@blamejs/exceptd-skills 0.19.5 → 0.19.7

package/data/zeroday-lessons.json

@@ -1,7 +1,7 @@
 {
   "_meta": {
     "schema_version": "1.1.0",
-    "last_updated": "2026-08-08",
+    "last_updated": "2026-08-09",
     "last_threat_review": "2026-05-17",
     "purpose": "Zero-day learning loop output. Each entry maps a CVE to: attack vector, defense chain analysis, framework coverage, new control requirements generated, and exposure scoring. v1.1.0 (2026-05-15): every entry now carries ai_discovered_zeroday boolean + ai_discovery_source enum + ai_discovery_date + ai_assist_factor ladder, per AGENTS.md Hard Rule #7.",
     "note": "Never delete entries. Closed gaps are marked status: closed. History is data.",
@@ -2085,7 +2085,29 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "human_researcher",
-    "ai_assist_factor": "low"
+    "ai_assist_factor": "low",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-009",
+        "name": "KERNEL-MODULE-INVENTORY-AND-DISABLE",
+        "description": "On every node running CRI-O, treat the host's loadable-module surface as the blast radius of the container runtime: inventory the modules a node actually needs for its workloads, blocklist the remainder in modprobe configuration, and enforce a locked/signed module set so a modprobe invocation carrying pod-spec-derived arguments cannot pull in a module the node's business function never requires. This is the compensating layer that survives an attacker who legitimately holds pod-create RBAC, because the module load is performed by the runtime on the host — not inside the container — so pod-level confinement (dropped capabilities, seccomp, AppArmor) never observes it. The distinguishing test: from a pod-create-capable service account on a staging CRI-O cluster, submit a pod spec whose attributes drive modprobe toward a module outside the node's approved inventory and confirm the load is refused rather than silently completed on the host; a cluster that passes image-scan and RBAC review still yields node-level module loading if the node's module set is unbounded.",
+        "evidence": "Packet: pod-spec attributes reach the modprobe argument path in CRI-O without validation, so 'an attacker with pod-create RBAC on a cluster using CRI-O can cause arbitrary kernel modules to load on the host node, achieving container-escape-equivalent capability' (CWE-20). CVSS 8.1, RWEP 30, poc_available: true. Not CISA KEV-listed and active_exploitation is unknown — the reason a CVSS/KEV-tiered flaw-remediation cadence deprioritizes it despite node-level impact. The entry records patch_available: true and live_patch_available: true, so a runtime fix and a live-patch path both exist; the module-inventory control is what covers the window before that fix lands and the residual after it.",
+        "gap_closes": [
+          "NIST-800-53-CM-7",
+          "AU-Essential-8-App-Hardening",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-036",
+        "name": "FLEET-CONTROL-PLANE-ADMIN-PRIVILEGE-TIER",
+        "description": "Classify pod-create authority on a CRI-O cluster as fleet-control-plane privilege rather than application-developer privilege. This CVE collapses the distance between the two: the namespace-scoped ability to submit a pod spec is, on an unpatched CRI-O node, the ability to load an arbitrary kernel module on the host. Every identity that holds pod-create on such a cluster — human operators and CI service accounts alike — therefore needs the control-plane tier's handling: an identity separate from application admin roles, just-in-time elevation with an approval step, and access only through a privileged path; and cluster RBAC must be audited for who holds pod-create outside that tier. The CIS Kubernetes admission guidance cited against this entry inspects what a pod requests (assigned capabilities, AppArmor profile) and does not help here, because the escape requires no elevated capability in the pod at all — the privileged action is taken by the runtime on the pod's behalf.",
+        "evidence": "Packet: 'Pod-spec attributes reach modprobe argument path in CRI-O without validation. An attacker with pod-create RBAC on a cluster using CRI-O can cause arbitrary kernel modules to load on the host node, achieving container-escape-equivalent capability.' The gap cited against this entry, CIS Kubernetes Benchmark v1.10.0 item 4.2.13, is scoped as 'Minimize the admission of containers with capabilities assigned (Kubelet / AppArmor profile guidance)'. CWE-20, CVSS 8.1, RWEP 30, poc_available: true.",
+        "gap_closes": [
+          "CIS-Kubernetes-Benchmark-4.2.13"
+        ]
+      }
+    ]
   },
   "CVE-2023-43472": {
     "name": "MLflow path-traversal arbitrary file read",
@@ -2369,7 +2391,28 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "human_researcher",
-    "ai_assist_factor": "low"
+    "ai_assist_factor": "low",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "The Orion authentication-bypass fix has to run on the KEV clock rather than the change window an internal monitoring server normally gets. Exploitation needs nothing but a single HTTP request whose URI matches the SkipI18nStrings pattern to land on Orion's API write endpoints — there is no credential to brute-force, no user to phish and no exploit-development lead time, so exposure lasts exactly as long as the unpatched Orion web surface stays reachable. The packet records a vendor fix as available and no live-patch path, so the mitigation is a scheduled Orion upgrade with the API surface restricted to a management segment (or the web service stopped) until the upgrade lands, not a deferral to the next quarterly maintenance slot.",
+        "evidence": "Packet: cisa_kev true, kev_date 2021-11-03, active_exploitation confirmed, rwep_score 75, cvss 9.8, poc_available true, patch_available true, live_patch_available false, live_patch_notes null, cwe_refs CWE-287. Vector: \"URI pattern matching against SkipI18nStrings triggers bypass — unauthenticated request matching the pattern reaches API write endpoints.\"",
+        "gap_closes": [
+          "AU-Essential-8-Patch"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-037",
+        "name": "FLEET-COMPROMISE-IR-PLAYBOOK",
+        "description": "Orion is a fleet control plane — it reaches, polls and holds credentials for the monitored estate — so the response to this bypass cannot end at the upgrade. The packet records SUNBURST operators using the bypass to exercise API write access against Orion installations that were already compromised, which means patching removes the entry path and leaves whatever was written through the API in place. The playbook's exposure-window steps are what actually apply here: enumerate every API write made against Orion during the window, audit configuration and job/alert-action changes made through it, invalidate the trust state of nodes Orion administers, and rotate every credential Orion custodied or that authenticated through it. That enumeration only exists if Orion's own per-request API telemetry was collected and retained off-box — monitoring programs scoped to the estate Orion watches routinely do not collect it for the monitoring platform itself, which is the monitoring gap this closes. It also closes the supply-chain gap: after a compromise delivered through the vendor product, a vendor patch restores the code but not the trust state of the installation or of the estate reachable from it.",
+        "evidence": "Packet attack_vector: \"URI pattern matching against SkipI18nStrings inside Orion's HTTP routing triggers an authentication bypass — an unauthenticated request that matches the pattern reaches API write endpoints. Used by SUNBURST operators to exercise API write access against compromised Orion installations.\" Packet: cisa_kev true, kev_date 2021-11-03, active_exploitation confirmed, poc_available true, rwep_score 75, cvss 9.8. Citing gaps already record UK-CAF-C1 (Security monitoring) and NIS2-Art21-supply-chain as insufficient for this CVE.",
+        "gap_closes": [
+          "UK-CAF-C1",
+          "NIS2-Art21-supply-chain"
+        ]
+      }
+    ]
   },
   "CVE-2023-3519": {
     "name": "Citrix NetScaler ADC/Gateway unauth RCE (CitrixBleed precursor)",
@@ -2502,7 +2545,40 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "human_researcher",
-    "ai_assist_factor": "low"
+    "ai_assist_factor": "low",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-036",
+        "name": "FLEET-CONTROL-PLANE-ADMIN-PRIVILEGE-TIER",
+        "description": "ScreenConnect is not an application server that happens to have admins — it is the control plane for every endpoint the affected MSP manages, and this CVE is what that distinction costs. The bypass is a URL suffix: appending /SetupWizard.aspx/anything defeats the auth filter and lands an unauthenticated caller in the admin setup endpoint, where a new admin account is created. No credential is guessed and no session is stolen, so console password policy, admin-account review and MFA-on-the-console all attest green while the takeover proceeds. What actually bites is treating ScreenConnect administration as a privilege tier above application admin: the admin and setup surface reachable only through a PAM jumphost rather than from the open internet (so /SetupWizard.aspx is not addressable by the attacker at all), and fleet-control-plane admin identities enumerated separately from every other admin role, so an account that appears without passing the just-in-time elevation and approval workflow is a detectable anomaly rather than one more row in the user table.",
+        "evidence": "Packet: cwe_refs CWE-287 + CWE-288, cvss 10, rwep_score 75, cisa_kev true, kev_date 2024-02-22, active_exploitation confirmed, poc_available true, patch_available true, live_patch_available false, live_patch_notes null. Attack vector as recorded: \"Path-traversal in the auth filter — appending /SetupWizard.aspx/anything to a request URL bypasses authentication and reaches the admin setup endpoint. Attacker creates a new admin account via the setup endpoint and gains full ScreenConnect control, including the ability to push remote-control payloads to every endpoint the affected MSP manages.\"",
+        "gap_closes": [
+          "UK-CAF-B2",
+          "NIST-800-53-AC-3",
+          "CIS-Controls-v8-Control6",
+          "ISO-27001-2022-A.5.15"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-037",
+        "name": "FLEET-COMPROMISE-IR-PLAYBOOK",
+        "description": "The vendor patch removes the bypass; it does not remove the admin account the bypass created, and it does not recall the payloads already pushed through that account. Because the packet's exploitation path ends at pushing remote-control payloads to every endpoint the affected MSP manages, one unpatched ScreenConnect server is not one compromised host — it is the whole downstream estate, and the response work is fleet-shaped rather than server-shaped. The runbook has to enumerate every admin account and remote session created since the exposure window opened, audit what was executed on managed endpoints during it, carry explicit quarantine criteria for endpoints that received a payload, and rotate credentials used on or through those endpoints. This has to be pre-rehearsed: an MSP discovering the compromise on the KEV date cannot start writing downstream-quarantine criteria while the attacker still holds an admin session.",
+        "evidence": "Packet: cisa_kev true, kev_date 2024-02-22, active_exploitation confirmed, poc_available true, cvss 10, rwep_score 75, patch_available true. Attack vector as recorded: the attacker \"creates a new admin account via the setup endpoint and gains full ScreenConnect control, including the ability to push remote-control payloads to every endpoint the affected MSP manages.\"",
+        "gap_closes": [
+          "UK-CAF-B2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "At CVSS 10 this reaches the top of any severity-ranked queue, so the question is not ranking but when the clock starts. The exploit primitive is a URL suffix with a public PoC — no chain to assemble, no credential to obtain, no user action to arrange — and it was KEV-listed 2024-02-22 with confirmed in-the-wild exploitation, so the interval between an operator's next maintenance window and an attacker's next internet scan is not a fair race. A patch SLA measured from the operator's monthly cycle is therefore the wrong instrument for a ScreenConnect instance: the clock has to start at the KEV listing, and where the restart cannot be booked inside it, the alternative is removing the instance from the internet, because the packet records no live-patch path for this entry.",
+        "evidence": "Packet: cisa_kev true, kev_date 2024-02-22, active_exploitation confirmed, cvss 10, rwep_score 75, poc_available true, patch_available true, live_patch_available false, live_patch_notes null, cwe_refs CWE-287 + CWE-288.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "NIS2-Art21-patch-management"
+        ]
+      }
+    ]
   },
   "CVE-2026-20182": {
     "name": "Cisco SD-WAN authentication bypass to admin",
@@ -2557,7 +2633,40 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "human_researcher",
-    "ai_assist_factor": "low"
+    "ai_assist_factor": "low",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-036",
+        "name": "FLEET-CONTROL-PLANE-ADMIN-PRIVILEGE-TIER",
+        "description": "A Cisco SD-WAN controller is not an application server that happens to have administrators — vManage is the policy plane for the whole WAN fabric, and this CVE is what that distinction costs. Because the bypass lands an unauthenticated caller in admin-equivalent state, every identity-layer attestation the operator holds stays green while the takeover proceeds: no credential is guessed, no session is stolen, and password policy, admin-account review and MFA-on-the-console are all evaluated on a login that never happens. The control that actually bites is treating controller administration as a privilege tier above application admin — the vManage/vEdge management surface reachable only through a PAM jumphost or operator network rather than from an untrusted one, so the bypassable endpoint is not addressable by the attacker at all; and fabric-control-plane admin identities enumerated separately from every other admin role, so an admin principal that appears on the controller without passing just-in-time elevation and the approval workflow is a detectable anomaly rather than one more row in the user table.",
+        "evidence": "Packet: cwe_refs CWE-287, cvss 10, rwep_score 65, cisa_kev true, kev_date 2026-05-14, active_exploitation confirmed, poc_available false, patch_available true, live_patch_available false, live_patch_notes null. Attack vector as recorded: \"Authentication bypass in the Cisco SD-WAN controller management plane (vManage / vEdge). An unauthenticated attacker reaches admin-equivalent state on the controller, giving control over the SD-WAN fabric's policy plane.\" The citing gaps recorded against this entry include NIST-800-53-IA-2, ISO-27001-2022-A.5.15 and UK-CAF-B2 — all three are marked insufficient here because the bypass resolves before the authentication control fires.",
+        "gap_closes": [
+          "UK-CAF-B2",
+          "ISO-27001-2022-A.5.15",
+          "NIST-800-53-IA-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "This entry is the case that a PoC-keyed remediation tier gets wrong. The packet records poc_available false alongside active_exploitation confirmed, so any SLA ladder whose fast lane opens on \"public exploit code exists\" routes a CVSS 10 controller takeover into a slow bucket while it is already being used. Keying the clock to the KEV listing itself — mitigation verified within 4 hours of listing or fix availability, whichever is later — is what puts this on the right lane. The packet records a vendor fix as available and no live-patch path, so the deliverable inside that window is the controller upgrade itself, and where the fabric's change-control cannot absorb a controller upgrade that fast, the SLA must be satisfied by the documented compensating control instead: withdrawing the vManage/vEdge management plane from untrusted reachability until the fixed build is on it. Recording \"scheduled for the next maintenance window\" is not a satisfied SLA under this control.",
+        "evidence": "Packet: cisa_kev true with kev_date 2026-05-14, active_exploitation confirmed, poc_available false, cvss 10, rwep_score 65, patch_available true, live_patch_available false, live_patch_notes null. The NIS2-Art21-network-security gap recorded against this entry states that Article 21 sets no CISA-KEV-tied response SLA for network-fabric controllers, so an operator can claim compliance with a generic 30-day patch SLA on this infrastructure; the DORA-Art-9 gap records that vendor-disclosure-to-action tempo is not differentiated per ICT-third-party-service category.",
+        "gap_closes": [
+          "NIS2-Art21-network-security",
+          "DORA-Art-9"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "Upgrading the controller closes the bypass and says nothing about what was done through it. Admin-equivalent state on an SD-WAN controller is exercised through the product's own legitimate functions — creating administrative accounts and API tokens, and editing the fabric policy and device templates that the controller pushes down to edge devices — so the attacker's artifacts are ordinary controller objects and ordinary pushed configuration, which no version scan and no malware signature will flag after the fixed build is installed. Any controller that was reachable from an untrusted network on a vulnerable build therefore has to be dispositioned as compromised rather than as remediated: export and diff the running controller configuration, policy definitions and device templates against the last known-good, audit every administrative account, token and template change since the exposure window opened, rotate the controller's local administrative credentials and the certificate and shared-secret material it holds for fabric membership, and re-verify the configuration actually resident on the edge devices rather than trusting the controller's own view of it.",
+        "evidence": "Packet: active_exploitation confirmed with cisa_kev true (kev_date 2026-05-14) — an exposed unpatched controller is an exploitation opportunity, not a hypothetical. The vector as recorded gives the attacker \"admin-equivalent state on the controller, giving control over the SD-WAN fabric's policy plane\" without authentication (CWE-287), so the post-exploitation actions are taken as a controller principal. patch_available true with live_patch_available false. The NIST-800-53-IA-2 gap recorded against this entry names the failure directly: an auth bypass that mints a privileged account satisfies whatever MFA policy applies, because the bypass happened at the create-account step rather than the login step, and its stated requirement is that privileged-account creation be audited independently of the MFA policy.",
+        "gap_closes": [
+          "NIST-800-53-IA-2",
+          "NIS2-Art21-network-security"
+        ]
+      }
+    ]
   },
   "CVE-2024-40635": {
     "name": "containerd integer overflow IP mask leak",
@@ -2612,7 +2721,30 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "human_researcher",
-    "ai_assist_factor": "low"
+    "ai_assist_factor": "low",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-028",
+        "name": "CONTAINER-RUNTIME-PATCH-SLA-24H",
+        "description": "The defect sits in containerd's CNI IP-allocation path, and a container receives its address and mask when its network is configured - so upgrading the containerd package on a node does not repair a workload that was already handed a spurious mask. Those containers keep permitting traffic across network namespaces until they are recreated on the fixed runtime, which makes the remediation unit node upgrade plus controlled recreation of every workload that was networked by the vulnerable allocation path, and makes the completion criterion 'no running container was networked by the vulnerable path' rather than 'containerd version is past the fix'. This entry is not KEV-listed and its exploitation status is unknown, so the control's KEV-triggered 24-hour clock does not fire here; what this CVE demonstrates is the recreation half of the control, the part every patch-cadence framework control omits because it assumes installing the fixed package ends the exposure. A vendor fix exists and no live-patch path is registered, so the recreation cannot be deferred in the hope of an in-place remedy.",
+        "evidence": "Packet attack_vector: 'Integer overflow in the containerd CNI IP-allocation path. A crafted CIDR specification overflows the uint32 mask conversion, causing the container to receive a spurious mask that allows traffic to leak across network namespaces.' Packet fields: cwe_refs CWE-200; cvss 5.9; rwep_score 30; cisa_kev false; kev_date null; active_exploitation unknown; poc_available true; patch_available true; live_patch_available false; live_patch_notes null. Citing gaps include AU-Essential-8-Patch and ISO-27001-2022-A.8.8.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-018",
+        "name": "SCANNER-PAPER-COMPLIANCE-TEST",
+        "description": "Two green reports coexist with this vulnerability. A CIS-Kubernetes 5.3 assessment passes by finding NetworkPolicy objects present and a policy-capable CNI, and a vulnerability scan passes by finding the containerd package at or past the fixed version. Neither verdict can see the failure: the container is handed a spurious mask by the allocation path, so traffic crosses network namespaces without any NetworkPolicy being violated - the leak is underneath the layer the benchmark inspects - and a package-version check says nothing about containers still running with a mask the vulnerable path gave them. The operational test has to touch the data plane: from a pod, attempt to reach an address in a neighbouring namespace's range that policy is supposed to forbid and confirm the packet is dropped, and enumerate running containers' allocated masks against the ranges their namespaces were meant to receive. Any assessment that reports boundary protection satisfied on the strength of policy-object presence plus a version string is paper compliance against exactly this defect.",
+        "evidence": "Packet attack_vector: 'Integer overflow in the containerd CNI IP-allocation path. A crafted CIDR specification overflows the uint32 mask conversion, causing the container to receive a spurious mask that allows traffic to leak across network namespaces.' Packet vector: 'Integer overflow in CNI IP-allocation path - container receives spurious mask, leaks across network namespaces.' Packet fields: cwe_refs CWE-200 (information disclosure), cvss 5.9, poc_available true, patch_available true. Citing gaps include CIS-Kubernetes-Benchmark-5.3 (Network Policies and CNI), NIST-800-53-SC-7 (Boundary Protection) and NIS2-Art21-network-security.",
+        "gap_closes": [
+          "CIS-Kubernetes-Benchmark-5.3",
+          "NIST-800-53-SC-7",
+          "NIS2-Art21-network-security"
+        ]
+      }
+    ]
   },
   "CVE-2026-30623": {
     "name": "Anthropic MCP SDK stdio command-injection",
@@ -2734,7 +2866,30 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "human_researcher",
-    "ai_assist_factor": "low"
+    "ai_assist_factor": "low",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-054",
+        "name": "BACKUP-TIER-NETWORK-ISOLATION",
+        "description": "A BeeStation is a consumer NAS whose whole purpose is holding the primary and backup copy of a household's or a branch site's data, and the packet's attack path reaches it with no credential and no user interaction — a pre-auth chain against the BeeStation Manager web management surface ending in OS command execution on the box that holds the data. Applied to this product, the control means the BeeStation Manager web surface answers only from an operator subnet or an authenticated VPN: not from the general user VLAN, and not from the internet via a UPnP mapping or a home-router port forward, which is how consumer NAS hardware at remote-worker and small-branch sites normally acquires exposure. The appliance's outbound path should be constrained too, so a rooted BeeStation cannot reach arbitrary destinations with the data it holds. Reachability is the entire exploit precondition for a pre-auth CWE-78 flaw, and it is the only lever an operator holds between a public exploit chain and a firmware update landing on a device that no enterprise console manages — the packet records a vendor patch but no live-patch path, so the appliance has to be taken through the update to remediate. The distinguishing test: from a general user VLAN and from an external address, attempt to load the BeeStation Manager web surface; anything that answers is within reach of the published chain, and \"the NAS is on the internal network\" is an assertion about topology, not a demonstration that the management surface is unreachable from untrusted segments.",
+        "evidence": "Packet: CVE-2025-12686, \"Synology BeeStation unauth RCE (Pwn2Own Ireland 2025)\", CWE-78, attack vector recorded as a pre-auth RCE chain on the Synology BeeStation Manager web management surface, demonstrated as a full chain on consumer NAS hardware at Pwn2Own Ireland 2025. CVSS 9.8, RWEP 45, poc_available true, cisa_kev false, active_exploitation unknown, patch_available true, live_patch_available false (live_patch_notes null). UK-CAF-B4 (system security) is already recorded as an insufficient control citing this CVE.",
+        "gap_closes": [
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-018",
+        "name": "SCANNER-PAPER-COMPLIANCE-TEST",
+        "description": "For this entry the paper-compliance failure is not a mis-compared version string but an asset that never enters the scan at all. Consumer NAS hardware arrives at remote-worker and small-branch sites outside the procurement and agent-deployment path, so an estate can report zero outstanding criticals while a BeeStation with a CVSS 9.8 pre-auth command-injection flaw and a public exploit chain runs unlisted on the same network. The operational test for this CVE: does the vulnerability-management programme enumerate the BeeStation as an asset and resolve its BeeStation Manager firmware build against CVE-2025-12686, or does the compliance verdict come from an endpoint-management console whose coverage is defined as managed workstations and servers? A second, independent failure: with cisa_kev false and active_exploitation unknown, a queue that escalates only on KEV listing leaves this CVE unranked despite a demonstrated working exploit chain, so the enumeration has to be paired with a severity input that does not depend on a KEV entry appearing. The distinguishing test: pick a site known to run a BeeStation and query the vulnerability register for that appliance's firmware build — an empty result, not a low-severity result, is the finding, and it is what a patch-management attestation against NIST-800-53-SI-2 or ISO 27001 A.8.8 will not reveal.",
+        "evidence": "Packet: CVE-2025-12686 is a pre-auth RCE chain (CWE-78) on the Synology BeeStation Manager web management surface, demonstrated on consumer NAS hardware at Pwn2Own Ireland 2025. CVSS 9.8, RWEP 45, poc_available true, cisa_kev false, active_exploitation unknown, patch_available true. AU-Essential-8-Patch, ISO-27001-2022-A.8.8, NIST-800-53-SI-2 and NIS2-Art21-vulnerability-management are all already recorded as insufficient controls citing this CVE.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "ISO-27001-2022-A.8.8",
+          "AU-Essential-8-Patch",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      }
+    ]
   },
   "CVE-2025-62847": {
     "name": "QNAP QTS/QuTS hero RCE (Pwn2Own Ireland 2025, chain 1/3)",
@@ -2844,7 +2999,30 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "human_researcher",
-    "ai_assist_factor": "low"
+    "ai_assist_factor": "low",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-054",
+        "name": "BACKUP-TIER-NETWORK-ISOLATION",
