm must be remediated on a KEV-tied clock, not the monthly server-patch window, because the flaw needs no credentials and is reached over the same web surface the farm exists to serve — every hour it answers requests is exposure. The SLA must budget the farm-wide restart the vendor fix requires (front-end plus application servers, not one node) inside the clock rather than deferring the restart to the next change window and counting the installer run as remediation.",
+        "evidence": "Packet records a CISA KEV listing dated 2026-03-18 with active_exploitation 'confirmed', RWEP 77 against CVSS 9.8, and poc_available true. patch_available is true and live_patch_available is false; live_patch_notes state the vendor patch typically requires service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "Installing the SharePoint update closes the deserialization entry point but does not evict whatever entered through it, and the packet's exploitation status says something did. A farm that was network-reachable and unpatched during the exposure window must be triaged as compromised rather than declared fixed: review the web-facing servers' content and handler trees for attacker-planted artifacts, rotate the farm's service-account and application credentials, and prefer rebuild over patch-in-place — the service restart the fix requires will otherwise simply relaunch anything the attacker left resident.",
+        "evidence": "Packet's attack_vector describes deserialization of untrusted data (CWE-502) yielding unauthenticated remote code execution on the SharePoint web surface, with active_exploitation 'confirmed' and CISA KEV listing 2026-03-18; poc_available is true. live_patch_available is false and live_patch_notes record that the vendor patch typically requires a service restart or system reboot.",
+        "gap_closes": [
+          "NIS2-Art21-vulnerability-management",
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2025-47813": {
     "name": "Wing FTP Server Information Disclosure Vulnerability",
@@ -11792,7 +12574,39 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-057",
+        "name": "BROWSER-MANAGED-UPDATE-NO-DEFERRAL",
+        "description": "Delivery here is a crafted HTML page, so exposure accrues during ordinary browsing rather than at some privileged action an operator could suspend — every hour a managed browser sits on a pre-fix Chromium build is live exposure to an exploited V8 memory bug. Enterprise update rings that stage a security-channel Chromium release through pilot and broad phases, or that let users defer the relaunch, push the fixed build past the exploitation window. Deferral of this update has to be disallowed by policy on the managed fleet, not merely discouraged, because the vendor build is the only remediation the packet records.",
+        "evidence": "Packet vector: 'could allow a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page'; cwe_refs CWE-119 in V8; cisa_kev true, kev_date 2026-03-13, active_exploitation 'confirmed', poc_available true; patch_available true, live_patch_available false.",
+        "gap_closes": [
+          "NIS2-Art21-patch-management",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "A browser normally rides an application-patch cadence measured in weeks; this entry is KEV-listed 2026-03-13 with confirmed in-the-wild exploitation and a public PoC, which puts it on the compressed KEV clock instead. The packet's live-patch note records that the vendor fix typically requires a service restart or system reboot and that no live-patch tool is registered, so compliance has to be evidenced as 'running the fixed build after that restart across the fleet' rather than 'update delivered' — a delivered-but-not-restarted installer leaves the vulnerable V8 code executing.",
+        "evidence": "cisa_kev true, kev_date 2026-03-13; active_exploitation 'confirmed'; poc_available true; RWEP 77 / CVSS 8.8; patch_available true, live_patch_available false, live_patch_notes: 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.'",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-021",
+        "name": "TIER-3-DEPENDENCY-INVENTORY",
+        "description": "The packet states this V8 flaw reaches multiple browsers that embed Chromium — Chrome, Edge and Opera named explicitly and 'not limited to' those — so an inventory keyed on product names reports the estate remediated once Chrome updates while every other Chromium-embedding product still ships the vulnerable engine. The inventory has to record the embedded browser engine as a component of each product that carries it, with each embedder's own update channel tracked as a separate remediation path, because updating one embedder fixes none of the others.",
+        "evidence": "Packet vector: 'This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.' cwe_refs CWE-119 located in the V8 engine; cisa_kev true, kev_date 2026-03-13.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      }
+    ]
   },
   "CVE-2026-3909": {
     "name": "Google Skia Out-of-Bounds Write Vulnerability",
@@ -11847,7 +12661,42 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-057",
+        "name": "BROWSER-MANAGED-UPDATE-NO-DEFERRAL",
+        "description": "The delivery primitive here is an ordinary web page, so any Chrome or ChromeOS instance parked on a deferred enterprise update ring stays exploitable through nothing more than users browsing — there is no risky-behavior policy that closes it. Percentage-staged rollouts, pinned-version pilot rings, and 'test in the pilot ring first' change control must be bypassed for this security-channel update. On ChromeOS the update is not effective until the device restarts, so the policy must force the restart rather than wait for a user-initiated one and count the downloaded update as remediation.",
+        "evidence": "Packet's vector states the out-of-bounds write 'could allow a remote attacker to perform out of bounds memory access via a crafted HTML page' and that it 'affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products'. CISA KEV listing 2026-03-13, active_exploitation 'confirmed', poc_available true, patch_available true, live_patch_available false, with live_patch_notes recording that the vendor patch typically requires service restart or system reboot.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-patch-management"
+        ]
+      },
+      {
+        "id": "MOBILE-OS-MINIMUM-PATCH-LEVEL-ENFORCEMENT",
+        "name": "MOBILE-OS-MINIMUM-PATCH-LEVEL-ENFORCEMENT",
+        "description": "The packet lists Android as separately affected from Chrome, so pushing a browser update to the fleet does not settle the Android exposure — the platform copy of the graphics component travels with the OS security-patch level. The enrolled-fleet policy therefore has to gate access to organizational data on the security-patch level that carries this fix, not merely report patch level on a compliance dashboard. Handsets that cannot yet receive that level — vendor-abandoned or carrier-delayed models — must be quarantined rather than risk-accepted, because the trigger is attacker-controlled web content that a user cannot reasonably avoid encountering.",
+        "evidence": "Packet's vector states the flaw 'affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products' and is reachable 'via a crafted HTML page'. CISA KEV listing 2026-03-13 with active_exploitation 'confirmed'; RWEP 77, CVSS 9.8, poc_available true, patch_available true.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "NIS2-Art21-patch-management",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-021",
+        "name": "TIER-3-DEPENDENCY-INVENTORY",
+        "description": "Skia is a bundled graphics component rather than a product an operator buys, and the packet's own affected list ends in 'possibly other products' — which is the admission that nobody can enumerate exposure from a product-level asset register. Real exposure includes in-house and third-party applications built on Flutter, which carry the component transitively and whose inventory entry names the app, never Skia. Asset and SBOM coverage must reach embedded-component depth so 'where is this graphics library in our estate?' is an answerable question, and the answer has to distinguish the copies that a vendor update channel fixes from the copies that are only fixed when the application is rebuilt against a fixed framework release and redistributed.",
+        "evidence": "Packet's attack_vector describes an out-of-bounds write in the Skia graphics library (CWE-787) reachable via attacker-controlled web content, and the vector text states the flaw 'affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products'. CISA KEV listing 2026-03-13, active_exploitation 'confirmed', poc_available true.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      }
+    ]
   },
   "CVE-2025-68613": {
     "name": "n8n Improper Control of Dynamically-Managed Code Resources Vulnerability",
@@ -11967,7 +12816,30 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "The remediation clock on this Workspace ONE UEM flaw starts at the 2026-03-09 KEV listing, not at the 2021 CVE id — an estate that closed out its 2021 vulnerability backlog years ago is still running the exposed build today, and nothing in a recency-ordered queue will surface it. Because the packet registers no live-patch path and states the vendor fix requires a service restart or reboot, meeting the KEV window means holding a pre-approved restart window for the UEM tier instead of queuing the platform behind the next monthly change cycle; every hour before that restart, the SSRF remains reachable by an unauthenticated caller with network access to UEM.",
+        "evidence": "cisa_kev true with kev_date 2026-03-09 on a 2021-numbered CVE; active_exploitation confirmed, RWEP 77, CVSS 7.5, poc_available true, patch_available true; live_patch_available false with live_patch_notes 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.'",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-037",
+        "name": "FLEET-COMPROMISE-IR-PLAYBOOK",
+        "description": "The vulnerable host is the endpoint-management control plane for the managed device estate, and the packet's impact is unauthenticated access to sensitive information rather than code execution — so a successful exploitation leaves no crash, no shell and no host artifact, while whatever the server-side requests retrieved stays valid after the patch lands. The playbook for this product has to assume disclosure over the full window the vulnerable build was live: rotate the enrollment, API and integration credentials plus any certificates reachable from the UEM's server-side request path, re-validate device trust state across the enrolled fleet, and audit configuration profiles pushed during that window before the incident is treated as closed. Patch completion is not evidence that the exposure ended.",
+        "evidence": "Packet vector: 'Omnissa Workspace One UEM formerly known as VMware Workspace One UEM contains a server-side request forgery (SSRF) vulnerability that could allow a malicious actor with network access to UEM to send their requests without authentication and to gain access to sensitive information.' active_exploitation confirmed, KEV-listed 2026-03-09, poc_available true, RWEP 77.",
+        "gap_closes": [
+          "UK-CAF-B4",
+          "NIS2-Art21-network-security"
+        ]
+      }
+    ]
   },
   "CVE-2025-26399": {
     "name": "SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability",
@@ -12027,7 +12899,32 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "Web Help Desk must run on a KEV-tied remediation clock rather than a routine application-patch window, because the deserialization sink sits in AjaxProxy and is reachable without authentication — exposure is a function of who can reach the Web Help Desk web tier, not of who holds a credential, so 'no untrusted users have accounts' is not an exposure argument. The packet records no live-patch path for this entry: the vendor fix requires a service restart or reboot, so the SLA has to pre-authorize a Web Help Desk service restart inside the KEV window instead of deferring it to the next change cycle. Where the restart genuinely cannot be taken in the window, the AjaxProxy request path must be made unreachable from untrusted networks for the remainder of it, and that state tracked as unremediated rather than counted as patched.",
