@blamejs/exceptd-skills 0.19.5 → 0.19.6

package/data/zeroday-lessons.json

@@ -2085,7 +2085,29 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "human_researcher",
-    "ai_assist_factor": "low"
+    "ai_assist_factor": "low",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-009",
+        "name": "KERNEL-MODULE-INVENTORY-AND-DISABLE",
+        "description": "On every node running CRI-O, treat the host's loadable-module surface as the blast radius of the container runtime: inventory the modules a node actually needs for its workloads, blocklist the remainder in modprobe configuration, and enforce a locked/signed module set so a modprobe invocation carrying pod-spec-derived arguments cannot pull in a module the node's business function never requires. This is the compensating layer that survives an attacker who legitimately holds pod-create RBAC, because the module load is performed by the runtime on the host — not inside the container — so pod-level confinement (dropped capabilities, seccomp, AppArmor) never observes it. The distinguishing test: from a pod-create-capable service account on a staging CRI-O cluster, submit a pod spec whose attributes drive modprobe toward a module outside the node's approved inventory and confirm the load is refused rather than silently completed on the host; a cluster that passes image-scan and RBAC review still yields node-level module loading if the node's module set is unbounded.",
+        "evidence": "Packet: pod-spec attributes reach the modprobe argument path in CRI-O without validation, so 'an attacker with pod-create RBAC on a cluster using CRI-O can cause arbitrary kernel modules to load on the host node, achieving container-escape-equivalent capability' (CWE-20). CVSS 8.1, RWEP 30, poc_available: true. Not CISA KEV-listed and active_exploitation is unknown — the reason a CVSS/KEV-tiered flaw-remediation cadence deprioritizes it despite node-level impact. The entry records patch_available: true and live_patch_available: true, so a runtime fix and a live-patch path both exist; the module-inventory control is what covers the window before that fix lands and the residual after it.",
+        "gap_closes": [
+          "NIST-800-53-CM-7",
+          "AU-Essential-8-App-Hardening",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-036",
+        "name": "FLEET-CONTROL-PLANE-ADMIN-PRIVILEGE-TIER",
+        "description": "Classify pod-create authority on a CRI-O cluster as fleet-control-plane privilege rather than application-developer privilege. This CVE collapses the distance between the two: the namespace-scoped ability to submit a pod spec is, on an unpatched CRI-O node, the ability to load an arbitrary kernel module on the host. Every identity that holds pod-create on such a cluster — human operators and CI service accounts alike — therefore needs the control-plane tier's handling: an identity separate from application admin roles, just-in-time elevation with an approval step, and access only through a privileged path; and cluster RBAC must be audited for who holds pod-create outside that tier. The CIS Kubernetes admission guidance cited against this entry inspects what a pod requests (assigned capabilities, AppArmor profile) and does not help here, because the escape requires no elevated capability in the pod at all — the privileged action is taken by the runtime on the pod's behalf.",
+        "evidence": "Packet: 'Pod-spec attributes reach modprobe argument path in CRI-O without validation. An attacker with pod-create RBAC on a cluster using CRI-O can cause arbitrary kernel modules to load on the host node, achieving container-escape-equivalent capability.' The gap cited against this entry, CIS Kubernetes Benchmark v1.10.0 item 4.2.13, is scoped as 'Minimize the admission of containers with capabilities assigned (Kubelet / AppArmor profile guidance)'. CWE-20, CVSS 8.1, RWEP 30, poc_available: true.",
+        "gap_closes": [
+          "CIS-Kubernetes-Benchmark-4.2.13"
+        ]
+      }
+    ]
   },
   "CVE-2023-43472": {
     "name": "MLflow path-traversal arbitrary file read",
@@ -2369,7 +2391,28 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "human_researcher",
-    "ai_assist_factor": "low"
+    "ai_assist_factor": "low",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "The Orion authentication-bypass fix has to run on the KEV clock rather than the change window an internal monitoring server normally gets. Exploitation needs nothing but a single HTTP request whose URI matches the SkipI18nStrings pattern to land on Orion's API write endpoints — there is no credential to brute-force, no user to phish and no exploit-development lead time, so exposure lasts exactly as long as the unpatched Orion web surface stays reachable. The packet records a vendor fix as available and no live-patch path, so the mitigation is a scheduled Orion upgrade with the API surface restricted to a management segment (or the web service stopped) until the upgrade lands, not a deferral to the next quarterly maintenance slot.",
+        "evidence": "Packet: cisa_kev true, kev_date 2021-11-03, active_exploitation confirmed, rwep_score 75, cvss 9.8, poc_available true, patch_available true, live_patch_available false, live_patch_notes null, cwe_refs CWE-287. Vector: \"URI pattern matching against SkipI18nStrings triggers bypass — unauthenticated request matching the pattern reaches API write endpoints.\"",
+        "gap_closes": [
+          "AU-Essential-8-Patch"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-037",
+        "name": "FLEET-COMPROMISE-IR-PLAYBOOK",
+        "description": "Orion is a fleet control plane — it reaches, polls and holds credentials for the monitored estate — so the response to this bypass cannot end at the upgrade. The packet records SUNBURST operators using the bypass to exercise API write access against Orion installations that were already compromised, which means patching removes the entry path and leaves whatever was written through the API in place. The playbook's exposure-window steps are what actually apply here: enumerate every API write made against Orion during the window, audit configuration and job/alert-action changes made through it, invalidate the trust state of nodes Orion administers, and rotate every credential Orion custodied or that authenticated through it. That enumeration only exists if Orion's own per-request API telemetry was collected and retained off-box — monitoring programs scoped to the estate Orion watches routinely do not collect it for the monitoring platform itself, which is the monitoring gap this closes. It also closes the supply-chain gap: after a compromise delivered through the vendor product, a vendor patch restores the code but not the trust state of the installation or of the estate reachable from it.",
+        "evidence": "Packet attack_vector: \"URI pattern matching against SkipI18nStrings inside Orion's HTTP routing triggers an authentication bypass — an unauthenticated request that matches the pattern reaches API write endpoints. Used by SUNBURST operators to exercise API write access against compromised Orion installations.\" Packet: cisa_kev true, kev_date 2021-11-03, active_exploitation confirmed, poc_available true, rwep_score 75, cvss 9.8. Citing gaps already record UK-CAF-C1 (Security monitoring) and NIS2-Art21-supply-chain as insufficient for this CVE.",
+        "gap_closes": [
+          "UK-CAF-C1",
+          "NIS2-Art21-supply-chain"
+        ]
+      }
+    ]
   },
   "CVE-2023-3519": {
     "name": "Citrix NetScaler ADC/Gateway unauth RCE (CitrixBleed precursor)",
@@ -2612,7 +2655,30 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "human_researcher",
-    "ai_assist_factor": "low"
+    "ai_assist_factor": "low",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-028",
+        "name": "CONTAINER-RUNTIME-PATCH-SLA-24H",
+        "description": "The defect sits in containerd's CNI IP-allocation path, and a container receives its address and mask when its network is configured - so upgrading the containerd package on a node does not repair a workload that was already handed a spurious mask. Those containers keep permitting traffic across network namespaces until they are recreated on the fixed runtime, which makes the remediation unit node upgrade plus controlled recreation of every workload that was networked by the vulnerable allocation path, and makes the completion criterion 'no running container was networked by the vulnerable path' rather than 'containerd version is past the fix'. This entry is not KEV-listed and its exploitation status is unknown, so the control's KEV-triggered 24-hour clock does not fire here; what this CVE demonstrates is the recreation half of the control, the part every patch-cadence framework control omits because it assumes installing the fixed package ends the exposure. A vendor fix exists and no live-patch path is registered, so the recreation cannot be deferred in the hope of an in-place remedy.",
+        "evidence": "Packet attack_vector: 'Integer overflow in the containerd CNI IP-allocation path. A crafted CIDR specification overflows the uint32 mask conversion, causing the container to receive a spurious mask that allows traffic to leak across network namespaces.' Packet fields: cwe_refs CWE-200; cvss 5.9; rwep_score 30; cisa_kev false; kev_date null; active_exploitation unknown; poc_available true; patch_available true; live_patch_available false; live_patch_notes null. Citing gaps include AU-Essential-8-Patch and ISO-27001-2022-A.8.8.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-018",
+        "name": "SCANNER-PAPER-COMPLIANCE-TEST",
+        "description": "Two green reports coexist with this vulnerability. A CIS-Kubernetes 5.3 assessment passes by finding NetworkPolicy objects present and a policy-capable CNI, and a vulnerability scan passes by finding the containerd package at or past the fixed version. Neither verdict can see the failure: the container is handed a spurious mask by the allocation path, so traffic crosses network namespaces without any NetworkPolicy being violated - the leak is underneath the layer the benchmark inspects - and a package-version check says nothing about containers still running with a mask the vulnerable path gave them. The operational test has to touch the data plane: from a pod, attempt to reach an address in a neighbouring namespace's range that policy is supposed to forbid and confirm the packet is dropped, and enumerate running containers' allocated masks against the ranges their namespaces were meant to receive. Any assessment that reports boundary protection satisfied on the strength of policy-object presence plus a version string is paper compliance against exactly this defect.",
+        "evidence": "Packet attack_vector: 'Integer overflow in the containerd CNI IP-allocation path. A crafted CIDR specification overflows the uint32 mask conversion, causing the container to receive a spurious mask that allows traffic to leak across network namespaces.' Packet vector: 'Integer overflow in CNI IP-allocation path - container receives spurious mask, leaks across network namespaces.' Packet fields: cwe_refs CWE-200 (information disclosure), cvss 5.9, poc_available true, patch_available true. Citing gaps include CIS-Kubernetes-Benchmark-5.3 (Network Policies and CNI), NIST-800-53-SC-7 (Boundary Protection) and NIS2-Art21-network-security.",
+        "gap_closes": [
+          "CIS-Kubernetes-Benchmark-5.3",
+          "NIST-800-53-SC-7",
+          "NIS2-Art21-network-security"
+        ]
+      }
+    ]
   },
   "CVE-2026-30623": {
     "name": "Anthropic MCP SDK stdio command-injection",
@@ -2734,7 +2800,30 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "human_researcher",
-    "ai_assist_factor": "low"
+    "ai_assist_factor": "low",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-054",
+        "name": "BACKUP-TIER-NETWORK-ISOLATION",
+        "description": "A BeeStation is a consumer NAS whose whole purpose is holding the primary and backup copy of a household's or a branch site's data, and the packet's attack path reaches it with no credential and no user interaction — a pre-auth chain against the BeeStation Manager web management surface ending in OS command execution on the box that holds the data. Applied to this product, the control means the BeeStation Manager web surface answers only from an operator subnet or an authenticated VPN: not from the general user VLAN, and not from the internet via a UPnP mapping or a home-router port forward, which is how consumer NAS hardware at remote-worker and small-branch sites normally acquires exposure. The appliance's outbound path should be constrained too, so a rooted BeeStation cannot reach arbitrary destinations with the data it holds. Reachability is the entire exploit precondition for a pre-auth CWE-78 flaw, and it is the only lever an operator holds between a public exploit chain and a firmware update landing on a device that no enterprise console manages — the packet records a vendor patch but no live-patch path, so the appliance has to be taken through the update to remediate. The distinguishing test: from a general user VLAN and from an external address, attempt to load the BeeStation Manager web surface; anything that answers is within reach of the published chain, and \"the NAS is on the internal network\" is an assertion about topology, not a demonstration that the management surface is unreachable from untrusted segments.",
+        "evidence": "Packet: CVE-2025-12686, \"Synology BeeStation unauth RCE (Pwn2Own Ireland 2025)\", CWE-78, attack vector recorded as a pre-auth RCE chain on the Synology BeeStation Manager web management surface, demonstrated as a full chain on consumer NAS hardware at Pwn2Own Ireland 2025. CVSS 9.8, RWEP 45, poc_available true, cisa_kev false, active_exploitation unknown, patch_available true, live_patch_available false (live_patch_notes null). UK-CAF-B4 (system security) is already recorded as an insufficient control citing this CVE.",
+        "gap_closes": [
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-018",
+        "name": "SCANNER-PAPER-COMPLIANCE-TEST",
+        "description": "For this entry the paper-compliance failure is not a mis-compared version string but an asset that never enters the scan at all. Consumer NAS hardware arrives at remote-worker and small-branch sites outside the procurement and agent-deployment path, so an estate can report zero outstanding criticals while a BeeStation with a CVSS 9.8 pre-auth command-injection flaw and a public exploit chain runs unlisted on the same network. The operational test for this CVE: does the vulnerability-management programme enumerate the BeeStation as an asset and resolve its BeeStation Manager firmware build against CVE-2025-12686, or does the compliance verdict come from an endpoint-management console whose coverage is defined as managed workstations and servers? A second, independent failure: with cisa_kev false and active_exploitation unknown, a queue that escalates only on KEV listing leaves this CVE unranked despite a demonstrated working exploit chain, so the enumeration has to be paired with a severity input that does not depend on a KEV entry appearing. The distinguishing test: pick a site known to run a BeeStation and query the vulnerability register for that appliance's firmware build — an empty result, not a low-severity result, is the finding, and it is what a patch-management attestation against NIST-800-53-SI-2 or ISO 27001 A.8.8 will not reveal.",
+        "evidence": "Packet: CVE-2025-12686 is a pre-auth RCE chain (CWE-78) on the Synology BeeStation Manager web management surface, demonstrated on consumer NAS hardware at Pwn2Own Ireland 2025. CVSS 9.8, RWEP 45, poc_available true, cisa_kev false, active_exploitation unknown, patch_available true. AU-Essential-8-Patch, ISO-27001-2022-A.8.8, NIST-800-53-SI-2 and NIS2-Art21-vulnerability-management are all already recorded as insufficient controls citing this CVE.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "ISO-27001-2022-A.8.8",
+          "AU-Essential-8-Patch",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      }
+    ]
   },
   "CVE-2025-62847": {
     "name": "QNAP QTS/QuTS hero RCE (Pwn2Own Ireland 2025, chain 1/3)",
@@ -2844,7 +2933,30 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "human_researcher",
-    "ai_assist_factor": "low"
+    "ai_assist_factor": "low",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-054",
+        "name": "BACKUP-TIER-NETWORK-ISOLATION",
+        "description": "On the QNAP TS-453E the appliance is simultaneously the file store and the restore source, so code execution on it is code execution on the copy of the data an operator would recover from. This CVE is not a standalone entry point — the packet records it as component 2/3 of a chain with CVE-2025-62847 and CVE-2025-62849 — which means the shared precondition for every link is network reachability of the QTS / QuTS hero web management surface. Applying the control to this product: the QTS / QuTS hero management surface must answer only from an operator subnet or an authenticated VPN, never from a general user VLAN and never through a UPnP mapping or branch-router port forward, and the appliance's own outbound path must be constrained so a rooted NAS cannot reach arbitrary destinations. Because a vendor patch exists but no live-patch path is registered for this entry, the appliance has to be taken through a firmware update to remediate — isolation is what covers the interval, and it collapses all three chain components at once rather than one CVE id at a time. The distinguishing test: from a user VLAN and from an external address, attempt to load the TS-453E's QTS / QuTS hero web management surface; anything that answers is inside the chain's reach, and a policy that merely records \"NAS appliances sit on the internal network\" has not demonstrated the management plane is unreachable from untrusted segments.",
+        "evidence": "Packet: CVE-2025-62848, \"QNAP QTS/QuTS hero RCE (Pwn2Own Ireland 2025, chain 2/3)\", CWE-94 code injection on the QNAP TS-453E appliance, demonstrated by the DEVCORE Research Team at Pwn2Own Ireland 2025 and chained with CVE-2025-62847 and CVE-2025-62849. CVSS 9.8, RWEP 40, poc_available true, cisa_kev false, active_exploitation unknown, patch_available true, live_patch_available false (live_patch_notes null). NIS2-Art21-network-security (security of network and information systems) and UK-CAF-B4 (system security) are both already recorded as insufficient controls citing this CVE.",
+        "gap_closes": [
+          "NIS2-Art21-network-security",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-018",
+        "name": "SCANNER-PAPER-COMPLIANCE-TEST",
+        "description": "A remediation register that closes this appliance on the strength of one ingested CVE id is paper compliance, because the packet describes a three-CVE chain and the appliance's exploitability is a property of the installed QTS / QuTS hero build, not of any single id. The operational test for this entry: does the vulnerability register resolve the TS-453E's actual installed firmware build against all three chain ids — CVE-2025-62847, CVE-2025-62848 and CVE-2025-62849 — and does it record which build closes each, rather than reporting \"remediated\" from whichever id the feed happened to deliver first? A second failure mode is prioritisation rather than detection: with cisa_kev false and active_exploitation unknown, a queue that escalates only on KEV listing never surfaces this CVE at all, even though the packet records a CVSS 9.8 code-injection flaw with a working public exploit chain demonstrated against the hardware. The distinguishing test: query the register for the TS-453E firmware build and confirm all three chain ids resolve to a closed state on that same build; a register showing one closed and the siblings absent is reporting on its feed coverage, not on whether the appliance can still be chained to privileged execution.",
+        "evidence": "Packet: CVE-2025-62848 is component 2/3 of the DEVCORE chain, chained with CVE-2025-62847 and CVE-2025-62849 on the QNAP TS-453E. poc_available true, CVSS 9.8, RWEP 40, cisa_kev false, active_exploitation unknown, patch_available true. NIST-800-53-SI-2 (flaw remediation), ISO-27001-2022-A.8.8 (management of technical vulnerabilities) and AU-Essential-8-Patch are all already recorded as insufficient controls citing this CVE.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "ISO-27001-2022-A.8.8",
+          "AU-Essential-8-Patch"
+        ]
+      }
+    ]
   },
   "CVE-2025-62849": {
     "name": "QNAP QTS/QuTS hero RCE (Pwn2Own Ireland 2025, chain 3/3)",
@@ -6956,7 +7068,41 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "A hosting fleet running cPanel & WHM or WP2 must be driven to the fixed release on a KEV-tied clock measured in hours, and applied fleet-wide rather than server-by-server on a rolling window. The bypass needs no credentials and targets the login flow itself, while the panel is by design internet-reachable so tenants can log in — so an unpatched host is a fully exposed control-plane takeover for the entire time it waits, and a rolling schedule simply means the last host in the queue stays open longest. Because no live-patch primitive is registered for this entry, the fix is a vendor update requiring a service restart or reboot, so that restart has to be pre-authorized against the KEV clock instead of deferred to the next tenant-notified maintenance slot. Hosts that cannot be updated inside the SLA must have their panel and WHM listeners restricted to operator networks and be booked as unremediated.",
+        "evidence": "Packet: CISA KEV-listed 2026-04-30 with active_exploitation=confirmed; RWEP 83, CVSS 9.1, poc_available=true. The vector states WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel (CWE-306, missing authentication for a critical function). patch_available=true, live_patch_available=false, and live_patch_notes state the vendor patch typically requires service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-handling"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "A panel host that was internet-reachable while unpatched must go through compromise assessment and credential rotation rather than patch-and-continue. Because the bypass hands an unauthenticated caller the control panel itself, the attacker inherits the panel's own legitimate capabilities — creating accounts and API tokens, rewriting mail and DNS records, writing files into tenant document roots, installing cron persistence — and none of that is removed by the update. The default response is configuration export, rebuild or restore of the panel host from known-good state, rotation of every tenant, reseller and API credential the panel issued, and an audit of accounts, cron entries and tenant webroots created since the KEV listing date. Anti-malware scanning is not the test here: the artifacts left behind are ordinary panel objects and ordinary web content, not malware signatures.",