+        "description": "On the QNAP TS-453E the appliance is simultaneously the file store and the restore source, so code execution on it is code execution on the copy of the data an operator would recover from. This CVE is not a standalone entry point — the packet records it as component 2/3 of a chain with CVE-2025-62847 and CVE-2025-62849 — which means the shared precondition for every link is network reachability of the QTS / QuTS hero web management surface. Applying the control to this product: the QTS / QuTS hero management surface must answer only from an operator subnet or an authenticated VPN, never from a general user VLAN and never through a UPnP mapping or branch-router port forward, and the appliance's own outbound path must be constrained so a rooted NAS cannot reach arbitrary destinations. Because a vendor patch exists but no live-patch path is registered for this entry, the appliance has to be taken through a firmware update to remediate — isolation is what covers the interval, and it collapses all three chain components at once rather than one CVE id at a time. The distinguishing test: from a user VLAN and from an external address, attempt to load the TS-453E's QTS / QuTS hero web management surface; anything that answers is inside the chain's reach, and a policy that merely records \"NAS appliances sit on the internal network\" has not demonstrated the management plane is unreachable from untrusted segments.",
+        "evidence": "Packet: CVE-2025-62848, \"QNAP QTS/QuTS hero RCE (Pwn2Own Ireland 2025, chain 2/3)\", CWE-94 code injection on the QNAP TS-453E appliance, demonstrated by the DEVCORE Research Team at Pwn2Own Ireland 2025 and chained with CVE-2025-62847 and CVE-2025-62849. CVSS 9.8, RWEP 40, poc_available true, cisa_kev false, active_exploitation unknown, patch_available true, live_patch_available false (live_patch_notes null). NIS2-Art21-network-security (security of network and information systems) and UK-CAF-B4 (system security) are both already recorded as insufficient controls citing this CVE.",
+        "gap_closes": [
+          "NIS2-Art21-network-security",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-018",
+        "name": "SCANNER-PAPER-COMPLIANCE-TEST",
+        "description": "A remediation register that closes this appliance on the strength of one ingested CVE id is paper compliance, because the packet describes a three-CVE chain and the appliance's exploitability is a property of the installed QTS / QuTS hero build, not of any single id. The operational test for this entry: does the vulnerability register resolve the TS-453E's actual installed firmware build against all three chain ids — CVE-2025-62847, CVE-2025-62848 and CVE-2025-62849 — and does it record which build closes each, rather than reporting \"remediated\" from whichever id the feed happened to deliver first? A second failure mode is prioritisation rather than detection: with cisa_kev false and active_exploitation unknown, a queue that escalates only on KEV listing never surfaces this CVE at all, even though the packet records a CVSS 9.8 code-injection flaw with a working public exploit chain demonstrated against the hardware. The distinguishing test: query the register for the TS-453E firmware build and confirm all three chain ids resolve to a closed state on that same build; a register showing one closed and the siblings absent is reporting on its feed coverage, not on whether the appliance can still be chained to privileged execution.",
+        "evidence": "Packet: CVE-2025-62848 is component 2/3 of the DEVCORE chain, chained with CVE-2025-62847 and CVE-2025-62849 on the QNAP TS-453E. poc_available true, CVSS 9.8, RWEP 40, cisa_kev false, active_exploitation unknown, patch_available true. NIST-800-53-SI-2 (flaw remediation), ISO-27001-2022-A.8.8 (management of technical vulnerabilities) and AU-Essential-8-Patch are all already recorded as insufficient controls citing this CVE.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "ISO-27001-2022-A.8.8",
+          "AU-Essential-8-Patch"
+        ]
+      }
+    ]
   },
   "CVE-2025-62849": {
     "name": "QNAP QTS/QuTS hero RCE (Pwn2Own Ireland 2025, chain 3/3)",
@@ -6956,7 +7134,41 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "A hosting fleet running cPanel & WHM or WP2 must be driven to the fixed release on a KEV-tied clock measured in hours, and applied fleet-wide rather than server-by-server on a rolling window. The bypass needs no credentials and targets the login flow itself, while the panel is by design internet-reachable so tenants can log in — so an unpatched host is a fully exposed control-plane takeover for the entire time it waits, and a rolling schedule simply means the last host in the queue stays open longest. Because no live-patch primitive is registered for this entry, the fix is a vendor update requiring a service restart or reboot, so that restart has to be pre-authorized against the KEV clock instead of deferred to the next tenant-notified maintenance slot. Hosts that cannot be updated inside the SLA must have their panel and WHM listeners restricted to operator networks and be booked as unremediated.",
+        "evidence": "Packet: CISA KEV-listed 2026-04-30 with active_exploitation=confirmed; RWEP 83, CVSS 9.1, poc_available=true. The vector states WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel (CWE-306, missing authentication for a critical function). patch_available=true, live_patch_available=false, and live_patch_notes state the vendor patch typically requires service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-handling"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "A panel host that was internet-reachable while unpatched must go through compromise assessment and credential rotation rather than patch-and-continue. Because the bypass hands an unauthenticated caller the control panel itself, the attacker inherits the panel's own legitimate capabilities — creating accounts and API tokens, rewriting mail and DNS records, writing files into tenant document roots, installing cron persistence — and none of that is removed by the update. The default response is configuration export, rebuild or restore of the panel host from known-good state, rotation of every tenant, reseller and API credential the panel issued, and an audit of accounts, cron entries and tenant webroots created since the KEV listing date. Anti-malware scanning is not the test here: the artifacts left behind are ordinary panel objects and ordinary web content, not malware signatures.",
+        "evidence": "Packet: CISA KEV-listed 2026-04-30 with active_exploitation=confirmed, poc_available=true and RWEP 83, so an exposed unpatched host is an exploitation opportunity rather than a hypothetical. The vector states the authentication bypass in the login flow allows unauthenticated remote attackers to gain unauthorized access to the control panel of WebPros cPanel & WHM and WP2 — the attacker operates as a panel principal rather than through a memory-corruption payload (CWE-306). patch_available=true with live_patch_available=false; the packet's remediation is a vendor patch requiring service restart or system reboot, which closes the entry path but makes no statement about actions already taken through it.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "CIS-Controls-v8-10.1"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-036",
+        "name": "FLEET-CONTROL-PLANE-ADMIN-PRIVILEGE-TIER",
+        "description": "WHM is the fleet control plane for every tenant site, mailbox, database and DNS zone on the host, and this flaw is the argument for making its administration a distinct privilege tier instead of the same login surface at a higher permission level. The WHM root and reseller surface should be reachable only from a PAM jumphost or operator network, behind FIDO2 step-up and just-in-time elevation with a separate identity from tenant accounts, so that a defect in the login flow does not present the whole hosting estate to an anonymous internet caller. Splitting the surfaces also bounds the damage where the tenant-facing cPanel login has to stay internet-exposed for customers: that side gets patched under the KEV clock, while the administrative plane is never an unauthenticated caller's first hop in the first place.",
+        "evidence": "Packet: CWE-306, missing authentication for a critical function — the vector records an authentication bypass in the login flow of WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) allowing unauthenticated remote attackers to gain unauthorized access to the control panel. CISA KEV-listed 2026-04-30, active_exploitation=confirmed, CVSS 9.1, RWEP 83, poc_available=true. The citing gaps recorded for this entry include NIST-800-53-AC-6 (Least Privilege) and UK-CAF-B2 (Identity and access control), both of which the packet marks as insufficient here.",
+        "gap_closes": [
+          "UK-CAF-B2",
+          "NIST-800-53-AC-6"
+        ]
+      }
+    ]
   },
   "CVE-2024-1708": {
     "name": "ConnectWise ScreenConnect Path Traversal Vulnerability",
@@ -7098,7 +7310,30 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "For a DIR-823X the KEV clock has to terminate in a verified per-unit outcome, because the failure mode of consumer-router patching is not a missed deadline, it is an open-ended 'awaiting firmware' state that never resolves. The packet records a vendor fix as available, no live-patch path, and a fix that per the KEV requiredAction typically requires a service restart or system reboot — for this device class that means a firmware flash and reboot on each unit, performed by whoever physically owns it. The packet's own vector text also states the impacted product could be end-of-life and/or end-of-service and that users should discontinue use, so the SLA must resolve to either a confirmed fixed firmware level on the specific unit or that unit's removal from service. With confirmed in-the-wild exploitation and a public PoC against a device that is always internet-facing by construction, 'firmware pending' is not a compliant resting state.",
+        "evidence": "Packet: cisa_kev true, kev_date 2026-04-24, active_exploitation confirmed, cvss 9.8, rwep_score 77, poc_available true, patch_available true, live_patch_available false, live_patch_notes \"No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.\", cwe_refs CWE-77. Vector: \"... The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.\"",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-030",
+        "name": "PERIMETER-DEVICE-ZERODAY-SLA-TIER",
+        "description": "A DIR-823X is the trust boundary for everything behind it, so command injection reached through the /goform/set_prohibiting handler is not an application bug on one host — execution on that router owns DNS resolution, routing, and every client session crossing it, and gives a persistent foothold that survives cleanup of anything on the LAN. That is the condition this tier exists for: mitigation within hours of the 2026-04-24 KEV listing, or the alternative the tier explicitly allows — isolate the vulnerable interface by taking the HTTP management surface off the WAN side and restricting it to a trusted internal management segment — instead of the 14/30-day operating-system patch SLA the citing frameworks apply to it today. Note the packet characterizes the caller two ways: the attack_vector field says unauthenticated command execution, while the vector text says an authorized attacker sending a POST to /goform/set_prohibiting. The interface-isolation half of the tier is the right action under either reading, which is why it belongs alongside the patch clock rather than behind it.",
+        "evidence": "Packet vector: \"D-Link DIR-823X contains a command injection vulnerability that allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /goform/set_prohibiting via the corresponding function.\" Packet attack_vector: \"command injection (CWE-77) on the D-Link DIR-823X, giving an unauthenticated attacker command execution on the device.\" Packet: cvss 9.8, rwep_score 77, cisa_kev true, kev_date 2026-04-24, active_exploitation confirmed, poc_available true. Citing gaps already record UK-CAF-B4 (System security) and NIS2-Art21-network-security as insufficient for this CVE.",
+        "gap_closes": [
+          "UK-CAF-B4",
+          "NIS2-Art21-network-security"
+        ]
+      }
+    ]
   },
   "CVE-2024-7399": {
     "name": "Samsung MagicINFO 9 Server Path Traversal Vulnerability",
@@ -7158,7 +7393,31 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "MagicINFO 9 Server instances run digital-signage estates and are typically commissioned once and left alone, outside the cadence that covers the rest of the server fleet — so the KEV clock has to be what pulls them in. Two things defeat the usual triage here: the CVSS score sits below the threshold that most severity-driven patch tiers use to demand urgency, while the real-world priority score is far higher; and the packet's own description has the attacker writing files as system authority, so one unpatched signage server is a full host, not a display. Because the fix lands as a service restart or reboot, the SLA must cover the restart of every signage server, not just the installer run on the ones an operator remembers owning.",
+        "evidence": "Packet records a CISA KEV listing dated 2026-04-24 with active_exploitation 'confirmed', RWEP 77 against CVSS 7.5, and poc_available true. The vector text states the path traversal 'could allow an attacker to write arbitrary files as system authority'. patch_available is true, live_patch_available is false, and live_patch_notes state the vendor patch typically requires service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-patch-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "This exploitation path leaves an artifact behind on purpose: the attacker uploads a file — the packet names a web shell — and then traverses to it to execute it. Patching the upload and traversal handlers removes the delivery route while leaving the uploaded shell sitting on disk and still reachable through ordinary requests, so a patched MagicINFO 9 Server can remain an attacker's foothold. A server that was network-reachable and unpatched during the exposure window must be triaged, not just updated: enumerate files written under its upload and web-serving directories across the exposure window, rotate the credentials and content-distribution keys the server held, and rebuild rather than patch-in-place.",
+        "evidence": "Packet's attack_vector describes 'a path-traversal plus unrestricted-file-upload flaw (CWE-22/CWE-434), letting an unauthenticated attacker upload a file (e.g. a web shell) and traverse to it for code execution', with active_exploitation 'confirmed', CISA KEV listing 2026-04-24, and poc_available true.",
+        "gap_closes": [
+          "NIS2-Art21-patch-management",
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2024-57728": {
     "name": "SimpleHelp Path Traversal Vulnerability",
@@ -7218,7 +7477,31 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "The KEV clock here has to run on the SimpleHelp support server itself, not on the endpoints it services: the zip-slip write lands with the privileges of the SimpleHelp server user and converts directly into code execution on that host, so a remediation programme that tracks technician workstations and serviced endpoints but treats the support server as infrastructure will miss the exploited surface entirely. The packet records no live-patch path — the vendor fix requires a service restart or reboot — so the SLA must schedule the SimpleHelp service restart inside the KEV window rather than treating patch download as completion. Until that restart is taken, the file-upload and administrative paths on the server must be restricted rather than counted as remediated, since the packet's own description places the upload behind admin access on the server.",
+        "evidence": "CISA KEV-listed 2026-04-24 with active_exploitation 'confirmed' and poc_available true. RWEP 83 against CVSS 7.5 — the real-world exploit priority sits well above the CVSS band, so a CVSS-threshold-driven patch queue deprioritizes an actively exploited flaw. The catalog vector records that SimpleHelp 'contains a path traversal vulnerability that allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file (i.e. zip slip). This can be exploited to execute arbitrary code on the host in the context of the SimpleHelp server user.' patch_available is true, live_patch_available is false, and live_patch_notes reads: 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.'",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-handling"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-078",
+        "name": "ENDPOINT-MGMT-DEPLOYMENT-CHANNEL-INTEGRITY",
+        "description": "The primitive in this CVE is an arbitrary write anywhere on the filesystem as the SimpleHelp server user — so the exposed asset is not just the web root but every file that remote-support server holds and hands out: session and client artifacts, technician-facing downloads, service configuration and any script the server executes. Treat that content as a privileged distribution channel rather than as application data: file-integrity-monitor the SimpleHelp installation and every directory it serves artifacts from, alert on writes that do not correspond to a sanctioned administrator action or a vendor update, and hold the support server to KEV-priority patching as a management-plane asset. This is the control that still has value after the patch lands, because the fix closes the zip-slip write path but removes nothing already written through it — an attacker file placed before remediation survives the upgrade, and neither signature-based anti-malware nor authentication logging will surface a bespoke artifact dropped through a legitimate upload endpoint.",
+        "evidence": "The catalog vector states the flaw lets an actor 'upload arbitrary files anywhere on the file system by uploading a crafted zip file (i.e. zip slip)' and thereby 'execute arbitrary code on the host in the context of the SimpleHelp server user'; the attack_vector locates the flaw 'on the remote-support server'. KEV-listed 2026-04-24 with active_exploitation 'confirmed' and poc_available true, RWEP 83. The gaps this entry already cites include CIS Controls v8 10.1 (Deploy and Maintain Anti-Malware Software) and UK CAF C1 (Security monitoring) — neither detects an attacker-written artifact that carries no malware signature and arrives over an authenticated upload path.",
+        "gap_closes": [
+          "UK-CAF-C1",
+          "CIS-Controls-v8-10.1"
+        ]
+      }
+    ]
   },
   "CVE-2024-57726": {
     "name": "SimpleHelp Missing Authorization Vulnerability",
@@ -7278,7 +7561,40 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-036",
+        "name": "FLEET-CONTROL-PLANE-ADMIN-PRIVILEGE-TIER",
+        "description": "SimpleHelp is a remote-support control plane, so its server admin role reaches every machine the technician population supports — the technician tier and the server-admin tier are not two shades of the same application user. This CVE collapses the distance between them: the entry records that low-privileged technicians can create API keys with excessive permissions and use those keys to escalate to the server admin role. Server administration of SimpleHelp needs to be classified as its own privilege tier — identity separate from every other admin role, jumphost-only access with hardware-key step-up, just-in-time elevation with approval — and the technician surface must not be able to mint or hold API keys at all. A framework that enumerates one admin role for this product attests accurately while the technician surface remains the real path into it.",
+        "evidence": "SimpleHelp missing authorization (CWE-862), CVSS 8.8, RWEP 83. The entry states low-privileged technicians can create API keys with excessive permissions and that these keys can be used to escalate privileges to the server admin role, on a remote-support server. CISA KEV-listed 2026-04-24 with active_exploitation=confirmed and poc_available=true.",
+        "gap_closes": [
+          "UK-CAF-B2",
+          "NIST-800-53-AC-6"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-037",
+        "name": "FLEET-COMPROMISE-IR-PLAYBOOK",
+        "description": "The escalation product here is a durable credential rather than a session: an API key minted through the missing-authorization flaw still carries server-admin power after the vendor fix is installed. The playbook for this CVE therefore has to enumerate and revoke every API key issued on the SimpleHelp server across the exposure window, audit technician accounts and role assignments for keys they should never have been able to create, and treat every endpoint reached through the server during that window as requiring credential rotation and review — a remote-support server is a path into the machines it supports, so its compromise fans outward rather than stopping at the appliance. Patching closes the minting path and leaves already-minted keys valid, which is precisely the state an audit reading only installed version would score as clean.",
+        "evidence": "Missing authorization (CWE-862) on a remote-support server; the entry records that the API keys created through the flaw can be used to escalate to the server admin role. active_exploitation=confirmed, poc_available=true, CISA KEV-listed 2026-04-24, RWEP 83, CVSS 8.8.",
+        "gap_closes": [
+          "UK-CAF-B2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "SimpleHelp entered CISA KEV on 2026-04-24 with confirmed exploitation and a public PoC and a vendor fix exists, so this runs on the KEV clock rather than a quarterly application-patch cycle. The complication specific to this product is that no live-patch path is registered and the fix typically requires a service restart per the KEV requiredAction, which drops the active remote-support sessions the server exists to carry — the operational argument for deferral is built into the product. The SLA has to pre-authorize that restart instead of letting support availability win, and it has to sequence the restart with revocation of the API keys minted before the fix, or the server returns to service still honoring them.",
+        "evidence": "CISA KEV-listed 2026-04-24 with active_exploitation=confirmed, poc_available=true, RWEP 83, CVSS 8.8. patch_available=true, live_patch_available=false; the entry states the vendor patch typically requires service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-vulnerability-handling",
+          "NIST-800-53-SI-2"
+        ]
+      }
+    ]
   },
   "CVE-2026-20122": {
     "name": "Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability",
@@ -7398,7 +7714,41 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "Catalyst SD-WAN Manager is the fabric controller, so its remediation clock has to start at the KEV listing (2026-04-20) rather than at the next network-appliance maintenance cycle. The packet records no live-patch path for this entry and notes the vendor patch typically needs a service restart or system reboot, so the SLA must be measured at 'manager restarted onto the fixed build', not at 'update staged' — until the restart lands the manager keeps serving the disclosure, and the operator has no interim mitigation recorded here.",
+        "evidence": "cisa_kev true with kev_date 2026-04-20; active_exploitation 'confirmed'; poc_available true; RWEP 77 / CVSS 8.8; patch_available true, live_patch_available false, live_patch_notes: 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.'",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-036",
+        "name": "FLEET-CONTROL-PLANE-ADMIN-PRIVILEGE-TIER",
+        "description": "Because the exposure is on the SD-WAN control plane rather than on one managed router, whatever the manager can show is fabric-wide, and the only pre-patch lever is bounding who can reach the surface at all. Catalyst SD-WAN Manager operators have to be classified above ordinary network admins — jumphost-only reachability for the management interface, step-up authentication per session, and an identity not shared with any other admin role — so a remotely reachable CWE-200 read path is not exposed to every account that happens to hold 'network admin'. Frameworks that collapse the fabric controller into the same admin class as the devices it manages carry no rule that would have constrained this.",
+        "evidence": "Packet vector: 'Cisco Catalyst SD-WAN Manager contains an exposure of sensitive information to an unauthorized actor vulnerability that could allow remote attackers to view sensitive information on affected systems.' cwe_refs CWE-200; CVSS 8.8; citing gaps include NIST-800-53-AC-6 (Least Privilege) and NIS2-Art21-network-security.",
+        "gap_closes": [
+          "NIST-800-53-AC-6",
+          "NIS2-Art21-network-security",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-037",
+        "name": "FLEET-COMPROMISE-IR-PLAYBOOK",
+        "description": "Exploitation was confirmed in the wild before the fix, and the flaw class is disclosure — so patching stops further reads but does not invalidate anything already read from the manager. The response has to be fleet-scoped and rehearsed in advance: rotate credentials for every account that authenticated through the SD-WAN Manager during the exposure window, audit configuration pushed to managed edge devices since the exposure window opened, and apply quarantine criteria to downstream devices, instead of closing the finding when the restart completes.",
+        "evidence": "cisa_kev true, kev_date 2026-04-20, active_exploitation 'confirmed', poc_available true; cwe_refs CWE-200 (exposure of sensitive information to an unauthorized actor); RWEP 77; patch_available true.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "ISO-27001-2022-A.8.8"
+        ]
+      }
+    ]
   },
   "CVE-2025-2749": {
     "name": "Kentico Xperience Path Traversal Vulnerability",
@@ -7458,7 +7808,32 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "Kentico Xperience sites must be moved to the vendor-fixed release on a clock started by the KEV listing rather than on a CMS-upgrade cycle, and the Staging Sync Server upload path named in the packet is the surface that sets the priority — that is where the traversal writes arbitrary data to path-relative locations. Because there is no live-patch path for this entry and the vendor fix requires a service restart or reboot, the SLA must cover the restart, not just the package upgrade. Where the restart cannot be taken inside the clock, the only remaining action is removing the staging/sync endpoint from untrusted network reach, since it is the reachable surface and no hot-fix option exists; leaving it reachable pending an upgrade window is exposure, not mitigation.",
+        "evidence": "Packet: Kentico Xperience path traversal (CWE-22) with unrestricted file upload (CWE-434). The packet's vector states the flaw 'could allow an authenticated user's Staging Sync Server to upload arbitrary data to path relative locations', and its attack_vector characterizes the result as writing a file outside the intended directory (e.g. a web shell) for code execution. CVSS 7.5, RWEP 77, poc_available true. CISA KEV-listed 2026-04-20 with active_exploitation confirmed. patch_available true; live_patch_available false, with the note that the vendor patch typically requires service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "For a Kentico Xperience instance that was reachable and unpatched while this CVE was being exploited, upgrading the CMS is not remediation. What this vulnerability produces is a file of the attacker's choosing written outside the intended directory — a web shell placed in the site tree survives the upgrade untouched and keeps serving requests afterwards. The response default must therefore be to treat the deployed web root and every writable content/media directory as attacker-modifiable: compare the live tree against the known-good deployment artifact, redeploy the site host from source of truth rather than patching in place, and rotate the credentials reachable from that foothold, including the CMS administrator accounts and the staging/sync credentials the affected endpoint uses. The distinguishing test is whether the upgrade record is accompanied by a file-integrity comparison of the deployed site tree; an upgrade ticket on its own cannot show the dropped file was removed.",
+        "evidence": "Packet: CWE-22 combined with CWE-434, described as letting an attacker write a file outside the intended directory (e.g. a web shell) for code execution via the Staging Sync Server upload path. CISA KEV-listed 2026-04-20 with active_exploitation confirmed and poc_available true, so exposed instances were being exploited before the fix was applied. patch_available true (restart or reboot required per the packet's live_patch_notes), which is precisely what makes patch-in-place the default operators reach for and why the gap matters.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "NIST-800-53-SI-2",
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2023-27351": {
     "name": "PaperCut NG/MF Improper Authentication Vulnerability",