+        "evidence": "CISA KEV-listed 2026-03-09 with active_exploitation 'confirmed' and poc_available true; CVSS 9.8, RWEP 77. The catalog vector records a 'deserialization of untrusted data vulnerability in AjaxProxy that could allow an attacker to run commands on the host machine', and the attack_vector records it as 'enabling unauthenticated remote code execution'. patch_available is true, live_patch_available is false, and live_patch_notes reads: 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.'",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-042",
+        "name": "INCOMPLETE-PATCH-SEQUENCE-SEVERITY-MULTIPLIER",
+        "description": "This is not a first-of-kind defect in this product — the catalog places it as the latest in the Web Help Desk deserialization chain — so vulnerability management must score it as an Nth-in-sequence failure of the same CWE-502 primitive, not as a discrete new CVE that resets the risk picture. For this deployment that means: Web Help Desk carries a standing severity multiplier and a shortened triage clock for any subsequent deserialization advisory, the AjaxProxy request path is recorded in the risk register as a known-recurring code-execution sink rather than a one-time finding, and the network-reachability restrictions placed around the Web Help Desk web tier for the earlier links in the chain are retained after this patch lands instead of being retired as remediated. A framework that treats each Web Help Desk CVE as an independent event keeps re-deriving the same 'patch and close' verdict against a primitive that has now failed repeatedly.",
+        "evidence": "The catalog attack_vector for this entry reads: 'a deserialization-of-untrusted-data flaw (CWE-502) enabling unauthenticated remote code execution (the latest in the Web Help Desk deserialization chain)' — the same CWE-502 primitive recurring in the same product. KEV-listed 2026-03-09, active_exploitation 'confirmed', poc_available true, CVSS 9.8, RWEP 77.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-patch-management"
+        ]
+      }
+    ]
   },
   "CVE-2026-1603": {
     "name": "Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability",
@@ -12087,7 +12984,40 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "Ivanti EPM is the endpoint-management server, so every hour between the 2026-03-09 KEV listing and the patched build running is time in which a remote unauthenticated caller can reach the alternate-path bypass and pull stored credential data. Run this on a 4-hour clock from KEV listing or patch availability, whichever is later, and — because no live patch is registered and the fix takes effect only at the service restart or reboot the KEV requiredAction calls for — book the EPM outage inside that clock instead of the next change window, which is where an endpoint-management server normally gets deferred to. Where the restart genuinely cannot happen in 4 hours, the documented compensating control must remove network reachability to the EPM surface, not merely record the delay as an approved exception.",
+        "evidence": "CISA KEV-listed 2026-03-09 with active_exploitation confirmed; RWEP 77, CVSS 9.1, PoC available. The packet describes an authentication bypass using an alternate path or channel (CWE-288) that could allow a remote unauthenticated attacker to leak specific stored credential data. patch_available is true, live_patch_available is false, and the packet records that the vendor patch typically requires service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-036",
+        "name": "FLEET-CONTROL-PLANE-ADMIN-PRIVILEGE-TIER",
+        "description": "EPM administers the endpoint fleet, and the packet's own statement of impact — unauthenticated leak of stored credential data — is precisely why its accounts cannot sit in the same tier as application admins. Two things follow for this deployment. First, the EPM management surface must be reachable only through a PAM jumphost, so an anonymous network caller has no route on which to present the alternate path or channel at all; network reachability, not authentication, is the only barrier a pre-auth bypass respects. Second, the credentials EPM stores must be just-in-time-elevated, FIDO2-step-up, EPM-scoped identities held separately from any other admin role, so what the bypass can disclose is not a standing password that also opens domain, backup or hypervisor infrastructure. A framework that counts EPM operators as ordinary admins lets the contents of the credential store, rather than any control, set the blast radius.",
+        "evidence": "The packet states the flaw is an authentication bypass using an alternate path or channel (CWE-288) that could allow a remote unauthenticated attacker to leak specific stored credential data from Ivanti Endpoint Manager; CVSS 9.1, RWEP 77, PoC available, with active_exploitation confirmed as of the 2026-03-09 KEV listing. The framework controls the packet records as insufficient here include NIST SP 800-53 AC-6 (Least Privilege), UK CAF B2 (Identity and access control) and NIS2 Art. 21 security of network and information systems — none of which give the endpoint-management control plane a privilege tier of its own.",
+        "gap_closes": [
+          "UK-CAF-B2",
+          "NIST-800-53-AC-6",
+          "NIS2-Art21-network-security"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-037",
+        "name": "FLEET-COMPROMISE-IR-PLAYBOOK",
+        "description": "Patching EPM closes the bypass and does nothing about credential data already read through it, which is the packet's stated impact — so the playbook for this entry has to open by assuming disclosure rather than waiting for evidence of it. Rotate every credential the EPM instance stored (agent-push service accounts, deployment shares, the EPM database account, any bound directory accounts), invalidate device-trust state pushed from the server, and audit configuration and package pushes back across the exposure window that opened no later than the 2026-03-09 KEV listing. Rotation scope must be driven by what EPM held, not by which accounts show anomalous logins: a credential taken from the store replays as ordinary successful authentication and generates no alert to scope from.",
+        "evidence": "The packet's description is that the flaw could allow a remote unauthenticated attacker to leak specific stored credential data; KEV-listed 2026-03-09 with active_exploitation confirmed and a PoC available. patch_available is true, but a fix that stops further leakage does not invalidate credentials disclosed before it was applied — and with live_patch_available false, the packet records that the fix lands only at the service restart or reboot the KEV requiredAction calls for, extending the disclosure window that rotation has to cover.",
+        "gap_closes": [
+          "UK-CAF-B2"
+        ]
+      }
+    ]
   },
   "CVE-2017-7921": {
     "name": "Hikvision Multiple Products Improper Authentication Vulnerability",
@@ -12317,7 +13247,31 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-056",
+        "name": "MOBILE-ENDPOINT-MDM-ENFORCED-KEV-SLA",
+        "description": "Every managed Apple endpoint in scope for this flaw must take the fixed OS build on an MDM-enforced clock tied to the KEV listing, with user deferral disabled. Because the packet records no live-patch path and states the vendor fix typically requires a service restart or system reboot, the enforcement has to include the ability to force that restart rather than waiting for a user-chosen moment — an update downloaded but never rebooted into leaves the device fully exploitable, and a dashboard that reports 'update available' as compliant is measuring the wrong event. Scope matters here: the packet names tvOS, macOS, Safari, iPadOS and watchOS, and tvOS and watchOS devices are routinely outside the update ring that covers phones and laptops, so the control must reach every Apple OS family enrolled in the estate rather than the iOS and macOS population alone.",
+        "evidence": "The packet's vector states that Apple tvOS, macOS, Safari, iPadOS and watchOS contain an integer overflow or wraparound arising from the processing of maliciously crafted web content that may lead to arbitrary code execution (CWE-190). cisa_kev is true with kev_date 2026-03-05, active_exploitation is confirmed, poc_available is true, and rwep_score is 77 against a CVSS of 8.8. patch_available is true, live_patch_available is false, and live_patch_notes states the vendor patch typically requires a service restart or system reboot per the KEV requiredAction — so the fixed build plus a reboot is the entire remediation and the only variable an operator controls is how quickly both happen. The framework controls cited against this entry set patch expectations but none binds the estate to the KEV listing date or forbids user deferral of the restart the fix depends on.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "NIST-800-53-SI-2",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-121",
+        "name": "MOBILE-ZERO-CLICK-HARDENING",
+        "description": "Users at elevated targeting risk must run their Apple devices in a reduced-attack-surface mode rather than relying on the update clock alone for this flaw. The packet's vector puts the trigger in the processing of maliciously crafted web content, which means exposure begins the moment a device renders an attacker's page or a message that automatically previews one — before any operator decision is available. Since the packet records no live-patch option and states the fix requires a restart or reboot, there is a period between disclosure and rebooted-and-fixed during which nothing in the patch programme protects the device; a mode that suppresses automatic processing of untrusted content is the only prevention that operates inside it. The enrolment decision therefore has to be taken for the at-risk population ahead of the next disclosure, since enrolling in response to a KEV listing repeats the same lag the control exists to remove.",
+        "evidence": "The packet's attack_vector describes the integer overflow / wraparound as a memory-corruption step in an exploit chain and records that Apple zero-days of this class are typically used in targeted-spyware chains; the vector text attributes the flaw to the processing of maliciously crafted web content that may lead to arbitrary code execution. active_exploitation is confirmed, poc_available is true, and the entry is KEV-listed on 2026-03-05. live_patch_available is false and live_patch_notes states the vendor patch typically requires a service restart or system reboot, so no mitigation takes effect without a reboot. Essential Eight patch maturity and the UK CAF system-security expectation cited against this entry both assume the remediation clock is the defence; neither requires a reduced-attack-surface posture for the population this exploitation class targets, so the pre-reboot window is left uncovered.",
+        "gap_closes": [
+          "UK-CAF-B4",
+          "AU-Essential-8-Patch"
+        ]
+      }
+    ]
   },
   "CVE-2023-41974": {
     "name": "Apple iOS and iPadOS Use-After-Free Vulnerability",
@@ -12479,15 +13433,41 @@
         "adequate": false,
         "gap": "Essential 8 patch-applications (operating systems, 48h at ML3) is the right tier, but the load-bearing controls are kernel/driver hardening and a timely vendor patch cadence — Android Security Bulletin OTA updates for the mobile-chipset entries, distribution kernel updates or live-patching for the Linux entries — none of which the framework names explicitly."