+        "evidence": "Packet: CISA KEV-listed 2026-04-30 with active_exploitation=confirmed, poc_available=true and RWEP 83, so an exposed unpatched host is an exploitation opportunity rather than a hypothetical. The vector states the authentication bypass in the login flow allows unauthenticated remote attackers to gain unauthorized access to the control panel of WebPros cPanel & WHM and WP2 — the attacker operates as a panel principal rather than through a memory-corruption payload (CWE-306). patch_available=true with live_patch_available=false; the packet's remediation is a vendor patch requiring service restart or system reboot, which closes the entry path but makes no statement about actions already taken through it.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "CIS-Controls-v8-10.1"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-036",
+        "name": "FLEET-CONTROL-PLANE-ADMIN-PRIVILEGE-TIER",
+        "description": "WHM is the fleet control plane for every tenant site, mailbox, database and DNS zone on the host, and this flaw is the argument for making its administration a distinct privilege tier instead of the same login surface at a higher permission level. The WHM root and reseller surface should be reachable only from a PAM jumphost or operator network, behind FIDO2 step-up and just-in-time elevation with a separate identity from tenant accounts, so that a defect in the login flow does not present the whole hosting estate to an anonymous internet caller. Splitting the surfaces also bounds the damage where the tenant-facing cPanel login has to stay internet-exposed for customers: that side gets patched under the KEV clock, while the administrative plane is never an unauthenticated caller's first hop in the first place.",
+        "evidence": "Packet: CWE-306, missing authentication for a critical function — the vector records an authentication bypass in the login flow of WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) allowing unauthenticated remote attackers to gain unauthorized access to the control panel. CISA KEV-listed 2026-04-30, active_exploitation=confirmed, CVSS 9.1, RWEP 83, poc_available=true. The citing gaps recorded for this entry include NIST-800-53-AC-6 (Least Privilege) and UK-CAF-B2 (Identity and access control), both of which the packet marks as insufficient here.",
+        "gap_closes": [
+          "UK-CAF-B2",
+          "NIST-800-53-AC-6"
+        ]
+      }
+    ]
   },
   "CVE-2024-1708": {
     "name": "ConnectWise ScreenConnect Path Traversal Vulnerability",
@@ -7098,7 +7244,30 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "For a DIR-823X the KEV clock has to terminate in a verified per-unit outcome, because the failure mode of consumer-router patching is not a missed deadline, it is an open-ended 'awaiting firmware' state that never resolves. The packet records a vendor fix as available, no live-patch path, and a fix that per the KEV requiredAction typically requires a service restart or system reboot — for this device class that means a firmware flash and reboot on each unit, performed by whoever physically owns it. The packet's own vector text also states the impacted product could be end-of-life and/or end-of-service and that users should discontinue use, so the SLA must resolve to either a confirmed fixed firmware level on the specific unit or that unit's removal from service. With confirmed in-the-wild exploitation and a public PoC against a device that is always internet-facing by construction, 'firmware pending' is not a compliant resting state.",
+        "evidence": "Packet: cisa_kev true, kev_date 2026-04-24, active_exploitation confirmed, cvss 9.8, rwep_score 77, poc_available true, patch_available true, live_patch_available false, live_patch_notes \"No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.\", cwe_refs CWE-77. Vector: \"... The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.\"",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-030",
+        "name": "PERIMETER-DEVICE-ZERODAY-SLA-TIER",
+        "description": "A DIR-823X is the trust boundary for everything behind it, so command injection reached through the /goform/set_prohibiting handler is not an application bug on one host — execution on that router owns DNS resolution, routing, and every client session crossing it, and gives a persistent foothold that survives cleanup of anything on the LAN. That is the condition this tier exists for: mitigation within hours of the 2026-04-24 KEV listing, or the alternative the tier explicitly allows — isolate the vulnerable interface by taking the HTTP management surface off the WAN side and restricting it to a trusted internal management segment — instead of the 14/30-day operating-system patch SLA the citing frameworks apply to it today. Note the packet characterizes the caller two ways: the attack_vector field says unauthenticated command execution, while the vector text says an authorized attacker sending a POST to /goform/set_prohibiting. The interface-isolation half of the tier is the right action under either reading, which is why it belongs alongside the patch clock rather than behind it.",
+        "evidence": "Packet vector: \"D-Link DIR-823X contains a command injection vulnerability that allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /goform/set_prohibiting via the corresponding function.\" Packet attack_vector: \"command injection (CWE-77) on the D-Link DIR-823X, giving an unauthenticated attacker command execution on the device.\" Packet: cvss 9.8, rwep_score 77, cisa_kev true, kev_date 2026-04-24, active_exploitation confirmed, poc_available true. Citing gaps already record UK-CAF-B4 (System security) and NIS2-Art21-network-security as insufficient for this CVE.",
+        "gap_closes": [
+          "UK-CAF-B4",
+          "NIS2-Art21-network-security"
+        ]
+      }
+    ]
   },
   "CVE-2024-7399": {
     "name": "Samsung MagicINFO 9 Server Path Traversal Vulnerability",
@@ -7158,7 +7327,31 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "MagicINFO 9 Server instances run digital-signage estates and are typically commissioned once and left alone, outside the cadence that covers the rest of the server fleet — so the KEV clock has to be what pulls them in. Two things defeat the usual triage here: the CVSS score sits below the threshold that most severity-driven patch tiers use to demand urgency, while the real-world priority score is far higher; and the packet's own description has the attacker writing files as system authority, so one unpatched signage server is a full host, not a display. Because the fix lands as a service restart or reboot, the SLA must cover the restart of every signage server, not just the installer run on the ones an operator remembers owning.",
+        "evidence": "Packet records a CISA KEV listing dated 2026-04-24 with active_exploitation 'confirmed', RWEP 77 against CVSS 7.5, and poc_available true. The vector text states the path traversal 'could allow an attacker to write arbitrary files as system authority'. patch_available is true, live_patch_available is false, and live_patch_notes state the vendor patch typically requires service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-patch-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "This exploitation path leaves an artifact behind on purpose: the attacker uploads a file — the packet names a web shell — and then traverses to it to execute it. Patching the upload and traversal handlers removes the delivery route while leaving the uploaded shell sitting on disk and still reachable through ordinary requests, so a patched MagicINFO 9 Server can remain an attacker's foothold. A server that was network-reachable and unpatched during the exposure window must be triaged, not just updated: enumerate files written under its upload and web-serving directories across the exposure window, rotate the credentials and content-distribution keys the server held, and rebuild rather than patch-in-place.",
+        "evidence": "Packet's attack_vector describes 'a path-traversal plus unrestricted-file-upload flaw (CWE-22/CWE-434), letting an unauthenticated attacker upload a file (e.g. a web shell) and traverse to it for code execution', with active_exploitation 'confirmed', CISA KEV listing 2026-04-24, and poc_available true.",
+        "gap_closes": [
+          "NIS2-Art21-patch-management",
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2024-57728": {
     "name": "SimpleHelp Path Traversal Vulnerability",
@@ -7218,7 +7411,31 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "The KEV clock here has to run on the SimpleHelp support server itself, not on the endpoints it services: the zip-slip write lands with the privileges of the SimpleHelp server user and converts directly into code execution on that host, so a remediation programme that tracks technician workstations and serviced endpoints but treats the support server as infrastructure will miss the exploited surface entirely. The packet records no live-patch path — the vendor fix requires a service restart or reboot — so the SLA must schedule the SimpleHelp service restart inside the KEV window rather than treating patch download as completion. Until that restart is taken, the file-upload and administrative paths on the server must be restricted rather than counted as remediated, since the packet's own description places the upload behind admin access on the server.",
+        "evidence": "CISA KEV-listed 2026-04-24 with active_exploitation 'confirmed' and poc_available true. RWEP 83 against CVSS 7.5 — the real-world exploit priority sits well above the CVSS band, so a CVSS-threshold-driven patch queue deprioritizes an actively exploited flaw. The catalog vector records that SimpleHelp 'contains a path traversal vulnerability that allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file (i.e. zip slip). This can be exploited to execute arbitrary code on the host in the context of the SimpleHelp server user.' patch_available is true, live_patch_available is false, and live_patch_notes reads: 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.'",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-handling"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-078",
+        "name": "ENDPOINT-MGMT-DEPLOYMENT-CHANNEL-INTEGRITY",
+        "description": "The primitive in this CVE is an arbitrary write anywhere on the filesystem as the SimpleHelp server user — so the exposed asset is not just the web root but every file that remote-support server holds and hands out: session and client artifacts, technician-facing downloads, service configuration and any script the server executes. Treat that content as a privileged distribution channel rather than as application data: file-integrity-monitor the SimpleHelp installation and every directory it serves artifacts from, alert on writes that do not correspond to a sanctioned administrator action or a vendor update, and hold the support server to KEV-priority patching as a management-plane asset. This is the control that still has value after the patch lands, because the fix closes the zip-slip write path but removes nothing already written through it — an attacker file placed before remediation survives the upgrade, and neither signature-based anti-malware nor authentication logging will surface a bespoke artifact dropped through a legitimate upload endpoint.",
+        "evidence": "The catalog vector states the flaw lets an actor 'upload arbitrary files anywhere on the file system by uploading a crafted zip file (i.e. zip slip)' and thereby 'execute arbitrary code on the host in the context of the SimpleHelp server user'; the attack_vector locates the flaw 'on the remote-support server'. KEV-listed 2026-04-24 with active_exploitation 'confirmed' and poc_available true, RWEP 83. The gaps this entry already cites include CIS Controls v8 10.1 (Deploy and Maintain Anti-Malware Software) and UK CAF C1 (Security monitoring) — neither detects an attacker-written artifact that carries no malware signature and arrives over an authenticated upload path.",
+        "gap_closes": [
+          "UK-CAF-C1",
+          "CIS-Controls-v8-10.1"
+        ]
+      }
+    ]
   },
   "CVE-2024-57726": {
     "name": "SimpleHelp Missing Authorization Vulnerability",
@@ -7278,7 +7495,40 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-036",
+        "name": "FLEET-CONTROL-PLANE-ADMIN-PRIVILEGE-TIER",
+        "description": "SimpleHelp is a remote-support control plane, so its server admin role reaches every machine the technician population supports — the technician tier and the server-admin tier are not two shades of the same application user. This CVE collapses the distance between them: the entry records that low-privileged technicians can create API keys with excessive permissions and use those keys to escalate to the server admin role. Server administration of SimpleHelp needs to be classified as its own privilege tier — identity separate from every other admin role, jumphost-only access with hardware-key step-up, just-in-time elevation with approval — and the technician surface must not be able to mint or hold API keys at all. A framework that enumerates one admin role for this product attests accurately while the technician surface remains the real path into it.",
+        "evidence": "SimpleHelp missing authorization (CWE-862), CVSS 8.8, RWEP 83. The entry states low-privileged technicians can create API keys with excessive permissions and that these keys can be used to escalate privileges to the server admin role, on a remote-support server. CISA KEV-listed 2026-04-24 with active_exploitation=confirmed and poc_available=true.",
+        "gap_closes": [
+          "UK-CAF-B2",
+          "NIST-800-53-AC-6"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-037",
+        "name": "FLEET-COMPROMISE-IR-PLAYBOOK",
+        "description": "The escalation product here is a durable credential rather than a session: an API key minted through the missing-authorization flaw still carries server-admin power after the vendor fix is installed. The playbook for this CVE therefore has to enumerate and revoke every API key issued on the SimpleHelp server across the exposure window, audit technician accounts and role assignments for keys they should never have been able to create, and treat every endpoint reached through the server during that window as requiring credential rotation and review — a remote-support server is a path into the machines it supports, so its compromise fans outward rather than stopping at the appliance. Patching closes the minting path and leaves already-minted keys valid, which is precisely the state an audit reading only installed version would score as clean.",
+        "evidence": "Missing authorization (CWE-862) on a remote-support server; the entry records that the API keys created through the flaw can be used to escalate to the server admin role. active_exploitation=confirmed, poc_available=true, CISA KEV-listed 2026-04-24, RWEP 83, CVSS 8.8.",
+        "gap_closes": [
+          "UK-CAF-B2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "SimpleHelp entered CISA KEV on 2026-04-24 with confirmed exploitation and a public PoC and a vendor fix exists, so this runs on the KEV clock rather than a quarterly application-patch cycle. The complication specific to this product is that no live-patch path is registered and the fix typically requires a service restart per the KEV requiredAction, which drops the active remote-support sessions the server exists to carry — the operational argument for deferral is built into the product. The SLA has to pre-authorize that restart instead of letting support availability win, and it has to sequence the restart with revocation of the API keys minted before the fix, or the server returns to service still honoring them.",
+        "evidence": "CISA KEV-listed 2026-04-24 with active_exploitation=confirmed, poc_available=true, RWEP 83, CVSS 8.8. patch_available=true, live_patch_available=false; the entry states the vendor patch typically requires service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-vulnerability-handling",
+          "NIST-800-53-SI-2"
+        ]
+      }
+    ]
   },
   "CVE-2026-20122": {
     "name": "Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability",
@@ -7398,7 +7648,41 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "Catalyst SD-WAN Manager is the fabric controller, so its remediation clock has to start at the KEV listing (2026-04-20) rather than at the next network-appliance maintenance cycle. The packet records no live-patch path for this entry and notes the vendor patch typically needs a service restart or system reboot, so the SLA must be measured at 'manager restarted onto the fixed build', not at 'update staged' — until the restart lands the manager keeps serving the disclosure, and the operator has no interim mitigation recorded here.",
+        "evidence": "cisa_kev true with kev_date 2026-04-20; active_exploitation 'confirmed'; poc_available true; RWEP 77 / CVSS 8.8; patch_available true, live_patch_available false, live_patch_notes: 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.'",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-036",
+        "name": "FLEET-CONTROL-PLANE-ADMIN-PRIVILEGE-TIER",
+        "description": "Because the exposure is on the SD-WAN control plane rather than on one managed router, whatever the manager can show is fabric-wide, and the only pre-patch lever is bounding who can reach the surface at all. Catalyst SD-WAN Manager operators have to be classified above ordinary network admins — jumphost-only reachability for the management interface, step-up authentication per session, and an identity not shared with any other admin role — so a remotely reachable CWE-200 read path is not exposed to every account that happens to hold 'network admin'. Frameworks that collapse the fabric controller into the same admin class as the devices it manages carry no rule that would have constrained this.",
+        "evidence": "Packet vector: 'Cisco Catalyst SD-WAN Manager contains an exposure of sensitive information to an unauthorized actor vulnerability that could allow remote attackers to view sensitive information on affected systems.' cwe_refs CWE-200; CVSS 8.8; citing gaps include NIST-800-53-AC-6 (Least Privilege) and NIS2-Art21-network-security.",
+        "gap_closes": [
+          "NIST-800-53-AC-6",
+          "NIS2-Art21-network-security",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-037",
+        "name": "FLEET-COMPROMISE-IR-PLAYBOOK",
+        "description": "Exploitation was confirmed in the wild before the fix, and the flaw class is disclosure — so patching stops further reads but does not invalidate anything already read from the manager. The response has to be fleet-scoped and rehearsed in advance: rotate credentials for every account that authenticated through the SD-WAN Manager during the exposure window, audit configuration pushed to managed edge devices since the exposure window opened, and apply quarantine criteria to downstream devices, instead of closing the finding when the restart completes.",
+        "evidence": "cisa_kev true, kev_date 2026-04-20, active_exploitation 'confirmed', poc_available true; cwe_refs CWE-200 (exposure of sensitive information to an unauthorized actor); RWEP 77; patch_available true.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "ISO-27001-2022-A.8.8"
+        ]
+      }
+    ]
   },
   "CVE-2025-2749": {
     "name": "Kentico Xperience Path Traversal Vulnerability",
@@ -7578,8 +7862,20 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
-  },
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "This is the case where a severity-ranked patch queue and a KEV-driven SLA give opposite answers, and the KEV answer is the correct one. At CVSS 6.1 the ZCS cross-site scripting flaw falls below the high/critical cut most Zimbra operators use to schedule mail-service downtime, yet it is KEV-listed with confirmed in-the-wild exploitation, has a public PoC, and scores RWEP 77 — the same real-world priority as the 9.8-rated RCEs in the same catalog. The remediation is not free: the packet records no live-patch tool for this entry and states that the vendor patch typically requires a service restart or system reboot per the KEV requiredAction, so closing it means booking a mailbox-server outage. That cost is precisely why a CVSS-ranked queue keeps deferring it, and why the SLA has to be pinned to the KEV listing date instead. Until the restart is booked, the exposure is live on every ZCS web-client session.",
+        "evidence": "Packet: cisa_kev true, kev_date 2026-04-20, active_exploitation confirmed, cvss 6.1, rwep_score 77, poc_available true, patch_available true, live_patch_available false, live_patch_notes \"No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.\", cwe_refs CWE-79. Attack vector: \"a cross-site scripting flaw (CWE-79) on the ZCS web client, letting an attacker run script in a victim's authenticated session for session/credential theft and mailbox access.\"",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "ISO-27001-2022-A.8.8"
+        ]
+      }
+    ]
+  },
   "CVE-2026-20128": {
     "name": "Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability",
     "lesson_date": "2026-05-29",
@@ -7818,7 +8114,31 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "ActiveMQ is middleware, so brokers are usually patched on an internal-messaging-tier cadence rather than an edge cadence — but this flaw is reachable by an unauthenticated network attacker against the broker itself, so the clock must start at KEV listing (2026-04-16), not at the next messaging maintenance window. A vendor fix exists, and because the packet records no live-patch path and notes the vendor patch typically requires a service restart or system reboot, the SLA is only meetable if restart authority for every broker instance is pre-approved rather than queued as a separate change. Until each broker is on the fixed build, the mitigation of record must be an inventoried compensating control — closing the broker's listener to any network the operator does not control — not a deferred patch date.",
+        "evidence": "Packet fields for CVE-2026-34197 (Apache ActiveMQ Improper Input Validation Vulnerability): cisa_kev=true with kev_date 2026-04-16; active_exploitation=confirmed; poc_available=true; cvss 9.8; rwep_score 77; attack_vector describes code execution reachable by an unauthenticated network attacker against the message broker; patch_available=true; live_patch_available=false with live_patch_notes stating no live-patch tool is registered and that the vendor patch typically requires service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-125",
+        "name": "SERVICE-INTERNAL-PROTOCOL-DESERIALIZATION-HARDENING",