@@ -7578,7 +7953,19 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "This is the case where a severity-ranked patch queue and a KEV-driven SLA give opposite answers, and the KEV answer is the correct one. At CVSS 6.1 the ZCS cross-site scripting flaw falls below the high/critical cut most Zimbra operators use to schedule mail-service downtime, yet it is KEV-listed with confirmed in-the-wild exploitation, has a public PoC, and scores RWEP 77 — the same real-world priority as the 9.8-rated RCEs in the same catalog. The remediation is not free: the packet records no live-patch tool for this entry and states that the vendor patch typically requires a service restart or system reboot per the KEV requiredAction, so closing it means booking a mailbox-server outage. That cost is precisely why a CVSS-ranked queue keeps deferring it, and why the SLA has to be pinned to the KEV listing date instead. Until the restart is booked, the exposure is live on every ZCS web-client session.",
+        "evidence": "Packet: cisa_kev true, kev_date 2026-04-20, active_exploitation confirmed, cvss 6.1, rwep_score 77, poc_available true, patch_available true, live_patch_available false, live_patch_notes \"No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.\", cwe_refs CWE-79. Attack vector: \"a cross-site scripting flaw (CWE-79) on the ZCS web client, letting an attacker run script in a victim's authenticated session for session/credential theft and mailbox access.\"",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "ISO-27001-2022-A.8.8"
+        ]
+      }
+    ]
   },
   "CVE-2026-20128": {
     "name": "Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability",
@@ -7758,7 +8145,21 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "For this TeamCity flaw the SLA clock is unusual in shape and that is what makes the control bite: the vendor patch already exists, so the trigger is the 2026-04-20 KEV listing itself, and remediation is due within four hours of that listing rather than at the next build-infrastructure maintenance window. Two properties of this specific entry make a routine cadence unsafe. First, the flaw is a relative path traversal that lets an attacker reach restricted endpoints and bypass authentication without credentials, so an exposed TeamCity server has no login barrier buying time while a change ticket ages. Second, the packet records that the vendor patch requires a service restart with no live-patch option — meaning a CI/CD platform whose restarts are treated as change-controlled outage events will breach the four-hour SLA by process alone unless a pre-approved emergency restart path for the build server exists before the next KEV listing arrives.",
+        "evidence": "cisa_kev true with kev_date 2026-04-20 and active_exploitation confirmed; poc_available true; rwep_score 83 against cvss 7.5; patch_available true, live_patch_available false, live_patch_notes: 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.' attack_vector: 'a relative path-traversal flaw (CWE-23) letting an unauthenticated attacker reach restricted endpoints and bypass authentication.'",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-handling"
+        ]
+      }
+    ]
   },
   "CVE-2026-34197": {
     "name": "Apache ActiveMQ Improper Input Validation Vulnerability",
@@ -7818,7 +8219,31 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "ActiveMQ is middleware, so brokers are usually patched on an internal-messaging-tier cadence rather than an edge cadence — but this flaw is reachable by an unauthenticated network attacker against the broker itself, so the clock must start at KEV listing (2026-04-16), not at the next messaging maintenance window. A vendor fix exists, and because the packet records no live-patch path and notes the vendor patch typically requires a service restart or system reboot, the SLA is only meetable if restart authority for every broker instance is pre-approved rather than queued as a separate change. Until each broker is on the fixed build, the mitigation of record must be an inventoried compensating control — closing the broker's listener to any network the operator does not control — not a deferred patch date.",
+        "evidence": "Packet fields for CVE-2026-34197 (Apache ActiveMQ Improper Input Validation Vulnerability): cisa_kev=true with kev_date 2026-04-16; active_exploitation=confirmed; poc_available=true; cvss 9.8; rwep_score 77; attack_vector describes code execution reachable by an unauthenticated network attacker against the message broker; patch_available=true; live_patch_available=false with live_patch_notes stating no live-patch tool is registered and that the vendor patch typically requires service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-125",
+        "name": "SERVICE-INTERNAL-PROTOCOL-DESERIALIZATION-HARDENING",
+        "description": "For this broker the control means treating the ActiveMQ wire-protocol listener as a trust boundary rather than an internal convenience: the defect is improper input validation that becomes code injection (CWE-20 into CWE-94) for a peer that never authenticates. Bind broker listeners to the messaging segment instead of all interfaces, require peer authentication on every wire protocol the broker has enabled — not only the one the applications happen to use — and constrain what content arriving on that port is permitted to construct or evaluate, instead of inheriting safety from the assumption that the broker sits on a trusted network. The distinguishing test: from an unauthenticated host that can route to the broker port on a staging instance, open a connection carrying content the broker's application protocol never legitimately conveys, and confirm the peer is rejected before the broker acts on the content — a broker that passes a patch-level audit while accepting unauthenticated connections on all interfaces still exposes the injection path the moment the next protocol-parsing defect lands.",
+        "evidence": "Packet fields for CVE-2026-34197: cwe_refs CWE-20 and CWE-94; attack_vector states improper input validation leading to code execution reachable by an unauthenticated network attacker against the message broker; vector text reads that Apache ActiveMQ contains an improper input validation vulnerability that allows for code injection; active_exploitation=confirmed; poc_available=true; rwep_score 77.",
+        "gap_closes": [
+          "UK-CAF-B4",
+          "NIST-800-53-AC-6"
+        ]
+      }
+    ]
   },
   "CVE-2009-0238": {
     "name": "Microsoft Office Remote Code Execution",
@@ -7956,7 +8381,20 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "Put the on-premises SharePoint Server farm on a clock that starts at the 2026-04-14 KEV listing rather than on the routine monthly server-patch ring. The exploitation path needs no account — the packet describes improper input validation reachable by an unauthorized attacker over the network — so tightening user access or admin rights does not defer the deadline. The remediation the packet actually records is the vendor patch with no live-patch path, and it notes the fix typically requires a service restart or system reboot per the KEV requiredAction. For a farm that means the SLA is met only when every web front-end and application server has been restarted onto the fixed build: a farm where the update is staged but the services were never recycled is unremediated, and must not be reported as patched-per-SLA. Where the restart cannot be completed inside the window, the deferral is a documented exposure with a time-bound action item, not a compensating control.",
+        "evidence": "cisa_kev is true with kev_date 2026-04-14 and active_exploitation 'confirmed'; CVSS 8.8, RWEP 77, poc_available true. The packet's vector states that Microsoft SharePoint Server contains an improper input validation vulnerability (CWE-20) that allows an unauthorized attacker to perform spoofing over a network, with the attack_vector recording that it is reachable by an unauthorized attacker and leads to compromise of the SharePoint server. patch_available is true, live_patch_available is false, and live_patch_notes states that no live-patch tool is registered and that the vendor patch typically requires service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management",
+          "NIST-800-53-SI-2"
+        ]
+      }
+    ]
   },
   "CVE-2012-1854": {
     "name": "Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability",
@@ -8066,7 +8504,22 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "For a Windows estate this flaw's remediation clock has to start at the KEV listing rather than at the next monthly patch ring, and the control has to be written so it survives the reboot dependency. The packet records a vendor fix as available but no live-patch path, with the patch landing only across a service restart or system reboot per the KEV requiredAction — so meeting a KEV-tied deadline on this CVE means a pre-authorized emergency restart deadline with user deferral disabled, not merely 'update approved in the ring'. Until a host is on the fixed build AND has rebooted, any local foothold on it can still redirect a privileged operation through the link-following path to reach SYSTEM, which is why the control's fallback state — documented compensating controls, with the host tracked as unremediated — must be recorded per host rather than the fleet being reported as patched once the update is published.",
+        "evidence": "The packet records CISA KEV listing on 2026-04-13 with active_exploitation 'confirmed' and poc_available true; RWEP 77 against CVSS 7.8, so real-world priority is driven by in-the-wild use rather than the base score. It describes a link-following / symlink-handling flaw (CWE-59) in a Windows component, exploited from a local foothold to redirect a privileged operation and gain SYSTEM, and notes that LPEs of this class are routinely paired with an initial-access flaw by ransomware operators. patch_available is true, live_patch_available is false, and live_patch_notes states that no live-patch tool is registered for this entry and that the vendor patch typically requires a service restart or system reboot per the KEV requiredAction. All five citing gaps (NIST SP 800-53 SI-2 Flaw Remediation, ISO/IEC 27001:2022 A.8.8, NIS2 Art 21 vulnerability handling and disclosure, ASD Essential Eight patch operating systems, UK CAF B4 system security) require timely remediation without binding a clock to confirmed exploitation.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management",
+          "NIST-800-53-SI-2",
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2023-21529": {
     "name": "Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability",
@@ -8204,7 +8657,38 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "This entry scores CVSS 5.5 — under the threshold at which most Windows patch programmes take action — while carrying RWEP 77 on the strength of confirmed in-the-wild exploitation, so a severity-ordered queue parks the CLFS driver fix behind 'criticals' nobody is exploiting. The SLA must fire on the KEV listing rather than the score: enumerate every Windows host whose Common Log File System driver predates the fix, deploy the vendor update, and book the restart inside the KEV clock instead of rolling it into the next monthly maintenance window. The packet registers no live-patch path for this entry, so the reboot is the remediation, not an optional follow-up — a host that has taken the update but not restarted is still exposed and must not be counted as remediated.",
+        "evidence": "Packet: cvss 5.5 against rwep_score 77; cisa_kev true, kev_date 2026-04-13, active_exploitation 'confirmed', poc_available true. patch_available true; live_patch_available false, with live_patch_notes 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.'",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-patch-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-003",
+        "name": "KERNEL-EXPLOITATION-DETECTION",
+        "description": "An out-of-bounds read is a silent primitive: it leaks kernel memory to seed the escalation stage and, unlike a corruption bug, produces no bugcheck, no crash dump and no failed-write artefact for the host to report, so a fleet can be under active exploitation with a clean event log. Between the KEV listing and the restart that lands the fix, the only coverage is behavioural — alert on anomalous Common Log File System driver activity from processes that have no business touching it, on process token and integrity-level transitions that promote a user-context process to SYSTEM, and on the escalate-then-move-laterally sequence — with alerting fast enough to interrupt a ransomware operator's dwell time rather than surface in the next day's report.",
+        "evidence": "Packet: CWE-125 out-of-bounds read in the Microsoft Windows Common Log File System Driver, described as an information-disclosure primitive within a privilege-escalation chain, with the note that LPEs of this class are routinely paired with an initial-access flaw by ransomware operators. active_exploitation 'confirmed', kev_date 2026-04-13, poc_available true. live_patch_available false, so every host carries a restart-bounded exposure window.",
+        "gap_closes": [
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-018",
+        "name": "SCANNER-PAPER-COMPLIANCE-TEST",
+        "description": "A 2023 CVE identifier that only reaches KEV in 2026 stresses a specific part of vulnerability management: a CVSS 5.5 finding triaged years ago sits at the bottom of the queue or has aged out of it entirely, and nothing in a version-comparison scanner re-opens it on the day CISA lists it. The operational test is therefore not 'is the host patched' but two checks the scan pipeline usually cannot answer: does a previously deprioritised, multi-year-old medium get re-raised at KEV-listing severity, and does the per-host verdict come from the Common Log File System driver's actual file version rather than from the mere presence of a cumulative update or a pending, unrestarted install? A dashboard reporting the estate compliant because every host is on the current rollup, with no KEV-triggered re-open path for aged findings, is paper compliance for exactly this entry.",
+        "evidence": "Packet: CVE identifier issued in the 2023 series with kev_date 2026-04-13 — a multi-year gap between assignment and KEV listing; cvss 5.5 versus rwep_score 77; active_exploitation 'confirmed'; patch_available true with live_patch_available false and a vendor patch that per live_patch_notes typically requires service restart or system reboot.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8"
+        ]
+      }
+    ]
   },
   "CVE-2020-9715": {
     "name": "Adobe Acrobat Use-After-Free Vulnerability",
@@ -8259,7 +8743,30 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "The vendor fix for this Adobe Acrobat and Reader use-after-free has existed for years, yet CISA added the CVE to KEV on 2026-04-13 on the strength of confirmed current in-the-wild exploitation. Any remediation queue that ages or sorts by CVE identifier year, by \"newly disclosed\" status, or by scanner first-seen date buries a CVE-2020 entry beneath every current-quarter finding and it never reaches a patch window — which is precisely why the long-tail estate the packet describes is still being exploited. The KEV listing date has to start the clock instead of the CVE year: from 2026-04-13, every Acrobat and Reader installation in the estate is re-evaluated against the fixed build inside the KEV SLA, and any host that cannot reach it is cut off from untrusted PDFs rather than risk-accepted on the grounds that the CVE is old. One product-specific wrinkle for this entry: the packet records no live-patch path, and notes the vendor patch typically requires a service restart or system reboot per the KEV required action, so the SLA must be satisfied by the restart, not by the installer run — a \"patch deployed\" record against a host whose vulnerable reader process is still resident has not removed the exposure. The distinguishing test: query the vulnerability queue for KEV-listed CVEs whose identifier year is more than five years old and confirm they carry the same due date as a current-quarter KEV entry — a program whose SLA derives from disclosure age reports \"no overdue criticals\" while an actively exploited reader RCE sits unremediated on the long tail.",
+        "evidence": "Packet: CVE-2020-9715, \"Adobe Acrobat Use-After-Free Vulnerability\", CWE-416, exploitable by an attacker-controlled PDF for code execution in the reader process. CISA KEV-listed 2026-04-13, active_exploitation confirmed, CVSS 8.8, RWEP 77, poc_available true, patch_available true, live_patch_available false with live_patch_notes recording that the vendor patch typically requires a service restart or system reboot per the KEV requiredAction. The packet states the legacy re-listing exists because long-tail unpatched/end-of-life estates remain exposed — the residual exposure is an unapplied fix, not an absent one. NIST-800-53-SI-2, ISO-27001-2022-A.8.8, NIS2-Art21-patch-management and AU-Essential-8-Patch are all already recorded as insufficient controls citing this CVE.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management",
+          "AU-Essential-8-Patch"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-120",
+        "name": "DOWNLOAD-PROVENANCE-ENFORCEMENT",
+        "description": "Exploitation of this CVE requires the victim to open an attacker-controlled PDF, so on the long-tail hosts the packet says are still unpatched the delivery path is the only control left that can be enforced. Require content provenance — Mark-of-the-Web — on every PDF arriving by mail, web download, or untrusted file share, and require provenance-tagged PDFs to open in the reader's reduced-privilege protected view rather than the full parsing path that carries the use-after-free sink at the user's own privilege. Provenance must survive the container: a PDF extracted from a ZIP, mounted from an ISO or VHD, or renamed must inherit the tag rather than lose it, and dismissing the protected view on an externally sourced document should be a policy decision rather than a per-user click. This is not a substitute for the vendor patch, which the packet records as available — it is what stands between an attacker-controlled document and the vulnerable parser on the end-of-life and unmanaged hosts that will not reach the fixed build inside the KEV window. The distinguishing test: mail a provenance-tagged PDF nested inside an archive to a managed host, extract it, and confirm the extracted file still opens in the protected view — an endpoint-hardening attestation that covers only macro and script settings still lets a provenance-stripped PDF reach the reader's parser with full user privileges.",
+        "evidence": "Packet attack vector: an attacker-controlled PDF reaching Adobe Acrobat and Reader for code execution in the reader process (CWE-416 use-after-free). poc_available true, active_exploitation confirmed, CISA KEV-listed 2026-04-13, CVSS 8.8, RWEP 77. The packet attributes the residual exposure to long-tail unpatched/end-of-life estates. UK-CAF-B4 (system security) is already recorded as an insufficient control citing this CVE.",
+        "gap_closes": [
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2026-21643": {
     "name": "Fortinet FortiClient EMS SQL Injection Vulnerability",
@@ -8319,7 +8826,39 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "FortiClient EMS is the management server for a Fortinet endpoint-agent estate, and the packet's flaw is an unauthenticated SQL injection on its HTTP surface that escalates to remote code execution at CVSS 9.8, KEV-listed with confirmed in-the-wild exploitation and a public PoC. The remediation clock for this box therefore starts at the KEV listing date, not at the next monthly patch window that the citing frameworks' cadence controls permit. Two packet facts shape how the SLA must be planned: no live-patch tool is registered, and the vendor patch typically requires a service restart or system reboot per the KEV requiredAction - so the deployment window has to be planned with an EMS service outage inside it, and the console's role in managing endpoints is not a reason to defer that restart to a change-approval cycle. An estate that cannot restart EMS inside the window has to pull the management surface out of network reach as the documented compensating control until it can, because there is no in-place mitigation to fall back on.",
+        "evidence": "Packet fields: cisa_kev true, kev_date 2026-04-13, active_exploitation confirmed, cvss 9.8, rwep_score 77, poc_available true, patch_available true, live_patch_available false, live_patch_notes 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.' Packet vector: 'Fortinet FortiClient EMS contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.' Citing gaps include AU-Essential-8-Patch, ISO-27001-2022-A.8.8, NIST-800-53-SI-2 and NIS2-Art21-vulnerability-management.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-078",
+        "name": "ENDPOINT-MGMT-DEPLOYMENT-CHANNEL-INTEGRITY",
+        "description": "An attacker who reaches code execution through this SQL-injection path owns the endpoint-management server itself - the box that distributes software, policy and trust material to every enrolled FortiClient agent. Least privilege scoped to EMS operator accounts, the NIST AC-6 control the framework gap cites, bounds nothing against this CVE, because the packet's attacker never authenticates as an operator at all: the injection is reachable unauthenticated via crafted HTTP requests. What bounds the blast radius is treating the EMS-to-agent path as a privileged supply-chain control plane rather than as ordinary application output: integrity-monitor the agent packages and key material the server distributes, alarm on any agent push or policy change that cannot be traced to a sanctioned admin action, and treat a confirmed EMS compromise as fleet-wide agent code execution until the deployment channel is proven untouched, rather than as a single-server incident closed by patching the console.",
+        "evidence": "Packet attack_vector: 'SQL injection (CWE-89) on the FortiClient EMS management surface escalating to remote code execution. CISA KEV-listed 2026-04-13 with confirmed in-the-wild exploitation.' Packet vector states an unauthenticated attacker may execute unauthorized code or commands via specifically crafted HTTP requests. Packet fields: cvss 9.8, rwep_score 77, active_exploitation confirmed, poc_available true. Citing gap NIST-800-53-AC-6 (Least Privilege).",
+        "gap_closes": [
+          "NIST-800-53-AC-6"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-046",
+        "name": "PEN-TEST-SCOPE-INCLUDES-SECURITY-PRODUCTS",
+        "description": "FortiClient EMS is a defensive product, and scoping documents routinely list the endpoint-security stack among the controls a test must evade rather than among the surfaces a test must attack. That scoping choice is why an unauthenticated SQL injection sitting on the EMS management HTTP surface - the cheapest finding class there is, reachable before any credential - survived to a KEV listing with confirmed exploitation instead of being found internally. The fix is scope language that names the EMS management HTTP surface itself as an in-scope target, tested with the same injection battery applied to any other unauthenticated web application, and a PoC is public for this CVE so the test is directly reproducible against a staging console. The distinguishing question for an assessor: does the last test report contain any request sent to the endpoint-security management plane, or only requests sent to systems it defends?",
+        "evidence": "Packet vector: 'Fortinet FortiClient EMS contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.' Packet fields: cwe_refs CWE-89, cvss 9.8, cisa_kev true with kev_date 2026-04-13, active_exploitation confirmed, poc_available true. Citing gap UK-CAF-B4 (System security).",
+        "gap_closes": [
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2026-34621": {
     "name": "Adobe Acrobat and Reader Prototype Pollution Vulnerability",
@@ -8434,7 +8973,41 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-MDM-GATEWAY-UNAUTH-CONFIG-ENDPOINT-NEUTRALIZE-AND-CONTAIN",
+        "name": "DEVICE-MANAGEMENT-GATEWAY-CONFIG-ENDPOINT-AUTH-INPUT-NEUTRALIZATION",
+        "description": "Ivanti EPMM is the device-management gateway itself, and this flaw reaches remote code execution on its management surface with no credentials at all - the injected code is interpreted before any authentication decision is made. Every EPMM message and configuration endpoint has to authenticate the caller before processing, neutralize injected code ahead of any interpreter or command sink, and no EPMM instance may be left with those endpoints reachable from an untrusted network. Distinguishing test: from an unauthenticated client on a staging EPMM, send each endpoint a payload that attempts code execution and confirm refusal before any interpreter runs. Because exploitation is confirmed, an instance whose endpoints were exposed before remediation also needs forensic triage rather than a patch-and-close.",
+        "evidence": "Packet: 'Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability that could allow attackers to achieve unauthenticated remote code execution'; attack_vector 'code injection (CWE-94) yielding unauthenticated remote code execution on the EPMM management surface'; cvss 9.8; poc_available true; cisa_kev true, kev_date 2026-04-08, active_exploitation confirmed.",
+        "gap_closes": [
+          "NIST-800-53-AC-6",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "EPMM was KEV-listed 2026-04-08 with exploitation confirmed and a public PoC, so the remediation window is hours rather than the routine patch cycle the framework controls assume. The packet records a vendor patch as available and no live-patch tool registered, with the vendor fix typically needing a service restart or system reboot per the KEV requiredAction - so the SLA for this entry must be written against a scheduled EPMM service outage, not against a hot-apply. Any EPMM instance that cannot take that restart inside the window has to be pulled off untrusted networks until it can, because there is no in-place mitigation path recorded here.",
+        "evidence": "Packet: cisa_kev true; kev_date 2026-04-08; active_exploitation confirmed; rwep_score 77; poc_available true; patch_available true; live_patch_available false; live_patch_notes 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.'",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "NIST-800-53-SI-2",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-037",
+        "name": "FLEET-COMPROMISE-IR-PLAYBOOK",
+        "description": "EPMM is the control plane for a managed mobile fleet, so unauthenticated code execution on it is a fleet-wide event rather than a single-host one: whoever holds the server inherits its ability to push configuration profiles and certificates to every enrolled device. For an instance that was reachable during the confirmed-exploitation window, installing the vendor patch closes the injection path but leaves any profile pushed, certificate issued, or credential that transited the server untouched. The playbook must cover EPMM-pushed certificate revocation, device-trust-state invalidation, an audit of configuration profiles changed since the exposure window opened, quarantine criteria for enrolled devices, and rotation of every account that authenticated through the server during that period.",
+        "evidence": "Packet: Ivanti Endpoint Manager Mobile (EPMM); unauthenticated remote code execution on the EPMM management surface (CWE-94); cisa_kev true, kev_date 2026-04-08, active_exploitation confirmed; patch_available true.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "AU-Essential-8-Patch"
+        ]
+      }
+    ]
   },
   "CVE-2026-35616": {
     "name": "Fortinet FortiClient EMS Improper Access Control Vulnerability",
@@ -8494,7 +9067,40 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-055",
+        "name": "SECURITY-TOOL-INTEGRITY-VERIFICATION",
+        "description": "Put the FortiClient EMS server itself inside vulnerability-management scope at the SLA of the most privileged software in the estate, instead of wherever 'endpoint security product' falls in the OS-versus-application patch split. The exploited surface is the management server operators deploy in order to secure endpoints, and the flaw is reachable by an unauthenticated caller sending crafted requests — so the EMS build level is itself a security control, not an operations detail. Audits must establish the deployed EMS build from the server rather than from the console's own status view, and must include the trust-anchor-inversion test: send an unauthenticated crafted request to the EMS request handlers on a staging instance and confirm it is refused before any code or command runs. Remediation is a scheduled EMS outage: the entry registers no live-patch path and the vendor patch requires a service restart or reboot, so the security console is offline during its own fix and that window must be planned on the KEV clock rather than deferred to the routine cycle.",