       }
-    },
-    "compliance_exposure_score": {
-      "percent_audit_passing_orgs_still_exposed": 66,
-      "basis": "Qualcomm chipsets is ubiquitous; audited organizations gate mobile OTA updates behind carrier/OEM cadence and MDM windows, leaving the LPE chain open well past the in-the-wild exploitation window.",
-      "theater_pattern": "patch_management"
-    },
-    "ai_discovered_zeroday": false,
-    "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    },
+    "compliance_exposure_score": {
+      "percent_audit_passing_orgs_still_exposed": 66,
+      "basis": "Qualcomm chipsets is ubiquitous; audited organizations gate mobile OTA updates behind carrier/OEM cadence and MDM windows, leaving the LPE chain open well past the in-the-wild exploitation window.",
+      "theater_pattern": "patch_management"
+    },
+    "ai_discovered_zeroday": false,
+    "ai_discovery_source": "vendor_research",
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "MOBILE-OS-MINIMUM-PATCH-LEVEL-ENFORCEMENT",
+        "name": "MOBILE-OS-MINIMUM-PATCH-LEVEL-ENFORCEMENT",
+        "description": "The defect is in Qualcomm chipset code — memory corruption while using alignments for memory allocation — so no operator patches it directly. The fix reaches a device only inside the device maker's firmware/OS build, and the device's reported security-patch level is the only observable that tells an operator whether that build is actually installed. For a fleet containing devices on the affected chipsets, this control means the MDM/EMM must read the security-patch level and block or quarantine devices below the build carrying the Qualcomm fix as a condition of access to organizational data, rather than reporting the stale level on a dashboard. Because the packet's exploitation path is a local foothold escalating privilege on the device, devices that cannot yet receive an updated build must additionally be constrained against installing untrusted or side-loaded code, since that is what supplies the local execution the escalation needs. The distinguishing test: enroll a device pinned below the fixed build and confirm the policy denies it access to protected resources — a fleet that only records patch level leaves exploitable devices in production against a confirmed-exploited chipset flaw.",
+        "evidence": "Packet: cisa_kev true, kev_date 2026-03-03, active_exploitation \"confirmed\", RWEP 77, CVSS 8.8, poc_available true. Vector: \"Multiple Qualcomm chipsets contain a memory corruption vulnerability while using alignments for memory allocation.\" Attack vector: an integer-overflow memory-corruption flaw (CWE-190) in Qualcomm chipset firmware/driver code, exploited by a local foothold to escalate privileges on the device. patch_available true; live_patch_available false. Every citing gap is a patch-policy control — ASD Essential Eight \"Patch operating systems\", ISO/IEC 27001:2022 A.8.8, NIST SP 800-53 SI-2, NIS2 Art.21 vulnerability handling and disclosure, UK CAF B4 — and each measures OS-level patch policy rather than enforcing a device's chipset-fix patch level as a precondition of access.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-patch-management",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "The entry is KEV-listed with confirmed exploitation and a vendor fix exists, but nothing on the affected devices can be fixed without an outage: the packet registers no live-patch tool and states the vendor patch typically requires a service restart or system reboot per the KEV requiredAction. For a silicon-vendor defect the SLA's \"or patch availability, whichever is later\" clause is the operative half — the organization's patch is not available when Qualcomm fixes the chipset code but when the device maker's build carrying that fix reaches its own devices. The clock must therefore run first against documented compensating controls (constraining untrusted local code, withdrawing or isolating devices that will not receive an updated build) and then against the reboot-bearing update, with that interim state tracked as an open compensating-control item rather than scored as patched within policy.",
+        "evidence": "Packet: cisa_kev true, kev_date 2026-03-03, active_exploitation \"confirmed\", RWEP 77, CVSS 8.8, poc_available true. patch_available true; live_patch_available false; live_patch_notes: \"No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.\" Attack vector: a local foothold escalating privileges on the device, with the packet noting that LPEs of this class are routinely paired with an initial-access primitive.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-patch-management",
+          "AU-Essential-8-Patch"
+        ]
+      }
+    ]
   },
   "CVE-2022-20775": {
     "name": "Cisco SD-WAN Path Traversal Vulnerability",
@@ -12907,7 +13887,41 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "No operator-side action stops this clock except the vendor fix. The credential is built into RP4VMs, so it cannot be rotated, expired or locked out through the appliance's own account management, and every unpatched instance stays authenticable by anyone holding the constant — there is no compensating configuration change that converts this into a lower-urgency item. The KEV window therefore has to be met by deploying the vendor fix with the service restart or reboot the packet says it requires, since the packet registers no live-patch tool for this entry; where that restart cannot be scheduled inside the window, the honest interim control is cutting network reachability to the appliance, not documenting a mitigation.",
+        "evidence": "CWE-798 use of hard-coded credentials; cisa_kev true, kev_date 2026-02-18, active_exploitation confirmed, RWEP 77, CVSS 8.8, poc_available true, patch_available true; live_patch_available false with live_patch_notes 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.'",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "NIS2-Art21-patch-management",
+          "NIST-800-53-SI-2",
+          "ISO-27001-2022-A.8.8"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "The packet's stated impact is not just unauthorized access but root-level persistence on the appliance's underlying operating system, with exploitation confirmed in the wild — so patching in place on an instance that was reachable while unpatched removes the credential and leaves anything installed through it running. For RP4VMs the default response to an instance whose exposure cannot be ruled out has to be configuration export, rebuild from vendor media at the fixed level, and rotation of every credential the appliance held for the virtual-machine estate it serves; patch-in-place is the exception, reserved for instances with demonstrable evidence they were never reachable by an unauthenticated caller. This control's scope is written for perimeter devices, but the triggering shape — pre-authentication root access under confirmed exploitation — is exactly what this appliance presents.",
+        "evidence": "Packet vector: 'Dell RecoverPoint for Virtual Machines (RP4VMs) contains an use of hard-coded credentials vulnerability that could allow an unauthenticated remote attacker to gain unauthorized access to the underlying operating system and root-level persistence.' active_exploitation confirmed, kev_date 2026-02-18, poc_available true, CVSS 8.8, RWEP 77.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-patch-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-054",
+        "name": "BACKUP-TIER-NETWORK-ISOLATION",
+        "description": "Identity controls on this appliance are inert by construction: the credential ships inside the product, so no password policy, account review, privilege assignment or authentication-strength requirement the operator configures can revoke it, and the account it hands out is root on the appliance operating system. The only access control left in operator hands is the network path. The RecoverPoint for Virtual Machines management surface must be reachable from a dedicated operator subnet only and never from the virtual-machine workload networks the product exists to recover, so that possession of the built-in credential does not by itself put an attacker on the appliance — and so that a compromise of a protected workload cannot reach the recovery tier that is supposed to survive it.",
+        "evidence": "CWE-798 hard-coded credentials in Dell RecoverPoint for Virtual Machines (RP4VMs); packet vector states an unauthenticated remote attacker gains 'unauthorized access to the underlying operating system and root-level persistence'; CVSS 8.8, RWEP 77, active_exploitation confirmed, KEV-listed 2026-02-18. The citing gaps include UK-CAF-B2 (Identity and access control) and NIST-800-53-AC-6 (Least Privilege), both of which the embedded credential bypasses entirely.",
+        "gap_closes": [
+          "UK-CAF-B2",
+          "NIST-800-53-AC-6"
+        ]
+      }
+    ]
   },
   "CVE-2020-7796": {
     "name": "Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery Vulnerability",
@@ -13027,7 +14041,39 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-055",
+        "name": "SECURITY-TOOL-INTEGRITY-VERIFICATION",
+        "description": "ThreatSonar is the anti-ransomware product itself, and the defect is that it does not validate the content of files uploaded to it — meaning the crafted-input path runs through the server's normal, expected input path, since ingesting attacker-adjacent artifacts is what the product is for. Bring the security-product estate under the same vulnerability-management SLA as the systems it defends: inventory the ThreatSonar server as patch-managed privileged software, run the KEV clock from the 2026-02-17 listing, and schedule the service restart or reboot the fix requires, since no live patch is registered for this entry. The trust-anchor-inversion test the control names lands directly here — upload a file whose content does not match its declared type to a staging ThreatSonar instance and confirm it is rejected rather than stored and executed. An 'endpoint protection deployed' attestation says nothing about whether the protection server is patched.",
+        "evidence": "The packet's KEV description states that ThreatSonar Anti-Ransomware does not properly validate the content of uploaded files, and that remote attackers with administrator privileges on the product platform can upload malicious files which can be used to execute arbitrary system commands on the server (CWE-434). CISA KEV-listed 2026-02-17 with active_exploitation confirmed; RWEP 77, CVSS 8.8, PoC available. patch_available is true and live_patch_available is false, with the packet recording that the vendor patch typically requires service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-036",
+        "name": "FLEET-CONTROL-PLANE-ADMIN-PRIVILEGE-TIER",
+        "description": "The packet's KEV description puts administrator privileges on the ThreatSonar platform in the exploitation precondition, which makes every path that issues, stores or reuses a console admin credential part of this vulnerability's attack surface. Classify ThreatSonar operators above application admins: a separate identity from any other admin role, FIDO2 step-up per session, just-in-time elevation with an approval workflow, and console access only from a PAM jumphost or privileged access workstation. The effect specific to this flaw is that a credential harvested elsewhere in the estate — the usual route to a console account — cannot be walked straight into the unvalidated upload handler and turned into arbitrary system commands on the anti-ransomware server, and every upload is attributable to an approved elevation rather than to a shared standing login.",
+        "evidence": "The packet's KEV description states that remote attackers with administrator privileges on the product platform can upload malicious files, which can be used to execute arbitrary system commands on the server (CWE-434); CVSS 8.8, RWEP 77, PoC available, active_exploitation confirmed as of the 2026-02-17 KEV listing. NIST SP 800-53 AC-6 (Least Privilege) is among the framework controls the packet records as insufficient for this CVE.",
+        "gap_closes": [
+          "NIST-800-53-AC-6"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-046",
+        "name": "PEN-TEST-SCOPE-INCLUDES-SECURITY-PRODUCTS",
+        "description": "Nothing about this flaw is exotic — an upload handler that does not check file content — yet it persisted in a shipping anti-ransomware product, because assessment scopes treat that product as a defense to be validated rather than a target to be attacked. Write the ThreatSonar server into the scope language by name: its administrative console, its file-upload and artifact-ingest endpoints, and its agent/update channels, with explicit authorization to attempt upload-to-arbitrary-command execution against a staging instance. The distinguishing observation for this entry is the route it took to operators — it surfaced through the KEV feed after in-the-wild use, not through any assessment of the security stack itself, which is what a scope that excludes defensive products guarantees.",