+        "description": "For this broker the control means treating the ActiveMQ wire-protocol listener as a trust boundary rather than an internal convenience: the defect is improper input validation that becomes code injection (CWE-20 into CWE-94) for a peer that never authenticates. Bind broker listeners to the messaging segment instead of all interfaces, require peer authentication on every wire protocol the broker has enabled — not only the one the applications happen to use — and constrain what content arriving on that port is permitted to construct or evaluate, instead of inheriting safety from the assumption that the broker sits on a trusted network. The distinguishing test: from an unauthenticated host that can route to the broker port on a staging instance, open a connection carrying content the broker's application protocol never legitimately conveys, and confirm the peer is rejected before the broker acts on the content — a broker that passes a patch-level audit while accepting unauthenticated connections on all interfaces still exposes the injection path the moment the next protocol-parsing defect lands.",
+        "evidence": "Packet fields for CVE-2026-34197: cwe_refs CWE-20 and CWE-94; attack_vector states improper input validation leading to code execution reachable by an unauthenticated network attacker against the message broker; vector text reads that Apache ActiveMQ contains an improper input validation vulnerability that allows for code injection; active_exploitation=confirmed; poc_available=true; rwep_score 77.",
+        "gap_closes": [
+          "UK-CAF-B4",
+          "NIST-800-53-AC-6"
+        ]
+      }
+    ]
   },
   "CVE-2009-0238": {
     "name": "Microsoft Office Remote Code Execution",
@@ -8204,7 +8524,38 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "This entry scores CVSS 5.5 — under the threshold at which most Windows patch programmes take action — while carrying RWEP 77 on the strength of confirmed in-the-wild exploitation, so a severity-ordered queue parks the CLFS driver fix behind 'criticals' nobody is exploiting. The SLA must fire on the KEV listing rather than the score: enumerate every Windows host whose Common Log File System driver predates the fix, deploy the vendor update, and book the restart inside the KEV clock instead of rolling it into the next monthly maintenance window. The packet registers no live-patch path for this entry, so the reboot is the remediation, not an optional follow-up — a host that has taken the update but not restarted is still exposed and must not be counted as remediated.",
+        "evidence": "Packet: cvss 5.5 against rwep_score 77; cisa_kev true, kev_date 2026-04-13, active_exploitation 'confirmed', poc_available true. patch_available true; live_patch_available false, with live_patch_notes 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.'",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-patch-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-003",
+        "name": "KERNEL-EXPLOITATION-DETECTION",
+        "description": "An out-of-bounds read is a silent primitive: it leaks kernel memory to seed the escalation stage and, unlike a corruption bug, produces no bugcheck, no crash dump and no failed-write artefact for the host to report, so a fleet can be under active exploitation with a clean event log. Between the KEV listing and the restart that lands the fix, the only coverage is behavioural — alert on anomalous Common Log File System driver activity from processes that have no business touching it, on process token and integrity-level transitions that promote a user-context process to SYSTEM, and on the escalate-then-move-laterally sequence — with alerting fast enough to interrupt a ransomware operator's dwell time rather than surface in the next day's report.",
+        "evidence": "Packet: CWE-125 out-of-bounds read in the Microsoft Windows Common Log File System Driver, described as an information-disclosure primitive within a privilege-escalation chain, with the note that LPEs of this class are routinely paired with an initial-access flaw by ransomware operators. active_exploitation 'confirmed', kev_date 2026-04-13, poc_available true. live_patch_available false, so every host carries a restart-bounded exposure window.",
+        "gap_closes": [
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-018",
+        "name": "SCANNER-PAPER-COMPLIANCE-TEST",
+        "description": "A 2023 CVE identifier that only reaches KEV in 2026 stresses a specific part of vulnerability management: a CVSS 5.5 finding triaged years ago sits at the bottom of the queue or has aged out of it entirely, and nothing in a version-comparison scanner re-opens it on the day CISA lists it. The operational test is therefore not 'is the host patched' but two checks the scan pipeline usually cannot answer: does a previously deprioritised, multi-year-old medium get re-raised at KEV-listing severity, and does the per-host verdict come from the Common Log File System driver's actual file version rather than from the mere presence of a cumulative update or a pending, unrestarted install? A dashboard reporting the estate compliant because every host is on the current rollup, with no KEV-triggered re-open path for aged findings, is paper compliance for exactly this entry.",
+        "evidence": "Packet: CVE identifier issued in the 2023 series with kev_date 2026-04-13 — a multi-year gap between assignment and KEV listing; cvss 5.5 versus rwep_score 77; active_exploitation 'confirmed'; patch_available true with live_patch_available false and a vendor patch that per live_patch_notes typically requires service restart or system reboot.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8"
+        ]
+      }
+    ]
   },
   "CVE-2020-9715": {
     "name": "Adobe Acrobat Use-After-Free Vulnerability",
@@ -8259,7 +8610,30 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "The vendor fix for this Adobe Acrobat and Reader use-after-free has existed for years, yet CISA added the CVE to KEV on 2026-04-13 on the strength of confirmed current in-the-wild exploitation. Any remediation queue that ages or sorts by CVE identifier year, by \"newly disclosed\" status, or by scanner first-seen date buries a CVE-2020 entry beneath every current-quarter finding and it never reaches a patch window — which is precisely why the long-tail estate the packet describes is still being exploited. The KEV listing date has to start the clock instead of the CVE year: from 2026-04-13, every Acrobat and Reader installation in the estate is re-evaluated against the fixed build inside the KEV SLA, and any host that cannot reach it is cut off from untrusted PDFs rather than risk-accepted on the grounds that the CVE is old. One product-specific wrinkle for this entry: the packet records no live-patch path, and notes the vendor patch typically requires a service restart or system reboot per the KEV required action, so the SLA must be satisfied by the restart, not by the installer run — a \"patch deployed\" record against a host whose vulnerable reader process is still resident has not removed the exposure. The distinguishing test: query the vulnerability queue for KEV-listed CVEs whose identifier year is more than five years old and confirm they carry the same due date as a current-quarter KEV entry — a program whose SLA derives from disclosure age reports \"no overdue criticals\" while an actively exploited reader RCE sits unremediated on the long tail.",
+        "evidence": "Packet: CVE-2020-9715, \"Adobe Acrobat Use-After-Free Vulnerability\", CWE-416, exploitable by an attacker-controlled PDF for code execution in the reader process. CISA KEV-listed 2026-04-13, active_exploitation confirmed, CVSS 8.8, RWEP 77, poc_available true, patch_available true, live_patch_available false with live_patch_notes recording that the vendor patch typically requires a service restart or system reboot per the KEV requiredAction. The packet states the legacy re-listing exists because long-tail unpatched/end-of-life estates remain exposed — the residual exposure is an unapplied fix, not an absent one. NIST-800-53-SI-2, ISO-27001-2022-A.8.8, NIS2-Art21-patch-management and AU-Essential-8-Patch are all already recorded as insufficient controls citing this CVE.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management",
+          "AU-Essential-8-Patch"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-120",
+        "name": "DOWNLOAD-PROVENANCE-ENFORCEMENT",
+        "description": "Exploitation of this CVE requires the victim to open an attacker-controlled PDF, so on the long-tail hosts the packet says are still unpatched the delivery path is the only control left that can be enforced. Require content provenance — Mark-of-the-Web — on every PDF arriving by mail, web download, or untrusted file share, and require provenance-tagged PDFs to open in the reader's reduced-privilege protected view rather than the full parsing path that carries the use-after-free sink at the user's own privilege. Provenance must survive the container: a PDF extracted from a ZIP, mounted from an ISO or VHD, or renamed must inherit the tag rather than lose it, and dismissing the protected view on an externally sourced document should be a policy decision rather than a per-user click. This is not a substitute for the vendor patch, which the packet records as available — it is what stands between an attacker-controlled document and the vulnerable parser on the end-of-life and unmanaged hosts that will not reach the fixed build inside the KEV window. The distinguishing test: mail a provenance-tagged PDF nested inside an archive to a managed host, extract it, and confirm the extracted file still opens in the protected view — an endpoint-hardening attestation that covers only macro and script settings still lets a provenance-stripped PDF reach the reader's parser with full user privileges.",
+        "evidence": "Packet attack vector: an attacker-controlled PDF reaching Adobe Acrobat and Reader for code execution in the reader process (CWE-416 use-after-free). poc_available true, active_exploitation confirmed, CISA KEV-listed 2026-04-13, CVSS 8.8, RWEP 77. The packet attributes the residual exposure to long-tail unpatched/end-of-life estates. UK-CAF-B4 (system security) is already recorded as an insufficient control citing this CVE.",
+        "gap_closes": [
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2026-21643": {
     "name": "Fortinet FortiClient EMS SQL Injection Vulnerability",
@@ -8319,7 +8693,39 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "FortiClient EMS is the management server for a Fortinet endpoint-agent estate, and the packet's flaw is an unauthenticated SQL injection on its HTTP surface that escalates to remote code execution at CVSS 9.8, KEV-listed with confirmed in-the-wild exploitation and a public PoC. The remediation clock for this box therefore starts at the KEV listing date, not at the next monthly patch window that the citing frameworks' cadence controls permit. Two packet facts shape how the SLA must be planned: no live-patch tool is registered, and the vendor patch typically requires a service restart or system reboot per the KEV requiredAction - so the deployment window has to be planned with an EMS service outage inside it, and the console's role in managing endpoints is not a reason to defer that restart to a change-approval cycle. An estate that cannot restart EMS inside the window has to pull the management surface out of network reach as the documented compensating control until it can, because there is no in-place mitigation to fall back on.",
+        "evidence": "Packet fields: cisa_kev true, kev_date 2026-04-13, active_exploitation confirmed, cvss 9.8, rwep_score 77, poc_available true, patch_available true, live_patch_available false, live_patch_notes 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.' Packet vector: 'Fortinet FortiClient EMS contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.' Citing gaps include AU-Essential-8-Patch, ISO-27001-2022-A.8.8, NIST-800-53-SI-2 and NIS2-Art21-vulnerability-management.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-078",
+        "name": "ENDPOINT-MGMT-DEPLOYMENT-CHANNEL-INTEGRITY",
+        "description": "An attacker who reaches code execution through this SQL-injection path owns the endpoint-management server itself - the box that distributes software, policy and trust material to every enrolled FortiClient agent. Least privilege scoped to EMS operator accounts, the NIST AC-6 control the framework gap cites, bounds nothing against this CVE, because the packet's attacker never authenticates as an operator at all: the injection is reachable unauthenticated via crafted HTTP requests. What bounds the blast radius is treating the EMS-to-agent path as a privileged supply-chain control plane rather than as ordinary application output: integrity-monitor the agent packages and key material the server distributes, alarm on any agent push or policy change that cannot be traced to a sanctioned admin action, and treat a confirmed EMS compromise as fleet-wide agent code execution until the deployment channel is proven untouched, rather than as a single-server incident closed by patching the console.",
+        "evidence": "Packet attack_vector: 'SQL injection (CWE-89) on the FortiClient EMS management surface escalating to remote code execution. CISA KEV-listed 2026-04-13 with confirmed in-the-wild exploitation.' Packet vector states an unauthenticated attacker may execute unauthorized code or commands via specifically crafted HTTP requests. Packet fields: cvss 9.8, rwep_score 77, active_exploitation confirmed, poc_available true. Citing gap NIST-800-53-AC-6 (Least Privilege).",
+        "gap_closes": [
+          "NIST-800-53-AC-6"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-046",
+        "name": "PEN-TEST-SCOPE-INCLUDES-SECURITY-PRODUCTS",
+        "description": "FortiClient EMS is a defensive product, and scoping documents routinely list the endpoint-security stack among the controls a test must evade rather than among the surfaces a test must attack. That scoping choice is why an unauthenticated SQL injection sitting on the EMS management HTTP surface - the cheapest finding class there is, reachable before any credential - survived to a KEV listing with confirmed exploitation instead of being found internally. The fix is scope language that names the EMS management HTTP surface itself as an in-scope target, tested with the same injection battery applied to any other unauthenticated web application, and a PoC is public for this CVE so the test is directly reproducible against a staging console. The distinguishing question for an assessor: does the last test report contain any request sent to the endpoint-security management plane, or only requests sent to systems it defends?",
+        "evidence": "Packet vector: 'Fortinet FortiClient EMS contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.' Packet fields: cwe_refs CWE-89, cvss 9.8, cisa_kev true with kev_date 2026-04-13, active_exploitation confirmed, poc_available true. Citing gap UK-CAF-B4 (System security).",
+        "gap_closes": [
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2026-34621": {
     "name": "Adobe Acrobat and Reader Prototype Pollution Vulnerability",
@@ -8494,7 +8900,40 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-055",
+        "name": "SECURITY-TOOL-INTEGRITY-VERIFICATION",
+        "description": "Put the FortiClient EMS server itself inside vulnerability-management scope at the SLA of the most privileged software in the estate, instead of wherever 'endpoint security product' falls in the OS-versus-application patch split. The exploited surface is the management server operators deploy in order to secure endpoints, and the flaw is reachable by an unauthenticated caller sending crafted requests — so the EMS build level is itself a security control, not an operations detail. Audits must establish the deployed EMS build from the server rather than from the console's own status view, and must include the trust-anchor-inversion test: send an unauthenticated crafted request to the EMS request handlers on a staging instance and confirm it is refused before any code or command runs. Remediation is a scheduled EMS outage: the entry registers no live-patch path and the vendor patch requires a service restart or reboot, so the security console is offline during its own fix and that window must be planned on the KEV clock rather than deferred to the routine cycle.",
+        "evidence": "Packet: 'Fortinet FortiClient EMS contains an improper access control vulnerability that may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests' (CWE-284). CISA KEV-listed 2026-04-06, active_exploitation: confirmed, CVSS 8.8, RWEP 77, poc_available: true. patch_available: true with live_patch_available: false; live_patch_notes records 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.'",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-078",
+        "name": "ENDPOINT-MGMT-DEPLOYMENT-CHANNEL-INTEGRITY",
+        "description": "Treat the EMS-to-FortiClient agent channel as a privileged supply-chain control plane for the duration of this exposure. Unauthenticated code or command execution on the EMS server hands an attacker the system that distributes configuration and software to every managed endpoint, so the blast radius is the agent fleet rather than one server: integrity-monitor the deployment artifacts and any key material the server holds, and alert on agent pushes and policy changes that do not correspond to a sanctioned admin action. Because the fix requires taking EMS down for a service restart, that monitoring has to span the outage and continue after it — restarting the server applies the patch but does not by itself evict anything placed through the flaw beforehand, and with exploitation confirmed in the wild an internet-reachable EMS instance is a forensic question, not a hypothetical. The distinguishing test: replay the deployment-artifact and key-table integrity baseline after the patch restart and confirm it matches the pre-exposure baseline.",
+        "evidence": "Packet: improper access control (CWE-284) 'allowing an unauthenticated attacker to access functions or data beyond authorization', with the KEV description recording that it 'may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests'. CISA KEV-listed 2026-04-06, active_exploitation: confirmed, CVSS 8.8, RWEP 77, poc_available: true. live_patch_available: false and the vendor patch requires a service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "NIST-800-53-AC-6",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-036",
+        "name": "FLEET-CONTROL-PLANE-ADMIN-PRIVILEGE-TIER",
+        "description": "Classify FortiClient EMS as a fleet control plane and confine its reachability on that basis: the EMS console and its request handlers should be reachable only through a privileged administrative path (PAM jumphost or a dedicated admin segment), with EMS administration held as an identity separate from general IT or application admin roles and elevated just-in-time. Against this CVE the tier's operative benefit is reachability rather than authentication strength — the flaw is exercised pre-authentication via crafted requests, so any deployment that leaves the EMS request surface reachable from general user networks or the internet gives the attacker the entire path no matter how the EMS credentials are governed. Frameworks that enumerate a single 'admin' tier do not distinguish the server that governs every endpoint agent from an application administrator, which is why this network-position requirement has to be stated as its own control. The distinguishing test: from a general user subnet, attempt to reach the EMS request handlers and confirm the connection is refused at the network boundary before authentication is ever reached.",
+        "evidence": "Packet: FortiClient EMS is exploited by 'an unauthenticated attacker to execute unauthorized code or commands via crafted requests' (CWE-284, improper access control). CISA KEV-listed 2026-04-06, active_exploitation: confirmed, CVSS 8.8, RWEP 77, poc_available: true. No live-patch tool is registered for this entry and the vendor patch requires a service restart or system reboot per the KEV requiredAction, so the exposure persists until an EMS restart window can be taken.",
+        "gap_closes": [
+          "NIS2-Art21-network-security",
+          "NIST-800-53-AC-6"
+        ]
+      }
+    ]
   },
   "CVE-2026-3502": {
     "name": "TrueConf Client Download of Code Without Integrity Check Vulnerability",
@@ -8693,7 +9132,30 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-030",
+        "name": "PERIMETER-DEVICE-ZERODAY-SLA-TIER",
+        "description": "When NetScaler is configured as a SAML IDP it is the authentication enforcement point for everything behind it, so its remediation tier cannot be derived from the CVE's severity band. This entry reads as a low-severity information disclosure by CVSS, yet the memory it overreads is authenticated session material and it is KEV-listed with confirmed in-the-wild exploitation — the RWEP score is 77 against a CVSS of 5.5. A vulnerability-management program that sorts by CVSS puts this appliance in the routine maintenance window. The tier requirement for this CVE: the update is due on the KEV clock, or the SAML IDP virtual server is taken out of service until the appliance is on a fixed build. Nothing upstream compensates, because the vulnerable device is the trust boundary the upstream controls delegate to.",
+        "evidence": "Packet: out-of-bounds read (CWE-125) on NetScaler ADC, NetScaler Gateway and NetScaler ADC FIPS/NDcPP when configured as a SAML IDP, leading to memory overread; the attack vector is described as disclosing adjacent memory used to steal authenticated session material. cisa_kev true, kev_date 2026-03-30, active_exploitation confirmed, poc_available true; cvss 5.5 against rwep_score 77.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "Updating this appliance stops the overread but does nothing about what has already left it. The exploited primitive hands an attacker authenticated session material read out of the SAML IDP's memory, and that material stays valid after the fix is applied — the vulnerability is closed while the access it produced is not. Remediation for this CVE must be run as compromise response rather than maintenance: once the appliance is on a fixed build, terminate every active session, rotate and reissue the session and signing secrets the IDP holds, rotate credentials that traversed it, and review the authentications it brokered during the exposure window (from KEV listing back through the earliest plausible exploitation). Patch-in-place with standing sessions is the failure mode this control exists to prevent.",
+        "evidence": "Packet: out-of-bounds read (CWE-125) in the SAML IDP path of NetScaler, disclosing adjacent memory used to steal authenticated session material; active_exploitation confirmed, cisa_kev true with kev_date 2026-03-30, poc_available true. patch_available true, live_patch_available false, live_patch_notes recording no registered live-patch tool and a vendor patch that typically requires service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "UK-CAF-B2",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      }
+    ]
   },
   "CVE-2025-53521": {
     "name": "F5 BIG-IP Stack-Based Buffer Overflow Vulnerability",
@@ -8753,7 +9215,41 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-030",