+        "evidence": "Packet: 'Fortinet FortiClient EMS contains an improper access control vulnerability that may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests' (CWE-284). CISA KEV-listed 2026-04-06, active_exploitation: confirmed, CVSS 8.8, RWEP 77, poc_available: true. patch_available: true with live_patch_available: false; live_patch_notes records 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.'",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-078",
+        "name": "ENDPOINT-MGMT-DEPLOYMENT-CHANNEL-INTEGRITY",
+        "description": "Treat the EMS-to-FortiClient agent channel as a privileged supply-chain control plane for the duration of this exposure. Unauthenticated code or command execution on the EMS server hands an attacker the system that distributes configuration and software to every managed endpoint, so the blast radius is the agent fleet rather than one server: integrity-monitor the deployment artifacts and any key material the server holds, and alert on agent pushes and policy changes that do not correspond to a sanctioned admin action. Because the fix requires taking EMS down for a service restart, that monitoring has to span the outage and continue after it — restarting the server applies the patch but does not by itself evict anything placed through the flaw beforehand, and with exploitation confirmed in the wild an internet-reachable EMS instance is a forensic question, not a hypothetical. The distinguishing test: replay the deployment-artifact and key-table integrity baseline after the patch restart and confirm it matches the pre-exposure baseline.",
+        "evidence": "Packet: improper access control (CWE-284) 'allowing an unauthenticated attacker to access functions or data beyond authorization', with the KEV description recording that it 'may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests'. CISA KEV-listed 2026-04-06, active_exploitation: confirmed, CVSS 8.8, RWEP 77, poc_available: true. live_patch_available: false and the vendor patch requires a service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "NIST-800-53-AC-6",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-036",
+        "name": "FLEET-CONTROL-PLANE-ADMIN-PRIVILEGE-TIER",
+        "description": "Classify FortiClient EMS as a fleet control plane and confine its reachability on that basis: the EMS console and its request handlers should be reachable only through a privileged administrative path (PAM jumphost or a dedicated admin segment), with EMS administration held as an identity separate from general IT or application admin roles and elevated just-in-time. Against this CVE the tier's operative benefit is reachability rather than authentication strength — the flaw is exercised pre-authentication via crafted requests, so any deployment that leaves the EMS request surface reachable from general user networks or the internet gives the attacker the entire path no matter how the EMS credentials are governed. Frameworks that enumerate a single 'admin' tier do not distinguish the server that governs every endpoint agent from an application administrator, which is why this network-position requirement has to be stated as its own control. The distinguishing test: from a general user subnet, attempt to reach the EMS request handlers and confirm the connection is refused at the network boundary before authentication is ever reached.",
+        "evidence": "Packet: FortiClient EMS is exploited by 'an unauthenticated attacker to execute unauthorized code or commands via crafted requests' (CWE-284, improper access control). CISA KEV-listed 2026-04-06, active_exploitation: confirmed, CVSS 8.8, RWEP 77, poc_available: true. No live-patch tool is registered for this entry and the vendor patch requires a service restart or system reboot per the KEV requiredAction, so the exposure persists until an EMS restart window can be taken.",
+        "gap_closes": [
+          "NIS2-Art21-network-security",
+          "NIST-800-53-AC-6"
+        ]
+      }
+    ]
   },
   "CVE-2026-3502": {
     "name": "TrueConf Client Download of Code Without Integrity Check Vulnerability",
@@ -8554,7 +9160,30 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-SUPPLYCHAIN-SIGNED-INSTALLER-INTEGRITY",
+        "name": "INDEPENDENT-INTEGRITY-VERIFICATION-OF-SIGNED-VENDOR-INSTALLERS",
+        "description": "TrueConf Client fetches update code without verifying its integrity, so nothing on the client side distinguishes the vendor's build from one substituted by an attacker who has gained influence over the delivery path. The operator response is to stop letting the in-app updater be the trust decision: pull TrueConf Client builds through managed software distribution, verify each build against an integrity source independent of the download itself — vendor-published per-release hashes obtained over a separate channel, or a behavioural baseline of the installed binaries — and only then push it to endpoints. This is the harder form of the control's premise: the original lesson was that a valid signature is not proof of integrity, whereas here the client performs no verification step at all, so an out-of-band check is the only thing standing between a tampered payload and execution in the updating process's context.",
+        "evidence": "The packet records a \"download of code without integrity check vulnerability\" (CWE-494) in which \"An attacker who is able to influence the update delivery path can substitute a tampered update payload. If the payload is executed or installed by the updater, this may result in arbitrary code execution in the context of the updating process or user,\" and identifies the delivery-path influence as \"a hijacked update endpoint or machine-in-the-middle.\" CISA KEV-listed 2026-04-02 with active_exploitation confirmed, poc_available true, CVSS 8.8, RWEP 77.",
+        "gap_closes": [
+          "UK-CAF-B4",
+          "NIS2-Art21-network-security"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "The KEV clock here governs a client fleet rather than a single server: every endpoint running TrueConf Client is independently exploitable by whoever can influence its update fetch, so the fixed client has to reach all of them on the KEV window rather than on the ordinary endpoint-software refresh cycle. Two facts make the rollout a scheduled fleet action rather than a background update — the packet registers no live-patch tool for this entry, and the vendor patch typically requires a service restart or system reboot per the KEV requiredAction. Until the fixed build is present on a given endpoint, the interim posture is to keep that endpoint's updater off networks where the delivery path can be influenced, because the vulnerable client will accept whatever the channel returns.",
+        "evidence": "cisa_kev is true with kev_date 2026-04-02 and active_exploitation confirmed; poc_available is true; patch_available is true and live_patch_available is false, with the packet noting \"No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.\" The exploitation precondition per the packet is an attacker who \"can influence the download channel (a hijacked update endpoint or machine-in-the-middle).\" CVSS 8.8, RWEP 77, CWE-494.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      }
+    ]
   },
   "CVE-2026-5281": {
     "name": "Google Dawn Use-After-Free Vulnerability",
@@ -8693,7 +9322,30 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-030",
+        "name": "PERIMETER-DEVICE-ZERODAY-SLA-TIER",
+        "description": "When NetScaler is configured as a SAML IDP it is the authentication enforcement point for everything behind it, so its remediation tier cannot be derived from the CVE's severity band. This entry reads as a low-severity information disclosure by CVSS, yet the memory it overreads is authenticated session material and it is KEV-listed with confirmed in-the-wild exploitation — the RWEP score is 77 against a CVSS of 5.5. A vulnerability-management program that sorts by CVSS puts this appliance in the routine maintenance window. The tier requirement for this CVE: the update is due on the KEV clock, or the SAML IDP virtual server is taken out of service until the appliance is on a fixed build. Nothing upstream compensates, because the vulnerable device is the trust boundary the upstream controls delegate to.",
+        "evidence": "Packet: out-of-bounds read (CWE-125) on NetScaler ADC, NetScaler Gateway and NetScaler ADC FIPS/NDcPP when configured as a SAML IDP, leading to memory overread; the attack vector is described as disclosing adjacent memory used to steal authenticated session material. cisa_kev true, kev_date 2026-03-30, active_exploitation confirmed, poc_available true; cvss 5.5 against rwep_score 77.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "Updating this appliance stops the overread but does nothing about what has already left it. The exploited primitive hands an attacker authenticated session material read out of the SAML IDP's memory, and that material stays valid after the fix is applied — the vulnerability is closed while the access it produced is not. Remediation for this CVE must be run as compromise response rather than maintenance: once the appliance is on a fixed build, terminate every active session, rotate and reissue the session and signing secrets the IDP holds, rotate credentials that traversed it, and review the authentications it brokered during the exposure window (from KEV listing back through the earliest plausible exploitation). Patch-in-place with standing sessions is the failure mode this control exists to prevent.",
+        "evidence": "Packet: out-of-bounds read (CWE-125) in the SAML IDP path of NetScaler, disclosing adjacent memory used to steal authenticated session material; active_exploitation confirmed, cisa_kev true with kev_date 2026-03-30, poc_available true. patch_available true, live_patch_available false, live_patch_notes recording no registered live-patch tool and a vendor patch that typically requires service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "UK-CAF-B2",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      }
+    ]
   },
   "CVE-2025-53521": {
     "name": "F5 BIG-IP Stack-Based Buffer Overflow Vulnerability",
@@ -8753,7 +9405,41 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-030",
+        "name": "PERIMETER-DEVICE-ZERODAY-SLA-TIER",
+        "description": "A BIG-IP APM appliance is the trust boundary for the remote-access path it fronts, so the routine 14/30-day windows generic vulnerability-management controls allow are the wrong clock for an unauthenticated stack-based overflow reaching code execution on its data path. This CVE belongs in a perimeter tier: vendor fix deployed within hours of the KEV listing, or the vulnerable virtual server and management interface taken out of untrusted reach until it can be. The packet records no live-patch path for this entry and a vendor fix that requires a service restart or system reboot per the KEV requiredAction, so the SLA has to pre-authorize a failover or downtime window on the appliance itself. Frameworks that grade patch timeliness on a single estate-wide average let a 9.8 pre-auth RCE on the device that terminates remote access sit inside an acceptable-looking metric.",
+        "evidence": "F5 BIG-IP APM stack-based buffer overflow (CWE-121), CVSS 9.8, RWEP 77, exploitable by an unauthenticated attacker for memory-corruption remote code execution on the appliance. CISA KEV-listed 2026-03-27 with confirmed in-the-wild exploitation and poc_available=true. patch_available=true, live_patch_available=false; the entry states the vendor patch typically requires service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "Confirmed in-the-wild exploitation plus a public PoC against an unauthenticated RCE on BIG-IP APM means any appliance that was network-reachable before the fix has to be treated as possibly already running attacker code, not merely as unpatched. The default IR path for this CVE is capture the running configuration off the box, rebuild the appliance from vendor media, and rotate the credentials and keys the appliance held or proxied before it returns to service. Installing the vendor fix removes the overflow; it does not remove anything an operator installed through the overflow beforehand, and the restart the fix requires is a convenient moment for an implant to reload. A compliance verdict of remediated based on the installed version alone is the failure this control exists to prevent.",
+        "evidence": "Unauthenticated memory-corruption RCE on the appliance (CWE-121, CVSS 9.8, RWEP 77), active_exploitation=confirmed, poc_available=true, CISA KEV-listed 2026-03-27. patch_available=true with live_patch_available=false and a vendor patch that typically requires service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "NIS2-Art21-patch-management",
+          "NIST-800-53-SI-2",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-031",
+        "name": "FIREWALL-EGRESS-TELEMETRY-SEPARATE-TRUST-ZONE",
+        "description": "Code execution on BIG-IP APM is code execution on the device that writes the access and authentication records for the remote-access path it fronts, so the appliance's local log store cannot answer whether it was hit before the fix landed. Syslog, access-policy and authentication events must already be landing on a collector in a separate trust zone, with different credentials and a different management path, and retained far enough back to cover the window preceding the 2026-03-27 KEV listing. Without that, the rebuild-versus-patch decision this CVE forces is made with no evidence, and the exposure window can only be guessed at from the disclosure date rather than measured.",
+        "evidence": "Confirmed in-the-wild exploitation of an unauthenticated RCE on the appliance (CWE-121, CVSS 9.8, RWEP 77) with poc_available=true, CISA KEV-listed 2026-03-27; remediation requires a service restart or system reboot per the KEV requiredAction with no live-patch path registered.",
+        "gap_closes": [
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2026-33634": {
     "name": "Aquasecurity Trivy Embedded Malicious Code Vulnerability",
@@ -8813,7 +9499,32 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-055",
+        "name": "SECURITY-TOOL-INTEGRITY-VERIFICATION",
+        "description": "Trivy is the scanner, not the scanned: it is invoked inside pipelines with broad read access precisely so it can inspect everything, which places it outside the asset inventory and patch SLA that the citing controls apply to production software. This CVE inverts that trust anchor — per the packet a Trivy distribution/component carried embedded malicious code (CWE-506) that executes in the vulnerability scanner's own trusted context in every environment it runs in. The control means enrolling the Trivy build deployed in each pipeline as a first-class inventoried asset with the same SLA as any other privileged software, pinning the version the pipeline resolves instead of a floating reference, requiring TLS with certificate pinning on the tool's update and vulnerability-database fetch channels, and running the trust-anchor-inversion audit test: execute the scanner against a crafted input in a sandbox and confirm it is rejected rather than trusted. Remediation per the packet: patch_available is true but live_patch_available is false, and live_patch_notes record that the vendor patch typically requires a service restart or system reboot per the KEV requiredAction — so the fix is a pipeline-image/binary replacement with restart, not an in-place hot fix. Because the packet's vector states the attacker reaches every token, SSH key, cloud credential, database password and in-memory configuration in the CI/CD environment, every secret a Trivy step could read during the exposure window must be treated as disclosed.",
+        "evidence": "Packet CVE-2026-33634 \"Aquasecurity Trivy Embedded Malicious Code Vulnerability\", cwe_refs CWE-506; cisa_kev true with kev_date 2026-03-26; active_exploitation confirmed; rwep_score 77; cvss 8.8; poc_available true. vector: \"Aquasecurity Trivy contains an embedded malicious code vulnerability that could allow an attacker to gain access to everything in the CI/CD environment, including all tokens, SSH keys, cloud credentials, database passwords, and any sensitive configuration in memory.\" attack_vector: \"a Trivy distribution/component contained embedded malicious code (CWE-506), executing in the trusted context of the vulnerability scanner across every environment it runs in.\" patch_available true; live_patch_available false; live_patch_notes: \"No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.\"",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-SUPPLYCHAIN-SIGNED-INSTALLER-INTEGRITY",
+        "name": "INDEPENDENT-INTEGRITY-VERIFICATION-OF-SIGNED-VENDOR-INSTALLERS",
+        "description": "The defect here is not a coding mistake in Trivy that a newer release fixes by accident — per the packet the malicious code was embedded in what shipped as a Trivy distribution/component. Every downstream check that derives its verdict from the distribution channel itself (publisher signature, registry provenance, an \"official\" designation) returns valid on that artifact, so a pipeline that gates promotion on signature validity promotes the payload. The control means the Trivy release a pipeline is about to adopt must be verified against an integrity source independent of the channel that delivered it: per-release hashes obtained through a separate channel, a reproducible-build attestation, or a behavioural baseline of the scanner binary — a scan step that begins reading credential paths and opening outbound connections beyond its vulnerability-database fetch is an integrity diff, not scanner noise. Gate promotion on that independent check, and treat any Trivy version bump as a supply-chain change requiring it. Remediation shape per the packet: patch_available true, live_patch_available false, with the vendor patch requiring a service restart or system reboot per the KEV requiredAction.",
+        "evidence": "Packet CVE-2026-33634, cwe_refs CWE-506 (embedded malicious code) with attack_vector \"a Trivy distribution/component contained embedded malicious code (CWE-506), executing in the trusted context of the vulnerability scanner across every environment it runs in\"; cisa_kev true, kev_date 2026-03-26; active_exploitation confirmed; poc_available true; rwep_score 77; cvss 8.8; ai_discovered false. patch_available true; live_patch_available false; live_patch_notes: \"No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.\"",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      }
+    ]
   },
   "CVE-2026-25592": {
     "name": "Microsoft Semantic Kernel SessionsPythonPlugin Path Traversal — Prompt-Injection to Host RCE",
@@ -11623,7 +12334,32 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-056",
+        "name": "MOBILE-ENDPOINT-MDM-ENFORCED-KEV-SLA",
+        "description": "Managed Apple devices must be driven to the fixed OS build on an MDM-enforced clock keyed to the KEV listing, with user deferral disabled and the restart forced rather than requested. For this flaw the update is not optional hardening: the packet describes a malicious application writing kernel memory, which is a defect below the app sandbox, so nothing an operator configures on the device changes the outcome until the fixed build is running. The packet records no live-patch tool and states the vendor fix typically requires a service restart or system reboot, so the compliance event to measure is 'rebooted onto the fixed build', not 'update pushed'. The affected list in the packet spans watchOS, iOS, iPadOS, macOS, visionOS and tvOS; visionOS and tvOS are the families most likely to sit outside an update ring built around phones and laptops, so the enforcement scope has to be checked against the full family list rather than assumed.",
+        "evidence": "The packet's vector states that Apple watchOS, iOS, iPadOS, macOS, visionOS and tvOS contain a classic buffer overflow (CWE-120) that could allow a malicious application to cause unexpected system termination or write kernel memory. cisa_kev is true with kev_date 2026-03-20, active_exploitation is confirmed, poc_available is true, and rwep_score is 77 against a CVSS of 8.8. patch_available is true, live_patch_available is false, and live_patch_notes states the vendor patch typically requires a service restart or system reboot per the KEV requiredAction. The cited patch-management controls — Essential Eight 'Patch operating systems', ISO 27001 A.8.8, NIS2 Art. 21 vulnerability handling, NIST SI-2 — express timescale expectations but none ties the estate to the KEV date or removes the user's ability to defer the restart the fix requires.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "NIST-800-53-SI-2",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management"
+        ]
+      },
+      {
+        "id": "MOBILE-OS-MINIMUM-PATCH-LEVEL-ENFORCEMENT",
+        "name": "MOBILE-OS-MINIMUM-PATCH-LEVEL-ENFORCEMENT",
+        "description": "The Apple fleet must treat the OS build that fixes this flaw as an access condition, not a reporting metric: a device below it is denied or quarantined from organizational data rather than listed on a patch-compliance dashboard. The packet's vector makes the second half of this control the load-bearing half — the trigger is a malicious application writing kernel memory, so on any device that cannot yet take the fixed build the operator's remaining lever is constraining what code gets to run at all, which means restricting installation of untrusted or side-loaded applications and holding the device outside the trust boundary until it updates. The distinguishing test is to enrol a device pinned below the fixed build and confirm the policy actually denies it access to protected resources; an estate that surfaces the stale build on a report while the device keeps its mail, VPN and document access has recorded the exposure rather than removed it.",
+        "evidence": "The packet's vector states the flaw could allow a malicious application to cause unexpected system termination or write kernel memory across watchOS, iOS, iPadOS, macOS, visionOS and tvOS — an application-driven kernel write, so the code is running locally and the boundary it crosses is below the application privilege model. That is why the least-privilege control cited against this entry is insufficient: no privilege assignment on the app constrains a kernel memory write, and the UK CAF system-security expectation likewise assumes an OS boundary the packet shows is defective. active_exploitation is confirmed, poc_available is true, cisa_kev is true with kev_date 2026-03-20, and rwep_score is 77. patch_available is true but live_patch_available is false with live_patch_notes stating the vendor patch typically requires a service restart or system reboot, so devices awaiting a reboot window remain in the exposed population and need an access-side control rather than a patch-side one.",
+        "gap_closes": [
+          "NIST-800-53-AC-6",
+          "UK-CAF-B4",
+          "AU-Essential-8-Patch"
+        ]
+      }
+    ]
   },
   "CVE-2025-31277": {
     "name": "Apple Multiple Products Buffer Overflow Vulnerability",
@@ -11678,7 +12414,30 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-056",
+        "name": "MOBILE-ENDPOINT-MDM-ENFORCED-KEV-SLA",
+        "description": "The entry covers Safari, iOS, watchOS, visionOS, iPadOS, macOS and tvOS at once, so a single deferring device in any of those families keeps the maliciously-crafted-web-content path into the CWE-119 memory-corruption primitive open. Because no live patch is registered and the vendor fix takes effect only after a restart or reboot, the exposure lasts exactly as long as a user can postpone the update. Enforce the Apple-OS update through device management with user deferral disallowed and the control's 24h KEV-class deadline measured from the 2026-03-20 listing, and track install completion per device across every OS family named in the entry — tvOS, visionOS and watchOS units counted, not assumed current, since those are the ones no help-desk ticket ever chases.",
+        "evidence": "CISA KEV-listed 2026-03-20 with active_exploitation confirmed; RWEP 77, CVSS 8.8, PoC available. The packet's description covers Apple Safari, iOS, watchOS, visionOS, iPadOS, macOS and tvOS, where processing maliciously crafted web content may lead to memory corruption (CWE-119). patch_available is true but live_patch_available is false, and the packet records that the vendor patch typically requires service restart or system reboot per the KEV requiredAction — so remediation completes only at the restart the deferring user controls.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-121",
+        "name": "MOBILE-ZERO-CLICK-HARDENING",
+        "description": "For the population plausibly inside the targeting set this class of Apple flaw serves — executives, journalists, legal and security staff — the reboot-gated update is not fast enough on its own, because the packet describes the overflow as a sandbox-escape / privilege step inside a chain rather than a standalone bug. Place those users in a reduced-attack-surface mode so untrusted web content, message attachments, fonts and link previews are not processed automatically, narrowing the delivery path into the CWE-119 primitive during the window between the 2026-03-20 KEV listing and completed fleet restart. This has to be a standing posture for the high-risk cohort assigned before the next disclosure, not a reaction to this CVE — the mode only helps if it was already on when the chain arrived.",
+        "evidence": "The packet's attack_vector records the flaw as a buffer overflow (CWE-119) used as a sandbox-escape / privilege step in an exploit chain, and notes that Apple zero-days of this class are typically used in targeted-spyware chains; the KEV description names processing of maliciously crafted web content as the trigger. Exploitation is confirmed in the wild (KEV 2026-03-20), RWEP 77, CVSS 8.8, PoC available. With live_patch_available false, the only vendor remediation lands at restart, leaving a device-by-device exposure window.",
+        "gap_closes": [
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2026-20131": {
     "name": "Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data Vulnerability",
@@ -11831,7 +12590,20 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "The delivery path is ordinary mail. The packet records abuse of CSS @import directives in email HTML against the ZCS Classic UI, so exploitation requires only that a message reaches a mailbox and the recipient opens it in the web client — the attacker needs no account, no network position and no interaction beyond normal mail reading. That is why the CVSS 6.1 rating misleads a severity-ranked patch queue: the score reflects the impact ceiling of script execution in one session, while the real-world priority (RWEP 77, KEV-listed 2026-03-18, confirmed in-the-wild exploitation, public PoC) reflects that every Classic UI user is reachable by anyone who can send them email. The remediation cost is exactly what keeps such a queue deferring it — the packet records no live-patch tool for this entry and states the vendor patch typically requires a service restart or system reboot per the KEV requiredAction, so closing it means booking a mail-service outage. The SLA therefore has to be pinned to the KEV listing date rather than the CVSS band, because a message that exploits it may already be sitting in mailboxes.",
+        "evidence": "Packet: cwe_refs CWE-79, cvss 6.1, rwep_score 77, cisa_kev true, kev_date 2026-03-18, active_exploitation confirmed, poc_available true, patch_available true, live_patch_available false, live_patch_notes \"No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.\" Vector as recorded: \"Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability in the Classic UI where attackers could abuse Cascading Style Sheets (CSS) @import directives in email HTML.\" Attack vector: \"a cross-site scripting flaw (CWE-79) on the ZCS web client, letting an attacker run script in a victim's authenticated session.\"",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management"
+        ]
+      }
+    ]
   },
   "CVE-2026-20963": {
     "name": "Microsoft SharePoint Deserialization of Untrusted Data Vulnerability",