+        "evidence": "The packet records a CWE-434 unrestricted upload of a file with a dangerous type in TeamT5 ThreatSonar Anti-Ransomware, where uploaded file content is not properly validated and uploaded files can be used to execute arbitrary system commands on the server. It carries CISA KEV listing 2026-02-17 with active_exploitation confirmed and a PoC available — i.e. it reached the catalog after exploitation, not before. UK CAF B4 (System security) is among the framework controls the packet records as insufficient here.",
+        "gap_closes": [
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2008-0015": {
     "name": " Microsoft Windows Video ActiveX Control Remote Code Execution Vulnerability",
@@ -13312,7 +14358,39 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "Configuration Manager is the system operators patch everything else with, which is exactly why it tends to sit outside its own SLA — the site server is treated as remediation infrastructure rather than as a remediation target. This CVE is KEV-listed 2026-02-12 with confirmed exploitation and a public PoC, and the packet describes an unauthenticated caller sending crafted requests that end in command execution on the server or its database, so the site server has to be enrolled in the same KEV clock it enforces on managed endpoints. A vendor fix exists; the packet records no live-patch path and notes the vendor patch typically requires a service restart or system reboot, so a maintenance window for the site server itself — not just for the fleet it patches — must be pre-authorised inside the SLA.",
+        "evidence": "Packet fields for CVE-2024-43468 (Microsoft Configuration Manager SQL Injection Vulnerability): cwe_refs CWE-89; cisa_kev=true with kev_date 2026-02-12; active_exploitation=confirmed; poc_available=true; cvss 9.8; rwep_score 77; vector text states an unauthenticated attacker could exploit it by sending specially crafted requests to the target environment which are processed in an unsafe manner, enabling the attacker to execute commands on the server and/or underlying database; patch_available=true; live_patch_available=false with live_patch_notes stating no live-patch tool is registered and that the vendor patch typically requires service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-085",
+        "name": "DB-ABSTRACTION-LAYER-PARAMETERIZATION-VERIFICATION",
+        "description": "The injectable path on Configuration Manager is reached without credentials — the packet describes crafted requests processed in an unsafe manner by the server — so the two assumptions operators normally lean on for this product ('the site server is on the internal network' and 'a WAF fronts the client-facing endpoints') are both untested inferences, and neither is evidence that a query is bound rather than concatenated. The control requires parameterization to be proven at the query layer for every request handler that accepts client-originated content, and re-proven after each site-server update, rather than inferred from upstream input validation. The distinguishing test: from an unauthenticated host that can reach the site server's request-handling endpoints on a staging hierarchy, submit request fields carrying SQL metacharacters and confirm the value is passed as a bound parameter rather than becoming part of the statement — a hierarchy that passes an application-firewall audit while a handler concatenates client-supplied content still yields command execution on the server and the database behind it.",
+        "evidence": "Packet fields for CVE-2024-43468: cwe_refs CWE-89; attack_vector states SQL injection on Microsoft Configuration Manager escalating to unauthenticated remote code execution; vector text states an unauthenticated attacker sends specially crafted requests processed in an unsafe manner, enabling execution of commands on the server and/or underlying database; cvss 9.8; active_exploitation=confirmed; poc_available=true.",
+        "gap_closes": [
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-078",
+        "name": "ENDPOINT-MGMT-DEPLOYMENT-CHANNEL-INTEGRITY",
+        "description": "Configuration Manager is the fleet's software-deployment control plane, and this CVE hands an unauthenticated attacker command execution on that server and its database — the same authority the product legitimately uses to push packages, scripts and updates to every managed endpoint, which is why a single unauthenticated request here is a fleet-wide code-execution primitive rather than one compromised host. The control requires the deployment channel to be integrity-monitored independently of the site server itself: alert on deployment objects, scripts and task sequences that appear without a matching sanctioned admin action, and land that audit trail on a collector the site server cannot rewrite, so a foothold on the server cannot quietly launder itself into signed-looking fleet distribution. It also sets the post-remediation obligation the patch does not: any window in which a site server ran the vulnerable build while exposed must be treated as fleet-wide code-execution exposure and everything deployed during it reviewed — patching closes the entry point but says nothing about what the deployment channel did while it was open.",
+        "evidence": "Packet fields for CVE-2024-43468: vector text states the unauthenticated attacker can execute commands on the server and/or underlying database of Microsoft Configuration Manager; active_exploitation=confirmed; cisa_kev=true with kev_date 2026-02-12; poc_available=true; rwep_score 77; cvss 9.8; patch_available=true with live_patch_available=false.",
+        "gap_closes": [
+          "NIST-800-53-AC-6"
+        ]
+      }
+    ]
   },
   "CVE-2025-15556": {
     "name": "Notepad++ Download of Code Without Integrity Check Vulnerability",
@@ -13432,7 +14510,30 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "A help-desk portal is normally reachable by the people it serves, including from outside the corporate network, so an unauthenticated bypass on Web Help Desk is exploitable from the same anonymous position the deployment is designed to accept — there is no 'internal only' fallback posture to hold while a routine change window is scheduled. Start the clock at the KEV listing rather than at the next patch cycle: inventory every Web Help Desk instance including staging, disaster-recovery and departmental copies that share the same exposure, apply the vendor update, and book the service restart the packet's requiredAction implies inside that same window. An instance that has the fix staged but has not been restarted must not be recorded as remediated.",
+        "evidence": "Packet: CWE-693 security-control bypass on SolarWinds Web Help Desk that 'could allow an unauthenticated attacker to gain access to certain restricted functionality'; cisa_kev true, kev_date 2026-02-12, active_exploitation 'confirmed', poc_available true, cvss 8.8, rwep_score 77. patch_available true; live_patch_available false, with live_patch_notes 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.'",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-018",
+        "name": "SCANNER-PAPER-COMPLIANCE-TEST",
+        "description": "A protection-mechanism failure means the product's security control was present and did answer — it simply did not stop the request — so an access-control attestation and a version-based scanner verdict can both be truthful while the restricted functionality is reachable by anyone. Verification has to be behavioural rather than declarative: from an unauthenticated client against a staging Web Help Desk instance, request each restricted function the bypass reached and confirm it is refused before the function executes, then re-run the same probe after the update instead of accepting the build number as proof. An audit that records 'Web Help Desk authenticates its users' or 'Web Help Desk is on the fixed build' without that probe cannot tell an enforced control from a bypassed one, which is the exact state this CVE describes.",
+        "evidence": "Packet: CWE-693 protection-mechanism failure letting an unauthenticated attacker bypass an intended security control to reach protected functionality; active_exploitation 'confirmed' with CISA KEV listing 2026-02-12 and poc_available true. The framework gaps already citing this CVE include UK-CAF-B2 (identity and access control) and ISO-27001-2022-A.8.8 (management of technical vulnerabilities) — the two controls an operator can satisfy on paper while the bypass works.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "UK-CAF-B2"
+        ]
+      }
+    ]
   },
   "CVE-2026-21513": {
     "name": "Microsoft MSHTML Framework Protection Mechanism Failure Vulnerability",
@@ -13487,7 +14588,40 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-041",
+        "name": "PROTECTION-MECHANISM-FAILURE-CLASS-REGRESSION",
+        "description": "The flaw here is in the protection mechanism itself — MSHTML fails to apply the Mark-of-the-Web / trust check, so attacker-controlled content renders without the warning the rest of the endpoint hardening posture assumes is present. Verifying this fix therefore means re-running the whole MOTW/trust battery against MSHTML-rendered content after the update lands (mark propagation, zone-of-origin handling, prompt-on-execute for internet-sourced content), not confirming that the single reported bypass path is closed. An application-hardening attestation is only as strong as the last end-to-end test of the primitive it depends on, and this CVE is the demonstration that the primitive can silently stop working while every hardening setting still reads as enabled. Make the class battery a standing step of patch deployment on the affected estate.",
+        "evidence": "Packet: protection-mechanism failure (CWE-693) in the Microsoft MSHTML framework that bypasses the Mark-of-the-Web / trust protection, letting attacker-controlled content run without the expected security warning; the KEV vector describes an unauthorized attacker bypassing a security feature over a network. cisa_kev true, kev_date 2026-02-10, active_exploitation confirmed, poc_available true, RWEP 77, CVSS 8.8.",
+        "gap_closes": [
+          "AU-Essential-8-App-Hardening",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-120",
+        "name": "DOWNLOAD-PROVENANCE-ENFORCEMENT",
+        "description": "Because this bug suppresses the warning rather than corrupting memory, any posture that leans on the user seeing a prompt — or on a reputation verdict rendered at the same moment — is leaning on exactly what the flaw disables. Provenance has to be enforced by policy on the affected estate instead: block execution of internet-sourced shortcuts, installers and script hosts by rule, independent of whether the Mark-of-the-Web marking survived and independent of any reputation service outcome, so content delivered through the MSHTML path is refused even when it is never evaluated. This is also what closes the least-privilege gap for this CVE: the bypassed content runs in the user's own context, so removing administrative rights does not stop it — the enforcement point has to be what the user's own process is permitted to execute.",
+        "evidence": "Packet: protection-mechanism failure (CWE-693) in Microsoft MSHTML bypassing Mark-of-the-Web / trust protection so attacker-controlled content runs without the expected security warning, reachable over a network by an unauthorized attacker. cisa_kev true, kev_date 2026-02-10, active_exploitation confirmed, poc_available true, RWEP 77.",
+        "gap_closes": [
+          "AU-Essential-8-App-Hardening",
+          "NIST-800-53-AC-6"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "For most endpoint CVEs the interval between disclosure and deployment is implicitly covered by the platform's trust prompts and user caution. This entry removes that cover — the entire defect is that the warning does not fire — so the unpatched window carries no residual endpoint-side compensating control, and the deployment clock has to run from the KEV listing rather than the next scheduled update ring. The packet records no live-patch path, so remediation is the vendor update plus the restart the KEV requiredAction implies; hosts that cannot take it inside the SLA need the provenance-enforcement block recorded as an explicit, time-bound compensating control, not counted as patched-per-policy.",
+        "evidence": "Packet: cisa_kev true, kev_date 2026-02-10, active_exploitation confirmed, poc_available true; patch_available true with live_patch_available false, and live_patch_notes stating no live-patch tool is registered and that the vendor patch typically requires service restart or system reboot per the KEV requiredAction. RWEP 77, CVSS 8.8; protection-mechanism failure (CWE-693) bypassing Mark-of-the-Web / trust protection.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-patch-management",