+        "name": "PERIMETER-DEVICE-ZERODAY-SLA-TIER",
+        "description": "A BIG-IP APM appliance is the trust boundary for the remote-access path it fronts, so the routine 14/30-day windows generic vulnerability-management controls allow are the wrong clock for an unauthenticated stack-based overflow reaching code execution on its data path. This CVE belongs in a perimeter tier: vendor fix deployed within hours of the KEV listing, or the vulnerable virtual server and management interface taken out of untrusted reach until it can be. The packet records no live-patch path for this entry and a vendor fix that requires a service restart or system reboot per the KEV requiredAction, so the SLA has to pre-authorize a failover or downtime window on the appliance itself. Frameworks that grade patch timeliness on a single estate-wide average let a 9.8 pre-auth RCE on the device that terminates remote access sit inside an acceptable-looking metric.",
+        "evidence": "F5 BIG-IP APM stack-based buffer overflow (CWE-121), CVSS 9.8, RWEP 77, exploitable by an unauthenticated attacker for memory-corruption remote code execution on the appliance. CISA KEV-listed 2026-03-27 with confirmed in-the-wild exploitation and poc_available=true. patch_available=true, live_patch_available=false; the entry states the vendor patch typically requires service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "Confirmed in-the-wild exploitation plus a public PoC against an unauthenticated RCE on BIG-IP APM means any appliance that was network-reachable before the fix has to be treated as possibly already running attacker code, not merely as unpatched. The default IR path for this CVE is capture the running configuration off the box, rebuild the appliance from vendor media, and rotate the credentials and keys the appliance held or proxied before it returns to service. Installing the vendor fix removes the overflow; it does not remove anything an operator installed through the overflow beforehand, and the restart the fix requires is a convenient moment for an implant to reload. A compliance verdict of remediated based on the installed version alone is the failure this control exists to prevent.",
+        "evidence": "Unauthenticated memory-corruption RCE on the appliance (CWE-121, CVSS 9.8, RWEP 77), active_exploitation=confirmed, poc_available=true, CISA KEV-listed 2026-03-27. patch_available=true with live_patch_available=false and a vendor patch that typically requires service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "NIS2-Art21-patch-management",
+          "NIST-800-53-SI-2",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-031",
+        "name": "FIREWALL-EGRESS-TELEMETRY-SEPARATE-TRUST-ZONE",
+        "description": "Code execution on BIG-IP APM is code execution on the device that writes the access and authentication records for the remote-access path it fronts, so the appliance's local log store cannot answer whether it was hit before the fix landed. Syslog, access-policy and authentication events must already be landing on a collector in a separate trust zone, with different credentials and a different management path, and retained far enough back to cover the window preceding the 2026-03-27 KEV listing. Without that, the rebuild-versus-patch decision this CVE forces is made with no evidence, and the exposure window can only be guessed at from the disclosure date rather than measured.",
+        "evidence": "Confirmed in-the-wild exploitation of an unauthenticated RCE on the appliance (CWE-121, CVSS 9.8, RWEP 77) with poc_available=true, CISA KEV-listed 2026-03-27; remediation requires a service restart or system reboot per the KEV requiredAction with no live-patch path registered.",
+        "gap_closes": [
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2026-33634": {
     "name": "Aquasecurity Trivy Embedded Malicious Code Vulnerability",
@@ -11623,7 +12119,32 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-056",
+        "name": "MOBILE-ENDPOINT-MDM-ENFORCED-KEV-SLA",
+        "description": "Managed Apple devices must be driven to the fixed OS build on an MDM-enforced clock keyed to the KEV listing, with user deferral disabled and the restart forced rather than requested. For this flaw the update is not optional hardening: the packet describes a malicious application writing kernel memory, which is a defect below the app sandbox, so nothing an operator configures on the device changes the outcome until the fixed build is running. The packet records no live-patch tool and states the vendor fix typically requires a service restart or system reboot, so the compliance event to measure is 'rebooted onto the fixed build', not 'update pushed'. The affected list in the packet spans watchOS, iOS, iPadOS, macOS, visionOS and tvOS; visionOS and tvOS are the families most likely to sit outside an update ring built around phones and laptops, so the enforcement scope has to be checked against the full family list rather than assumed.",
+        "evidence": "The packet's vector states that Apple watchOS, iOS, iPadOS, macOS, visionOS and tvOS contain a classic buffer overflow (CWE-120) that could allow a malicious application to cause unexpected system termination or write kernel memory. cisa_kev is true with kev_date 2026-03-20, active_exploitation is confirmed, poc_available is true, and rwep_score is 77 against a CVSS of 8.8. patch_available is true, live_patch_available is false, and live_patch_notes states the vendor patch typically requires a service restart or system reboot per the KEV requiredAction. The cited patch-management controls — Essential Eight 'Patch operating systems', ISO 27001 A.8.8, NIS2 Art. 21 vulnerability handling, NIST SI-2 — express timescale expectations but none ties the estate to the KEV date or removes the user's ability to defer the restart the fix requires.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "NIST-800-53-SI-2",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management"
+        ]
+      },
+      {
+        "id": "MOBILE-OS-MINIMUM-PATCH-LEVEL-ENFORCEMENT",
+        "name": "MOBILE-OS-MINIMUM-PATCH-LEVEL-ENFORCEMENT",
+        "description": "The Apple fleet must treat the OS build that fixes this flaw as an access condition, not a reporting metric: a device below it is denied or quarantined from organizational data rather than listed on a patch-compliance dashboard. The packet's vector makes the second half of this control the load-bearing half — the trigger is a malicious application writing kernel memory, so on any device that cannot yet take the fixed build the operator's remaining lever is constraining what code gets to run at all, which means restricting installation of untrusted or side-loaded applications and holding the device outside the trust boundary until it updates. The distinguishing test is to enrol a device pinned below the fixed build and confirm the policy actually denies it access to protected resources; an estate that surfaces the stale build on a report while the device keeps its mail, VPN and document access has recorded the exposure rather than removed it.",
+        "evidence": "The packet's vector states the flaw could allow a malicious application to cause unexpected system termination or write kernel memory across watchOS, iOS, iPadOS, macOS, visionOS and tvOS — an application-driven kernel write, so the code is running locally and the boundary it crosses is below the application privilege model. That is why the least-privilege control cited against this entry is insufficient: no privilege assignment on the app constrains a kernel memory write, and the UK CAF system-security expectation likewise assumes an OS boundary the packet shows is defective. active_exploitation is confirmed, poc_available is true, cisa_kev is true with kev_date 2026-03-20, and rwep_score is 77. patch_available is true but live_patch_available is false with live_patch_notes stating the vendor patch typically requires a service restart or system reboot, so devices awaiting a reboot window remain in the exposed population and need an access-side control rather than a patch-side one.",
+        "gap_closes": [
+          "NIST-800-53-AC-6",
+          "UK-CAF-B4",
+          "AU-Essential-8-Patch"
+        ]
+      }
+    ]
   },
   "CVE-2025-31277": {
     "name": "Apple Multiple Products Buffer Overflow Vulnerability",
@@ -11678,7 +12199,30 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-056",
+        "name": "MOBILE-ENDPOINT-MDM-ENFORCED-KEV-SLA",
+        "description": "The entry covers Safari, iOS, watchOS, visionOS, iPadOS, macOS and tvOS at once, so a single deferring device in any of those families keeps the maliciously-crafted-web-content path into the CWE-119 memory-corruption primitive open. Because no live patch is registered and the vendor fix takes effect only after a restart or reboot, the exposure lasts exactly as long as a user can postpone the update. Enforce the Apple-OS update through device management with user deferral disallowed and the control's 24h KEV-class deadline measured from the 2026-03-20 listing, and track install completion per device across every OS family named in the entry — tvOS, visionOS and watchOS units counted, not assumed current, since those are the ones no help-desk ticket ever chases.",
+        "evidence": "CISA KEV-listed 2026-03-20 with active_exploitation confirmed; RWEP 77, CVSS 8.8, PoC available. The packet's description covers Apple Safari, iOS, watchOS, visionOS, iPadOS, macOS and tvOS, where processing maliciously crafted web content may lead to memory corruption (CWE-119). patch_available is true but live_patch_available is false, and the packet records that the vendor patch typically requires service restart or system reboot per the KEV requiredAction — so remediation completes only at the restart the deferring user controls.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-121",
+        "name": "MOBILE-ZERO-CLICK-HARDENING",
+        "description": "For the population plausibly inside the targeting set this class of Apple flaw serves — executives, journalists, legal and security staff — the reboot-gated update is not fast enough on its own, because the packet describes the overflow as a sandbox-escape / privilege step inside a chain rather than a standalone bug. Place those users in a reduced-attack-surface mode so untrusted web content, message attachments, fonts and link previews are not processed automatically, narrowing the delivery path into the CWE-119 primitive during the window between the 2026-03-20 KEV listing and completed fleet restart. This has to be a standing posture for the high-risk cohort assigned before the next disclosure, not a reaction to this CVE — the mode only helps if it was already on when the chain arrived.",
+        "evidence": "The packet's attack_vector records the flaw as a buffer overflow (CWE-119) used as a sandbox-escape / privilege step in an exploit chain, and notes that Apple zero-days of this class are typically used in targeted-spyware chains; the KEV description names processing of maliciously crafted web content as the trigger. Exploitation is confirmed in the wild (KEV 2026-03-20), RWEP 77, CVSS 8.8, PoC available. With live_patch_available false, the only vendor remediation lands at restart, leaving a device-by-device exposure window.",
+        "gap_closes": [
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2026-20131": {
     "name": "Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data Vulnerability",
@@ -11891,7 +12435,31 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "A SharePoint farm must be remediated on a KEV-tied clock, not the monthly server-patch window, because the flaw needs no credentials and is reached over the same web surface the farm exists to serve — every hour it answers requests is exposure. The SLA must budget the farm-wide restart the vendor fix requires (front-end plus application servers, not one node) inside the clock rather than deferring the restart to the next change window and counting the installer run as remediation.",
+        "evidence": "Packet records a CISA KEV listing dated 2026-03-18 with active_exploitation 'confirmed', RWEP 77 against CVSS 9.8, and poc_available true. patch_available is true and live_patch_available is false; live_patch_notes state the vendor patch typically requires service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "Installing the SharePoint update closes the deserialization entry point but does not evict whatever entered through it, and the packet's exploitation status says something did. A farm that was network-reachable and unpatched during the exposure window must be triaged as compromised rather than declared fixed: review the web-facing servers' content and handler trees for attacker-planted artifacts, rotate the farm's service-account and application credentials, and prefer rebuild over patch-in-place — the service restart the fix requires will otherwise simply relaunch anything the attacker left resident.",
+        "evidence": "Packet's attack_vector describes deserialization of untrusted data (CWE-502) yielding unauthenticated remote code execution on the SharePoint web surface, with active_exploitation 'confirmed' and CISA KEV listing 2026-03-18; poc_available is true. live_patch_available is false and live_patch_notes record that the vendor patch typically requires a service restart or system reboot.",
+        "gap_closes": [
+          "NIS2-Art21-vulnerability-management",
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2025-47813": {
     "name": "Wing FTP Server Information Disclosure Vulnerability",
@@ -12006,7 +12574,39 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-057",
+        "name": "BROWSER-MANAGED-UPDATE-NO-DEFERRAL",
+        "description": "Delivery here is a crafted HTML page, so exposure accrues during ordinary browsing rather than at some privileged action an operator could suspend — every hour a managed browser sits on a pre-fix Chromium build is live exposure to an exploited V8 memory bug. Enterprise update rings that stage a security-channel Chromium release through pilot and broad phases, or that let users defer the relaunch, push the fixed build past the exploitation window. Deferral of this update has to be disallowed by policy on the managed fleet, not merely discouraged, because the vendor build is the only remediation the packet records.",
+        "evidence": "Packet vector: 'could allow a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page'; cwe_refs CWE-119 in V8; cisa_kev true, kev_date 2026-03-13, active_exploitation 'confirmed', poc_available true; patch_available true, live_patch_available false.",
+        "gap_closes": [
+          "NIS2-Art21-patch-management",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "A browser normally rides an application-patch cadence measured in weeks; this entry is KEV-listed 2026-03-13 with confirmed in-the-wild exploitation and a public PoC, which puts it on the compressed KEV clock instead. The packet's live-patch note records that the vendor fix typically requires a service restart or system reboot and that no live-patch tool is registered, so compliance has to be evidenced as 'running the fixed build after that restart across the fleet' rather than 'update delivered' — a delivered-but-not-restarted installer leaves the vulnerable V8 code executing.",
+        "evidence": "cisa_kev true, kev_date 2026-03-13; active_exploitation 'confirmed'; poc_available true; RWEP 77 / CVSS 8.8; patch_available true, live_patch_available false, live_patch_notes: 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.'",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-021",
+        "name": "TIER-3-DEPENDENCY-INVENTORY",
+        "description": "The packet states this V8 flaw reaches multiple browsers that embed Chromium — Chrome, Edge and Opera named explicitly and 'not limited to' those — so an inventory keyed on product names reports the estate remediated once Chrome updates while every other Chromium-embedding product still ships the vulnerable engine. The inventory has to record the embedded browser engine as a component of each product that carries it, with each embedder's own update channel tracked as a separate remediation path, because updating one embedder fixes none of the others.",
+        "evidence": "Packet vector: 'This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.' cwe_refs CWE-119 located in the V8 engine; cisa_kev true, kev_date 2026-03-13.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      }
+    ]
   },
   "CVE-2026-3909": {
     "name": "Google Skia Out-of-Bounds Write Vulnerability",
@@ -12061,7 +12661,42 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-057",
+        "name": "BROWSER-MANAGED-UPDATE-NO-DEFERRAL",
+        "description": "The delivery primitive here is an ordinary web page, so any Chrome or ChromeOS instance parked on a deferred enterprise update ring stays exploitable through nothing more than users browsing — there is no risky-behavior policy that closes it. Percentage-staged rollouts, pinned-version pilot rings, and 'test in the pilot ring first' change control must be bypassed for this security-channel update. On ChromeOS the update is not effective until the device restarts, so the policy must force the restart rather than wait for a user-initiated one and count the downloaded update as remediation.",
+        "evidence": "Packet's vector states the out-of-bounds write 'could allow a remote attacker to perform out of bounds memory access via a crafted HTML page' and that it 'affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products'. CISA KEV listing 2026-03-13, active_exploitation 'confirmed', poc_available true, patch_available true, live_patch_available false, with live_patch_notes recording that the vendor patch typically requires service restart or system reboot.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-patch-management"
+        ]
+      },
+      {
+        "id": "MOBILE-OS-MINIMUM-PATCH-LEVEL-ENFORCEMENT",
+        "name": "MOBILE-OS-MINIMUM-PATCH-LEVEL-ENFORCEMENT",
+        "description": "The packet lists Android as separately affected from Chrome, so pushing a browser update to the fleet does not settle the Android exposure — the platform copy of the graphics component travels with the OS security-patch level. The enrolled-fleet policy therefore has to gate access to organizational data on the security-patch level that carries this fix, not merely report patch level on a compliance dashboard. Handsets that cannot yet receive that level — vendor-abandoned or carrier-delayed models — must be quarantined rather than risk-accepted, because the trigger is attacker-controlled web content that a user cannot reasonably avoid encountering.",
+        "evidence": "Packet's vector states the flaw 'affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products' and is reachable 'via a crafted HTML page'. CISA KEV listing 2026-03-13 with active_exploitation 'confirmed'; RWEP 77, CVSS 9.8, poc_available true, patch_available true.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "NIS2-Art21-patch-management",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-021",
+        "name": "TIER-3-DEPENDENCY-INVENTORY",
+        "description": "Skia is a bundled graphics component rather than a product an operator buys, and the packet's own affected list ends in 'possibly other products' — which is the admission that nobody can enumerate exposure from a product-level asset register. Real exposure includes in-house and third-party applications built on Flutter, which carry the component transitively and whose inventory entry names the app, never Skia. Asset and SBOM coverage must reach embedded-component depth so 'where is this graphics library in our estate?' is an answerable question, and the answer has to distinguish the copies that a vendor update channel fixes from the copies that are only fixed when the application is rebuilt against a fixed framework release and redistributed.",
+        "evidence": "Packet's attack_vector describes an out-of-bounds write in the Skia graphics library (CWE-787) reachable via attacker-controlled web content, and the vector text states the flaw 'affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products'. CISA KEV listing 2026-03-13, active_exploitation 'confirmed', poc_available true.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      }
+    ]
   },
   "CVE-2025-68613": {
     "name": "n8n Improper Control of Dynamically-Managed Code Resources Vulnerability",
@@ -12181,7 +12816,30 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "The remediation clock on this Workspace ONE UEM flaw starts at the 2026-03-09 KEV listing, not at the 2021 CVE id — an estate that closed out its 2021 vulnerability backlog years ago is still running the exposed build today, and nothing in a recency-ordered queue will surface it. Because the packet registers no live-patch path and states the vendor fix requires a service restart or reboot, meeting the KEV window means holding a pre-approved restart window for the UEM tier instead of queuing the platform behind the next monthly change cycle; every hour before that restart, the SSRF remains reachable by an unauthenticated caller with network access to UEM.",
+        "evidence": "cisa_kev true with kev_date 2026-03-09 on a 2021-numbered CVE; active_exploitation confirmed, RWEP 77, CVSS 7.5, poc_available true, patch_available true; live_patch_available false with live_patch_notes 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.'",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-037",
+        "name": "FLEET-COMPROMISE-IR-PLAYBOOK",
+        "description": "The vulnerable host is the endpoint-management control plane for the managed device estate, and the packet's impact is unauthenticated access to sensitive information rather than code execution — so a successful exploitation leaves no crash, no shell and no host artifact, while whatever the server-side requests retrieved stays valid after the patch lands. The playbook for this product has to assume disclosure over the full window the vulnerable build was live: rotate the enrollment, API and integration credentials plus any certificates reachable from the UEM's server-side request path, re-validate device trust state across the enrolled fleet, and audit configuration profiles pushed during that window before the incident is treated as closed. Patch completion is not evidence that the exposure ended.",
+        "evidence": "Packet vector: 'Omnissa Workspace One UEM formerly known as VMware Workspace One UEM contains a server-side request forgery (SSRF) vulnerability that could allow a malicious actor with network access to UEM to send their requests without authentication and to gain access to sensitive information.' active_exploitation confirmed, KEV-listed 2026-03-09, poc_available true, RWEP 77.",
+        "gap_closes": [
+          "UK-CAF-B4",
+          "NIS2-Art21-network-security"
+        ]
+      }
+    ]
   },
   "CVE-2025-26399": {
     "name": "SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability",