@@ -11891,7 +12663,31 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "A SharePoint farm must be remediated on a KEV-tied clock, not the monthly server-patch window, because the flaw needs no credentials and is reached over the same web surface the farm exists to serve — every hour it answers requests is exposure. The SLA must budget the farm-wide restart the vendor fix requires (front-end plus application servers, not one node) inside the clock rather than deferring the restart to the next change window and counting the installer run as remediation.",
+        "evidence": "Packet records a CISA KEV listing dated 2026-03-18 with active_exploitation 'confirmed', RWEP 77 against CVSS 9.8, and poc_available true. patch_available is true and live_patch_available is false; live_patch_notes state the vendor patch typically requires service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "Installing the SharePoint update closes the deserialization entry point but does not evict whatever entered through it, and the packet's exploitation status says something did. A farm that was network-reachable and unpatched during the exposure window must be triaged as compromised rather than declared fixed: review the web-facing servers' content and handler trees for attacker-planted artifacts, rotate the farm's service-account and application credentials, and prefer rebuild over patch-in-place — the service restart the fix requires will otherwise simply relaunch anything the attacker left resident.",
+        "evidence": "Packet's attack_vector describes deserialization of untrusted data (CWE-502) yielding unauthenticated remote code execution on the SharePoint web surface, with active_exploitation 'confirmed' and CISA KEV listing 2026-03-18; poc_available is true. live_patch_available is false and live_patch_notes record that the vendor patch typically requires a service restart or system reboot.",
+        "gap_closes": [
+          "NIS2-Art21-vulnerability-management",
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2025-47813": {
     "name": "Wing FTP Server Information Disclosure Vulnerability",
@@ -11951,7 +12747,21 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "This Wing FTP entry is the case that a severity-banded patch policy silently drops. It scores CVSS 5.5 because the payoff is only the disclosure of the installation / local file path, so any remediation queue keyed to High-and-Critical never schedules it — yet it is KEV-listed with confirmed in-the-wild exploitation, a public PoC, and an RWEP of 77, and the disclosed path is the reconnaissance input that makes a follow-on attack on the same file server land. The SLA must therefore be triggered by KEV membership rather than the CVSS band, starting at the 2026-03-16 listing since the vendor fix already exists. Two specifics of this entry shape the four-hour response: the trigger is a single crafted request — an oversized or malformed UID cookie against loginok.html — so there is no exploitation toolchain slowing an attacker down, and the vendor patch needs a service restart with no live-patch option, which means the restart of an internet-facing file-transfer service must be pre-authorized rather than negotiated inside the SLA window.",
+        "evidence": "cvss 5.5 but rwep_score 77; cisa_kev true with kev_date 2026-03-16 and active_exploitation confirmed; poc_available true. attack_vector: 'Generation of an error message containing sensitive information (CWE-209) in Wing FTP Server: an oversized or malformed UID session cookie triggers an error (on loginok.html) that discloses the installation / local file path, aiding a follow-on attack.' patch_available true, live_patch_available false, live_patch_notes: 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.'",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      }
+    ]
   },
   "CVE-2026-3910": {
     "name": "Google Chromium V8 Improper Restriction of Operations Within the Bounds of a Memory Buffer Vulnerability",
@@ -12006,7 +12816,39 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-057",
+        "name": "BROWSER-MANAGED-UPDATE-NO-DEFERRAL",
+        "description": "Delivery here is a crafted HTML page, so exposure accrues during ordinary browsing rather than at some privileged action an operator could suspend — every hour a managed browser sits on a pre-fix Chromium build is live exposure to an exploited V8 memory bug. Enterprise update rings that stage a security-channel Chromium release through pilot and broad phases, or that let users defer the relaunch, push the fixed build past the exploitation window. Deferral of this update has to be disallowed by policy on the managed fleet, not merely discouraged, because the vendor build is the only remediation the packet records.",
+        "evidence": "Packet vector: 'could allow a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page'; cwe_refs CWE-119 in V8; cisa_kev true, kev_date 2026-03-13, active_exploitation 'confirmed', poc_available true; patch_available true, live_patch_available false.",
+        "gap_closes": [
+          "NIS2-Art21-patch-management",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "A browser normally rides an application-patch cadence measured in weeks; this entry is KEV-listed 2026-03-13 with confirmed in-the-wild exploitation and a public PoC, which puts it on the compressed KEV clock instead. The packet's live-patch note records that the vendor fix typically requires a service restart or system reboot and that no live-patch tool is registered, so compliance has to be evidenced as 'running the fixed build after that restart across the fleet' rather than 'update delivered' — a delivered-but-not-restarted installer leaves the vulnerable V8 code executing.",
+        "evidence": "cisa_kev true, kev_date 2026-03-13; active_exploitation 'confirmed'; poc_available true; RWEP 77 / CVSS 8.8; patch_available true, live_patch_available false, live_patch_notes: 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.'",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-021",
+        "name": "TIER-3-DEPENDENCY-INVENTORY",
+        "description": "The packet states this V8 flaw reaches multiple browsers that embed Chromium — Chrome, Edge and Opera named explicitly and 'not limited to' those — so an inventory keyed on product names reports the estate remediated once Chrome updates while every other Chromium-embedding product still ships the vulnerable engine. The inventory has to record the embedded browser engine as a component of each product that carries it, with each embedder's own update channel tracked as a separate remediation path, because updating one embedder fixes none of the others.",
+        "evidence": "Packet vector: 'This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.' cwe_refs CWE-119 located in the V8 engine; cisa_kev true, kev_date 2026-03-13.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      }
+    ]
   },
   "CVE-2026-3909": {
     "name": "Google Skia Out-of-Bounds Write Vulnerability",
@@ -12061,7 +12903,42 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-057",
+        "name": "BROWSER-MANAGED-UPDATE-NO-DEFERRAL",
+        "description": "The delivery primitive here is an ordinary web page, so any Chrome or ChromeOS instance parked on a deferred enterprise update ring stays exploitable through nothing more than users browsing — there is no risky-behavior policy that closes it. Percentage-staged rollouts, pinned-version pilot rings, and 'test in the pilot ring first' change control must be bypassed for this security-channel update. On ChromeOS the update is not effective until the device restarts, so the policy must force the restart rather than wait for a user-initiated one and count the downloaded update as remediation.",
+        "evidence": "Packet's vector states the out-of-bounds write 'could allow a remote attacker to perform out of bounds memory access via a crafted HTML page' and that it 'affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products'. CISA KEV listing 2026-03-13, active_exploitation 'confirmed', poc_available true, patch_available true, live_patch_available false, with live_patch_notes recording that the vendor patch typically requires service restart or system reboot.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-patch-management"
+        ]
+      },
+      {
+        "id": "MOBILE-OS-MINIMUM-PATCH-LEVEL-ENFORCEMENT",
+        "name": "MOBILE-OS-MINIMUM-PATCH-LEVEL-ENFORCEMENT",
+        "description": "The packet lists Android as separately affected from Chrome, so pushing a browser update to the fleet does not settle the Android exposure — the platform copy of the graphics component travels with the OS security-patch level. The enrolled-fleet policy therefore has to gate access to organizational data on the security-patch level that carries this fix, not merely report patch level on a compliance dashboard. Handsets that cannot yet receive that level — vendor-abandoned or carrier-delayed models — must be quarantined rather than risk-accepted, because the trigger is attacker-controlled web content that a user cannot reasonably avoid encountering.",
+        "evidence": "Packet's vector states the flaw 'affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products' and is reachable 'via a crafted HTML page'. CISA KEV listing 2026-03-13 with active_exploitation 'confirmed'; RWEP 77, CVSS 9.8, poc_available true, patch_available true.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "NIS2-Art21-patch-management",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-021",
+        "name": "TIER-3-DEPENDENCY-INVENTORY",
+        "description": "Skia is a bundled graphics component rather than a product an operator buys, and the packet's own affected list ends in 'possibly other products' — which is the admission that nobody can enumerate exposure from a product-level asset register. Real exposure includes in-house and third-party applications built on Flutter, which carry the component transitively and whose inventory entry names the app, never Skia. Asset and SBOM coverage must reach embedded-component depth so 'where is this graphics library in our estate?' is an answerable question, and the answer has to distinguish the copies that a vendor update channel fixes from the copies that are only fixed when the application is rebuilt against a fixed framework release and redistributed.",
+        "evidence": "Packet's attack_vector describes an out-of-bounds write in the Skia graphics library (CWE-787) reachable via attacker-controlled web content, and the vector text states the flaw 'affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products'. CISA KEV listing 2026-03-13, active_exploitation 'confirmed', poc_available true.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      }
+    ]
   },
   "CVE-2025-68613": {
     "name": "n8n Improper Control of Dynamically-Managed Code Resources Vulnerability",
@@ -12181,7 +13058,30 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "The remediation clock on this Workspace ONE UEM flaw starts at the 2026-03-09 KEV listing, not at the 2021 CVE id — an estate that closed out its 2021 vulnerability backlog years ago is still running the exposed build today, and nothing in a recency-ordered queue will surface it. Because the packet registers no live-patch path and states the vendor fix requires a service restart or reboot, meeting the KEV window means holding a pre-approved restart window for the UEM tier instead of queuing the platform behind the next monthly change cycle; every hour before that restart, the SSRF remains reachable by an unauthenticated caller with network access to UEM.",
+        "evidence": "cisa_kev true with kev_date 2026-03-09 on a 2021-numbered CVE; active_exploitation confirmed, RWEP 77, CVSS 7.5, poc_available true, patch_available true; live_patch_available false with live_patch_notes 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.'",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-037",
+        "name": "FLEET-COMPROMISE-IR-PLAYBOOK",
+        "description": "The vulnerable host is the endpoint-management control plane for the managed device estate, and the packet's impact is unauthenticated access to sensitive information rather than code execution — so a successful exploitation leaves no crash, no shell and no host artifact, while whatever the server-side requests retrieved stays valid after the patch lands. The playbook for this product has to assume disclosure over the full window the vulnerable build was live: rotate the enrollment, API and integration credentials plus any certificates reachable from the UEM's server-side request path, re-validate device trust state across the enrolled fleet, and audit configuration profiles pushed during that window before the incident is treated as closed. Patch completion is not evidence that the exposure ended.",
+        "evidence": "Packet vector: 'Omnissa Workspace One UEM formerly known as VMware Workspace One UEM contains a server-side request forgery (SSRF) vulnerability that could allow a malicious actor with network access to UEM to send their requests without authentication and to gain access to sensitive information.' active_exploitation confirmed, KEV-listed 2026-03-09, poc_available true, RWEP 77.",
+        "gap_closes": [
+          "UK-CAF-B4",
+          "NIS2-Art21-network-security"
+        ]
+      }
+    ]
   },
   "CVE-2025-26399": {
     "name": "SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability",
@@ -12241,7 +13141,32 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "Web Help Desk must run on a KEV-tied remediation clock rather than a routine application-patch window, because the deserialization sink sits in AjaxProxy and is reachable without authentication — exposure is a function of who can reach the Web Help Desk web tier, not of who holds a credential, so 'no untrusted users have accounts' is not an exposure argument. The packet records no live-patch path for this entry: the vendor fix requires a service restart or reboot, so the SLA has to pre-authorize a Web Help Desk service restart inside the KEV window instead of deferring it to the next change cycle. Where the restart genuinely cannot be taken in the window, the AjaxProxy request path must be made unreachable from untrusted networks for the remainder of it, and that state tracked as unremediated rather than counted as patched.",
+        "evidence": "CISA KEV-listed 2026-03-09 with active_exploitation 'confirmed' and poc_available true; CVSS 9.8, RWEP 77. The catalog vector records a 'deserialization of untrusted data vulnerability in AjaxProxy that could allow an attacker to run commands on the host machine', and the attack_vector records it as 'enabling unauthenticated remote code execution'. patch_available is true, live_patch_available is false, and live_patch_notes reads: 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.'",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-042",
+        "name": "INCOMPLETE-PATCH-SEQUENCE-SEVERITY-MULTIPLIER",
+        "description": "This is not a first-of-kind defect in this product — the catalog places it as the latest in the Web Help Desk deserialization chain — so vulnerability management must score it as an Nth-in-sequence failure of the same CWE-502 primitive, not as a discrete new CVE that resets the risk picture. For this deployment that means: Web Help Desk carries a standing severity multiplier and a shortened triage clock for any subsequent deserialization advisory, the AjaxProxy request path is recorded in the risk register as a known-recurring code-execution sink rather than a one-time finding, and the network-reachability restrictions placed around the Web Help Desk web tier for the earlier links in the chain are retained after this patch lands instead of being retired as remediated. A framework that treats each Web Help Desk CVE as an independent event keeps re-deriving the same 'patch and close' verdict against a primitive that has now failed repeatedly.",
+        "evidence": "The catalog attack_vector for this entry reads: 'a deserialization-of-untrusted-data flaw (CWE-502) enabling unauthenticated remote code execution (the latest in the Web Help Desk deserialization chain)' — the same CWE-502 primitive recurring in the same product. KEV-listed 2026-03-09, active_exploitation 'confirmed', poc_available true, CVSS 9.8, RWEP 77.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-patch-management"
+        ]
+      }
+    ]
   },
   "CVE-2026-1603": {
     "name": "Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability",
@@ -12301,7 +13226,40 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "Ivanti EPM is the endpoint-management server, so every hour between the 2026-03-09 KEV listing and the patched build running is time in which a remote unauthenticated caller can reach the alternate-path bypass and pull stored credential data. Run this on a 4-hour clock from KEV listing or patch availability, whichever is later, and — because no live patch is registered and the fix takes effect only at the service restart or reboot the KEV requiredAction calls for — book the EPM outage inside that clock instead of the next change window, which is where an endpoint-management server normally gets deferred to. Where the restart genuinely cannot happen in 4 hours, the documented compensating control must remove network reachability to the EPM surface, not merely record the delay as an approved exception.",
+        "evidence": "CISA KEV-listed 2026-03-09 with active_exploitation confirmed; RWEP 77, CVSS 9.1, PoC available. The packet describes an authentication bypass using an alternate path or channel (CWE-288) that could allow a remote unauthenticated attacker to leak specific stored credential data. patch_available is true, live_patch_available is false, and the packet records that the vendor patch typically requires service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-036",
+        "name": "FLEET-CONTROL-PLANE-ADMIN-PRIVILEGE-TIER",
+        "description": "EPM administers the endpoint fleet, and the packet's own statement of impact — unauthenticated leak of stored credential data — is precisely why its accounts cannot sit in the same tier as application admins. Two things follow for this deployment. First, the EPM management surface must be reachable only through a PAM jumphost, so an anonymous network caller has no route on which to present the alternate path or channel at all; network reachability, not authentication, is the only barrier a pre-auth bypass respects. Second, the credentials EPM stores must be just-in-time-elevated, FIDO2-step-up, EPM-scoped identities held separately from any other admin role, so what the bypass can disclose is not a standing password that also opens domain, backup or hypervisor infrastructure. A framework that counts EPM operators as ordinary admins lets the contents of the credential store, rather than any control, set the blast radius.",
+        "evidence": "The packet states the flaw is an authentication bypass using an alternate path or channel (CWE-288) that could allow a remote unauthenticated attacker to leak specific stored credential data from Ivanti Endpoint Manager; CVSS 9.1, RWEP 77, PoC available, with active_exploitation confirmed as of the 2026-03-09 KEV listing. The framework controls the packet records as insufficient here include NIST SP 800-53 AC-6 (Least Privilege), UK CAF B2 (Identity and access control) and NIS2 Art. 21 security of network and information systems — none of which give the endpoint-management control plane a privilege tier of its own.",
+        "gap_closes": [
+          "UK-CAF-B2",
+          "NIST-800-53-AC-6",
+          "NIS2-Art21-network-security"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-037",
+        "name": "FLEET-COMPROMISE-IR-PLAYBOOK",
+        "description": "Patching EPM closes the bypass and does nothing about credential data already read through it, which is the packet's stated impact — so the playbook for this entry has to open by assuming disclosure rather than waiting for evidence of it. Rotate every credential the EPM instance stored (agent-push service accounts, deployment shares, the EPM database account, any bound directory accounts), invalidate device-trust state pushed from the server, and audit configuration and package pushes back across the exposure window that opened no later than the 2026-03-09 KEV listing. Rotation scope must be driven by what EPM held, not by which accounts show anomalous logins: a credential taken from the store replays as ordinary successful authentication and generates no alert to scope from.",
+        "evidence": "The packet's description is that the flaw could allow a remote unauthenticated attacker to leak specific stored credential data; KEV-listed 2026-03-09 with active_exploitation confirmed and a PoC available. patch_available is true, but a fix that stops further leakage does not invalidate credentials disclosed before it was applied — and with live_patch_available false, the packet records that the fix lands only at the service restart or reboot the KEV requiredAction calls for, extending the disclosure window that rotation has to cover.",
+        "gap_closes": [
+          "UK-CAF-B2"
+        ]
+      }
+    ]
   },
   "CVE-2017-7921": {
     "name": "Hikvision Multiple Products Improper Authentication Vulnerability",
@@ -12476,7 +13434,31 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-056",
+        "name": "MOBILE-ENDPOINT-MDM-ENFORCED-KEV-SLA",
+        "description": "The affected surface here is the general-purpose Apple estate — macOS, iOS, iPadOS and Safari — where Apple ships the fix but it only reaches a device when a user accepts a restart, and this class of flaw is reached simply by rendering a web page. Enforce the update through device management against a hard deadline measured from the 2026-03-05 KEV listing rather than a notification: push a declarative software-update deadline, remove the deferral option, and quarantine devices past the deadline from organisational data. A management console that reports how many devices are behind is not the control — the enforcement is. The citing patch controls are satisfied by an estate-wide policy existing; this entry is exploited on the individual handset that deferred.",
+        "evidence": "The packet's vector states that Apple macOS, iOS, iPadOS, and Safari 16.6 contain the use-after-free, triggered by processing maliciously crafted web content. cisa_kev is true with kev_date 2026-03-05, active_exploitation is 'confirmed', poc_available is true, RWEP is 77 at CVSS 8.8. patch_available is true and live_patch_available is false, with live_patch_notes recording that remediation requires a service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-121",
+        "name": "MOBILE-ZERO-CLICK-HARDENING",
+        "description": "Reachability is ordinary web-content rendering, so the exposure is live for anyone who opens a page or previews a link in the interval between disclosure and the device actually restarting — and the packet places this class in targeted-spyware chains, which means a named cohort (executives, legal, journalists, security staff) carries far more of the risk than the estate average. Put that cohort in the platform's reduced-attack-surface mode (Lockdown Mode) as standing configuration, not as an incident response, so the complex web-content processing paths this use-after-free is reached through are not exercised at all. This is compensating cover for the gap between disclosure and restart — the Apple update still has to land, and NEW-CTRL-056 is what makes it land.",
+        "evidence": "vector records a use-after-free arising from the processing of maliciously crafted web content across Apple macOS, iOS, iPadOS and Safari 16.6. attack_vector records its role as a sandbox-escape step in an exploit chain and notes that Apple zero-days of this class are typically used in targeted-spyware chains. active_exploitation is 'confirmed', cisa_kev true with kev_date 2026-03-05, poc_available true.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2021-30952": {
     "name": "Apple Multiple Products Integer Overflow or Wraparound Vulnerability",
@@ -12531,7 +13513,31 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-056",
+        "name": "MOBILE-ENDPOINT-MDM-ENFORCED-KEV-SLA",
+        "description": "Every managed Apple endpoint in scope for this flaw must take the fixed OS build on an MDM-enforced clock tied to the KEV listing, with user deferral disabled. Because the packet records no live-patch path and states the vendor fix typically requires a service restart or system reboot, the enforcement has to include the ability to force that restart rather than waiting for a user-chosen moment — an update downloaded but never rebooted into leaves the device fully exploitable, and a dashboard that reports 'update available' as compliant is measuring the wrong event. Scope matters here: the packet names tvOS, macOS, Safari, iPadOS and watchOS, and tvOS and watchOS devices are routinely outside the update ring that covers phones and laptops, so the control must reach every Apple OS family enrolled in the estate rather than the iOS and macOS population alone.",
+        "evidence": "The packet's vector states that Apple tvOS, macOS, Safari, iPadOS and watchOS contain an integer overflow or wraparound arising from the processing of maliciously crafted web content that may lead to arbitrary code execution (CWE-190). cisa_kev is true with kev_date 2026-03-05, active_exploitation is confirmed, poc_available is true, and rwep_score is 77 against a CVSS of 8.8. patch_available is true, live_patch_available is false, and live_patch_notes states the vendor patch typically requires a service restart or system reboot per the KEV requiredAction — so the fixed build plus a reboot is the entire remediation and the only variable an operator controls is how quickly both happen. The framework controls cited against this entry set patch expectations but none binds the estate to the KEV listing date or forbids user deferral of the restart the fix depends on.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "NIST-800-53-SI-2",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-121",
+        "name": "MOBILE-ZERO-CLICK-HARDENING",
+        "description": "Users at elevated targeting risk must run their Apple devices in a reduced-attack-surface mode rather than relying on the update clock alone for this flaw. The packet's vector puts the trigger in the processing of maliciously crafted web content, which means exposure begins the moment a device renders an attacker's page or a message that automatically previews one — before any operator decision is available. Since the packet records no live-patch option and states the fix requires a restart or reboot, there is a period between disclosure and rebooted-and-fixed during which nothing in the patch programme protects the device; a mode that suppresses automatic processing of untrusted content is the only prevention that operates inside it. The enrolment decision therefore has to be taken for the at-risk population ahead of the next disclosure, since enrolling in response to a KEV listing repeats the same lag the control exists to remove.",
+        "evidence": "The packet's attack_vector describes the integer overflow / wraparound as a memory-corruption step in an exploit chain and records that Apple zero-days of this class are typically used in targeted-spyware chains; the vector text attributes the flaw to the processing of maliciously crafted web content that may lead to arbitrary code execution. active_exploitation is confirmed, poc_available is true, and the entry is KEV-listed on 2026-03-05. live_patch_available is false and live_patch_notes states the vendor patch typically requires a service restart or system reboot, so no mitigation takes effect without a reboot. Essential Eight patch maturity and the UK CAF system-security expectation cited against this entry both assume the remediation clock is the defence; neither requires a reduced-attack-surface posture for the population this exploitation class targets, so the pre-reboot window is left uncovered.",
+        "gap_closes": [
+          "UK-CAF-B4",
+          "AU-Essential-8-Patch"
+        ]
+      }
+    ]
   },
   "CVE-2023-41974": {
     "name": "Apple iOS and iPadOS Use-After-Free Vulnerability",
@@ -12586,7 +13592,30 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-056",
+        "name": "MOBILE-ENDPOINT-MDM-ENFORCED-KEV-SLA",
+        "description": "This is an iOS/iPadOS use-after-free that yields arbitrary code execution with kernel privileges, KEV-listed 2026-03-05 with exploitation confirmed, and the only remediation the packet records is the vendor update - no live-patch tool is registered for the platform. On a mobile estate the operative failure is user deferral: an update prompt dismissed on a personally-carried device silently extends exposure to a confirmed-exploited kernel bug for weeks, while the compliance dashboard still shows the fleet as enrolled and managed. The update must be pushed as a device-management enforcement with a deadline measured in hours, deferral disallowed, and devices still on an unpatched build past the deadline cut off from organizational data.",