+          "ISO-27001-2022-A.8.8"
+        ]
+      }
+    ]
   },
   "CVE-2026-21525": {
     "name": "Microsoft Windows NULL Pointer Dereference Vulnerability",
@@ -13707,7 +14841,21 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "Managed Windows desktops running the affected Desktop Window Manager component must be driven to the vendor fix on a KEV-tied clock rather than the monthly workstation-patch cadence, because the elevation is already being exploited and any local foothold on a user's desktop — a phished document, a commodity loader, a compromised standard-user session — converts into elevated execution on that endpoint. The packet records no live-patch path for this entry and the vendor fix takes effect only after the service restart or reboot the KEV requiredAction calls for, so the SLA clock must be measured to completed-restart per endpoint, not to package-deployed: a fleet dashboard showing 100% deployed with user-deferred reboots is still fully exploitable, and reboot deferral on a desktop estate is the norm rather than the exception.",
+        "evidence": "Packet fields for CVE-2026-21519: cisa_kev true, kev_date 2026-02-10, active_exploitation confirmed, rwep_score 77, cvss 8.8, poc_available true, cwe_refs CWE-843. patch_available true, live_patch_available false, live_patch_notes \"No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.\" Product statement in the packet vector: \"Microsoft Desktop Windows Manager contains a type confusion vulnerability that could allow an authorized attacker to elevate privileges locally.\"",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management",
+          "NIST-800-53-SI-2"
+        ]
+      }
+    ]
   },
   "CVE-2026-21514": {
     "name": "Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision Vulnerability",
@@ -14242,7 +15390,38 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-058",
+        "name": "CLOUD-CONTROL-PLANE-CROSS-TENANT-CLAIM-VALIDATION",
+        "description": "The packet describes an attacker holding their own FortiCloud account and a registered device logging into devices registered to other accounts wherever FortiCloud SSO authentication is enabled — the SSO assertion is honoured without being bound to the account the target device belongs to, which is a cross-account claim-validation failure in the vendor's cloud identity plane rather than a flaw on any one appliance. The operator-actionable half is the monitoring half: on FortiAnalyzer, FortiManager, FortiOS and FortiProxy units with FortiCloud SSO enabled, cloud-SSO administrative logins must be logged and reviewed for actors with no relationship to the device, because a successful bypass produces an authorized-looking login and no other artifact.",
+        "evidence": "Packet vector: 'Fortinet FortiAnalyzer, FortiManager, FortiOS, and FortiProxy contain an authentication bypass using an alternate path or channel that could allow an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices.' cwe_refs CWE-288; CVSS 9.1; cisa_kev true, kev_date 2026-01-27, active_exploitation 'confirmed'.",
+        "gap_closes": [
+          "UK-CAF-B2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-PERIMETER-VPN-AUTH-BYPASS-EXPEDITED-PATCH",
+        "name": "PERIMETER-VPN-GATEWAY-AUTH-BYPASS-EXPEDITED-REMEDIATION",
+        "description": "FortiOS and FortiProxy are the authentication enforcement point for the perimeter, so an authentication bypass on them is not an appliance-patch-window item — it is the enforcement point failing open. The packet gives a vendor patch with no live-patch path and a restart-or-reboot requirement, so the expedited clock has to run from the 2026-01-27 KEV listing through the reboot of every affected FortiAnalyzer, FortiManager, FortiOS and FortiProxy unit. Because the packet names FortiCloud SSO authentication being enabled on the device as the condition under which the bypass works, interim exposure is bounded by enumerating which units have that path enabled and restricting reachability of their administrative surfaces until the reboot completes.",
+        "evidence": "Packet name: 'Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability'; cwe_refs CWE-288; CVSS 9.1, RWEP 77; cisa_kev true, kev_date 2026-01-27, active_exploitation 'confirmed', poc_available true; patch_available true, live_patch_available false, live_patch_notes: 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.'",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-network-security"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-036",
+        "name": "FLEET-CONTROL-PLANE-ADMIN-PRIVILEGE-TIER",
+        "description": "Two of the four affected products, FortiManager and FortiAnalyzer, are fleet control planes for the firewall estate, so one bypassed login reaches the configuration and logs of every device they manage. This control is exactly what the vulnerable path collapses: it requires control-plane administration to run on an identity separate from any other admin role, with per-session step-up and jumphost-only access, whereas here a cloud account created for one operator's device becomes an administrative login on another operator's. Frameworks that classify FortiManager and FortiAnalyzer administrators as ordinary network admins carry no rule against wiring that tier to an internet-facing cloud SSO in the first place.",
+        "evidence": "Packet vector names FortiAnalyzer and FortiManager among the affected products and describes logging 'into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices'; cwe_refs CWE-288; citing gaps include NIST-800-53-AC-6 (Least Privilege) and UK-CAF-B2 (Identity and access control).",
+        "gap_closes": [
+          "NIST-800-53-AC-6"
+        ]
+      }
+    ]
   },
   "CVE-2018-14634": {
     "name": "Linux Kernel Integer Overflow Vulnerability (CVE-2018-14634)",
@@ -14357,7 +15536,32 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "For SmarterMail the remediation clock has to start at the 2026-01-26 KEV listing and drive the fixed SmarterTools build onto every internet-facing mail node within hours, not at the next mail-maintenance window. Because the upload path is reachable before authentication, no mailbox password policy, MFA rollout, or admin-permission review buys time while the SLA runs — the only thing that shortens exposure is the build going live. No live-patch path exists for this entry, so the SLA definition must include the service restart or reboot the vendor fix needs to take effect: a mail host with the fixed installer staged but the SmarterMail service still running old code must count as unremediated, not as patched-per-SLA.",
+        "evidence": "The packet records CISA KEV listing on 2026-01-26 with active_exploitation \"confirmed\", RWEP 83, CVSS 9.8 and poc_available true, against an unrestricted upload of file with dangerous type (CWE-434) that lets an unauthenticated attacker \"upload arbitrary files to any location on the mail server, potentially enabling remote code execution\". patch_available is true, live_patch_available is false, and live_patch_notes state the vendor patch typically requires a service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-handling"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "The durable artifact of exploiting this flaw is a file the attacker chose the location of on the mail server's filesystem — a web shell or equivalent — so upgrading SmarterMail closes the upload endpoint and removes nothing the attacker already wrote. Any SmarterMail instance that was internet-reachable while unpatched must be handled as compromised until proven otherwise: export and preserve configuration for forensics, rebuild the host from known-good media instead of upgrading in place, and rotate every credential the mail service could reach — service accounts, administrator and mailbox passwords, API keys and smart-host/relay credentials — because arbitrary file write on the mail server implies code execution on the host that stores them. Anti-malware on the mail host is not the deciding control: an attacker-supplied handler file placed at an attacker-chosen path is not reliably a signatured object.",
+        "evidence": "The packet describes CWE-434 allowing an unauthenticated attacker to write arbitrary files anywhere on the mail server for code execution (\"e.g. a web shell\"), with active_exploitation \"confirmed\", poc_available true, and a KEV listing dated 2026-01-26 — so pre-patch exposure windows must be assumed to have been exercised. CIS Controls v8 10.1 (anti-malware) is one of the framework controls this entry already cites as insufficient.",
+        "gap_closes": [
+          "CIS-Controls-v8-10.1",
+          "NIST-800-53-SI-2",
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2026-23760": {
     "name": "SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability",
@@ -14592,7 +15796,30 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "A KEV clock on this entry is a clock on the entire virtual estate, not on one server: vCenter is the management plane for every host and VM registered to it, so the blast radius of the recorded remote code execution is the virtualization control plane rather than a single application host. The reachable surface is the DCE/RPC implementation, which processes packets before authentication — so 'only administrators use vCenter' does not bound exposure; anything with network access to the vCenter service does. The packet records no live-patch path and a vendor fix that requires a service restart or reboot, which is the real obstacle for this asset class: vCenter restarts are typically held behind virtualization change freezes. The SLA must therefore pre-authorize the vCenter restart as part of the KEV response rather than queueing it behind the next maintenance window, and any window that cannot be met must be recorded as unremediated exposure with the DCE/RPC surface restricted in the interim.",
+        "evidence": "CISA KEV-listed 2026-01-23 with active_exploitation 'confirmed' and poc_available true; CVSS 9.8, RWEP 77. The catalog vector records that vCenter Server 'contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. This could allow a malicious actor with network access to vCenter Server to send specially crafted network packets, potentially leading to remote code execution.' patch_available is true, live_patch_available is false, and live_patch_notes reads: 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.'",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "APPSERVER-REMOTING-PROTOCOL-RESTRICTION",
+        "name": "APPSERVER-REMOTING-PROTOCOL-RESTRICTION",
+        "description": "vCenter's DCE/RPC listener is exactly the binary remoting-protocol class this control governs: a non-HTTP protocol endpoint that answers before authentication and whose parser is itself the vulnerable code, so the perimeter firewall and the web-tier hardening that most vCenter deployments are audited against never touch it. The requirement for this deployment is that DCE/RPC on vCenter accepts connections only from hosts that legitimately speak it — management and jump networks and the hosts vCenter administers — enforced by network ACL or host firewall rather than assumed from 'vCenter is internal', and that a KEV-listed defect in that parser is patched on an accelerated clock with the service restart taken rather than folded into the next quarterly virtualization window. The distinguishing test for this product: from a general user or workstation VLAN on a staging deployment, send crafted DCE/RPC packets at vCenter and confirm they are dropped before reaching the listener — an estate that passes vCenter role-and-permission audits while leaving the DCE/RPC port reachable from any internal segment is still exposed to the unauthenticated packet path.",
+        "evidence": "The catalog attack_vector records 'an out-of-bounds write (CWE-787) in the vCenter Server DCE/RPC protocol implementation, exploitable by an unauthenticated attacker for remote code execution', and the vector states the trigger is 'a malicious actor with network access to vCenter Server' sending 'specially crafted network packets' — network reach to the protocol endpoint is the sole precondition. KEV-listed 2026-01-23, active_exploitation 'confirmed', poc_available true, CVSS 9.8, RWEP 77. The gaps this entry cites include NIS2 Art. 21 security of network and information systems and UK CAF B4 system security.",
+        "gap_closes": [
+          "NIS2-Art21-network-security",
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2025-68645": {
     "name": "Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability",
@@ -15654,15 +16881,38 @@
         "adequate": false,
         "gap": "The 30-day critical-patch window is exploitation acceptance for an internet-facing application in or adjacent to the CDE (SAP/Oracle EBS sit adjacent to financial data); WAF coverage is partial mitigation, not remediation."