@@ -12241,7 +12899,32 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "Web Help Desk must run on a KEV-tied remediation clock rather than a routine application-patch window, because the deserialization sink sits in AjaxProxy and is reachable without authentication — exposure is a function of who can reach the Web Help Desk web tier, not of who holds a credential, so 'no untrusted users have accounts' is not an exposure argument. The packet records no live-patch path for this entry: the vendor fix requires a service restart or reboot, so the SLA has to pre-authorize a Web Help Desk service restart inside the KEV window instead of deferring it to the next change cycle. Where the restart genuinely cannot be taken in the window, the AjaxProxy request path must be made unreachable from untrusted networks for the remainder of it, and that state tracked as unremediated rather than counted as patched.",
+        "evidence": "CISA KEV-listed 2026-03-09 with active_exploitation 'confirmed' and poc_available true; CVSS 9.8, RWEP 77. The catalog vector records a 'deserialization of untrusted data vulnerability in AjaxProxy that could allow an attacker to run commands on the host machine', and the attack_vector records it as 'enabling unauthenticated remote code execution'. patch_available is true, live_patch_available is false, and live_patch_notes reads: 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.'",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-042",
+        "name": "INCOMPLETE-PATCH-SEQUENCE-SEVERITY-MULTIPLIER",
+        "description": "This is not a first-of-kind defect in this product — the catalog places it as the latest in the Web Help Desk deserialization chain — so vulnerability management must score it as an Nth-in-sequence failure of the same CWE-502 primitive, not as a discrete new CVE that resets the risk picture. For this deployment that means: Web Help Desk carries a standing severity multiplier and a shortened triage clock for any subsequent deserialization advisory, the AjaxProxy request path is recorded in the risk register as a known-recurring code-execution sink rather than a one-time finding, and the network-reachability restrictions placed around the Web Help Desk web tier for the earlier links in the chain are retained after this patch lands instead of being retired as remediated. A framework that treats each Web Help Desk CVE as an independent event keeps re-deriving the same 'patch and close' verdict against a primitive that has now failed repeatedly.",
+        "evidence": "The catalog attack_vector for this entry reads: 'a deserialization-of-untrusted-data flaw (CWE-502) enabling unauthenticated remote code execution (the latest in the Web Help Desk deserialization chain)' — the same CWE-502 primitive recurring in the same product. KEV-listed 2026-03-09, active_exploitation 'confirmed', poc_available true, CVSS 9.8, RWEP 77.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-patch-management"
+        ]
+      }
+    ]
   },
   "CVE-2026-1603": {
     "name": "Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability",
@@ -12301,7 +12984,40 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "Ivanti EPM is the endpoint-management server, so every hour between the 2026-03-09 KEV listing and the patched build running is time in which a remote unauthenticated caller can reach the alternate-path bypass and pull stored credential data. Run this on a 4-hour clock from KEV listing or patch availability, whichever is later, and — because no live patch is registered and the fix takes effect only at the service restart or reboot the KEV requiredAction calls for — book the EPM outage inside that clock instead of the next change window, which is where an endpoint-management server normally gets deferred to. Where the restart genuinely cannot happen in 4 hours, the documented compensating control must remove network reachability to the EPM surface, not merely record the delay as an approved exception.",
+        "evidence": "CISA KEV-listed 2026-03-09 with active_exploitation confirmed; RWEP 77, CVSS 9.1, PoC available. The packet describes an authentication bypass using an alternate path or channel (CWE-288) that could allow a remote unauthenticated attacker to leak specific stored credential data. patch_available is true, live_patch_available is false, and the packet records that the vendor patch typically requires service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-036",
+        "name": "FLEET-CONTROL-PLANE-ADMIN-PRIVILEGE-TIER",
+        "description": "EPM administers the endpoint fleet, and the packet's own statement of impact — unauthenticated leak of stored credential data — is precisely why its accounts cannot sit in the same tier as application admins. Two things follow for this deployment. First, the EPM management surface must be reachable only through a PAM jumphost, so an anonymous network caller has no route on which to present the alternate path or channel at all; network reachability, not authentication, is the only barrier a pre-auth bypass respects. Second, the credentials EPM stores must be just-in-time-elevated, FIDO2-step-up, EPM-scoped identities held separately from any other admin role, so what the bypass can disclose is not a standing password that also opens domain, backup or hypervisor infrastructure. A framework that counts EPM operators as ordinary admins lets the contents of the credential store, rather than any control, set the blast radius.",
+        "evidence": "The packet states the flaw is an authentication bypass using an alternate path or channel (CWE-288) that could allow a remote unauthenticated attacker to leak specific stored credential data from Ivanti Endpoint Manager; CVSS 9.1, RWEP 77, PoC available, with active_exploitation confirmed as of the 2026-03-09 KEV listing. The framework controls the packet records as insufficient here include NIST SP 800-53 AC-6 (Least Privilege), UK CAF B2 (Identity and access control) and NIS2 Art. 21 security of network and information systems — none of which give the endpoint-management control plane a privilege tier of its own.",
+        "gap_closes": [
+          "UK-CAF-B2",
+          "NIST-800-53-AC-6",
+          "NIS2-Art21-network-security"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-037",
+        "name": "FLEET-COMPROMISE-IR-PLAYBOOK",
+        "description": "Patching EPM closes the bypass and does nothing about credential data already read through it, which is the packet's stated impact — so the playbook for this entry has to open by assuming disclosure rather than waiting for evidence of it. Rotate every credential the EPM instance stored (agent-push service accounts, deployment shares, the EPM database account, any bound directory accounts), invalidate device-trust state pushed from the server, and audit configuration and package pushes back across the exposure window that opened no later than the 2026-03-09 KEV listing. Rotation scope must be driven by what EPM held, not by which accounts show anomalous logins: a credential taken from the store replays as ordinary successful authentication and generates no alert to scope from.",
+        "evidence": "The packet's description is that the flaw could allow a remote unauthenticated attacker to leak specific stored credential data; KEV-listed 2026-03-09 with active_exploitation confirmed and a PoC available. patch_available is true, but a fix that stops further leakage does not invalidate credentials disclosed before it was applied — and with live_patch_available false, the packet records that the fix lands only at the service restart or reboot the KEV requiredAction calls for, extending the disclosure window that rotation has to cover.",
+        "gap_closes": [
+          "UK-CAF-B2"
+        ]
+      }
+    ]
   },
   "CVE-2017-7921": {
     "name": "Hikvision Multiple Products Improper Authentication Vulnerability",
@@ -12531,7 +13247,31 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-056",
+        "name": "MOBILE-ENDPOINT-MDM-ENFORCED-KEV-SLA",
+        "description": "Every managed Apple endpoint in scope for this flaw must take the fixed OS build on an MDM-enforced clock tied to the KEV listing, with user deferral disabled. Because the packet records no live-patch path and states the vendor fix typically requires a service restart or system reboot, the enforcement has to include the ability to force that restart rather than waiting for a user-chosen moment — an update downloaded but never rebooted into leaves the device fully exploitable, and a dashboard that reports 'update available' as compliant is measuring the wrong event. Scope matters here: the packet names tvOS, macOS, Safari, iPadOS and watchOS, and tvOS and watchOS devices are routinely outside the update ring that covers phones and laptops, so the control must reach every Apple OS family enrolled in the estate rather than the iOS and macOS population alone.",
+        "evidence": "The packet's vector states that Apple tvOS, macOS, Safari, iPadOS and watchOS contain an integer overflow or wraparound arising from the processing of maliciously crafted web content that may lead to arbitrary code execution (CWE-190). cisa_kev is true with kev_date 2026-03-05, active_exploitation is confirmed, poc_available is true, and rwep_score is 77 against a CVSS of 8.8. patch_available is true, live_patch_available is false, and live_patch_notes states the vendor patch typically requires a service restart or system reboot per the KEV requiredAction — so the fixed build plus a reboot is the entire remediation and the only variable an operator controls is how quickly both happen. The framework controls cited against this entry set patch expectations but none binds the estate to the KEV listing date or forbids user deferral of the restart the fix depends on.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "NIST-800-53-SI-2",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-121",
+        "name": "MOBILE-ZERO-CLICK-HARDENING",
+        "description": "Users at elevated targeting risk must run their Apple devices in a reduced-attack-surface mode rather than relying on the update clock alone for this flaw. The packet's vector puts the trigger in the processing of maliciously crafted web content, which means exposure begins the moment a device renders an attacker's page or a message that automatically previews one — before any operator decision is available. Since the packet records no live-patch option and states the fix requires a restart or reboot, there is a period between disclosure and rebooted-and-fixed during which nothing in the patch programme protects the device; a mode that suppresses automatic processing of untrusted content is the only prevention that operates inside it. The enrolment decision therefore has to be taken for the at-risk population ahead of the next disclosure, since enrolling in response to a KEV listing repeats the same lag the control exists to remove.",
+        "evidence": "The packet's attack_vector describes the integer overflow / wraparound as a memory-corruption step in an exploit chain and records that Apple zero-days of this class are typically used in targeted-spyware chains; the vector text attributes the flaw to the processing of maliciously crafted web content that may lead to arbitrary code execution. active_exploitation is confirmed, poc_available is true, and the entry is KEV-listed on 2026-03-05. live_patch_available is false and live_patch_notes states the vendor patch typically requires a service restart or system reboot, so no mitigation takes effect without a reboot. Essential Eight patch maturity and the UK CAF system-security expectation cited against this entry both assume the remediation clock is the defence; neither requires a reduced-attack-surface posture for the population this exploitation class targets, so the pre-reboot window is left uncovered.",
+        "gap_closes": [
+          "UK-CAF-B4",
+          "AU-Essential-8-Patch"
+        ]
+      }
+    ]
   },
   "CVE-2023-41974": {
     "name": "Apple iOS and iPadOS Use-After-Free Vulnerability",
@@ -12701,7 +13441,33 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "MOBILE-OS-MINIMUM-PATCH-LEVEL-ENFORCEMENT",
+        "name": "MOBILE-OS-MINIMUM-PATCH-LEVEL-ENFORCEMENT",
+        "description": "The defect is in Qualcomm chipset code — memory corruption while using alignments for memory allocation — so no operator patches it directly. The fix reaches a device only inside the device maker's firmware/OS build, and the device's reported security-patch level is the only observable that tells an operator whether that build is actually installed. For a fleet containing devices on the affected chipsets, this control means the MDM/EMM must read the security-patch level and block or quarantine devices below the build carrying the Qualcomm fix as a condition of access to organizational data, rather than reporting the stale level on a dashboard. Because the packet's exploitation path is a local foothold escalating privilege on the device, devices that cannot yet receive an updated build must additionally be constrained against installing untrusted or side-loaded code, since that is what supplies the local execution the escalation needs. The distinguishing test: enroll a device pinned below the fixed build and confirm the policy denies it access to protected resources — a fleet that only records patch level leaves exploitable devices in production against a confirmed-exploited chipset flaw.",
+        "evidence": "Packet: cisa_kev true, kev_date 2026-03-03, active_exploitation \"confirmed\", RWEP 77, CVSS 8.8, poc_available true. Vector: \"Multiple Qualcomm chipsets contain a memory corruption vulnerability while using alignments for memory allocation.\" Attack vector: an integer-overflow memory-corruption flaw (CWE-190) in Qualcomm chipset firmware/driver code, exploited by a local foothold to escalate privileges on the device. patch_available true; live_patch_available false. Every citing gap is a patch-policy control — ASD Essential Eight \"Patch operating systems\", ISO/IEC 27001:2022 A.8.8, NIST SP 800-53 SI-2, NIS2 Art.21 vulnerability handling and disclosure, UK CAF B4 — and each measures OS-level patch policy rather than enforcing a device's chipset-fix patch level as a precondition of access.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-patch-management",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "The entry is KEV-listed with confirmed exploitation and a vendor fix exists, but nothing on the affected devices can be fixed without an outage: the packet registers no live-patch tool and states the vendor patch typically requires a service restart or system reboot per the KEV requiredAction. For a silicon-vendor defect the SLA's \"or patch availability, whichever is later\" clause is the operative half — the organization's patch is not available when Qualcomm fixes the chipset code but when the device maker's build carrying that fix reaches its own devices. The clock must therefore run first against documented compensating controls (constraining untrusted local code, withdrawing or isolating devices that will not receive an updated build) and then against the reboot-bearing update, with that interim state tracked as an open compensating-control item rather than scored as patched within policy.",
+        "evidence": "Packet: cisa_kev true, kev_date 2026-03-03, active_exploitation \"confirmed\", RWEP 77, CVSS 8.8, poc_available true. patch_available true; live_patch_available false; live_patch_notes: \"No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.\" Attack vector: a local foothold escalating privileges on the device, with the packet noting that LPEs of this class are routinely paired with an initial-access primitive.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-patch-management",
+          "AU-Essential-8-Patch"
+        ]
+      }
+    ]
   },
   "CVE-2022-20775": {
     "name": "Cisco SD-WAN Path Traversal Vulnerability",
@@ -13121,7 +13887,41 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "No operator-side action stops this clock except the vendor fix. The credential is built into RP4VMs, so it cannot be rotated, expired or locked out through the appliance's own account management, and every unpatched instance stays authenticable by anyone holding the constant — there is no compensating configuration change that converts this into a lower-urgency item. The KEV window therefore has to be met by deploying the vendor fix with the service restart or reboot the packet says it requires, since the packet registers no live-patch tool for this entry; where that restart cannot be scheduled inside the window, the honest interim control is cutting network reachability to the appliance, not documenting a mitigation.",
+        "evidence": "CWE-798 use of hard-coded credentials; cisa_kev true, kev_date 2026-02-18, active_exploitation confirmed, RWEP 77, CVSS 8.8, poc_available true, patch_available true; live_patch_available false with live_patch_notes 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.'",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "NIS2-Art21-patch-management",
+          "NIST-800-53-SI-2",
+          "ISO-27001-2022-A.8.8"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "The packet's stated impact is not just unauthorized access but root-level persistence on the appliance's underlying operating system, with exploitation confirmed in the wild — so patching in place on an instance that was reachable while unpatched removes the credential and leaves anything installed through it running. For RP4VMs the default response to an instance whose exposure cannot be ruled out has to be configuration export, rebuild from vendor media at the fixed level, and rotation of every credential the appliance held for the virtual-machine estate it serves; patch-in-place is the exception, reserved for instances with demonstrable evidence they were never reachable by an unauthenticated caller. This control's scope is written for perimeter devices, but the triggering shape — pre-authentication root access under confirmed exploitation — is exactly what this appliance presents.",
+        "evidence": "Packet vector: 'Dell RecoverPoint for Virtual Machines (RP4VMs) contains an use of hard-coded credentials vulnerability that could allow an unauthenticated remote attacker to gain unauthorized access to the underlying operating system and root-level persistence.' active_exploitation confirmed, kev_date 2026-02-18, poc_available true, CVSS 8.8, RWEP 77.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-patch-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-054",
+        "name": "BACKUP-TIER-NETWORK-ISOLATION",
+        "description": "Identity controls on this appliance are inert by construction: the credential ships inside the product, so no password policy, account review, privilege assignment or authentication-strength requirement the operator configures can revoke it, and the account it hands out is root on the appliance operating system. The only access control left in operator hands is the network path. The RecoverPoint for Virtual Machines management surface must be reachable from a dedicated operator subnet only and never from the virtual-machine workload networks the product exists to recover, so that possession of the built-in credential does not by itself put an attacker on the appliance — and so that a compromise of a protected workload cannot reach the recovery tier that is supposed to survive it.",
+        "evidence": "CWE-798 hard-coded credentials in Dell RecoverPoint for Virtual Machines (RP4VMs); packet vector states an unauthenticated remote attacker gains 'unauthorized access to the underlying operating system and root-level persistence'; CVSS 8.8, RWEP 77, active_exploitation confirmed, KEV-listed 2026-02-18. The citing gaps include UK-CAF-B2 (Identity and access control) and NIST-800-53-AC-6 (Least Privilege), both of which the embedded credential bypasses entirely.",
+        "gap_closes": [
+          "UK-CAF-B2",
+          "NIST-800-53-AC-6"
+        ]
+      }
+    ]
   },
   "CVE-2020-7796": {
     "name": "Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery Vulnerability",
@@ -13241,7 +14041,39 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-055",
+        "name": "SECURITY-TOOL-INTEGRITY-VERIFICATION",
+        "description": "ThreatSonar is the anti-ransomware product itself, and the defect is that it does not validate the content of files uploaded to it — meaning the crafted-input path runs through the server's normal, expected input path, since ingesting attacker-adjacent artifacts is what the product is for. Bring the security-product estate under the same vulnerability-management SLA as the systems it defends: inventory the ThreatSonar server as patch-managed privileged software, run the KEV clock from the 2026-02-17 listing, and schedule the service restart or reboot the fix requires, since no live patch is registered for this entry. The trust-anchor-inversion test the control names lands directly here — upload a file whose content does not match its declared type to a staging ThreatSonar instance and confirm it is rejected rather than stored and executed. An 'endpoint protection deployed' attestation says nothing about whether the protection server is patched.",
+        "evidence": "The packet's KEV description states that ThreatSonar Anti-Ransomware does not properly validate the content of uploaded files, and that remote attackers with administrator privileges on the product platform can upload malicious files which can be used to execute arbitrary system commands on the server (CWE-434). CISA KEV-listed 2026-02-17 with active_exploitation confirmed; RWEP 77, CVSS 8.8, PoC available. patch_available is true and live_patch_available is false, with the packet recording that the vendor patch typically requires service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-036",
+        "name": "FLEET-CONTROL-PLANE-ADMIN-PRIVILEGE-TIER",
+        "description": "The packet's KEV description puts administrator privileges on the ThreatSonar platform in the exploitation precondition, which makes every path that issues, stores or reuses a console admin credential part of this vulnerability's attack surface. Classify ThreatSonar operators above application admins: a separate identity from any other admin role, FIDO2 step-up per session, just-in-time elevation with an approval workflow, and console access only from a PAM jumphost or privileged access workstation. The effect specific to this flaw is that a credential harvested elsewhere in the estate — the usual route to a console account — cannot be walked straight into the unvalidated upload handler and turned into arbitrary system commands on the anti-ransomware server, and every upload is attributable to an approved elevation rather than to a shared standing login.",
+        "evidence": "The packet's KEV description states that remote attackers with administrator privileges on the product platform can upload malicious files, which can be used to execute arbitrary system commands on the server (CWE-434); CVSS 8.8, RWEP 77, PoC available, active_exploitation confirmed as of the 2026-02-17 KEV listing. NIST SP 800-53 AC-6 (Least Privilege) is among the framework controls the packet records as insufficient for this CVE.",