+        "evidence": "Packet: 'Apple iOS and iPadOS contain a use-after-free vulnerability. An app may be able to execute arbitrary code with kernel privileges.' cwe_refs CWE-416; cisa_kev true, kev_date 2026-03-05, active_exploitation confirmed; rwep_score 77; cvss 8.8; poc_available true; patch_available true; live_patch_available false; live_patch_notes 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.'",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "NIST-800-53-SI-2",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-121",
+        "name": "MOBILE-ZERO-CLICK-HARDENING",
+        "description": "The packet places this use-after-free as a sandbox-escape step inside an exploit chain, of the class typically used in targeted-spyware operations - which means a delivery stage runs before it, usually untrusted content the device processes automatically. Putting the high-risk subset of the iOS/iPadOS estate into the platform's reduced-attack-surface mode removes that automatic processing of untrusted attachments, fonts and link previews, so the chain loses its delivery step even on a device that has not yet taken the update. This is the only control here that covers the interval between the 2026-03-05 KEV listing and completed fleet remediation, which matters because the packet records no live-patch path that could shorten that interval.",
+        "evidence": "Packet attack_vector: 'a use-after-free (CWE-416) on iOS/iPadOS used as a sandbox-escape step in an exploit chain. CISA KEV-listed 2026-03-05 with confirmed in-the-wild exploitation (Apple zero-days of this class are typically used in targeted-spyware chains).' live_patch_available false; active_exploitation confirmed.",
+        "gap_closes": [
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2026-22719": {
     "name": "Broadcom VMware Aria Operations Command Injection Vulnerability",
@@ -12646,7 +13675,30 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "Run the Aria Operations appliance on a KEV clock starting 2026-03-03, tracked separately from the guest-OS patch cadence that the Essential Eight and SI-2 controls are audited against — the vulnerable surface is the appliance's own management stack, not an OS package inside a monitored VM, and an unauthenticated caller reaches arbitrary command execution on it. The packet records a vendor patch as available with no live-patch path, and notes the fix typically requires a service restart or system reboot per the KEV requiredAction, so the mitigation deadline must be measured against the appliance actually restarting onto the fixed build. Deferring that restart to the next infrastructure maintenance window is a breach of the SLA rather than a compensating control, and the appliance stays reachable-and-vulnerable for the whole deferral. The same clock covers any support-assisted product migration activity, which the packet names as the path on which the command execution occurs.",
+        "evidence": "cisa_kev is true with kev_date 2026-03-03 and active_exploitation 'confirmed'; CVSS 9.8, RWEP 77, poc_available true. The packet's vector states that Broadcom VMware Aria Operations, formerly vRealize Operations (vROps), contains a command injection vulnerability allowing an unauthenticated attacker to execute arbitrary commands, potentially leading to remote code execution during support-assisted product migration; the attack_vector records command injection (CWE-77) giving command execution on the Aria Operations management surface. patch_available is true, live_patch_available is false, and live_patch_notes states that no live-patch tool is registered and that the vendor patch typically requires service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-036",
+        "name": "FLEET-CONTROL-PLANE-ADMIN-PRIVILEGE-TIER",
+        "description": "Classify the Aria Operations administrators and the appliance's own integration/service identities as a management-plane privilege tier above ordinary application admins, instead of folding them into the generic admin scope that AC-6 is audited against. This does not prevent the vulnerability — no admin tiering gates an unauthenticated request, and the packet's attacker needs no credential — but it bounds what the attacker inherits the moment command execution lands on the appliance. Under the tier, the standing estate-integration credentials the appliance holds become just-in-time, approval-gated grants rather than always-live ones; the Aria console is reachable only from a PAM jumphost rather than from general internal networks; and the identities used to administer it are distinct from any other admin role, so credentials or sessions captured on a compromised appliance are not replayable against the rest of the estate. The support-assisted product migration path named in the packet has to sit inside that tier as well: a vendor-assisted migration is a privileged-access event requiring JIT elevation and an approval record, not a standing exception on the management surface where this command-injection sink lives.",
+        "evidence": "The packet lists NIST-800-53-AC-6 (Least Privilege) among the framework gaps citing this CVE, alongside the patch-timeliness gaps. The attack_vector records command injection (CWE-77) giving command execution on the Aria Operations management surface, and the vector states the attacker is unauthenticated; CVSS is 9.8 with RWEP 77 and poc_available true. cisa_kev is true with kev_date 2026-03-03 and active_exploitation 'confirmed'. The packet names support-assisted product migration as the context in which the command execution can lead to remote code execution.",
+        "gap_closes": [
+          "NIST-800-53-AC-6"
+        ]
+      }
+    ]
   },
   "CVE-2026-21385": {
     "name": "Qualcomm Multiple Chipsets Memory Corruption Vulnerability",
@@ -12701,7 +13753,33 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "MOBILE-OS-MINIMUM-PATCH-LEVEL-ENFORCEMENT",
+        "name": "MOBILE-OS-MINIMUM-PATCH-LEVEL-ENFORCEMENT",
+        "description": "The defect is in Qualcomm chipset code — memory corruption while using alignments for memory allocation — so no operator patches it directly. The fix reaches a device only inside the device maker's firmware/OS build, and the device's reported security-patch level is the only observable that tells an operator whether that build is actually installed. For a fleet containing devices on the affected chipsets, this control means the MDM/EMM must read the security-patch level and block or quarantine devices below the build carrying the Qualcomm fix as a condition of access to organizational data, rather than reporting the stale level on a dashboard. Because the packet's exploitation path is a local foothold escalating privilege on the device, devices that cannot yet receive an updated build must additionally be constrained against installing untrusted or side-loaded code, since that is what supplies the local execution the escalation needs. The distinguishing test: enroll a device pinned below the fixed build and confirm the policy denies it access to protected resources — a fleet that only records patch level leaves exploitable devices in production against a confirmed-exploited chipset flaw.",
+        "evidence": "Packet: cisa_kev true, kev_date 2026-03-03, active_exploitation \"confirmed\", RWEP 77, CVSS 8.8, poc_available true. Vector: \"Multiple Qualcomm chipsets contain a memory corruption vulnerability while using alignments for memory allocation.\" Attack vector: an integer-overflow memory-corruption flaw (CWE-190) in Qualcomm chipset firmware/driver code, exploited by a local foothold to escalate privileges on the device. patch_available true; live_patch_available false. Every citing gap is a patch-policy control — ASD Essential Eight \"Patch operating systems\", ISO/IEC 27001:2022 A.8.8, NIST SP 800-53 SI-2, NIS2 Art.21 vulnerability handling and disclosure, UK CAF B4 — and each measures OS-level patch policy rather than enforcing a device's chipset-fix patch level as a precondition of access.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-patch-management",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "The entry is KEV-listed with confirmed exploitation and a vendor fix exists, but nothing on the affected devices can be fixed without an outage: the packet registers no live-patch tool and states the vendor patch typically requires a service restart or system reboot per the KEV requiredAction. For a silicon-vendor defect the SLA's \"or patch availability, whichever is later\" clause is the operative half — the organization's patch is not available when Qualcomm fixes the chipset code but when the device maker's build carrying that fix reaches its own devices. The clock must therefore run first against documented compensating controls (constraining untrusted local code, withdrawing or isolating devices that will not receive an updated build) and then against the reboot-bearing update, with that interim state tracked as an open compensating-control item rather than scored as patched within policy.",
+        "evidence": "Packet: cisa_kev true, kev_date 2026-03-03, active_exploitation \"confirmed\", RWEP 77, CVSS 8.8, poc_available true. patch_available true; live_patch_available false; live_patch_notes: \"No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.\" Attack vector: a local foothold escalating privileges on the device, with the packet noting that LPEs of this class are routinely paired with an initial-access primitive.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-patch-management",
+          "AU-Essential-8-Patch"
+        ]
+      }
+    ]
   },
   "CVE-2022-20775": {
     "name": "Cisco SD-WAN Path Traversal Vulnerability",
@@ -12941,7 +14019,30 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "The Roundcube fix has to run on a KEV clock rather than the next webmail maintenance window, and the SLA must be written so it ends at a restarted service, not at a staged package. The packet records no live-patch path for this entry and notes the vendor patch typically requires a service restart or system reboot per the KEV requiredAction, so a Roundcube install that has the fixed release on disk but has not been restarted is still serving the vulnerable program/actions/settings/upload.php handler and is still exploitable. Because the sink is reached with an ordinary mailbox session rather than an admin one, every hour of deferral is exposed to any credential the organization has already lost, so the interim position until the restart is a documented compensating restriction on reachability of that settings upload path.",
+        "evidence": "CISA KEV-listed 2026-02-20 with active_exploitation 'confirmed'; RWEP 77 against CVSS 9.8; poc_available true. patch_available true, live_patch_available false, and live_patch_notes states no live-patch tool is registered for this entry and that the vendor patch typically requires a service restart or system reboot per the KEV requiredAction. The packet locates the flaw (CWE-502) in the unvalidated _from parameter in program/actions/settings/upload.php, reachable by authenticated users.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-040",
+        "name": "OWA-PER-REQUEST-SIEM-INGESTION",
+        "description": "The same webmail-logging requirement the control states for Exchange OWA applies to Roundcube, and this CVE is the case that shows why: the exploit request is issued inside an already-authenticated mailbox session, so authentication-event logging captures nothing but a successful login while the crafted _from value travels to program/actions/settings/upload.php as ordinary session traffic. Roundcube must ship per-request web access records — request path and parameter names for the settings upload handler included — to a collector off the webmail host, retained long enough to answer which sessions touched that handler in the window before the fixed release was restarted into service. Off-host is the load-bearing part: the flaw yields code execution on the mail server itself, so any log the attacker's own process can reach is not evidence.",
+        "evidence": "The packet's vector states the vulnerability 'allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php' — the malicious request rides an authenticated session rather than creating an authentication event. CISA KEV-listed 2026-02-20, active_exploitation 'confirmed', poc_available true, CVSS 9.8, RWEP 77.",
+        "gap_closes": [
+          "UK-CAF-B2"
+        ]
+      }
+    ]
   },
   "CVE-2025-68461": {
     "name": "RoundCube Webmail Cross-site Scripting Vulnerability",
@@ -13001,7 +14102,39 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "The number that gets this entry mishandled is CVSS 6.1. A severity-driven queue reads \"Medium XSS\" and buckets a webmail flaw at 30 or 90 days, while the packet records it as KEV-listed with confirmed in-the-wild exploitation and a public PoC — the conditions under which the real requirement is hours. Keying the clock to KEV status rather than to base score is the whole point here: 4 hours from listing or fix availability to a verified mitigation on every Roundcube instance. Two packet facts shape what that window has to contain. There is no live-patch path registered for this entry, and the packet notes the vendor patch typically requires a service restart or system reboot per the KEV requiredAction — so the SLA must be planned as an upgrade plus a scheduled webmail service restart, not as a hot fix that can be slipped in without an outage. An operator whose change process cannot restart the mail front end inside the window needs the alternative recorded as a documented compensating control with a conversion deadline, not as an accepted 90-day queue position.",
+        "evidence": "Packet: cisa_kev true with kev_date 2026-02-20, active_exploitation confirmed, poc_available true, cvss 6.1 against rwep_score 77, patch_available true, live_patch_available false, live_patch_notes \"No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.\" The ISO-27001-2022-A.8.8 gap recorded against this entry states that \"appropriate timescales\" is undefined and interpreted as 30 days for Critical and 90 days for Medium with no KEV-aware response category; the NIST-800-53-SI-2 gap states the required tier is 4h for KEV plus public PoC.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-042",
+        "name": "INCOMPLETE-PATCH-SEQUENCE-SEVERITY-MULTIPLIER",
+        "description": "The packet records this flaw as a later variant of the Roundcube XSS class, and that word is the finding. The sink is an animate tag inside an SVG document — markup the message renderer's sanitizer was already supposed to be filtering — so what the CVE demonstrates is not one missed tag but that the allowlist governing SVG and animation markup in the mail body renderer keeps admitting script, one element at a time. Per-CVE severity scoring cannot express that: each instance lands as another 6.1 reflected-script issue, the structural defect never surfaces, and the operator has no basis for predicting the next one. A vulnerability-management program covering webmail must therefore carry a multiplier for the Nth flaw on the same sanitizer primitive — escalating handling above what the base score alone would trigger, and treating the renderer's markup filter as a standing area of exposure that warrants defence at the rendering layer rather than a series of unrelated Medium tickets closed on the routine queue.",
+        "evidence": "Packet attack vector as recorded: \"a cross-site scripting flaw (CWE-79) in Roundcube Webmail (a later variant), letting an attacker run script in a victim's authenticated session via a crafted email\" — the entry is explicitly recorded as a later variant, not a first instance. The vector field names the sink: \"a cross-site scripting vulnerability via the animate tag in an SVG document.\" cvss 6.1 against rwep_score 77 is the scoring divergence itself. The NIS2-Art21-vulnerability-management gap recorded against this entry states that on-prem mailflow XSS is not enumerated as a distinct vulnerability class deserving accelerated handling.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-040",
+        "name": "OWA-PER-REQUEST-SIEM-INGESTION",
+        "description": "The script executes inside a session the victim opened legitimately, so the authentication record for a successful exploitation of this CVE is one ordinary login by the right user from the right place. Everything the attacker then does — reading and searching the mailbox, adding a forwarding or filter rule, pulling the address book, calling the webmail API with the victim's own session — arrives as authenticated application traffic that an auth-event-only log pipeline never records. For a Roundcube deployment this means per-request access logs from the webmail front end, not just the login events, must be shipped off the mail host to a SIEM with retention long enough to cover the window between the KEV listing and the day the upgrade and its service restart actually land. That window is the operative one here: the packet records no vendor workaround short of the fix, so during it the only available posture is detection — a monitored interim state with a documented deadline for conversion to the vendor patch, rather than an unobserved wait.",
+        "evidence": "Packet attack vector as recorded: the flaw lets \"an attacker run script in a victim's authenticated session via a crafted email\" — the malicious activity therefore flows over an already-authenticated session, which is exactly the telemetry class this control exists for. cisa_kev true (kev_date 2026-02-20), active_exploitation confirmed, poc_available true. patch_available true with live_patch_available false and live_patch_notes recording that the vendor patch typically requires a service restart or system reboot, so a non-zero exposure window between listing and remediation is expected rather than exceptional. The UK-CAF-B4 gap recorded against this entry states that no compensating-control posture is named for the interval before the vendor patch, and that any such posture must be reversible, monitored, and carry a documented conversion SLA to the binary patch.",
+        "gap_closes": [
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2021-22175": {
     "name": "GitLab Server-Side Request Forgery (SSRF) Vulnerability",
@@ -13061,7 +14194,30 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "This is a 2021 identifier that CISA listed on 2026-02-18 — years after the vendor fix shipped and long after any normal patch window closed. That inversion is precisely why the control's 'KEV listing or patch availability, whichever is later' wording matters here: the clock starts at the listing date, not at disclosure. Vulnerability programmes age findings out by disclosure year and de-prioritise anything that has been open long enough to look inert, so an instance still exposed to this flaw is by definition one that survived every prior scan-and-triage cycle — the age of the identifier is the reason it is still there, not a reason to relax. Inside that window the work is inventory-led rather than patch-led: enumerate every self-managed GitLab instance including team-run and forgotten ones (the same lack of ownership that let a years-old flaw persist is what will hide instances from the sweep), confirm each running version against the fixed release, and apply the vendor update with the service restart the packet says it requires. Confirmed in-the-wild exploitation with a public PoC on an unauthenticated flaw means the interval between listing and remediation is contested time, not a grace period.",
+        "evidence": "Packet: CVE identifier year 2021 against kev_date 2026-02-18, cisa_kev true, active_exploitation confirmed, poc_available true, RWEP 77 against CVSS 7.5. attack_vector describes 'a server-side request forgery flaw (CWE-918) letting an unauthenticated attacker coerce the server into making requests to internal resources'. patch_available true; live_patch_available false with live_patch_notes 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.'",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-038",
+        "name": "MITIGATION-ACTIVE-PATCH-PENDING-VERDICT-CLASS",
+        "description": "The packet scopes exposure with a configuration condition rather than a version alone: the SSRF is present when requests to the internal network for webhooks are enabled. That means an unpatched GitLab instance with that setting off and an instance running the fixed release look identical in any compliance report that carries only vulnerable/not-vulnerable — and they are not the same risk. The first is one settings change away from exposure, and the change is one a legitimate internal integration will eventually ask for; whoever re-enables local-network webhook delivery will not know they are re-opening a KEV-listed unauthenticated SSRF. Record the configuration-based state as mitigation-active/patch-pending with a named owner and a deadline, distinct from the fixed release, and re-assert the setting on every configuration audit. This matters more than usual on an entry whose fix predates its KEV listing by years: over that span the workaround is exactly the kind of setting that gets quietly reverted somewhere in an estate, and a version-only verdict will never surface it.",
+        "evidence": "Packet: vector states 'GitLab contains a server-side request forgery (SSRF) vulnerability when requests to the internal network for webhooks are enabled.' attack_vector: 'a server-side request forgery flaw (CWE-918) letting an unauthenticated attacker coerce the server into making requests to internal resources', cwe_refs CWE-918. patch_available true, live_patch_available false, cisa_kev true with kev_date 2026-02-18 on a 2021 identifier, active_exploitation confirmed.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      }
+    ]
   },
   "CVE-2026-22769": {
     "name": "Dell RecoverPoint for Virtual Machines (RP4VMs) Use of Hard-coded Credentials Vulnerability",
@@ -13121,7 +14277,41 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "No operator-side action stops this clock except the vendor fix. The credential is built into RP4VMs, so it cannot be rotated, expired or locked out through the appliance's own account management, and every unpatched instance stays authenticable by anyone holding the constant — there is no compensating configuration change that converts this into a lower-urgency item. The KEV window therefore has to be met by deploying the vendor fix with the service restart or reboot the packet says it requires, since the packet registers no live-patch tool for this entry; where that restart cannot be scheduled inside the window, the honest interim control is cutting network reachability to the appliance, not documenting a mitigation.",
+        "evidence": "CWE-798 use of hard-coded credentials; cisa_kev true, kev_date 2026-02-18, active_exploitation confirmed, RWEP 77, CVSS 8.8, poc_available true, patch_available true; live_patch_available false with live_patch_notes 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.'",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "NIS2-Art21-patch-management",
+          "NIST-800-53-SI-2",
+          "ISO-27001-2022-A.8.8"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "The packet's stated impact is not just unauthorized access but root-level persistence on the appliance's underlying operating system, with exploitation confirmed in the wild — so patching in place on an instance that was reachable while unpatched removes the credential and leaves anything installed through it running. For RP4VMs the default response to an instance whose exposure cannot be ruled out has to be configuration export, rebuild from vendor media at the fixed level, and rotation of every credential the appliance held for the virtual-machine estate it serves; patch-in-place is the exception, reserved for instances with demonstrable evidence they were never reachable by an unauthenticated caller. This control's scope is written for perimeter devices, but the triggering shape — pre-authentication root access under confirmed exploitation — is exactly what this appliance presents.",
+        "evidence": "Packet vector: 'Dell RecoverPoint for Virtual Machines (RP4VMs) contains an use of hard-coded credentials vulnerability that could allow an unauthenticated remote attacker to gain unauthorized access to the underlying operating system and root-level persistence.' active_exploitation confirmed, kev_date 2026-02-18, poc_available true, CVSS 8.8, RWEP 77.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-patch-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-054",
+        "name": "BACKUP-TIER-NETWORK-ISOLATION",
+        "description": "Identity controls on this appliance are inert by construction: the credential ships inside the product, so no password policy, account review, privilege assignment or authentication-strength requirement the operator configures can revoke it, and the account it hands out is root on the appliance operating system. The only access control left in operator hands is the network path. The RecoverPoint for Virtual Machines management surface must be reachable from a dedicated operator subnet only and never from the virtual-machine workload networks the product exists to recover, so that possession of the built-in credential does not by itself put an attacker on the appliance — and so that a compromise of a protected workload cannot reach the recovery tier that is supposed to survive it.",
+        "evidence": "CWE-798 hard-coded credentials in Dell RecoverPoint for Virtual Machines (RP4VMs); packet vector states an unauthenticated remote attacker gains 'unauthorized access to the underlying operating system and root-level persistence'; CVSS 8.8, RWEP 77, active_exploitation confirmed, KEV-listed 2026-02-18. The citing gaps include UK-CAF-B2 (Identity and access control) and NIST-800-53-AC-6 (Least Privilege), both of which the embedded credential bypasses entirely.",
+        "gap_closes": [
+          "UK-CAF-B2",
+          "NIST-800-53-AC-6"
+        ]
+      }
+    ]
   },
   "CVE-2020-7796": {
     "name": "Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery Vulnerability",
@@ -13181,7 +14371,21 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "The remediation problem for CVE-2020-7796 is discovery timing, not fix availability. This is a 2020-assigned CVE that CISA added to KEV on 2026-02-17 — the affected systems are long-running Zimbra Collaboration Suite deployments where the WebEx zimlet happens to be installed and zimlet JSP happens to be enabled, a configuration nobody re-examines six years after commissioning. Programs that queue work by CVE publication year, or that treat an aged advisory as historically handled, will never raise it; the exposure has been continuous and silent. Requirement: the KEV listing date starts the clock, not the CVE year. A KEV-triggered sweep must re-inventory the ZCS estate against the precondition the packet names — WebEx zimlet installed AND zimlet JSP enabled — and deploy the vendor fix on the KEV-tied window, accepting the service restart the packet's live-patch note says the update requires, rather than letting a six-year-old identifier route the work into a routine cycle. Age is not a mitigating factor here; it is the reason the vulnerable configuration survived.",
+        "evidence": "Packet: CWE-918 server-side request forgery in Synacor Zimbra Collaboration Suite (ZCS), present 'if WebEx zimlet installed and zimlet JSP is enabled', letting an unauthenticated attacker coerce the server into making requests to internal resources. CISA KEV-listed 2026-02-17 with active_exploitation 'confirmed' and poc_available true — an identifier assigned in 2020 reaching confirmed in-the-wild exploitation roughly six years later. RWEP 77 against CVSS 7.5. patch_available true; live_patch_available false, live_patch_notes: 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.' The citing gaps (ISO-27001-2022-A.8.8, NIST-800-53-SI-2, NIS2-Art21-vulnerability-management, UK-CAF-B4) schedule remediation off severity and disclosure recency, neither of which surfaces a 2020 CVE in 2026.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management",
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2024-7694": {
     "name": "TeamT5 ThreatSonar Anti-Ransomware Unrestricted Upload of File with Dangerous Type Vulnerability",
@@ -13241,7 +14445,39 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-055",