       }
-    },
-    "compliance_exposure_score": {
-      "percent_audit_passing_orgs_still_exposed": 75,
-      "basis": "Internet-facing OSGeo GeoServer is run by audited organizations on a standard patch SLA and is mass-exploited within days; the required web-shell hunt, secret rotation, or egress/XXE hardening is rarely part of the documented patch procedure.",
-      "theater_pattern": "patch_management"
-    },
-    "ai_discovered_zeroday": false,
-    "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    },
+    "compliance_exposure_score": {
+      "percent_audit_passing_orgs_still_exposed": 75,
+      "basis": "Internet-facing OSGeo GeoServer is run by audited organizations on a standard patch SLA and is mass-exploited within days; the required web-shell hunt, secret rotation, or egress/XXE hardening is rarely part of the documented patch procedure.",
+      "theater_pattern": "patch_management"
+    },
+    "ai_discovered_zeroday": false,
+    "ai_discovery_source": "vendor_research",
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "GeoServer entered CISA KEV on 2025-12-11 with confirmed exploitation and a public PoC and a fix exists, so the KEV clock governs. Two properties of this deployment break the routine application-patch cadence: a GeoServer instance is usually an internet-facing map service owned by a GIS or data team rather than by the pipeline that patches the rest of the estate, and the entry records no live-patch path with a fix that requires a service restart per the KEV requiredAction. The SLA must therefore name an accountable owner for each GeoServer instance and pre-authorize the restart, because the vulnerable operation is reachable without authentication — every hour of deferral is an hour in which an unauthenticated caller can read server-side files, including the service's own configuration, and coerce requests from the server.",
+        "evidence": "OSGeo GeoServer XML external entity flaw (CWE-611) allowing an unauthenticated attacker to read server files and coerce server-side requests; the entry names the surface as XML input to /geoserver/wms, operation GetMap. CISA KEV-listed 2025-12-11 with active_exploitation=confirmed, poc_available=true, RWEP 77, CVSS 8.8. patch_available=true, live_patch_available=false, with a vendor patch that typically requires service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-025",
+        "name": "CONFIGURATION-SIDE-LIVE-PATCH-INVENTORY",
+        "description": "The exposed surface for this CVE is narrow and named — XML input to /geoserver/wms on the GetMap operation — which means a filtering path in front of the service can shorten the exposure window on a much shorter clock than the restart the vendor fix requires. Rejecting request bodies that carry DOCTYPE or external-entity declarations to that endpoint, or removing its anonymous reachability, is deployable without taking the map service down. What the control demands is that this path be inventoried, staged and rehearsed before a disclosure rather than improvised during one. Because the entry records no live-patch capability for GeoServer and a fix gated behind a service restart, the request-filtering route is the only lever an operator has between the 2025-12-11 KEV listing and whenever the restart window opens — and a vulnerability-management programme that recognises only the vendor-patch path will report that interval as unmitigated because it has nothing else to record.",
+        "evidence": "The entry states the flaw occurs when the application accepts XML input through a specific endpoint, /geoserver/wms operation GetMap, and that an attacker can define external entities within the XML request; exploitation is unauthenticated. live_patch_available=false and the vendor patch typically requires service restart or system reboot per the KEV requiredAction. CISA KEV-listed 2025-12-11, active_exploitation=confirmed, poc_available=true.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2025-6218": {
     "name": "RARLAB WinRAR Path Traversal Vulnerability",
@@ -16297,7 +17547,33 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-057",
+        "name": "BROWSER-MANAGED-UPDATE-NO-DEFERRAL",
+        "description": "This bug is reached by any page the browser renders, so exposure is every browsing session until the fixed build is the one actually executing. Staged rollout percentages, pilot-ring soak periods, and admin-set update deferral on Chrome/Edge and other Chromium-derived browsers must be overridden for the security channel: push to the whole fleet at once and force the relaunch rather than waiting for the user to close their windows. The packet shows no live-patch path, so the update only takes effect on restart — an endpoint that has downloaded the fixed build but has not relaunched is still running the vulnerable V8 and must be reported as exposed, not as updated. Fleet reporting therefore has to key on the running browser version, not on update-channel assignment.",
+        "evidence": "The packet records a type confusion (CWE-843) in V8 \"exploitable by an attacker-controlled web page for code execution in the renderer\", CISA KEV-listed 2025-11-19 with active_exploitation \"confirmed\", poc_available true, CVSS 8.8, RWEP 77. patch_available is true, live_patch_available is false, and live_patch_notes state the vendor patch typically requires a service restart or system reboot per the KEV requiredAction. The packet also notes browser zero-days of this class are typically used in targeted-spyware or watering-hole chains.",
+        "gap_closes": [
+          "AU-Essential-8-App-Hardening",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management",
+          "NIST-800-53-SI-2",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "Browsers are routinely excluded from vulnerability-management SLAs on the assumption that they update themselves, so a KEV listing against Chromium lands on software no SLA is tracking. This entry has to be booked as a KEV item with a named owner and a deadline anchored to 2025-11-19, and the compliance evidence must be a count of endpoints still running a pre-fix V8 build at each checkpoint — not a screenshot of the update policy. Stragglers that cannot relaunch inside the window (kiosk, shared-session, or change-frozen hosts) need a documented compensating action for the delivery path, since the exploit arrives as ordinary web content rather than as an installed file.",
+        "evidence": "The packet records CISA KEV listing on 2025-11-19 with active_exploitation \"confirmed\", RWEP 77, CVSS 8.8, poc_available true, patch_available true and live_patch_available false. NIST SP 800-53 SI-2 (Flaw Remediation), ISO/IEC 27001:2022 A.8.8 and NIS2 Art. 21 patch management are the framework controls this entry already cites as insufficient.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management",
+          "NIST-800-53-SI-2"
+        ]
+      }
+    ]
   },
   "CVE-2025-58034": {
     "name": "Fortinet FortiWeb OS Command Injection Vulnerability",
@@ -16477,7 +17753,21 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "The exposure here is a provisioning-state defect, not an install-window one: the packet's vector text records that Triofox's initial setup pages stay reachable after setup is complete, so every already-provisioned server is affected for its whole service life and an unauthenticated caller reaches functionality reserved for authorized users. That places the KEV clock (listed 2025-11-12, exploitation confirmed) on production instances operators consider finished and therefore out of the active change queue — the SLA has to reach 'completed' deployments, not just ones under build. A vendor fix exists; the packet records no live-patch path and notes the vendor patch typically requires a service restart or system reboot, so restart authority must be pre-approved inside the window rather than negotiated after it. Because the flaw grants access rather than degrading the service, meeting this SLA means verifying the remediated state of each server — confirming the setup surface is no longer reachable unauthenticated — not recording a build number and closing the ticket.",
+        "evidence": "Packet fields for CVE-2025-12480 (Gladinet Triofox Improper Access Control Vulnerability): cwe_refs CWE-284; cisa_kev=true with kev_date 2025-11-12; active_exploitation=confirmed; poc_available=true; cvss 8.8; rwep_score 77; vector text states the product allows access to initial setup pages even after setup is complete; attack_vector states an unauthenticated attacker can reach functionality reserved for authorized users; patch_available=true; live_patch_available=false with live_patch_notes stating no live-patch tool is registered and that the vendor patch typically requires service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      }
+    ]
   },
   "CVE-2025-62215": {
     "name": "Microsoft Windows Race Condition Vulnerability",
@@ -18797,7 +20087,30 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-030",
+        "name": "PERIMETER-DEVICE-ZERODAY-SLA-TIER",
+        "description": "The exposed surface here is the SNMP subsystem of IOS and IOS XE, and the packet's fix path requires a device restart or reload — on routing and switching gear that means a change window measured in weeks under the routine cadence, while a low-privileged attacker can already force the reload as a denial of service and a high-privileged one can execute code as root. This control requires the alternative to be exercised on the KEV clock instead of waiting: restrict the SNMP listener to a management ACL and trusted collectors, or take SNMP out of service on exposed devices, within hours of listing, because that is the only action that closes the reachable path before the reload window arrives. The citing gaps frame this as operating-system patching; the device is the network's trust boundary and its management protocol is the exposed interface, so it needs its own SLA tier with interface isolation as a first-class satisfying action.",
+        "evidence": "Packet: cisa_kev true, kev_date 2025-09-29, active_exploitation \"confirmed\", RWEP 77, CVSS 9.8, poc_available true, CWE-121. Vector: \"Cisco IOS and IOS XE contains a stack-based buffer overflow vulnerability in the Simple Network Management Protocol (SNMP) subsystem that could allow for denial of service or remote code execution. A successful exploit could allow a low-privileged attacker to cause the affected system to reload, resulting in a DoS condition, or allow a high-privileged attacker to execute arbitrary code as the root user and obtain full control of the affected system.\" patch_available true; live_patch_available false; live_patch_notes: \"No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.\"",
+        "gap_closes": [
+          "NIS2-Art21-network-security",
+          "UK-CAF-B4",
+          "AU-Essential-8-Patch"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "The packet's high-privilege path ends in arbitrary code as the root user with full control of the device, and exploitation is confirmed in the wild — so for any IOS or IOS XE device whose SNMP surface was reachable during the exposure window, loading the fixed image remediates the flaw but not the device. The runbook must default to exporting and diffing the running and startup configuration against a known-good baseline, rebuilding from a verified image, and rotating every credential the device held (its SNMP credentials, local and privileged-mode secrets, and any AAA or routing-protocol keys stored on it) before returning it to service. Reloading into the patched image and closing the ticket preserves whatever a root-level attacker changed on the box, which is precisely what the SI-2 and A.8.8 flaw-remediation gaps score as remediated.",
+        "evidence": "Packet: cisa_kev true, kev_date 2025-09-29, active_exploitation \"confirmed\", RWEP 77, CVSS 9.8, poc_available true. Vector states a high-privileged attacker can \"execute arbitrary code as the root user and obtain full control of the affected system,\" and a low-privileged attacker can cause the system to reload for a DoS condition; the attack_vector summary records the flaw as exploitable for denial of service and remote code execution. patch_available true; live_patch_available false; live_patch_notes: \"No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.\"",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "ISO-27001-2022-A.8.8"
+        ]
+      }
+    ]
   },
   "CVE-2021-21311": {
     "name": "Adminer Server-Side Request Forgery Vulnerability",
@@ -19387,7 +20700,39 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-121",
+        "name": "MOBILE-ZERO-CLICK-HARDENING",
+        "description": "WhatsApp's linked-device synchronization path causes the target handset to fetch and process content from an attacker-named URL with no action by the target, so no awareness, phishing-report or attachment-scanning control has anything to act on. For high-risk users (journalists, executives, legal, activist-adjacent contacts) the pre-patch control is to stop the handset from automatically retrieving and rendering message-delivered content: enable the platform's reduced-attack-surface mode (Lockdown Mode on Apple devices and the equivalent hardening on Android), turn off automatic media download and link previews in the messaging client, and — because this flaw rides the linked-device sync channel specifically — audit each account's linked-device list on a schedule and unlink any session the user does not recognise. This closes the delivery step rather than the memory-corruption step: the chained Apple ImageIO flaw only gets its input once the attacker-named content has been fetched.",