+        "gap_closes": [
+          "NIST-800-53-AC-6"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-046",
+        "name": "PEN-TEST-SCOPE-INCLUDES-SECURITY-PRODUCTS",
+        "description": "Nothing about this flaw is exotic — an upload handler that does not check file content — yet it persisted in a shipping anti-ransomware product, because assessment scopes treat that product as a defense to be validated rather than a target to be attacked. Write the ThreatSonar server into the scope language by name: its administrative console, its file-upload and artifact-ingest endpoints, and its agent/update channels, with explicit authorization to attempt upload-to-arbitrary-command execution against a staging instance. The distinguishing observation for this entry is the route it took to operators — it surfaced through the KEV feed after in-the-wild use, not through any assessment of the security stack itself, which is what a scope that excludes defensive products guarantees.",
+        "evidence": "The packet records a CWE-434 unrestricted upload of a file with a dangerous type in TeamT5 ThreatSonar Anti-Ransomware, where uploaded file content is not properly validated and uploaded files can be used to execute arbitrary system commands on the server. It carries CISA KEV listing 2026-02-17 with active_exploitation confirmed and a PoC available — i.e. it reached the catalog after exploitation, not before. UK CAF B4 (System security) is among the framework controls the packet records as insufficient here.",
+        "gap_closes": [
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2008-0015": {
     "name": " Microsoft Windows Video ActiveX Control Remote Code Execution Vulnerability",
@@ -13526,7 +14358,39 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "Configuration Manager is the system operators patch everything else with, which is exactly why it tends to sit outside its own SLA — the site server is treated as remediation infrastructure rather than as a remediation target. This CVE is KEV-listed 2026-02-12 with confirmed exploitation and a public PoC, and the packet describes an unauthenticated caller sending crafted requests that end in command execution on the server or its database, so the site server has to be enrolled in the same KEV clock it enforces on managed endpoints. A vendor fix exists; the packet records no live-patch path and notes the vendor patch typically requires a service restart or system reboot, so a maintenance window for the site server itself — not just for the fleet it patches — must be pre-authorised inside the SLA.",
+        "evidence": "Packet fields for CVE-2024-43468 (Microsoft Configuration Manager SQL Injection Vulnerability): cwe_refs CWE-89; cisa_kev=true with kev_date 2026-02-12; active_exploitation=confirmed; poc_available=true; cvss 9.8; rwep_score 77; vector text states an unauthenticated attacker could exploit it by sending specially crafted requests to the target environment which are processed in an unsafe manner, enabling the attacker to execute commands on the server and/or underlying database; patch_available=true; live_patch_available=false with live_patch_notes stating no live-patch tool is registered and that the vendor patch typically requires service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-085",
+        "name": "DB-ABSTRACTION-LAYER-PARAMETERIZATION-VERIFICATION",
+        "description": "The injectable path on Configuration Manager is reached without credentials — the packet describes crafted requests processed in an unsafe manner by the server — so the two assumptions operators normally lean on for this product ('the site server is on the internal network' and 'a WAF fronts the client-facing endpoints') are both untested inferences, and neither is evidence that a query is bound rather than concatenated. The control requires parameterization to be proven at the query layer for every request handler that accepts client-originated content, and re-proven after each site-server update, rather than inferred from upstream input validation. The distinguishing test: from an unauthenticated host that can reach the site server's request-handling endpoints on a staging hierarchy, submit request fields carrying SQL metacharacters and confirm the value is passed as a bound parameter rather than becoming part of the statement — a hierarchy that passes an application-firewall audit while a handler concatenates client-supplied content still yields command execution on the server and the database behind it.",
+        "evidence": "Packet fields for CVE-2024-43468: cwe_refs CWE-89; attack_vector states SQL injection on Microsoft Configuration Manager escalating to unauthenticated remote code execution; vector text states an unauthenticated attacker sends specially crafted requests processed in an unsafe manner, enabling execution of commands on the server and/or underlying database; cvss 9.8; active_exploitation=confirmed; poc_available=true.",
+        "gap_closes": [
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-078",
+        "name": "ENDPOINT-MGMT-DEPLOYMENT-CHANNEL-INTEGRITY",
+        "description": "Configuration Manager is the fleet's software-deployment control plane, and this CVE hands an unauthenticated attacker command execution on that server and its database — the same authority the product legitimately uses to push packages, scripts and updates to every managed endpoint, which is why a single unauthenticated request here is a fleet-wide code-execution primitive rather than one compromised host. The control requires the deployment channel to be integrity-monitored independently of the site server itself: alert on deployment objects, scripts and task sequences that appear without a matching sanctioned admin action, and land that audit trail on a collector the site server cannot rewrite, so a foothold on the server cannot quietly launder itself into signed-looking fleet distribution. It also sets the post-remediation obligation the patch does not: any window in which a site server ran the vulnerable build while exposed must be treated as fleet-wide code-execution exposure and everything deployed during it reviewed — patching closes the entry point but says nothing about what the deployment channel did while it was open.",
+        "evidence": "Packet fields for CVE-2024-43468: vector text states the unauthenticated attacker can execute commands on the server and/or underlying database of Microsoft Configuration Manager; active_exploitation=confirmed; cisa_kev=true with kev_date 2026-02-12; poc_available=true; rwep_score 77; cvss 9.8; patch_available=true with live_patch_available=false.",
+        "gap_closes": [
+          "NIST-800-53-AC-6"
+        ]
+      }
+    ]
   },
   "CVE-2025-15556": {
     "name": "Notepad++ Download of Code Without Integrity Check Vulnerability",
@@ -13646,7 +14510,30 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "A help-desk portal is normally reachable by the people it serves, including from outside the corporate network, so an unauthenticated bypass on Web Help Desk is exploitable from the same anonymous position the deployment is designed to accept — there is no 'internal only' fallback posture to hold while a routine change window is scheduled. Start the clock at the KEV listing rather than at the next patch cycle: inventory every Web Help Desk instance including staging, disaster-recovery and departmental copies that share the same exposure, apply the vendor update, and book the service restart the packet's requiredAction implies inside that same window. An instance that has the fix staged but has not been restarted must not be recorded as remediated.",
+        "evidence": "Packet: CWE-693 security-control bypass on SolarWinds Web Help Desk that 'could allow an unauthenticated attacker to gain access to certain restricted functionality'; cisa_kev true, kev_date 2026-02-12, active_exploitation 'confirmed', poc_available true, cvss 8.8, rwep_score 77. patch_available true; live_patch_available false, with live_patch_notes 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.'",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-018",
+        "name": "SCANNER-PAPER-COMPLIANCE-TEST",
+        "description": "A protection-mechanism failure means the product's security control was present and did answer — it simply did not stop the request — so an access-control attestation and a version-based scanner verdict can both be truthful while the restricted functionality is reachable by anyone. Verification has to be behavioural rather than declarative: from an unauthenticated client against a staging Web Help Desk instance, request each restricted function the bypass reached and confirm it is refused before the function executes, then re-run the same probe after the update instead of accepting the build number as proof. An audit that records 'Web Help Desk authenticates its users' or 'Web Help Desk is on the fixed build' without that probe cannot tell an enforced control from a bypassed one, which is the exact state this CVE describes.",
+        "evidence": "Packet: CWE-693 protection-mechanism failure letting an unauthenticated attacker bypass an intended security control to reach protected functionality; active_exploitation 'confirmed' with CISA KEV listing 2026-02-12 and poc_available true. The framework gaps already citing this CVE include UK-CAF-B2 (identity and access control) and ISO-27001-2022-A.8.8 (management of technical vulnerabilities) — the two controls an operator can satisfy on paper while the bypass works.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "UK-CAF-B2"
+        ]
+      }
+    ]
   },
   "CVE-2026-21513": {
     "name": "Microsoft MSHTML Framework Protection Mechanism Failure Vulnerability",
@@ -13701,7 +14588,40 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-041",
+        "name": "PROTECTION-MECHANISM-FAILURE-CLASS-REGRESSION",
+        "description": "The flaw here is in the protection mechanism itself — MSHTML fails to apply the Mark-of-the-Web / trust check, so attacker-controlled content renders without the warning the rest of the endpoint hardening posture assumes is present. Verifying this fix therefore means re-running the whole MOTW/trust battery against MSHTML-rendered content after the update lands (mark propagation, zone-of-origin handling, prompt-on-execute for internet-sourced content), not confirming that the single reported bypass path is closed. An application-hardening attestation is only as strong as the last end-to-end test of the primitive it depends on, and this CVE is the demonstration that the primitive can silently stop working while every hardening setting still reads as enabled. Make the class battery a standing step of patch deployment on the affected estate.",
+        "evidence": "Packet: protection-mechanism failure (CWE-693) in the Microsoft MSHTML framework that bypasses the Mark-of-the-Web / trust protection, letting attacker-controlled content run without the expected security warning; the KEV vector describes an unauthorized attacker bypassing a security feature over a network. cisa_kev true, kev_date 2026-02-10, active_exploitation confirmed, poc_available true, RWEP 77, CVSS 8.8.",
+        "gap_closes": [
+          "AU-Essential-8-App-Hardening",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-120",
+        "name": "DOWNLOAD-PROVENANCE-ENFORCEMENT",
+        "description": "Because this bug suppresses the warning rather than corrupting memory, any posture that leans on the user seeing a prompt — or on a reputation verdict rendered at the same moment — is leaning on exactly what the flaw disables. Provenance has to be enforced by policy on the affected estate instead: block execution of internet-sourced shortcuts, installers and script hosts by rule, independent of whether the Mark-of-the-Web marking survived and independent of any reputation service outcome, so content delivered through the MSHTML path is refused even when it is never evaluated. This is also what closes the least-privilege gap for this CVE: the bypassed content runs in the user's own context, so removing administrative rights does not stop it — the enforcement point has to be what the user's own process is permitted to execute.",
+        "evidence": "Packet: protection-mechanism failure (CWE-693) in Microsoft MSHTML bypassing Mark-of-the-Web / trust protection so attacker-controlled content runs without the expected security warning, reachable over a network by an unauthorized attacker. cisa_kev true, kev_date 2026-02-10, active_exploitation confirmed, poc_available true, RWEP 77.",
+        "gap_closes": [
+          "AU-Essential-8-App-Hardening",
+          "NIST-800-53-AC-6"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "For most endpoint CVEs the interval between disclosure and deployment is implicitly covered by the platform's trust prompts and user caution. This entry removes that cover — the entire defect is that the warning does not fire — so the unpatched window carries no residual endpoint-side compensating control, and the deployment clock has to run from the KEV listing rather than the next scheduled update ring. The packet records no live-patch path, so remediation is the vendor update plus the restart the KEV requiredAction implies; hosts that cannot take it inside the SLA need the provenance-enforcement block recorded as an explicit, time-bound compensating control, not counted as patched-per-policy.",
+        "evidence": "Packet: cisa_kev true, kev_date 2026-02-10, active_exploitation confirmed, poc_available true; patch_available true with live_patch_available false, and live_patch_notes stating no live-patch tool is registered and that the vendor patch typically requires service restart or system reboot per the KEV requiredAction. RWEP 77, CVSS 8.8; protection-mechanism failure (CWE-693) bypassing Mark-of-the-Web / trust protection.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-patch-management",
+          "ISO-27001-2022-A.8.8"
+        ]
+      }
+    ]
   },
   "CVE-2026-21525": {
     "name": "Microsoft Windows NULL Pointer Dereference Vulnerability",
@@ -13921,7 +14841,21 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "Managed Windows desktops running the affected Desktop Window Manager component must be driven to the vendor fix on a KEV-tied clock rather than the monthly workstation-patch cadence, because the elevation is already being exploited and any local foothold on a user's desktop — a phished document, a commodity loader, a compromised standard-user session — converts into elevated execution on that endpoint. The packet records no live-patch path for this entry and the vendor fix takes effect only after the service restart or reboot the KEV requiredAction calls for, so the SLA clock must be measured to completed-restart per endpoint, not to package-deployed: a fleet dashboard showing 100% deployed with user-deferred reboots is still fully exploitable, and reboot deferral on a desktop estate is the norm rather than the exception.",
+        "evidence": "Packet fields for CVE-2026-21519: cisa_kev true, kev_date 2026-02-10, active_exploitation confirmed, rwep_score 77, cvss 8.8, poc_available true, cwe_refs CWE-843. patch_available true, live_patch_available false, live_patch_notes \"No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.\" Product statement in the packet vector: \"Microsoft Desktop Windows Manager contains a type confusion vulnerability that could allow an authorized attacker to elevate privileges locally.\"",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management",
+          "NIST-800-53-SI-2"
+        ]
+      }
+    ]
   },
   "CVE-2026-21514": {
     "name": "Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision Vulnerability",
@@ -14456,7 +15390,38 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-058",
+        "name": "CLOUD-CONTROL-PLANE-CROSS-TENANT-CLAIM-VALIDATION",
+        "description": "The packet describes an attacker holding their own FortiCloud account and a registered device logging into devices registered to other accounts wherever FortiCloud SSO authentication is enabled — the SSO assertion is honoured without being bound to the account the target device belongs to, which is a cross-account claim-validation failure in the vendor's cloud identity plane rather than a flaw on any one appliance. The operator-actionable half is the monitoring half: on FortiAnalyzer, FortiManager, FortiOS and FortiProxy units with FortiCloud SSO enabled, cloud-SSO administrative logins must be logged and reviewed for actors with no relationship to the device, because a successful bypass produces an authorized-looking login and no other artifact.",
+        "evidence": "Packet vector: 'Fortinet FortiAnalyzer, FortiManager, FortiOS, and FortiProxy contain an authentication bypass using an alternate path or channel that could allow an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices.' cwe_refs CWE-288; CVSS 9.1; cisa_kev true, kev_date 2026-01-27, active_exploitation 'confirmed'.",
+        "gap_closes": [
+          "UK-CAF-B2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-PERIMETER-VPN-AUTH-BYPASS-EXPEDITED-PATCH",
+        "name": "PERIMETER-VPN-GATEWAY-AUTH-BYPASS-EXPEDITED-REMEDIATION",
+        "description": "FortiOS and FortiProxy are the authentication enforcement point for the perimeter, so an authentication bypass on them is not an appliance-patch-window item — it is the enforcement point failing open. The packet gives a vendor patch with no live-patch path and a restart-or-reboot requirement, so the expedited clock has to run from the 2026-01-27 KEV listing through the reboot of every affected FortiAnalyzer, FortiManager, FortiOS and FortiProxy unit. Because the packet names FortiCloud SSO authentication being enabled on the device as the condition under which the bypass works, interim exposure is bounded by enumerating which units have that path enabled and restricting reachability of their administrative surfaces until the reboot completes.",
+        "evidence": "Packet name: 'Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability'; cwe_refs CWE-288; CVSS 9.1, RWEP 77; cisa_kev true, kev_date 2026-01-27, active_exploitation 'confirmed', poc_available true; patch_available true, live_patch_available false, live_patch_notes: 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.'",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-network-security"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-036",
+        "name": "FLEET-CONTROL-PLANE-ADMIN-PRIVILEGE-TIER",
+        "description": "Two of the four affected products, FortiManager and FortiAnalyzer, are fleet control planes for the firewall estate, so one bypassed login reaches the configuration and logs of every device they manage. This control is exactly what the vulnerable path collapses: it requires control-plane administration to run on an identity separate from any other admin role, with per-session step-up and jumphost-only access, whereas here a cloud account created for one operator's device becomes an administrative login on another operator's. Frameworks that classify FortiManager and FortiAnalyzer administrators as ordinary network admins carry no rule against wiring that tier to an internet-facing cloud SSO in the first place.",
+        "evidence": "Packet vector names FortiAnalyzer and FortiManager among the affected products and describes logging 'into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices'; cwe_refs CWE-288; citing gaps include NIST-800-53-AC-6 (Least Privilege) and UK-CAF-B2 (Identity and access control).",
+        "gap_closes": [
+          "NIST-800-53-AC-6"
+        ]
+      }
+    ]
   },
   "CVE-2018-14634": {
     "name": "Linux Kernel Integer Overflow Vulnerability (CVE-2018-14634)",
@@ -14571,7 +15536,32 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "For SmarterMail the remediation clock has to start at the 2026-01-26 KEV listing and drive the fixed SmarterTools build onto every internet-facing mail node within hours, not at the next mail-maintenance window. Because the upload path is reachable before authentication, no mailbox password policy, MFA rollout, or admin-permission review buys time while the SLA runs — the only thing that shortens exposure is the build going live. No live-patch path exists for this entry, so the SLA definition must include the service restart or reboot the vendor fix needs to take effect: a mail host with the fixed installer staged but the SmarterMail service still running old code must count as unremediated, not as patched-per-SLA.",
+        "evidence": "The packet records CISA KEV listing on 2026-01-26 with active_exploitation \"confirmed\", RWEP 83, CVSS 9.8 and poc_available true, against an unrestricted upload of file with dangerous type (CWE-434) that lets an unauthenticated attacker \"upload arbitrary files to any location on the mail server, potentially enabling remote code execution\". patch_available is true, live_patch_available is false, and live_patch_notes state the vendor patch typically requires a service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-handling"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "The durable artifact of exploiting this flaw is a file the attacker chose the location of on the mail server's filesystem — a web shell or equivalent — so upgrading SmarterMail closes the upload endpoint and removes nothing the attacker already wrote. Any SmarterMail instance that was internet-reachable while unpatched must be handled as compromised until proven otherwise: export and preserve configuration for forensics, rebuild the host from known-good media instead of upgrading in place, and rotate every credential the mail service could reach — service accounts, administrator and mailbox passwords, API keys and smart-host/relay credentials — because arbitrary file write on the mail server implies code execution on the host that stores them. Anti-malware on the mail host is not the deciding control: an attacker-supplied handler file placed at an attacker-chosen path is not reliably a signatured object.",
+        "evidence": "The packet describes CWE-434 allowing an unauthenticated attacker to write arbitrary files anywhere on the mail server for code execution (\"e.g. a web shell\"), with active_exploitation \"confirmed\", poc_available true, and a KEV listing dated 2026-01-26 — so pre-patch exposure windows must be assumed to have been exercised. CIS Controls v8 10.1 (anti-malware) is one of the framework controls this entry already cites as insufficient.",
+        "gap_closes": [
+          "CIS-Controls-v8-10.1",
+          "NIST-800-53-SI-2",
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2026-23760": {
     "name": "SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability",
@@ -14798,15 +15788,38 @@
         "adequate": false,
         "gap": "The 30-day critical-patch window is exploitation acceptance for an internet-facing network service in or adjacent to the CDE."