+        "name": "SECURITY-TOOL-INTEGRITY-VERIFICATION",
+        "description": "ThreatSonar is the anti-ransomware product itself, and the defect is that it does not validate the content of files uploaded to it — meaning the crafted-input path runs through the server's normal, expected input path, since ingesting attacker-adjacent artifacts is what the product is for. Bring the security-product estate under the same vulnerability-management SLA as the systems it defends: inventory the ThreatSonar server as patch-managed privileged software, run the KEV clock from the 2026-02-17 listing, and schedule the service restart or reboot the fix requires, since no live patch is registered for this entry. The trust-anchor-inversion test the control names lands directly here — upload a file whose content does not match its declared type to a staging ThreatSonar instance and confirm it is rejected rather than stored and executed. An 'endpoint protection deployed' attestation says nothing about whether the protection server is patched.",
+        "evidence": "The packet's KEV description states that ThreatSonar Anti-Ransomware does not properly validate the content of uploaded files, and that remote attackers with administrator privileges on the product platform can upload malicious files which can be used to execute arbitrary system commands on the server (CWE-434). CISA KEV-listed 2026-02-17 with active_exploitation confirmed; RWEP 77, CVSS 8.8, PoC available. patch_available is true and live_patch_available is false, with the packet recording that the vendor patch typically requires service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-036",
+        "name": "FLEET-CONTROL-PLANE-ADMIN-PRIVILEGE-TIER",
+        "description": "The packet's KEV description puts administrator privileges on the ThreatSonar platform in the exploitation precondition, which makes every path that issues, stores or reuses a console admin credential part of this vulnerability's attack surface. Classify ThreatSonar operators above application admins: a separate identity from any other admin role, FIDO2 step-up per session, just-in-time elevation with an approval workflow, and console access only from a PAM jumphost or privileged access workstation. The effect specific to this flaw is that a credential harvested elsewhere in the estate — the usual route to a console account — cannot be walked straight into the unvalidated upload handler and turned into arbitrary system commands on the anti-ransomware server, and every upload is attributable to an approved elevation rather than to a shared standing login.",
+        "evidence": "The packet's KEV description states that remote attackers with administrator privileges on the product platform can upload malicious files, which can be used to execute arbitrary system commands on the server (CWE-434); CVSS 8.8, RWEP 77, PoC available, active_exploitation confirmed as of the 2026-02-17 KEV listing. NIST SP 800-53 AC-6 (Least Privilege) is among the framework controls the packet records as insufficient for this CVE.",
+        "gap_closes": [
+          "NIST-800-53-AC-6"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-046",
+        "name": "PEN-TEST-SCOPE-INCLUDES-SECURITY-PRODUCTS",
+        "description": "Nothing about this flaw is exotic — an upload handler that does not check file content — yet it persisted in a shipping anti-ransomware product, because assessment scopes treat that product as a defense to be validated rather than a target to be attacked. Write the ThreatSonar server into the scope language by name: its administrative console, its file-upload and artifact-ingest endpoints, and its agent/update channels, with explicit authorization to attempt upload-to-arbitrary-command execution against a staging instance. The distinguishing observation for this entry is the route it took to operators — it surfaced through the KEV feed after in-the-wild use, not through any assessment of the security stack itself, which is what a scope that excludes defensive products guarantees.",
+        "evidence": "The packet records a CWE-434 unrestricted upload of a file with a dangerous type in TeamT5 ThreatSonar Anti-Ransomware, where uploaded file content is not properly validated and uploaded files can be used to execute arbitrary system commands on the server. It carries CISA KEV listing 2026-02-17 with active_exploitation confirmed and a PoC available — i.e. it reached the catalog after exploitation, not before. UK CAF B4 (System security) is among the framework controls the packet records as insufficient here.",
+        "gap_closes": [
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2008-0015": {
     "name": " Microsoft Windows Video ActiveX Control Remote Code Execution Vulnerability",
@@ -13466,7 +14702,32 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-056",
+        "name": "MOBILE-ENDPOINT-MDM-ENFORCED-KEV-SLA",
+        "description": "The packet names iOS, macOS, tvOS, watchOS and visionOS as affected by the same memory-buffer flaw, which is broader than the device classes a typical Apple update policy actually enforces — most estates enforce phones and laptops through management and leave watches, TV devices and headsets to whatever the user gets around to, so a single KEV entry leaves enforced and unenforced device classes carrying the same defect. Enforcement must therefore cover the whole managed Apple estate, including personally-owned devices under BYOD enrollment, pushed through declarative device management with user deferral disabled and a hard enforcement deadline. 'Update deferred by user' has to be treated as a non-compliant state that loses access to organizational data, not a line on a compliance report. The vendor update is the remediation and it is available; the packet registers no live-patch path and notes the fix typically requires restart, so the enforced deadline must include the device restart, not merely the download.",
+        "evidence": "Packet name and vector: 'Apple iOS, macOS, tvOS, watchOS, and visionOS contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow an attacker with memory write the capability to execute arbitrary code' (CWE-119). CISA KEV-listed 2026-02-12 with active_exploitation 'confirmed', poc_available true, CVSS 8.8, RWEP 77. patch_available true; live_patch_available false, with live_patch_notes recording that the vendor patch typically requires service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-121",
+        "name": "MOBILE-ZERO-CLICK-HARDENING",
+        "description": "The packet describes this overflow as reachable via attacker-controlled content and places the class in targeted-spyware chains, which means delivery happens when content arrives at the device rather than when a user takes an action an awareness policy could influence — the interval between in-the-wild use and an enforced estate-wide update is unprotected by any patch SLA, however short it is written. For users at elevated targeting risk (executives, legal, security staff, anyone handling sensitive negotiations), the reduced-attack-surface mode must be enabled as a standing configuration, so untrusted message attachments, fonts and link previews are not auto-processed, and it must stay on across Apple's platforms in the estate rather than being switched on reactively after a specific CVE is announced. This is the control that covers the next member of the class before its patch exists, which is the same position operators were in when this one was listed.",
+        "evidence": "Packet attack_vector: 'a buffer overflow (CWE-119) reachable via attacker-controlled content. CISA KEV-listed 2026-02-12 with confirmed in-the-wild exploitation (Apple zero-days of this class are typically used in targeted-spyware chains).' The vector adds that an attacker with memory-write capability can execute arbitrary code. poc_available true, CVSS 8.8, RWEP 77; live_patch_available false, so there is no mid-window fix that avoids the update-and-restart cycle.",
+        "gap_closes": [
+          "UK-CAF-B4",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      }
+    ]
   },
   "CVE-2024-43468": {
     "name": "Microsoft Configuration Manager SQL Injection Vulnerability",
@@ -13526,7 +14787,39 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "Configuration Manager is the system operators patch everything else with, which is exactly why it tends to sit outside its own SLA — the site server is treated as remediation infrastructure rather than as a remediation target. This CVE is KEV-listed 2026-02-12 with confirmed exploitation and a public PoC, and the packet describes an unauthenticated caller sending crafted requests that end in command execution on the server or its database, so the site server has to be enrolled in the same KEV clock it enforces on managed endpoints. A vendor fix exists; the packet records no live-patch path and notes the vendor patch typically requires a service restart or system reboot, so a maintenance window for the site server itself — not just for the fleet it patches — must be pre-authorised inside the SLA.",
+        "evidence": "Packet fields for CVE-2024-43468 (Microsoft Configuration Manager SQL Injection Vulnerability): cwe_refs CWE-89; cisa_kev=true with kev_date 2026-02-12; active_exploitation=confirmed; poc_available=true; cvss 9.8; rwep_score 77; vector text states an unauthenticated attacker could exploit it by sending specially crafted requests to the target environment which are processed in an unsafe manner, enabling the attacker to execute commands on the server and/or underlying database; patch_available=true; live_patch_available=false with live_patch_notes stating no live-patch tool is registered and that the vendor patch typically requires service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-085",
+        "name": "DB-ABSTRACTION-LAYER-PARAMETERIZATION-VERIFICATION",
+        "description": "The injectable path on Configuration Manager is reached without credentials — the packet describes crafted requests processed in an unsafe manner by the server — so the two assumptions operators normally lean on for this product ('the site server is on the internal network' and 'a WAF fronts the client-facing endpoints') are both untested inferences, and neither is evidence that a query is bound rather than concatenated. The control requires parameterization to be proven at the query layer for every request handler that accepts client-originated content, and re-proven after each site-server update, rather than inferred from upstream input validation. The distinguishing test: from an unauthenticated host that can reach the site server's request-handling endpoints on a staging hierarchy, submit request fields carrying SQL metacharacters and confirm the value is passed as a bound parameter rather than becoming part of the statement — a hierarchy that passes an application-firewall audit while a handler concatenates client-supplied content still yields command execution on the server and the database behind it.",
+        "evidence": "Packet fields for CVE-2024-43468: cwe_refs CWE-89; attack_vector states SQL injection on Microsoft Configuration Manager escalating to unauthenticated remote code execution; vector text states an unauthenticated attacker sends specially crafted requests processed in an unsafe manner, enabling execution of commands on the server and/or underlying database; cvss 9.8; active_exploitation=confirmed; poc_available=true.",
+        "gap_closes": [
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-078",
+        "name": "ENDPOINT-MGMT-DEPLOYMENT-CHANNEL-INTEGRITY",
+        "description": "Configuration Manager is the fleet's software-deployment control plane, and this CVE hands an unauthenticated attacker command execution on that server and its database — the same authority the product legitimately uses to push packages, scripts and updates to every managed endpoint, which is why a single unauthenticated request here is a fleet-wide code-execution primitive rather than one compromised host. The control requires the deployment channel to be integrity-monitored independently of the site server itself: alert on deployment objects, scripts and task sequences that appear without a matching sanctioned admin action, and land that audit trail on a collector the site server cannot rewrite, so a foothold on the server cannot quietly launder itself into signed-looking fleet distribution. It also sets the post-remediation obligation the patch does not: any window in which a site server ran the vulnerable build while exposed must be treated as fleet-wide code-execution exposure and everything deployed during it reviewed — patching closes the entry point but says nothing about what the deployment channel did while it was open.",
+        "evidence": "Packet fields for CVE-2024-43468: vector text states the unauthenticated attacker can execute commands on the server and/or underlying database of Microsoft Configuration Manager; active_exploitation=confirmed; cisa_kev=true with kev_date 2026-02-12; poc_available=true; rwep_score 77; cvss 9.8; patch_available=true with live_patch_available=false.",
+        "gap_closes": [
+          "NIST-800-53-AC-6"
+        ]
+      }
+    ]
   },
   "CVE-2025-15556": {
     "name": "Notepad++ Download of Code Without Integrity Check Vulnerability",
@@ -13586,7 +14879,39 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "Notepad++ is fleet-wide desktop software that updates itself through WinGUp, so the KEV clock lands on every workstation carrying the vulnerable build rather than on a small set of managed servers. The mitigation that satisfies the SLA must be a managed software-deployment push of the fixed build, not a prompt to run the in-application update check — that check is the exact channel the flaw lets an attacker redirect, so using it as the remediation mechanism runs the attack. No live-patch path is registered for this entry and the packet records that a patch of this class typically requires a restart, so the SLA has to be met with the vendor update plus that restart, or with a documented compensating control (blocking or disabling the in-app update check) until the fleet is on the fixed build.",
+        "evidence": "CISA KEV-listed 2026-02-12 with active_exploitation 'confirmed', RWEP 77, CVSS 9.8, and poc_available true. patch_available is true; live_patch_available is false, and live_patch_notes states no live-patch tool is registered and that the vendor patch typically requires service restart or system reboot per the KEV requiredAction. The packet's vector states that Notepad++, when using the WinGUp updater, downloads code without an integrity check, allowing an attacker to intercept or redirect update traffic to download and execute an attacker-controlled installer with the privileges of the user.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-SUPPLYCHAIN-SIGNED-INSTALLER-INTEGRITY",
+        "name": "INDEPENDENT-INTEGRITY-VERIFICATION-OF-SIGNED-VENDOR-INSTALLERS",
+        "description": "The Notepad++ update path makes the delivery channel the trust anchor: whatever WinGUp retrieves is executed. The organization must therefore verify the Notepad++ installer against an integrity source independent of the channel that delivered it — a published per-release hash fetched over a separate path — and deploy only the verified artifact, instead of allowing endpoints to accept whatever the updater fetches. The distinguishing test for this CVE: on a staging workstation, serve a substituted installer from an operator-controlled endpoint in place of the real update host and confirm the deployment tooling refuses the artifact on hash mismatch before it runs. A software-supply-chain policy that only asserts 'we install vendor software from the vendor' passes while this exact substitution succeeds.",
+        "evidence": "The packet's CWE is CWE-494 (download of code without integrity check), and the vector states the WinGUp updater downloads code without an integrity check so that intercepted or redirected update traffic results in an attacker-controlled installer being downloaded and executed. KEV-listed 2026-02-12 with confirmed active exploitation and poc_available true.",
+        "gap_closes": [
+          "NIS2-Art21-supply-chain",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-120",
+        "name": "DOWNLOAD-PROVENANCE-ENFORCEMENT",
+        "description": "Application-control and provenance policy on the endpoint must refuse to execute an installer image that an application fetched from the network unless it carries verified publisher provenance, so that a redirected Notepad++ update cannot run on a host that has not yet reached the fixed build. Reputation-service verdicts are worthless against this specific path: the defect is the absence of any integrity check on the fetched payload, so the payload never has to defeat a reputation check to be executed by the updater. The distinguishing test: on a staging endpoint, have a non-vendor-signed installer be launched by the updater process and confirm execution is blocked by policy rather than allowed on the basis of the parent application's own trust.",
+        "evidence": "The vector states the attacker-controlled installer is downloaded and executed, yielding arbitrary code execution with the privileges of the user. patch_available is true and live_patch_available is false, so the only in-window alternative to deploying the fixed build is blocking the execution step.",
+        "gap_closes": [
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2025-40536": {
     "name": "SolarWinds Web Help Desk Security Control Bypass Vulnerability",
@@ -13646,7 +14971,30 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "A help-desk portal is normally reachable by the people it serves, including from outside the corporate network, so an unauthenticated bypass on Web Help Desk is exploitable from the same anonymous position the deployment is designed to accept — there is no 'internal only' fallback posture to hold while a routine change window is scheduled. Start the clock at the KEV listing rather than at the next patch cycle: inventory every Web Help Desk instance including staging, disaster-recovery and departmental copies that share the same exposure, apply the vendor update, and book the service restart the packet's requiredAction implies inside that same window. An instance that has the fix staged but has not been restarted must not be recorded as remediated.",
+        "evidence": "Packet: CWE-693 security-control bypass on SolarWinds Web Help Desk that 'could allow an unauthenticated attacker to gain access to certain restricted functionality'; cisa_kev true, kev_date 2026-02-12, active_exploitation 'confirmed', poc_available true, cvss 8.8, rwep_score 77. patch_available true; live_patch_available false, with live_patch_notes 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.'",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-018",
+        "name": "SCANNER-PAPER-COMPLIANCE-TEST",
+        "description": "A protection-mechanism failure means the product's security control was present and did answer — it simply did not stop the request — so an access-control attestation and a version-based scanner verdict can both be truthful while the restricted functionality is reachable by anyone. Verification has to be behavioural rather than declarative: from an unauthenticated client against a staging Web Help Desk instance, request each restricted function the bypass reached and confirm it is refused before the function executes, then re-run the same probe after the update instead of accepting the build number as proof. An audit that records 'Web Help Desk authenticates its users' or 'Web Help Desk is on the fixed build' without that probe cannot tell an enforced control from a bypassed one, which is the exact state this CVE describes.",
+        "evidence": "Packet: CWE-693 protection-mechanism failure letting an unauthenticated attacker bypass an intended security control to reach protected functionality; active_exploitation 'confirmed' with CISA KEV listing 2026-02-12 and poc_available true. The framework gaps already citing this CVE include UK-CAF-B2 (identity and access control) and ISO-27001-2022-A.8.8 (management of technical vulnerabilities) — the two controls an operator can satisfy on paper while the bypass works.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "UK-CAF-B2"
+        ]
+      }
+    ]
   },
   "CVE-2026-21513": {
     "name": "Microsoft MSHTML Framework Protection Mechanism Failure Vulnerability",
@@ -13701,7 +15049,40 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-041",
+        "name": "PROTECTION-MECHANISM-FAILURE-CLASS-REGRESSION",
+        "description": "The flaw here is in the protection mechanism itself — MSHTML fails to apply the Mark-of-the-Web / trust check, so attacker-controlled content renders without the warning the rest of the endpoint hardening posture assumes is present. Verifying this fix therefore means re-running the whole MOTW/trust battery against MSHTML-rendered content after the update lands (mark propagation, zone-of-origin handling, prompt-on-execute for internet-sourced content), not confirming that the single reported bypass path is closed. An application-hardening attestation is only as strong as the last end-to-end test of the primitive it depends on, and this CVE is the demonstration that the primitive can silently stop working while every hardening setting still reads as enabled. Make the class battery a standing step of patch deployment on the affected estate.",
+        "evidence": "Packet: protection-mechanism failure (CWE-693) in the Microsoft MSHTML framework that bypasses the Mark-of-the-Web / trust protection, letting attacker-controlled content run without the expected security warning; the KEV vector describes an unauthorized attacker bypassing a security feature over a network. cisa_kev true, kev_date 2026-02-10, active_exploitation confirmed, poc_available true, RWEP 77, CVSS 8.8.",
+        "gap_closes": [
+          "AU-Essential-8-App-Hardening",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-120",
+        "name": "DOWNLOAD-PROVENANCE-ENFORCEMENT",
+        "description": "Because this bug suppresses the warning rather than corrupting memory, any posture that leans on the user seeing a prompt — or on a reputation verdict rendered at the same moment — is leaning on exactly what the flaw disables. Provenance has to be enforced by policy on the affected estate instead: block execution of internet-sourced shortcuts, installers and script hosts by rule, independent of whether the Mark-of-the-Web marking survived and independent of any reputation service outcome, so content delivered through the MSHTML path is refused even when it is never evaluated. This is also what closes the least-privilege gap for this CVE: the bypassed content runs in the user's own context, so removing administrative rights does not stop it — the enforcement point has to be what the user's own process is permitted to execute.",
+        "evidence": "Packet: protection-mechanism failure (CWE-693) in Microsoft MSHTML bypassing Mark-of-the-Web / trust protection so attacker-controlled content runs without the expected security warning, reachable over a network by an unauthorized attacker. cisa_kev true, kev_date 2026-02-10, active_exploitation confirmed, poc_available true, RWEP 77.",
+        "gap_closes": [
+          "AU-Essential-8-App-Hardening",
+          "NIST-800-53-AC-6"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "For most endpoint CVEs the interval between disclosure and deployment is implicitly covered by the platform's trust prompts and user caution. This entry removes that cover — the entire defect is that the warning does not fire — so the unpatched window carries no residual endpoint-side compensating control, and the deployment clock has to run from the KEV listing rather than the next scheduled update ring. The packet records no live-patch path, so remediation is the vendor update plus the restart the KEV requiredAction implies; hosts that cannot take it inside the SLA need the provenance-enforcement block recorded as an explicit, time-bound compensating control, not counted as patched-per-policy.",
+        "evidence": "Packet: cisa_kev true, kev_date 2026-02-10, active_exploitation confirmed, poc_available true; patch_available true with live_patch_available false, and live_patch_notes stating no live-patch tool is registered and that the vendor patch typically requires service restart or system reboot per the KEV requiredAction. RWEP 77, CVSS 8.8; protection-mechanism failure (CWE-693) bypassing Mark-of-the-Web / trust protection.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-patch-management",
+          "ISO-27001-2022-A.8.8"
+        ]
+      }
+    ]
   },
   "CVE-2026-21525": {
     "name": "Microsoft Windows NULL Pointer Dereference Vulnerability",
@@ -13811,7 +15192,33 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-120",
+        "name": "DOWNLOAD-PROVENANCE-ENFORCEMENT",
+        "description": "The defect is in the Windows Shell's handling of the provenance signal itself: content fetched over the network executes without the SmartScreen / Mark-of-the-Web warning that the surrounding endpoint controls assume will fire. Enforcement must therefore be moved off the Shell's verdict — apply and preserve MotW on every internet-sourced file, propagate it rather than letting a handler drop it, and use AppLocker/WDAC or equivalent to refuse execution of provenance-stripped shortcuts, installers and script hosts outright, so an attacker-supplied payload is denied by policy rather than by a dialog this flaw suppresses. Any Windows endpoint whose only barrier between a downloaded file and execution is the SmartScreen prompt has no barrier at all for this CVE, and that remains true for every unrebooted host in the estate.",
+        "evidence": "Packet attack_vector: 'a protection-mechanism failure (CWE-693) in the Windows Shell that bypasses SmartScreen / Mark-of-the-Web, letting downloaded content run without the expected warning'; the vector records an unauthorized attacker bypassing a security feature over a network. CISA KEV-listed 2026-02-10, active_exploitation confirmed, poc_available true, CVSS 8.8, RWEP 77. patch_available is true, but live_patch_available is false and live_patch_notes records the vendor patch typically requires a service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "NIST-800-53-SI-2",
+          "NIST-800-53-AC-6",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-041",
+        "name": "PROTECTION-MECHANISM-FAILURE-CLASS-REGRESSION",
+        "description": "For this CVE 'the update is installed' is not evidence of remediation, because what failed was a protection mechanism, not a service — a Shell whose SmartScreen / MotW path is silently inert is indistinguishable from a patched one by inventory alone. Detonation-chamber, EDR and AppLocker/WDAC coverage for the MOTW/SmartScreen class must be run as a battery on every Windows patch deployment, exercising the historic bypass primitives for that class and not just this CVE's, and the reboot cycle must not be signed off until a freshly downloaded test payload actually raises the expected warning on a representative endpoint. That test is the only thing that converts a completed patch window into demonstrated closure here.",
+        "evidence": "Packet: protection-mechanism failure (CWE-693) in the Windows Shell bypassing SmartScreen / Mark-of-the-Web, letting downloaded content run without the expected warning. CISA KEV-listed 2026-02-10 with confirmed in-the-wild exploitation and poc_available true. patch_available true, live_patch_available false, live_patch_notes: the vendor patch typically requires a service restart or system reboot per the KEV requiredAction — so remediation is a discrete reboot event whose success is directly testable at that moment.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management",
+          "NIST-800-53-SI-2"
+        ]
+      }
+    ]
   },
   "CVE-2026-21533": {
     "name": "Microsoft Windows Improper Privilege Management Vulnerability",
@@ -13921,7 +15328,21 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "Managed Windows desktops running the affected Desktop Window Manager component must be driven to the vendor fix on a KEV-tied clock rather than the monthly workstation-patch cadence, because the elevation is already being exploited and any local foothold on a user's desktop — a phished document, a commodity loader, a compromised standard-user session — converts into elevated execution on that endpoint. The packet records no live-patch path for this entry and the vendor fix takes effect only after the service restart or reboot the KEV requiredAction calls for, so the SLA clock must be measured to completed-restart per endpoint, not to package-deployed: a fleet dashboard showing 100% deployed with user-deferred reboots is still fully exploitable, and reboot deferral on a desktop estate is the norm rather than the exception.",