+        "evidence": "Packet: CWE-863 incorrect authorization arising from incomplete authorization of linked-device synchronization messages, which 'could allow an unrelated user to trigger processing of content from an arbitrary URL on a target's device'; characterised as the zero-click delivery half of a mobile-spyware chain, paired in the wild with CVE-2025-43300. cisa_kev true, kev_date 2025-09-02, active_exploitation 'confirmed', poc_available true, cvss 8.8, rwep_score 77.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-056",
+        "name": "MOBILE-ENDPOINT-MDM-ENFORCED-KEV-SLA",
+        "description": "WhatsApp is a consumer-store application updated on the user's own schedule, which is precisely the class of software that falls outside an OS-centric patch programme — the fixed client reaches most handsets only when the user next opens the app store. A managed fleet must treat the fixed WhatsApp build as an MDM/UEM-pushed, deferral-disallowed update on the KEV clock: forced app update and managed-app configuration on corporate-owned devices, and a conditional-access block that denies organisational data to BYOD handsets still reporting a vulnerable build. The paired Apple flaw must be pushed on the same clock, since the two halves of this chain ship from different vendors through different update channels and a fleet that closes only one of them is still chainable.",
+        "evidence": "Packet: patch_available true; live_patch_available false, with live_patch_notes 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction' — so deploying the vendor-fixed build is the only remediation this entry records. cisa_kev true, kev_date 2025-09-02, active_exploitation 'confirmed'. The chained flaw named in the packet, CVE-2025-43300, is an Apple issue, i.e. a separate vendor's update channel from the messaging client.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-043",
+        "name": "NATION-STATE-INITIAL-ACCESS-IR-ESCALATION",
+        "description": "A zero-click compromise of this kind produces no user-reportable artefact — nothing was clicked, nothing was opened — so it enters incident response only through a vendor threat notification or an anomalous linked-device entry, and commodity handling ('reinstall the app, reset the phone') destroys the evidence while leaving the second-stage implant unexamined. The runbook needs an explicit targeted-intrusion path triggered by that signal rather than by an actor name: preserve and image the handset before any update, wipe or re-enrolment; contact the target out-of-band on a different device; treat every account, token and credential reachable from that handset as exposed across the responder-established exposure window; and proceed on the assumption that the chained content-processing stage succeeded, rather than requiring proof of it before escalating.",
+        "evidence": "Packet: active_exploitation 'confirmed' with CISA KEV listing 2025-09-02 and poc_available true; the entry is described as the zero-click delivery half of a mobile-spyware chain paired in the wild with CVE-2025-43300, and exploitation requires no interaction from the target (an unrelated user triggers the processing). NIS2-Art21-incident-handling is among the framework gaps that already cite this CVE as evidence.",
+        "gap_closes": [
+          "NIS2-Art21-incident-handling"
+        ]
+      }
+    ]
   },
   "CVE-2025-57819": {
     "name": "Sangoma FreePBX Authentication Bypass Vulnerability",
@@ -20322,7 +21667,40 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "Cisco ISE and ISE-PIC nodes must be driven to the fixed release on a KEV-tied clock measured in hours, not on the estate's routine appliance-maintenance cadence. The flaw is reached pre-authentication through a crafted API request and yields root on the box that arbitrates network admission, so the exposure is not confined to the appliance: while it stands, an anonymous caller owns the RADIUS/TACACS+ policy decision point. Because no live-patch primitive is registered for this entry, the fix is a vendor patch that takes a service restart or reboot, which means the restart window has to be pre-authorized against the KEV clock rather than negotiated after the listing. Any ISE node that cannot be patched inside the SLA must have its API surface restricted to management networks as an interim measure and be recorded as unremediated, not as 'scheduled'.",
+        "evidence": "Packet: CISA KEV-listed 2025-07-28 with active_exploitation=confirmed; CVSS 9.8, RWEP 77, poc_available=true. The vector records an injection flaw in a specific API of Cisco ISE and Cisco ISE-PIC caused by insufficient validation of user-supplied input, exploitable by submitting a crafted API request, with successful exploitation allowing remote code execution and root privileges on an affected device (CWE-74); the attack_vector records the code execution as unauthenticated. patch_available=true, live_patch_available=false, and live_patch_notes state the vendor patch typically requires service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "An ISE node that was reachable while unpatched must be treated as compromised rather than merely vulnerable. Because the defect runs attacker code as root before authentication, the default response is configuration export, rebuild from vendor media, and rotation of every secret the node holds — RADIUS and TACACS+ shared secrets, the directory join credential, administrator and API accounts, and certificate material — instead of applying the update to the running appliance. Patch-in-place closes the API defect while leaving any root-level implant, attacker-added admin account, or exported policy database untouched, and the restart the patch itself requires is easily mistaken for evidence that the node came back clean.",
+        "evidence": "Packet: active_exploitation=confirmed with a CISA KEV listing dated 2025-07-28 and poc_available=true, so exposure of an unpatched node is an exploitation opportunity rather than a theoretical one (RWEP 77, CVSS 9.8). The vector states successful exploitation allows an attacker to perform remote code execution and obtain root privileges on an affected device via a crafted API request; the attack_vector records that execution as unauthenticated. patch_available=true and live_patch_available=false — the packet's only remediation is a vendor patch requiring a service restart or system reboot, so the outage a rebuild needs is already budgeted by the remediation itself.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-patch-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-037",
+        "name": "FLEET-COMPROMISE-IR-PLAYBOOK",
+        "description": "Root on ISE is root on the identity decision point for every endpoint the network admits, so the playbook has to extend past the appliance itself: invalidate device trust state and posture verdicts issued during the exposure window, revoke and re-issue certificates the deployment enrolled or vouched for, audit policy-set and authorization-profile changes made since the KEV listing date, define quarantine criteria for endpoints admitted under a policy that may have been rewritten, and rotate credentials for every administrator and service account that authenticated through the affected deployment. Without that downstream sweep the operator patches the node and leaves the attacker's admission decisions and enrolled endpoints in force.",
+        "evidence": "Packet: the vector records an injection flaw reached through a crafted API request to a specific API of Cisco Identity Services Engine and ISE-PIC, allowing remote code execution and root privileges on an affected device; the attack_vector records it as unauthenticated code execution on Cisco ISE. active_exploitation=confirmed, CISA KEV-listed 2025-07-28, poc_available=true, RWEP 77, CVSS 9.8 — the interval from that listing date to patch deployment is the window whose identity decisions need review.",
+        "gap_closes": [
+          "UK-CAF-B2"
+        ]
+      }
+    ]
   },
   "CVE-2025-20281": {
     "name": "Cisco Identity Services Engine Injection Vulnerability (variant: CVE-2025-20281)",
@@ -22142,7 +23520,38 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "MOBILE-OS-MINIMUM-PATCH-LEVEL-ENFORCEMENT",
+        "name": "MOBILE-OS-MINIMUM-PATCH-LEVEL-ENFORCEMENT",
+        "description": "An operator cannot remediate this flaw in place — the incorrect-authorization defect is in the Qualcomm chipset's GPU driver, so it closes only when the handset is running a build that carries the vendor fix. The enforcing control is therefore a minimum device security-patch level as a condition of access to organizational data, not as a reported attribute: the MDM/EMM must read each enrolled device's patch level, block or quarantine devices below the level carrying the Qualcomm fix, and — because the unauthorized GPU command sequence has to be issued by code already running on the device — constrain side-loaded and untrusted app installation on devices that cannot yet update. The distinguishing test: enroll a device pinned below the fixing patch level and confirm policy denies it access to protected resources; if the only outcome is a stale-patch-level row on a dashboard, the estate is attesting patch management it is not enforcing.",
+        "evidence": "Packet: incorrect authorization (CWE-863) in the Qualcomm Adreno GPU driver across multiple Qualcomm chipsets, allowing unauthorized GPU command execution in the GPU micronode while executing a specific sequence of commands, corrupting memory to escalate privilege; exploited in the wild in Android targeted chains. patch_available true, live_patch_available false, and live_patch_notes records that no live-patch tool is registered and the vendor patch typically requires service restart or system reboot per the KEV requiredAction — remediation lands only when the device itself updates and restarts. RWEP 77, CVSS 8.8, poc_available true.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "The remediation clock for this entry must run from the KEV listing date, not from an internal severity triage of a chipset advisory the organization cannot act on directly. Because the fix is device-resident, 'mitigation deployed' has to be evidenced per handset — the count of devices confirmed on a fixed build and restarted — rather than as a single closed advisory ticket. The packet records no live-patch path for this CVE, so there is no in-place option that avoids the restart; devices that cannot take the update inside the SLA must be moved out of scope for organizational data as a documented compensating decision rather than being carried indefinitely as 'pending patch'.",
+        "evidence": "Packet: cisa_kev true with kev_date 2025-06-03 and active_exploitation confirmed; poc_available true; patch_available true with live_patch_available false, and live_patch_notes stating no live-patch tool is registered and that the vendor patch typically requires service restart or system reboot per the KEV requiredAction. RWEP 77 against CVSS 8.8.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-121",
+        "name": "MOBILE-ZERO-CLICK-HARDENING",
+        "description": "This CVE is an escalation primitive, not an entry point — the unauthorized GPU command sequence must be issued by code already executing on the handset, and the packet notes that LPEs of this class are routinely paired with an initial-access primitive in the Android targeted chains where it was exploited. For high-risk users, the control that acts inside the window before a fixed build reaches the device is a reduced-attack-surface mode that stops automatic processing of untrusted message attachments, fonts and link previews, removing the delivery leg the GPU escalation is chained to. This is additive to the device update, not a substitute for it: the vendor fix exists and still has to land, with the restart the KEV requiredAction implies.",
+        "evidence": "Packet: incorrect authorization (CWE-863) in the Qualcomm Adreno GPU driver; memory corruption via unauthorized command execution in the GPU micronode; exploited in the wild in Android targeted chains, with the packet stating that LPEs of this class are routinely paired with an initial-access primitive. cisa_kev true, kev_date 2025-06-03, active_exploitation confirmed, RWEP 77, poc_available true; live_patch_available false with the vendor patch requiring restart or reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2025-21480": {
     "name": "Qualcomm Multiple Chipsets Incorrect Authorization Vulnerability (variant: CVE-2025-21480)",
@@ -23317,7 +24726,41 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "The CLFS driver fix must be scheduled off a KEV clock rather than a change-advisory maintenance window, on servers as well as workstations, because this is the escalation half of a ransomware intrusion: the packet records that LPEs of this class are routinely paired with an initial-access flaw, so the window between a phishing foothold and domain-wide SYSTEM is measured in minutes, not in patch cycles. There is no live-patch path for this entry and the fix is a kernel-driver replacement that only becomes active after the restart or reboot the KEV requiredAction calls for, so the SLA must be tracked to reboot-completed per host. Production servers whose owners defer reboots — the exact machines whose compromise is worth the most to an operator — are the population this control exists to force through, and 'patched, pending reboot' must be reported as unremediated.",