       }
-    },
-    "compliance_exposure_score": {
-      "percent_audit_passing_orgs_still_exposed": 73,
-      "basis": "Internet-facing VMware vCenter Server is run by audited organizations on a standard patch SLA and is mass-exploited within days of disclosure; the required web-shell hunt / rebuild is rarely part of the documented patch procedure, and long-tail unpatched estates persist (the MS08-067 pattern).",
-      "theater_pattern": "patch_management"
-    },
-    "ai_discovered_zeroday": false,
-    "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    },
+    "compliance_exposure_score": {
+      "percent_audit_passing_orgs_still_exposed": 73,
+      "basis": "Internet-facing VMware vCenter Server is run by audited organizations on a standard patch SLA and is mass-exploited within days of disclosure; the required web-shell hunt / rebuild is rarely part of the documented patch procedure, and long-tail unpatched estates persist (the MS08-067 pattern).",
+      "theater_pattern": "patch_management"
+    },
+    "ai_discovered_zeroday": false,
+    "ai_discovery_source": "vendor_research",
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "A KEV clock on this entry is a clock on the entire virtual estate, not on one server: vCenter is the management plane for every host and VM registered to it, so the blast radius of the recorded remote code execution is the virtualization control plane rather than a single application host. The reachable surface is the DCE/RPC implementation, which processes packets before authentication — so 'only administrators use vCenter' does not bound exposure; anything with network access to the vCenter service does. The packet records no live-patch path and a vendor fix that requires a service restart or reboot, which is the real obstacle for this asset class: vCenter restarts are typically held behind virtualization change freezes. The SLA must therefore pre-authorize the vCenter restart as part of the KEV response rather than queueing it behind the next maintenance window, and any window that cannot be met must be recorded as unremediated exposure with the DCE/RPC surface restricted in the interim.",
+        "evidence": "CISA KEV-listed 2026-01-23 with active_exploitation 'confirmed' and poc_available true; CVSS 9.8, RWEP 77. The catalog vector records that vCenter Server 'contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. This could allow a malicious actor with network access to vCenter Server to send specially crafted network packets, potentially leading to remote code execution.' patch_available is true, live_patch_available is false, and live_patch_notes reads: 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.'",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "APPSERVER-REMOTING-PROTOCOL-RESTRICTION",
+        "name": "APPSERVER-REMOTING-PROTOCOL-RESTRICTION",
+        "description": "vCenter's DCE/RPC listener is exactly the binary remoting-protocol class this control governs: a non-HTTP protocol endpoint that answers before authentication and whose parser is itself the vulnerable code, so the perimeter firewall and the web-tier hardening that most vCenter deployments are audited against never touch it. The requirement for this deployment is that DCE/RPC on vCenter accepts connections only from hosts that legitimately speak it — management and jump networks and the hosts vCenter administers — enforced by network ACL or host firewall rather than assumed from 'vCenter is internal', and that a KEV-listed defect in that parser is patched on an accelerated clock with the service restart taken rather than folded into the next quarterly virtualization window. The distinguishing test for this product: from a general user or workstation VLAN on a staging deployment, send crafted DCE/RPC packets at vCenter and confirm they are dropped before reaching the listener — an estate that passes vCenter role-and-permission audits while leaving the DCE/RPC port reachable from any internal segment is still exposed to the unauthenticated packet path.",
+        "evidence": "The catalog attack_vector records 'an out-of-bounds write (CWE-787) in the vCenter Server DCE/RPC protocol implementation, exploitable by an unauthenticated attacker for remote code execution', and the vector states the trigger is 'a malicious actor with network access to vCenter Server' sending 'specially crafted network packets' — network reach to the protocol endpoint is the sole precondition. KEV-listed 2026-01-23, active_exploitation 'confirmed', poc_available true, CVSS 9.8, RWEP 77. The gaps this entry cites include NIS2 Art. 21 security of network and information systems and UK CAF B4 system security.",
+        "gap_closes": [
+          "NIS2-Art21-network-security",
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2025-68645": {
     "name": "Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability",
@@ -15876,7 +16889,30 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "GeoServer entered CISA KEV on 2025-12-11 with confirmed exploitation and a public PoC and a fix exists, so the KEV clock governs. Two properties of this deployment break the routine application-patch cadence: a GeoServer instance is usually an internet-facing map service owned by a GIS or data team rather than by the pipeline that patches the rest of the estate, and the entry records no live-patch path with a fix that requires a service restart per the KEV requiredAction. The SLA must therefore name an accountable owner for each GeoServer instance and pre-authorize the restart, because the vulnerable operation is reachable without authentication — every hour of deferral is an hour in which an unauthenticated caller can read server-side files, including the service's own configuration, and coerce requests from the server.",
+        "evidence": "OSGeo GeoServer XML external entity flaw (CWE-611) allowing an unauthenticated attacker to read server files and coerce server-side requests; the entry names the surface as XML input to /geoserver/wms, operation GetMap. CISA KEV-listed 2025-12-11 with active_exploitation=confirmed, poc_available=true, RWEP 77, CVSS 8.8. patch_available=true, live_patch_available=false, with a vendor patch that typically requires service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-025",
+        "name": "CONFIGURATION-SIDE-LIVE-PATCH-INVENTORY",
+        "description": "The exposed surface for this CVE is narrow and named — XML input to /geoserver/wms on the GetMap operation — which means a filtering path in front of the service can shorten the exposure window on a much shorter clock than the restart the vendor fix requires. Rejecting request bodies that carry DOCTYPE or external-entity declarations to that endpoint, or removing its anonymous reachability, is deployable without taking the map service down. What the control demands is that this path be inventoried, staged and rehearsed before a disclosure rather than improvised during one. Because the entry records no live-patch capability for GeoServer and a fix gated behind a service restart, the request-filtering route is the only lever an operator has between the 2025-12-11 KEV listing and whenever the restart window opens — and a vulnerability-management programme that recognises only the vendor-patch path will report that interval as unmitigated because it has nothing else to record.",
+        "evidence": "The entry states the flaw occurs when the application accepts XML input through a specific endpoint, /geoserver/wms operation GetMap, and that an attacker can define external entities within the XML request; exploitation is unauthenticated. live_patch_available=false and the vendor patch typically requires service restart or system reboot per the KEV requiredAction. CISA KEV-listed 2025-12-11, active_exploitation=confirmed, poc_available=true.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2025-6218": {
     "name": "RARLAB WinRAR Path Traversal Vulnerability",
@@ -16511,7 +17547,33 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-057",
+        "name": "BROWSER-MANAGED-UPDATE-NO-DEFERRAL",
+        "description": "This bug is reached by any page the browser renders, so exposure is every browsing session until the fixed build is the one actually executing. Staged rollout percentages, pilot-ring soak periods, and admin-set update deferral on Chrome/Edge and other Chromium-derived browsers must be overridden for the security channel: push to the whole fleet at once and force the relaunch rather than waiting for the user to close their windows. The packet shows no live-patch path, so the update only takes effect on restart — an endpoint that has downloaded the fixed build but has not relaunched is still running the vulnerable V8 and must be reported as exposed, not as updated. Fleet reporting therefore has to key on the running browser version, not on update-channel assignment.",
+        "evidence": "The packet records a type confusion (CWE-843) in V8 \"exploitable by an attacker-controlled web page for code execution in the renderer\", CISA KEV-listed 2025-11-19 with active_exploitation \"confirmed\", poc_available true, CVSS 8.8, RWEP 77. patch_available is true, live_patch_available is false, and live_patch_notes state the vendor patch typically requires a service restart or system reboot per the KEV requiredAction. The packet also notes browser zero-days of this class are typically used in targeted-spyware or watering-hole chains.",
+        "gap_closes": [
+          "AU-Essential-8-App-Hardening",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management",
+          "NIST-800-53-SI-2",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "Browsers are routinely excluded from vulnerability-management SLAs on the assumption that they update themselves, so a KEV listing against Chromium lands on software no SLA is tracking. This entry has to be booked as a KEV item with a named owner and a deadline anchored to 2025-11-19, and the compliance evidence must be a count of endpoints still running a pre-fix V8 build at each checkpoint — not a screenshot of the update policy. Stragglers that cannot relaunch inside the window (kiosk, shared-session, or change-frozen hosts) need a documented compensating action for the delivery path, since the exploit arrives as ordinary web content rather than as an installed file.",
+        "evidence": "The packet records CISA KEV listing on 2025-11-19 with active_exploitation \"confirmed\", RWEP 77, CVSS 8.8, poc_available true, patch_available true and live_patch_available false. NIST SP 800-53 SI-2 (Flaw Remediation), ISO/IEC 27001:2022 A.8.8 and NIS2 Art. 21 patch management are the framework controls this entry already cites as insufficient.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management",
+          "NIST-800-53-SI-2"
+        ]
+      }
+    ]
   },
   "CVE-2025-58034": {
     "name": "Fortinet FortiWeb OS Command Injection Vulnerability",
@@ -16691,7 +17753,21 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "The exposure here is a provisioning-state defect, not an install-window one: the packet's vector text records that Triofox's initial setup pages stay reachable after setup is complete, so every already-provisioned server is affected for its whole service life and an unauthenticated caller reaches functionality reserved for authorized users. That places the KEV clock (listed 2025-11-12, exploitation confirmed) on production instances operators consider finished and therefore out of the active change queue — the SLA has to reach 'completed' deployments, not just ones under build. A vendor fix exists; the packet records no live-patch path and notes the vendor patch typically requires a service restart or system reboot, so restart authority must be pre-approved inside the window rather than negotiated after it. Because the flaw grants access rather than degrading the service, meeting this SLA means verifying the remediated state of each server — confirming the setup surface is no longer reachable unauthenticated — not recording a build number and closing the ticket.",
+        "evidence": "Packet fields for CVE-2025-12480 (Gladinet Triofox Improper Access Control Vulnerability): cwe_refs CWE-284; cisa_kev=true with kev_date 2025-11-12; active_exploitation=confirmed; poc_available=true; cvss 8.8; rwep_score 77; vector text states the product allows access to initial setup pages even after setup is complete; attack_vector states an unauthenticated attacker can reach functionality reserved for authorized users; patch_available=true; live_patch_available=false with live_patch_notes stating no live-patch tool is registered and that the vendor patch typically requires service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      }
+    ]
   },
   "CVE-2025-62215": {
     "name": "Microsoft Windows Race Condition Vulnerability",
@@ -19011,7 +20087,30 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-030",
+        "name": "PERIMETER-DEVICE-ZERODAY-SLA-TIER",
+        "description": "The exposed surface here is the SNMP subsystem of IOS and IOS XE, and the packet's fix path requires a device restart or reload — on routing and switching gear that means a change window measured in weeks under the routine cadence, while a low-privileged attacker can already force the reload as a denial of service and a high-privileged one can execute code as root. This control requires the alternative to be exercised on the KEV clock instead of waiting: restrict the SNMP listener to a management ACL and trusted collectors, or take SNMP out of service on exposed devices, within hours of listing, because that is the only action that closes the reachable path before the reload window arrives. The citing gaps frame this as operating-system patching; the device is the network's trust boundary and its management protocol is the exposed interface, so it needs its own SLA tier with interface isolation as a first-class satisfying action.",
+        "evidence": "Packet: cisa_kev true, kev_date 2025-09-29, active_exploitation \"confirmed\", RWEP 77, CVSS 9.8, poc_available true, CWE-121. Vector: \"Cisco IOS and IOS XE contains a stack-based buffer overflow vulnerability in the Simple Network Management Protocol (SNMP) subsystem that could allow for denial of service or remote code execution. A successful exploit could allow a low-privileged attacker to cause the affected system to reload, resulting in a DoS condition, or allow a high-privileged attacker to execute arbitrary code as the root user and obtain full control of the affected system.\" patch_available true; live_patch_available false; live_patch_notes: \"No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.\"",
+        "gap_closes": [
+          "NIS2-Art21-network-security",
+          "UK-CAF-B4",
+          "AU-Essential-8-Patch"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "The packet's high-privilege path ends in arbitrary code as the root user with full control of the device, and exploitation is confirmed in the wild — so for any IOS or IOS XE device whose SNMP surface was reachable during the exposure window, loading the fixed image remediates the flaw but not the device. The runbook must default to exporting and diffing the running and startup configuration against a known-good baseline, rebuilding from a verified image, and rotating every credential the device held (its SNMP credentials, local and privileged-mode secrets, and any AAA or routing-protocol keys stored on it) before returning it to service. Reloading into the patched image and closing the ticket preserves whatever a root-level attacker changed on the box, which is precisely what the SI-2 and A.8.8 flaw-remediation gaps score as remediated.",
+        "evidence": "Packet: cisa_kev true, kev_date 2025-09-29, active_exploitation \"confirmed\", RWEP 77, CVSS 9.8, poc_available true. Vector states a high-privileged attacker can \"execute arbitrary code as the root user and obtain full control of the affected system,\" and a low-privileged attacker can cause the system to reload for a DoS condition; the attack_vector summary records the flaw as exploitable for denial of service and remote code execution. patch_available true; live_patch_available false; live_patch_notes: \"No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.\"",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "ISO-27001-2022-A.8.8"
+        ]
+      }
+    ]
   },
   "CVE-2021-21311": {
     "name": "Adminer Server-Side Request Forgery Vulnerability",
@@ -19601,7 +20700,39 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-121",
+        "name": "MOBILE-ZERO-CLICK-HARDENING",
+        "description": "WhatsApp's linked-device synchronization path causes the target handset to fetch and process content from an attacker-named URL with no action by the target, so no awareness, phishing-report or attachment-scanning control has anything to act on. For high-risk users (journalists, executives, legal, activist-adjacent contacts) the pre-patch control is to stop the handset from automatically retrieving and rendering message-delivered content: enable the platform's reduced-attack-surface mode (Lockdown Mode on Apple devices and the equivalent hardening on Android), turn off automatic media download and link previews in the messaging client, and — because this flaw rides the linked-device sync channel specifically — audit each account's linked-device list on a schedule and unlink any session the user does not recognise. This closes the delivery step rather than the memory-corruption step: the chained Apple ImageIO flaw only gets its input once the attacker-named content has been fetched.",
+        "evidence": "Packet: CWE-863 incorrect authorization arising from incomplete authorization of linked-device synchronization messages, which 'could allow an unrelated user to trigger processing of content from an arbitrary URL on a target's device'; characterised as the zero-click delivery half of a mobile-spyware chain, paired in the wild with CVE-2025-43300. cisa_kev true, kev_date 2025-09-02, active_exploitation 'confirmed', poc_available true, cvss 8.8, rwep_score 77.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-056",
+        "name": "MOBILE-ENDPOINT-MDM-ENFORCED-KEV-SLA",
+        "description": "WhatsApp is a consumer-store application updated on the user's own schedule, which is precisely the class of software that falls outside an OS-centric patch programme — the fixed client reaches most handsets only when the user next opens the app store. A managed fleet must treat the fixed WhatsApp build as an MDM/UEM-pushed, deferral-disallowed update on the KEV clock: forced app update and managed-app configuration on corporate-owned devices, and a conditional-access block that denies organisational data to BYOD handsets still reporting a vulnerable build. The paired Apple flaw must be pushed on the same clock, since the two halves of this chain ship from different vendors through different update channels and a fleet that closes only one of them is still chainable.",
+        "evidence": "Packet: patch_available true; live_patch_available false, with live_patch_notes 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction' — so deploying the vendor-fixed build is the only remediation this entry records. cisa_kev true, kev_date 2025-09-02, active_exploitation 'confirmed'. The chained flaw named in the packet, CVE-2025-43300, is an Apple issue, i.e. a separate vendor's update channel from the messaging client.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-043",
+        "name": "NATION-STATE-INITIAL-ACCESS-IR-ESCALATION",
+        "description": "A zero-click compromise of this kind produces no user-reportable artefact — nothing was clicked, nothing was opened — so it enters incident response only through a vendor threat notification or an anomalous linked-device entry, and commodity handling ('reinstall the app, reset the phone') destroys the evidence while leaving the second-stage implant unexamined. The runbook needs an explicit targeted-intrusion path triggered by that signal rather than by an actor name: preserve and image the handset before any update, wipe or re-enrolment; contact the target out-of-band on a different device; treat every account, token and credential reachable from that handset as exposed across the responder-established exposure window; and proceed on the assumption that the chained content-processing stage succeeded, rather than requiring proof of it before escalating.",
+        "evidence": "Packet: active_exploitation 'confirmed' with CISA KEV listing 2025-09-02 and poc_available true; the entry is described as the zero-click delivery half of a mobile-spyware chain paired in the wild with CVE-2025-43300, and exploitation requires no interaction from the target (an unrelated user triggers the processing). NIS2-Art21-incident-handling is among the framework gaps that already cite this CVE as evidence.",
+        "gap_closes": [
+          "NIS2-Art21-incident-handling"
+        ]
+      }
+    ]
   },
   "CVE-2025-57819": {
     "name": "Sangoma FreePBX Authentication Bypass Vulnerability",
@@ -20536,7 +21667,40 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "Cisco ISE and ISE-PIC nodes must be driven to the fixed release on a KEV-tied clock measured in hours, not on the estate's routine appliance-maintenance cadence. The flaw is reached pre-authentication through a crafted API request and yields root on the box that arbitrates network admission, so the exposure is not confined to the appliance: while it stands, an anonymous caller owns the RADIUS/TACACS+ policy decision point. Because no live-patch primitive is registered for this entry, the fix is a vendor patch that takes a service restart or reboot, which means the restart window has to be pre-authorized against the KEV clock rather than negotiated after the listing. Any ISE node that cannot be patched inside the SLA must have its API surface restricted to management networks as an interim measure and be recorded as unremediated, not as 'scheduled'.",
+        "evidence": "Packet: CISA KEV-listed 2025-07-28 with active_exploitation=confirmed; CVSS 9.8, RWEP 77, poc_available=true. The vector records an injection flaw in a specific API of Cisco ISE and Cisco ISE-PIC caused by insufficient validation of user-supplied input, exploitable by submitting a crafted API request, with successful exploitation allowing remote code execution and root privileges on an affected device (CWE-74); the attack_vector records the code execution as unauthenticated. patch_available=true, live_patch_available=false, and live_patch_notes state the vendor patch typically requires service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "An ISE node that was reachable while unpatched must be treated as compromised rather than merely vulnerable. Because the defect runs attacker code as root before authentication, the default response is configuration export, rebuild from vendor media, and rotation of every secret the node holds — RADIUS and TACACS+ shared secrets, the directory join credential, administrator and API accounts, and certificate material — instead of applying the update to the running appliance. Patch-in-place closes the API defect while leaving any root-level implant, attacker-added admin account, or exported policy database untouched, and the restart the patch itself requires is easily mistaken for evidence that the node came back clean.",
+        "evidence": "Packet: active_exploitation=confirmed with a CISA KEV listing dated 2025-07-28 and poc_available=true, so exposure of an unpatched node is an exploitation opportunity rather than a theoretical one (RWEP 77, CVSS 9.8). The vector states successful exploitation allows an attacker to perform remote code execution and obtain root privileges on an affected device via a crafted API request; the attack_vector records that execution as unauthenticated. patch_available=true and live_patch_available=false — the packet's only remediation is a vendor patch requiring a service restart or system reboot, so the outage a rebuild needs is already budgeted by the remediation itself.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-patch-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-037",
+        "name": "FLEET-COMPROMISE-IR-PLAYBOOK",
+        "description": "Root on ISE is root on the identity decision point for every endpoint the network admits, so the playbook has to extend past the appliance itself: invalidate device trust state and posture verdicts issued during the exposure window, revoke and re-issue certificates the deployment enrolled or vouched for, audit policy-set and authorization-profile changes made since the KEV listing date, define quarantine criteria for endpoints admitted under a policy that may have been rewritten, and rotate credentials for every administrator and service account that authenticated through the affected deployment. Without that downstream sweep the operator patches the node and leaves the attacker's admission decisions and enrolled endpoints in force.",
+        "evidence": "Packet: the vector records an injection flaw reached through a crafted API request to a specific API of Cisco Identity Services Engine and ISE-PIC, allowing remote code execution and root privileges on an affected device; the attack_vector records it as unauthenticated code execution on Cisco ISE. active_exploitation=confirmed, CISA KEV-listed 2025-07-28, poc_available=true, RWEP 77, CVSS 9.8 — the interval from that listing date to patch deployment is the window whose identity decisions need review.",
+        "gap_closes": [
+          "UK-CAF-B2"
+        ]
+      }
+    ]
   },
   "CVE-2025-20281": {
     "name": "Cisco Identity Services Engine Injection Vulnerability (variant: CVE-2025-20281)",
@@ -22356,7 +23520,38 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "MOBILE-OS-MINIMUM-PATCH-LEVEL-ENFORCEMENT",
+        "name": "MOBILE-OS-MINIMUM-PATCH-LEVEL-ENFORCEMENT",
+        "description": "An operator cannot remediate this flaw in place — the incorrect-authorization defect is in the Qualcomm chipset's GPU driver, so it closes only when the handset is running a build that carries the vendor fix. The enforcing control is therefore a minimum device security-patch level as a condition of access to organizational data, not as a reported attribute: the MDM/EMM must read each enrolled device's patch level, block or quarantine devices below the level carrying the Qualcomm fix, and — because the unauthorized GPU command sequence has to be issued by code already running on the device — constrain side-loaded and untrusted app installation on devices that cannot yet update. The distinguishing test: enroll a device pinned below the fixing patch level and confirm policy denies it access to protected resources; if the only outcome is a stale-patch-level row on a dashboard, the estate is attesting patch management it is not enforcing.",
+        "evidence": "Packet: incorrect authorization (CWE-863) in the Qualcomm Adreno GPU driver across multiple Qualcomm chipsets, allowing unauthorized GPU command execution in the GPU micronode while executing a specific sequence of commands, corrupting memory to escalate privilege; exploited in the wild in Android targeted chains. patch_available true, live_patch_available false, and live_patch_notes records that no live-patch tool is registered and the vendor patch typically requires service restart or system reboot per the KEV requiredAction — remediation lands only when the device itself updates and restarts. RWEP 77, CVSS 8.8, poc_available true.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "The remediation clock for this entry must run from the KEV listing date, not from an internal severity triage of a chipset advisory the organization cannot act on directly. Because the fix is device-resident, 'mitigation deployed' has to be evidenced per handset — the count of devices confirmed on a fixed build and restarted — rather than as a single closed advisory ticket. The packet records no live-patch path for this CVE, so there is no in-place option that avoids the restart; devices that cannot take the update inside the SLA must be moved out of scope for organizational data as a documented compensating decision rather than being carried indefinitely as 'pending patch'.",
+        "evidence": "Packet: cisa_kev true with kev_date 2025-06-03 and active_exploitation confirmed; poc_available true; patch_available true with live_patch_available false, and live_patch_notes stating no live-patch tool is registered and that the vendor patch typically requires service restart or system reboot per the KEV requiredAction. RWEP 77 against CVSS 8.8.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-121",
+        "name": "MOBILE-ZERO-CLICK-HARDENING",
+        "description": "This CVE is an escalation primitive, not an entry point — the unauthorized GPU command sequence must be issued by code already executing on the handset, and the packet notes that LPEs of this class are routinely paired with an initial-access primitive in the Android targeted chains where it was exploited. For high-risk users, the control that acts inside the window before a fixed build reaches the device is a reduced-attack-surface mode that stops automatic processing of untrusted message attachments, fonts and link previews, removing the delivery leg the GPU escalation is chained to. This is additive to the device update, not a substitute for it: the vendor fix exists and still has to land, with the restart the KEV requiredAction implies.",
+        "evidence": "Packet: incorrect authorization (CWE-863) in the Qualcomm Adreno GPU driver; memory corruption via unauthorized command execution in the GPU micronode; exploited in the wild in Android targeted chains, with the packet stating that LPEs of this class are routinely paired with an initial-access primitive. cisa_kev true, kev_date 2025-06-03, active_exploitation confirmed, RWEP 77, poc_available true; live_patch_available false with the vendor patch requiring restart or reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2025-21480": {
     "name": "Qualcomm Multiple Chipsets Incorrect Authorization Vulnerability (variant: CVE-2025-21480)",
@@ -23531,7 +24726,41 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "The CLFS driver fix must be scheduled off a KEV clock rather than a change-advisory maintenance window, on servers as well as workstations, because this is the escalation half of a ransomware intrusion: the packet records that LPEs of this class are routinely paired with an initial-access flaw, so the window between a phishing foothold and domain-wide SYSTEM is measured in minutes, not in patch cycles. There is no live-patch path for this entry and the fix is a kernel-driver replacement that only becomes active after the restart or reboot the KEV requiredAction calls for, so the SLA must be tracked to reboot-completed per host. Production servers whose owners defer reboots — the exact machines whose compromise is worth the most to an operator — are the population this control exists to force through, and 'patched, pending reboot' must be reported as unremediated.",
+        "evidence": "Packet fields for CVE-2025-32706: cisa_kev true, kev_date 2025-05-13, active_exploitation confirmed, rwep_score 77, cvss 9.8, poc_available true, cwe_refs CWE-122. patch_available true, live_patch_available false, live_patch_notes \"No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.\" Packet attack_vector: \"a heap-based buffer overflow (CWE-122) in the Windows Common Log File System (CLFS) driver — a recurring kernel-LPE target — exploited by a local foothold to escalate to SYSTEM ... LPEs of this class are routinely paired with an initial-access flaw by ransomware operators.\"",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-003",
+        "name": "KERNEL-EXPLOITATION-DETECTION",
+        "description": "Between KEV listing and the reboot that actually activates the CLFS driver fix, detection of the escalation attempt is the only control still standing, and the cited framework controls do not require it. Hosts must carry telemetry that alerts inside a minute on kernel privilege-escalation indicators for this path: a non-privileged process acquiring a SYSTEM token, and anomalous creation or manipulation of CLFS log files by user-context processes. The escalation runs entirely on the host from a foothold the attacker already has, so it produces no network-side indicator for a perimeter sensor to catch, and least-privilege posture does not contain it — the packet's own description is a local foothold reaching SYSTEM, which means standard-user-only accounts are not a mitigating control here and cannot be attested as one.",
+        "evidence": "Packet fields for CVE-2025-32706: cwe_refs CWE-122, cvss 9.8, rwep_score 77, poc_available true, cisa_kev true (kev_date 2025-05-13), active_exploitation confirmed. Packet attack_vector: \"a heap-based buffer overflow (CWE-122) in the Windows Common Log File System (CLFS) driver ... exploited by a local foothold to escalate to SYSTEM.\" live_patch_available false; live_patch_notes states the vendor patch \"typically requires service restart or system reboot per the KEV requiredAction,\" leaving a detection-only interval on hosts awaiting restart. Citing gaps include NIST-800-53-AC-6 (Least Privilege) and UK-CAF-B4 (System security).",
+        "gap_closes": [
+          "NIST-800-53-AC-6",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-042",
+        "name": "INCOMPLETE-PATCH-SEQUENCE-SEVERITY-MULTIPLIER",
+        "description": "The packet characterizes the CLFS driver as a recurring kernel-LPE target, which means a vulnerability-management program that scores this heap overflow as a discrete finding will re-learn the same lesson at the next CLFS CVE. Any CVE landing on the CLFS driver should carry a severity multiplier over an equivalent-CVSS flaw in a component with no exploitation history, and the CLFS surface should sit on a standing watchlist so the next advisory is triaged as a likely-exploited repeat rather than routed through generic intake. Practically: a host estate that has applied and rebooted for this CVE still carries elevated structural risk on the same primitive, and that residual should be stated in the risk register rather than being closed out when the patch record goes green.",
+        "evidence": "Packet attack_vector for CVE-2025-32706 describes the Windows Common Log File System (CLFS) driver as \"a recurring kernel-LPE target.\" Supporting packet fields: cwe_refs CWE-122, cvss 9.8, rwep_score 77, cisa_kev true with kev_date 2025-05-13, active_exploitation confirmed, poc_available true.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      }
+    ]
   },
   "CVE-2025-32701": {
     "name": "Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability",
@@ -24842,7 +26071,30 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "The \"whichever is later\" half of this control is the operative one here. Adobe shipped the fix in APSB09-15 in 2009, so every SLA anchored to patch availability expired more than a decade ago and reports green today, while the event that actually reopens the exposure is CISA's 2026-05-20 listing. Estates must re-run the KEV clock from that listing date against their installed Acrobat and Reader inventory, treat any host still on a pre-APSB09-15 build as an open KEV item on an hours-level deadline, and record the verified action as the application update — there is no live-patch path for this entry, so remediation means the reader binaries on the endpoint changed, not that a policy was reasserted. A KEV programme that only enqueues recently-published CVEs will never generate this work item at all.",
+        "evidence": "The packet records CISA KEV listing on 2026-05-20 with active_exploitation \"confirmed\", RWEP 65, CVSS 8.8 and poc_available true, for a heap-based buffer overflow (CWE-122) triggered by an attacker-controlled PDF for code execution in the reader process. patch_available is true, live_patch_available is false, and live_patch_notes name \"Adobe patch APSB09-15 (2009); application update\".",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-074",
+        "name": "CVE-REGRESSION-WATCHER",
+        "description": "No advisory feed re-announces a 2009 CVE, so nothing in a new-CVE-driven intake pipeline surfaced this entry; it became visible only when CISA re-listed it, by which point exploitation was already confirmed. Threat intake for document-reader software must therefore watch current exploitation and PoC signal for historical CVE ids and route each hit straight to an inventory query for pre-fix Acrobat/Reader builds — CVE-2009-3459 clears the watcher's historical-id threshold by seventeen years. The triage outcome here resolves to a long-tail unpatched estate rather than a code regression, and that is the point: the watcher is the only mechanism that raises an aged, still-exploited flaw at all, whichever way the triage lands.",
+        "evidence": "The CVE id is from 2009 while the packet's KEV listing is dated 2026-05-20, with active_exploitation \"confirmed\" and poc_available true. The packet states the legacy re-listing exists \"because long-tail unpatched/end-of-life estates remain exposed\".",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      }
+    ]
   },
   "CVE-2010-0249": {
     "name": "Microsoft Internet Explorer Use-After-Free (Operation Aurora)",
@@ -25782,7 +27034,30 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "academic_ai_fuzzing",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-017",
+        "name": "BUG-FAMILY-MITIGATION-PERSISTENCE",
+        "description": "The vendor fix bounds NSEC3 iteration and closest-encloser work, but the packet records a second worst-case-work primitive in the same validating path disclosed alongside it (key-tag collision handling), which is exactly the sibling-bug condition this control exists for. Resolver operators must keep the query-side limits they ran before upgrading — recursion restricted to known client ranges, per-client query and CPU budgets, response-rate limiting, and alerting on validator CPU saturation — in force after the upgrade, for a stated soak period, rather than retiring them on the strength of a version bump. Dropping them leaves the resolver defended only against the specific iteration-counting path this CVE names, inside a validation routine where a second forced-work primitive has already been demonstrated. The soak also has to be tracked per resolver instance, because the fix only takes effect on the instances that have actually been restarted.",
+        "evidence": "Packet: the vector states that validating an NSEC3 closest-encloser proof for a crafted response forces the resolver to perform a large number of SHA-1 hash iterations, and that the fix is vendor patches bounding the NSEC3 iteration/closest-encloser work. The attack_vector describes the class as a single crafted DNSSEC response forcing worst-case signature/hash work, naming both KeyTrap key-tag collisions and NSEC3 iteration enumeration as co-disclosed (Feb 2024), stalling the resolver for all clients. CWE-400, CVSS 7.5, RWEP 37, poc_available=true, active_exploitation=suspected, cisa_kev=false. patch_available=true, live_patch_available=false, and live_patch_notes state remediation is a software update requiring a service restart, not a host reboot.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "ISO-27001-2022-A.8.8",
+          "AU-Essential-8-Patch"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-008",
+        "name": "CRYPTO-SUBSYSTEM-CVE-DISCLOSURE",
+        "description": "DNSSEC validation is the cryptographic subsystem this flaw attacks, so while a resolver runs an unbounded-iteration build the organization cannot count 'DNSSEC validation enabled' as a compensating control for DNS response integrity — turning it on is precisely what exposes the resolver to a single crafted response that stalls resolution for every client behind it. Any risk narrative that leans on DNSSEC to cover spoofing or cache-poisoning risk must record that dependency explicitly, state the availability trade-off, and stop presenting a validating resolver as a net-positive control until the bounded build is deployed and each instance restarted. This matters most where one validating resolver is a shared dependency of the whole service estate, since its stall is a simultaneous outage for every dependent service rather than a single-system fault.",
+        "evidence": "Packet: CWE-400 resource exhaustion located in the DNSSEC validation path — the vector states that validating an NSEC3 closest-encloser proof for a crafted response drives a large number of SHA-1 hash iterations and consumes CPU, and the attack_vector states a single crafted DNSSEC response stalls the resolver for all clients. CVSS 7.5, RWEP 37, poc_available=true, active_exploitation=suspected, cisa_kev=false (no KEV clock applies). patch_available=true with live_patch_available=false; live_patch_notes state the remediation is a software update requiring a service restart rather than a host reboot, so exposure persists on each instance until that restart happens.",
+        "gap_closes": [
+          "DORA-Art-9",
+          "ISO-27001-2022-A.8.8"
+        ]
+      }
+    ]
   },
   "CVE-2023-44487": {
     "name": "HTTP/2 Rapid Reset — stream open-then-RST_STREAM flood (record-breaking DDoS)",