+        "evidence": "Packet fields for CVE-2025-32706: cisa_kev true, kev_date 2025-05-13, active_exploitation confirmed, rwep_score 77, cvss 9.8, poc_available true, cwe_refs CWE-122. patch_available true, live_patch_available false, live_patch_notes \"No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.\" Packet attack_vector: \"a heap-based buffer overflow (CWE-122) in the Windows Common Log File System (CLFS) driver — a recurring kernel-LPE target — exploited by a local foothold to escalate to SYSTEM ... LPEs of this class are routinely paired with an initial-access flaw by ransomware operators.\"",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-003",
+        "name": "KERNEL-EXPLOITATION-DETECTION",
+        "description": "Between KEV listing and the reboot that actually activates the CLFS driver fix, detection of the escalation attempt is the only control still standing, and the cited framework controls do not require it. Hosts must carry telemetry that alerts inside a minute on kernel privilege-escalation indicators for this path: a non-privileged process acquiring a SYSTEM token, and anomalous creation or manipulation of CLFS log files by user-context processes. The escalation runs entirely on the host from a foothold the attacker already has, so it produces no network-side indicator for a perimeter sensor to catch, and least-privilege posture does not contain it — the packet's own description is a local foothold reaching SYSTEM, which means standard-user-only accounts are not a mitigating control here and cannot be attested as one.",
+        "evidence": "Packet fields for CVE-2025-32706: cwe_refs CWE-122, cvss 9.8, rwep_score 77, poc_available true, cisa_kev true (kev_date 2025-05-13), active_exploitation confirmed. Packet attack_vector: \"a heap-based buffer overflow (CWE-122) in the Windows Common Log File System (CLFS) driver ... exploited by a local foothold to escalate to SYSTEM.\" live_patch_available false; live_patch_notes states the vendor patch \"typically requires service restart or system reboot per the KEV requiredAction,\" leaving a detection-only interval on hosts awaiting restart. Citing gaps include NIST-800-53-AC-6 (Least Privilege) and UK-CAF-B4 (System security).",
+        "gap_closes": [
+          "NIST-800-53-AC-6",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-042",
+        "name": "INCOMPLETE-PATCH-SEQUENCE-SEVERITY-MULTIPLIER",
+        "description": "The packet characterizes the CLFS driver as a recurring kernel-LPE target, which means a vulnerability-management program that scores this heap overflow as a discrete finding will re-learn the same lesson at the next CLFS CVE. Any CVE landing on the CLFS driver should carry a severity multiplier over an equivalent-CVSS flaw in a component with no exploitation history, and the CLFS surface should sit on a standing watchlist so the next advisory is triaged as a likely-exploited repeat rather than routed through generic intake. Practically: a host estate that has applied and rebooted for this CVE still carries elevated structural risk on the same primitive, and that residual should be stated in the risk register rather than being closed out when the patch record goes green.",
+        "evidence": "Packet attack_vector for CVE-2025-32706 describes the Windows Common Log File System (CLFS) driver as \"a recurring kernel-LPE target.\" Supporting packet fields: cwe_refs CWE-122, cvss 9.8, rwep_score 77, cisa_kev true with kev_date 2025-05-13, active_exploitation confirmed, poc_available true.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      }
+    ]
   },
   "CVE-2025-32701": {
     "name": "Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability",
@@ -24628,7 +26071,30 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "The \"whichever is later\" half of this control is the operative one here. Adobe shipped the fix in APSB09-15 in 2009, so every SLA anchored to patch availability expired more than a decade ago and reports green today, while the event that actually reopens the exposure is CISA's 2026-05-20 listing. Estates must re-run the KEV clock from that listing date against their installed Acrobat and Reader inventory, treat any host still on a pre-APSB09-15 build as an open KEV item on an hours-level deadline, and record the verified action as the application update — there is no live-patch path for this entry, so remediation means the reader binaries on the endpoint changed, not that a policy was reasserted. A KEV programme that only enqueues recently-published CVEs will never generate this work item at all.",
+        "evidence": "The packet records CISA KEV listing on 2026-05-20 with active_exploitation \"confirmed\", RWEP 65, CVSS 8.8 and poc_available true, for a heap-based buffer overflow (CWE-122) triggered by an attacker-controlled PDF for code execution in the reader process. patch_available is true, live_patch_available is false, and live_patch_notes name \"Adobe patch APSB09-15 (2009); application update\".",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-074",
+        "name": "CVE-REGRESSION-WATCHER",
+        "description": "No advisory feed re-announces a 2009 CVE, so nothing in a new-CVE-driven intake pipeline surfaced this entry; it became visible only when CISA re-listed it, by which point exploitation was already confirmed. Threat intake for document-reader software must therefore watch current exploitation and PoC signal for historical CVE ids and route each hit straight to an inventory query for pre-fix Acrobat/Reader builds — CVE-2009-3459 clears the watcher's historical-id threshold by seventeen years. The triage outcome here resolves to a long-tail unpatched estate rather than a code regression, and that is the point: the watcher is the only mechanism that raises an aged, still-exploited flaw at all, whichever way the triage lands.",
+        "evidence": "The CVE id is from 2009 while the packet's KEV listing is dated 2026-05-20, with active_exploitation \"confirmed\" and poc_available true. The packet states the legacy re-listing exists \"because long-tail unpatched/end-of-life estates remain exposed\".",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      }
+    ]
   },
   "CVE-2010-0249": {
     "name": "Microsoft Internet Explorer Use-After-Free (Operation Aurora)",
@@ -25568,7 +27034,30 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "academic_ai_fuzzing",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-017",
+        "name": "BUG-FAMILY-MITIGATION-PERSISTENCE",
+        "description": "The vendor fix bounds NSEC3 iteration and closest-encloser work, but the packet records a second worst-case-work primitive in the same validating path disclosed alongside it (key-tag collision handling), which is exactly the sibling-bug condition this control exists for. Resolver operators must keep the query-side limits they ran before upgrading — recursion restricted to known client ranges, per-client query and CPU budgets, response-rate limiting, and alerting on validator CPU saturation — in force after the upgrade, for a stated soak period, rather than retiring them on the strength of a version bump. Dropping them leaves the resolver defended only against the specific iteration-counting path this CVE names, inside a validation routine where a second forced-work primitive has already been demonstrated. The soak also has to be tracked per resolver instance, because the fix only takes effect on the instances that have actually been restarted.",
+        "evidence": "Packet: the vector states that validating an NSEC3 closest-encloser proof for a crafted response forces the resolver to perform a large number of SHA-1 hash iterations, and that the fix is vendor patches bounding the NSEC3 iteration/closest-encloser work. The attack_vector describes the class as a single crafted DNSSEC response forcing worst-case signature/hash work, naming both KeyTrap key-tag collisions and NSEC3 iteration enumeration as co-disclosed (Feb 2024), stalling the resolver for all clients. CWE-400, CVSS 7.5, RWEP 37, poc_available=true, active_exploitation=suspected, cisa_kev=false. patch_available=true, live_patch_available=false, and live_patch_notes state remediation is a software update requiring a service restart, not a host reboot.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "ISO-27001-2022-A.8.8",
+          "AU-Essential-8-Patch"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-008",
+        "name": "CRYPTO-SUBSYSTEM-CVE-DISCLOSURE",
+        "description": "DNSSEC validation is the cryptographic subsystem this flaw attacks, so while a resolver runs an unbounded-iteration build the organization cannot count 'DNSSEC validation enabled' as a compensating control for DNS response integrity — turning it on is precisely what exposes the resolver to a single crafted response that stalls resolution for every client behind it. Any risk narrative that leans on DNSSEC to cover spoofing or cache-poisoning risk must record that dependency explicitly, state the availability trade-off, and stop presenting a validating resolver as a net-positive control until the bounded build is deployed and each instance restarted. This matters most where one validating resolver is a shared dependency of the whole service estate, since its stall is a simultaneous outage for every dependent service rather than a single-system fault.",
+        "evidence": "Packet: CWE-400 resource exhaustion located in the DNSSEC validation path — the vector states that validating an NSEC3 closest-encloser proof for a crafted response drives a large number of SHA-1 hash iterations and consumes CPU, and the attack_vector states a single crafted DNSSEC response stalls the resolver for all clients. CVSS 7.5, RWEP 37, poc_available=true, active_exploitation=suspected, cisa_kev=false (no KEV clock applies). patch_available=true with live_patch_available=false; live_patch_notes state the remediation is a software update requiring a service restart rather than a host reboot, so exposure persists on each instance until that restart happens.",
+        "gap_closes": [
+          "DORA-Art-9",
+          "ISO-27001-2022-A.8.8"
+        ]
+      }
+    ]
   },
   "CVE-2023-44487": {
     "name": "HTTP/2 Rapid Reset — stream open-then-RST_STREAM flood (record-breaking DDoS)",
@@ -26200,7 +27689,19 @@
     "ai_discovery_source": "human_researcher",
     "ai_assist_factor": "none",
     "new_control_requirements": [
-      "Enforce timely remediation of CISA KEV-listed RCE in Google Chrome and Chromium-based browsers before Chrome 149: KEV due-date as the binding SLA, not a 30-day default."
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "Enforce timely remediation of CISA KEV-listed RCE in Google Chrome and Chromium-based browsers before Chrome 149: KEV due-date as the binding SLA, not a 30-day default.",
+        "evidence": "CVE-2026-11645 — Chromium V8 out-of-bounds read/write, CISA KEV-listed with confirmed in-the-wild exploitation (RWEP 60). Browser fleets patch on a release cadence rather than a KEV clock, so the binding date is the KEV due date, not the next scheduled Chrome rollout.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "AU-ISM-1546",
+          "NIS2-Art21-vulnerability-handling",
+          "DORA-Art-9"
+        ]
+      }
     ],
     "_auto_imported": false,
     "_intake_method": "manual-verified-curation"
@@ -26240,7 +27741,16 @@
     "ai_discovery_source": "human_researcher",
     "ai_assist_factor": "none",
     "new_control_requirements": [
-      "Enforce timely remediation of CISA KEV-listed Privilege Escalation in Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage) and SD-WAN vSmart Controller across the affected 20: KEV due-date as the binding SLA, not a 30-day default."
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "Enforce timely remediation of CISA KEV-listed Privilege Escalation in Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage) and SD-WAN vSmart Controller across the affected 20: KEV due-date as the binding SLA, not a 30-day default.",
+        "evidence": "CVE-2026-20245 — Cisco Catalyst SD-WAN Manager root command execution via improper output encoding, CISA KEV-listed with confirmed exploitation (RWEP 56). Network-management appliances sit outside the OS patch pipeline these controls assume, so the remediation tempo has to be stated for the appliance estate explicitly.",
+        "gap_closes": [
+          "AU-ISM-1546",
+          "DORA-Art-9"
+        ]
+      }
     ],
     "_auto_imported": false,
     "_intake_method": "manual-verified-curation"
@@ -26590,7 +28100,18 @@
     "ai_discovery_source": "human_researcher",
     "ai_assist_factor": "none",
     "new_control_requirements": [
-      "Enforce timely remediation of CISA KEV-listed Access Control Bypass in Arista EOS - all release trains: KEV due-date as the binding SLA, not a 30-day default."
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "Enforce timely remediation of CISA KEV-listed Access Control Bypass in Arista EOS - all release trains: KEV due-date as the binding SLA, not a 30-day default.",
+        "evidence": "CVE-2026-7473 — Arista EOS tunnel-decapsulation access-control bypass via incomplete comparison, CISA KEV-listed with confirmed exploitation (RWEP 69), affecting all release trains. Arista states no software fix or upgrade path is planned, so patch_available is false: the only mitigation is MAC/IP access-control lists on the affected switches or upstream devices that drop unexpected tunnel types. The KEV deadline therefore has to be met by deploying and evidencing that ACL, which is precisely the documented-compensating-control limb of the SLA rather than a patch window.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "AU-ISM-1546",
+          "DORA-Art-9",
+          "UK-CAF-B4"
+        ]
+      }
     ],
     "_auto_imported": false,
     "_intake_method": "manual-verified-curation"