+        "evidence": "Packet fields for CVE-2026-21519: cisa_kev true, kev_date 2026-02-10, active_exploitation confirmed, rwep_score 77, cvss 8.8, poc_available true, cwe_refs CWE-843. patch_available true, live_patch_available false, live_patch_notes \"No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.\" Product statement in the packet vector: \"Microsoft Desktop Windows Manager contains a type confusion vulnerability that could allow an authorized attacker to elevate privileges locally.\"",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management",
+          "NIST-800-53-SI-2"
+        ]
+      }
+    ]
   },
   "CVE-2026-21514": {
     "name": "Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision Vulnerability",
@@ -13976,7 +15397,39 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-041",
+        "name": "PROTECTION-MECHANISM-FAILURE-CLASS-REGRESSION",
+        "description": "Protected View is the mechanism Word uses to open untrusted documents in a sandbox, and this CVE shows the decision to apply it can be driven by input the attacker supplies. Verifying the fix for this one document therefore proves nothing about the mechanism: the detonation-chamber, EDR and ASR rule sets covering the document-sandbox decision must carry a class-level regression battery — every known way a document has been made to open outside Protected View — re-executed on every Office update, not a one-off retest of this CVE's sample. Test artifact for this class: a document set that reaches the handler through each delivery path in use, with the pass condition being that Word opens each one in Protected View rather than in full trust.",
+        "evidence": "CWE-807 (reliance on untrusted inputs in a security decision) in Microsoft Office Word. The packet's attack_vector states the flaw bypasses a document security feature (Protected View) so attacker content opens without the expected protection. KEV-listed 2026-02-10 with active_exploitation 'confirmed', poc_available true, RWEP 77, CVSS 8.8.",
+        "gap_closes": [
+          "AU-Essential-8-App-Hardening",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-119",
+        "name": "ARCHIVE-CONTENT-TYPE-PROVENANCE",
+        "description": "For this CVE the requirement is that Word's Protected View decision be taken from verified provenance of the file — established outside the document — rather than from metadata that travels with the document and that an attacker controls, and that the untrusted-origin marking survive whatever container the document is delivered in so the handler still sees it as externally sourced. The operator-side expression of the control: the mail gateway and file-share boundary apply and preserve the untrusted-origin marking themselves, so the sandbox decision does not depend on the application deriving it from attacker-supplied input. The distinguishing test: deliver an externally-sourced document through each ingress path and confirm it reaches Word marked untrusted, instead of confirming only that Protected View is enabled in policy.",
+        "evidence": "The packet classifies this as CWE-807, reliance on untrusted inputs in a security decision, in Microsoft Office Word, and states the effect is that a document security feature (Protected View) is bypassed so attacker content opens without the expected protection. KEV-listed 2026-02-10 with confirmed in-the-wild exploitation.",
+        "gap_closes": [
+          "AU-Essential-8-App-Hardening",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "Office is user software on the whole estate, so meeting the KEV clock here means the update reaching every workstation, and the packet registers no live-patch path — remediation is the vendor update with the restart the KEV requiredAction implies. What makes the interim window unusual for this CVE is that the application's own protective decision is the thing that failed, so 'Protected View is enforced by policy' cannot be recorded as the compensating control during that window; the compensating control has to be external to Word, such as quarantining or blocking externally-sourced Office documents until the update lands.",
+        "evidence": "KEV-listed 2026-02-10, active_exploitation 'confirmed', RWEP 77, CVSS 8.8, poc_available true. patch_available is true; live_patch_available is false and live_patch_notes states no live-patch tool is registered and that the vendor patch typically requires service restart or system reboot per the KEV requiredAction. attack_vector: content opens without the expected Protected View protection.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      }
+    ]
   },
   "CVE-2025-11953": {
     "name": "React Native Community CLI OS Command Injection Vulnerability",
@@ -14096,7 +15549,32 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "There is no exploitation prerequisite here to buy an operator time. The ConnectToHub API method is missing authentication entirely (CWE-306), so the sequence is: reach the SmarterMail instance, point it at an attacker-controlled HTTP server, and the instance fetches and executes the OS command that server returns. At RWEP 83 with a public PoC and confirmed in-the-wild exploitation from the 2026-02-05 KEV listing, exposure is bounded only by how quickly the instance is found on the internet, which makes a routine mail-server patch window a schedule rather than a control. The packet records no live-patch tool for this entry and notes the vendor patch typically requires a service restart or system reboot per the KEV requiredAction, so the SLA has to carry that outage inside it: book the restart against the KEV clock, and where it cannot be booked, take the instance off untrusted networks until it can.",
+        "evidence": "Packet: cwe_refs CWE-306, cvss 9.1, rwep_score 83, cisa_kev true, kev_date 2026-02-05, active_exploitation confirmed, poc_available true, patch_available true, live_patch_available false, live_patch_notes \"No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.\" Vector as recorded: \"SmarterTools SmarterMail contains a missing authentication for critical function vulnerability in the ConnectToHub API method. This could allow the attacker to point the SmarterMail instance to a malicious HTTP server which serves the malicious OS command and could lead to command execution.\"",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-handling"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "Updating SmarterMail closes the unauthenticated ConnectToHub path; it says nothing about what already ran through it. The packet's path ends in OS command execution driven by content the instance fetched from an attacker's HTTP server, on a host that holds mailbox data and the mail service's own credentials, with exploitation confirmed in the wild since the 2026-02-05 KEV listing — so any internet-reachable instance that was unpatched during that window has to be triaged as possibly-executed-upon, not merely as vulnerable-and-now-fixed. The operator default should be capture the configuration, rebuild the mail server from known-good media, and rotate every credential the instance held or could reach, rather than patch in place and ask the anti-malware agent whether anything is present: a command supplied at runtime by a remote HTTP server leaves nothing the vendor patch removes and nothing a signature is guaranteed to name.",
+        "evidence": "Packet: cwe_refs CWE-306, cvss 9.1, rwep_score 83, cisa_kev true, kev_date 2026-02-05, active_exploitation confirmed, poc_available true, patch_available true, live_patch_available false. Vector as recorded: the attacker can \"point the SmarterMail instance to a malicious HTTP server which serves the malicious OS command and could lead to command execution.\" Attack vector: \"missing authentication for a critical function (CWE-306) on SmarterMail, reachable by an unauthenticated attacker.\"",
+        "gap_closes": [
+          "CIS-Controls-v8-10.1",
+          "NIST-800-53-SI-2",
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2021-39935": {
     "name": "GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability",
@@ -14456,7 +15934,38 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-058",
+        "name": "CLOUD-CONTROL-PLANE-CROSS-TENANT-CLAIM-VALIDATION",
+        "description": "The packet describes an attacker holding their own FortiCloud account and a registered device logging into devices registered to other accounts wherever FortiCloud SSO authentication is enabled — the SSO assertion is honoured without being bound to the account the target device belongs to, which is a cross-account claim-validation failure in the vendor's cloud identity plane rather than a flaw on any one appliance. The operator-actionable half is the monitoring half: on FortiAnalyzer, FortiManager, FortiOS and FortiProxy units with FortiCloud SSO enabled, cloud-SSO administrative logins must be logged and reviewed for actors with no relationship to the device, because a successful bypass produces an authorized-looking login and no other artifact.",
+        "evidence": "Packet vector: 'Fortinet FortiAnalyzer, FortiManager, FortiOS, and FortiProxy contain an authentication bypass using an alternate path or channel that could allow an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices.' cwe_refs CWE-288; CVSS 9.1; cisa_kev true, kev_date 2026-01-27, active_exploitation 'confirmed'.",
+        "gap_closes": [
+          "UK-CAF-B2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-PERIMETER-VPN-AUTH-BYPASS-EXPEDITED-PATCH",
+        "name": "PERIMETER-VPN-GATEWAY-AUTH-BYPASS-EXPEDITED-REMEDIATION",
+        "description": "FortiOS and FortiProxy are the authentication enforcement point for the perimeter, so an authentication bypass on them is not an appliance-patch-window item — it is the enforcement point failing open. The packet gives a vendor patch with no live-patch path and a restart-or-reboot requirement, so the expedited clock has to run from the 2026-01-27 KEV listing through the reboot of every affected FortiAnalyzer, FortiManager, FortiOS and FortiProxy unit. Because the packet names FortiCloud SSO authentication being enabled on the device as the condition under which the bypass works, interim exposure is bounded by enumerating which units have that path enabled and restricting reachability of their administrative surfaces until the reboot completes.",
+        "evidence": "Packet name: 'Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability'; cwe_refs CWE-288; CVSS 9.1, RWEP 77; cisa_kev true, kev_date 2026-01-27, active_exploitation 'confirmed', poc_available true; patch_available true, live_patch_available false, live_patch_notes: 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.'",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-network-security"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-036",
+        "name": "FLEET-CONTROL-PLANE-ADMIN-PRIVILEGE-TIER",
+        "description": "Two of the four affected products, FortiManager and FortiAnalyzer, are fleet control planes for the firewall estate, so one bypassed login reaches the configuration and logs of every device they manage. This control is exactly what the vulnerable path collapses: it requires control-plane administration to run on an identity separate from any other admin role, with per-session step-up and jumphost-only access, whereas here a cloud account created for one operator's device becomes an administrative login on another operator's. Frameworks that classify FortiManager and FortiAnalyzer administrators as ordinary network admins carry no rule against wiring that tier to an internet-facing cloud SSO in the first place.",
+        "evidence": "Packet vector names FortiAnalyzer and FortiManager among the affected products and describes logging 'into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices'; cwe_refs CWE-288; citing gaps include NIST-800-53-AC-6 (Least Privilege) and UK-CAF-B2 (Identity and access control).",
+        "gap_closes": [
+          "NIST-800-53-AC-6"
+        ]
+      }
+    ]
   },
   "CVE-2018-14634": {
     "name": "Linux Kernel Integer Overflow Vulnerability (CVE-2018-14634)",
@@ -14511,7 +16020,39 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "Anchor the remediation clock for this Linux kernel flaw to its CISA KEV listing date (2026-01-26), not to the 2018 CVE identifier and not to the 8.8 CVSS. A vulnerability-management program that ages findings from CVE publication, or that ranks local-only flaws beneath network-reachable ones, will have this kernel sitting years past every SLA window and therefore invisible on the dashboard on the day it becomes KEV-listed with confirmed exploitation. The SLA must also define what 'mitigated' means for this specific fix path: the packet's live-patch note says the vendor patch typically needs a service restart or reboot, so a host that has installed the updated kernel package but has not rebooted is still executing the vulnerable create_elf_tables() path and must not be counted as remediated in the evidence pack.",
+        "evidence": "Packet records cisa_kev true with kev_date 2026-01-26 and active_exploitation confirmed for a CVE carrying a 2018 identifier; poc_available true; rwep_score 77 against cvss 8.8; patch_available true; live_patch_available false with live_patch_notes 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.'",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-002",
+        "name": "LIVE-PATCH-CAPABILITY",
+        "description": "The only fix path the packet records for this entry is a kernel update whose activation requires a reboot, and it explicitly notes that no live-patch tool is registered for it. On long-uptime Linux hosts — exactly the ones most likely to still be carrying a kernel with the vulnerable create_elf_tables() path — that turns remediation into a negotiation with a change window instead of a countdown against an SLA, and every deferred reboot leaves a working local root path for any user who can reach a SUID or otherwise privileged binary. Deploying and quarterly-testing kpatch / livepatch / kGraft ahead of the next kernel LPE is what makes same-day kernel remediation possible on production Linux fleets; it is a prerequisite capability, not something that can be procured after a KEV listing lands.",
+        "evidence": "Packet records live_patch_available false with live_patch_notes 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.', patch_available true, and a vector describing an integer overflow (CWE-190) in create_elf_tables() that allows an unprivileged local user with access to a SUID (or otherwise privileged) binary to escalate privileges.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-003",
+        "name": "KERNEL-EXPLOITATION-DETECTION",
+        "description": "Between the KEV listing and the reboot that actually activates the fixed kernel, detection is the only coverage these hosts have, and the packet says a public PoC already exists — so the attempt is cheap for an attacker who has any unprivileged foothold. Instrument auditd or eBPF for the shape this bug takes on a Linux host: an unprivileged process invoking a SUID or otherwise privileged binary, followed by an unexplained transition to uid 0 whose parent chain is an ordinary user session rather than a legitimate privileged service. Alert inside 60 seconds and treat a hit on a host still pending its kernel reboot as a confirmed escalation, not a tuning candidate, because the packet notes LPEs of this class are routinely paired with an initial-access primitive — the escalation is the second half of an intrusion already underway.",
+        "evidence": "Packet records poc_available true, active_exploitation confirmed, rwep_score 77, and a vector in which an unprivileged local user with access to a SUID (or otherwise privileged) binary escalates privileges on the system; attack_vector notes 'LPEs of this class are routinely paired with an initial-access primitive'; live_patch_available false and the vendor patch 'typically requires service restart or system reboot', leaving an exposure window on hosts awaiting reboot.",
+        "gap_closes": [
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2025-52691": {
     "name": "SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability",
@@ -14571,7 +16112,32 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "For SmarterMail the remediation clock has to start at the 2026-01-26 KEV listing and drive the fixed SmarterTools build onto every internet-facing mail node within hours, not at the next mail-maintenance window. Because the upload path is reachable before authentication, no mailbox password policy, MFA rollout, or admin-permission review buys time while the SLA runs — the only thing that shortens exposure is the build going live. No live-patch path exists for this entry, so the SLA definition must include the service restart or reboot the vendor fix needs to take effect: a mail host with the fixed installer staged but the SmarterMail service still running old code must count as unremediated, not as patched-per-SLA.",
+        "evidence": "The packet records CISA KEV listing on 2026-01-26 with active_exploitation \"confirmed\", RWEP 83, CVSS 9.8 and poc_available true, against an unrestricted upload of file with dangerous type (CWE-434) that lets an unauthenticated attacker \"upload arbitrary files to any location on the mail server, potentially enabling remote code execution\". patch_available is true, live_patch_available is false, and live_patch_notes state the vendor patch typically requires a service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-handling"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "The durable artifact of exploiting this flaw is a file the attacker chose the location of on the mail server's filesystem — a web shell or equivalent — so upgrading SmarterMail closes the upload endpoint and removes nothing the attacker already wrote. Any SmarterMail instance that was internet-reachable while unpatched must be handled as compromised until proven otherwise: export and preserve configuration for forensics, rebuild the host from known-good media instead of upgrading in place, and rotate every credential the mail service could reach — service accounts, administrator and mailbox passwords, API keys and smart-host/relay credentials — because arbitrary file write on the mail server implies code execution on the host that stores them. Anti-malware on the mail host is not the deciding control: an attacker-supplied handler file placed at an attacker-chosen path is not reliably a signatured object.",
+        "evidence": "The packet describes CWE-434 allowing an unauthenticated attacker to write arbitrary files anywhere on the mail server for code execution (\"e.g. a web shell\"), with active_exploitation \"confirmed\", poc_available true, and a KEV listing dated 2026-01-26 — so pre-patch exposure windows must be assumed to have been exercised. CIS Controls v8 10.1 (anti-malware) is one of the framework controls this entry already cites as insufficient.",
+        "gap_closes": [
+          "CIS-Controls-v8-10.1",
+          "NIST-800-53-SI-2",
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2026-23760": {
     "name": "SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability",
@@ -14631,7 +16197,32 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "SmarterMail's force-reset-password endpoint accepts anonymous requests and never checks the existing password or a reset token, so there is no exploitation-difficulty buffer between KEV listing and administrator takeover — one request naming a system administrator account is the whole exploit. The response clock must therefore start at the 2026-01-26 KEV listing rather than at the mail server's next maintenance window. The packet records the vendor update as the only remediation available (no live-patch tool is registered for this entry), and applying it requires the service restart or reboot the KEV requiredAction calls for, so that restart has to be scheduled inside the SLA window rather than used as the reason to defer past it.",
+        "evidence": "Packet: CISA KEV-listed 2026-01-26 with active_exploitation confirmed; CVSS 9.8, RWEP 83, poc_available true. patch_available true, live_patch_available false, live_patch_notes: \"No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.\"",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-handling"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "The end state of this exploit is a system administrator account whose password the attacker chose. Installing the SmarterMail update closes the anonymous force-reset-password path but leaves that credential valid, so patch-in-place is not eviction for this CVE — an operator who patches and closes the ticket has locked the door on an attacker already holding admin. Any instance that was network-reachable before the update must be treated as potentially compromised: audit the system-administrator account list and password-change history across an exposure window that opened no later than the 2026-01-26 KEV listing, rotate every administrator credential rather than only ones that look wrong, and review the administrative changes an attacker in that context could have made (added or re-enabled accounts, altered mail routing, delegated mailbox access) before declaring the instance clean.",
+        "evidence": "Packet vector: \"The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts. This could allow an unauthenticated attacker to supply a target administrator username and a new password to reset the account, resulting in full administrative compromise of the SmarterMail instance.\" active_exploitation confirmed, CISA KEV-listed 2026-01-26, poc_available true, CVSS 9.8, RWEP 83.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "UK-CAF-B2"
+        ]
+      }
+    ]
   },
   "CVE-2026-24061": {
     "name": "GNU InetUtils Argument Injection Vulnerability",
@@ -14691,7 +16282,29 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "The exploit path here needs no credential and no user interaction — setting the USER environment variable to a '-f root' value drives telnetd into an authentication bypass — so any reachable unpatched listener is exploitable by whoever can open the port, and the KEV clock has to be met on every host and image where the inetutils telnetd binary is actually in service, not only on the hosts the patch-management inventory happens to enumerate. No live-patch tool is registered for this entry, so the SLA is satisfied by the vendor update with the restart the KEV requiredAction implies; stopping or firewalling the telnetd listener is the mitigation available inside the window, and it must be recorded as a compensating control rather than as remediation.",
+        "evidence": "CISA KEV-listed 2026-01-26 with active_exploitation 'confirmed', RWEP 77, CVSS 9.1, poc_available true. patch_available is true; live_patch_available is false and live_patch_notes states no live-patch tool is registered and that the vendor patch typically requires service restart or system reboot per the KEV requiredAction. The vector states GNU InetUtils contains an argument injection vulnerability in telnetd allowing remote authentication bypass via a '-f root' value for the USER environment variable.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-038",
+        "name": "MITIGATION-ACTIVE-PATCH-PENDING-VERDICT-CLASS",
+        "description": "For this CVE two remediation states report identically on a vulnerability dashboard and are not equivalent: (a) inetutils updated to the fixed build, and (b) the telnetd listener stopped or firewalled while the vulnerable binary stays on disk. State (b) does close the path, but only for as long as the listener stays down — a host rebuild from an unpatched image, a re-enable of the service, or any dependent tooling that starts telnetd restores an unauthenticated path to root with no new vulnerability being introduced. Audit output must carry the state per host with a time-bound action to reach (a), instead of collapsing both into 'remediated' and losing the fact that the exposure is one service-start away.",
+        "evidence": "The packet gives patch_available true and live_patch_available false, so both a patch path and a service-disable path exist for the same entry. The vector states the flaw is an argument injection in telnetd yielding remote authentication bypass via a '-f root' value for the USER environment variable. KEV-listed 2026-01-26 with confirmed in-the-wild exploitation, CVSS 9.1, RWEP 77.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2026-21509": {
     "name": "Microsoft Office Security Feature Bypass Vulnerability",
@@ -14806,7 +16419,30 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "A KEV clock on this entry is a clock on the entire virtual estate, not on one server: vCenter is the management plane for every host and VM registered to it, so the blast radius of the recorded remote code execution is the virtualization control plane rather than a single application host. The reachable surface is the DCE/RPC implementation, which processes packets before authentication — so 'only administrators use vCenter' does not bound exposure; anything with network access to the vCenter service does. The packet records no live-patch path and a vendor fix that requires a service restart or reboot, which is the real obstacle for this asset class: vCenter restarts are typically held behind virtualization change freezes. The SLA must therefore pre-authorize the vCenter restart as part of the KEV response rather than queueing it behind the next maintenance window, and any window that cannot be met must be recorded as unremediated exposure with the DCE/RPC surface restricted in the interim.",
+        "evidence": "CISA KEV-listed 2026-01-23 with active_exploitation 'confirmed' and poc_available true; CVSS 9.8, RWEP 77. The catalog vector records that vCenter Server 'contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. This could allow a malicious actor with network access to vCenter Server to send specially crafted network packets, potentially leading to remote code execution.' patch_available is true, live_patch_available is false, and live_patch_notes reads: 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.'",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "APPSERVER-REMOTING-PROTOCOL-RESTRICTION",
+        "name": "APPSERVER-REMOTING-PROTOCOL-RESTRICTION",
+        "description": "vCenter's DCE/RPC listener is exactly the binary remoting-protocol class this control governs: a non-HTTP protocol endpoint that answers before authentication and whose parser is itself the vulnerable code, so the perimeter firewall and the web-tier hardening that most vCenter deployments are audited against never touch it. The requirement for this deployment is that DCE/RPC on vCenter accepts connections only from hosts that legitimately speak it — management and jump networks and the hosts vCenter administers — enforced by network ACL or host firewall rather than assumed from 'vCenter is internal', and that a KEV-listed defect in that parser is patched on an accelerated clock with the service restart taken rather than folded into the next quarterly virtualization window. The distinguishing test for this product: from a general user or workstation VLAN on a staging deployment, send crafted DCE/RPC packets at vCenter and confirm they are dropped before reaching the listener — an estate that passes vCenter role-and-permission audits while leaving the DCE/RPC port reachable from any internal segment is still exposed to the unauthenticated packet path.",
+        "evidence": "The catalog attack_vector records 'an out-of-bounds write (CWE-787) in the vCenter Server DCE/RPC protocol implementation, exploitable by an unauthenticated attacker for remote code execution', and the vector states the trigger is 'a malicious actor with network access to vCenter Server' sending 'specially crafted network packets' — network reach to the protocol endpoint is the sole precondition. KEV-listed 2026-01-23, active_exploitation 'confirmed', poc_available true, CVSS 9.8, RWEP 77. The gaps this entry cites include NIS2 Art. 21 security of network and information systems and UK CAF B4 system security.",
+        "gap_closes": [
+          "NIS2-Art21-network-security",
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2025-68645": {
     "name": "Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability",
@@ -14926,7 +16562,43 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-030",
+        "name": "PERIMETER-DEVICE-ZERODAY-SLA-TIER",
+        "description": "Versa Concerto orchestrates the SD-WAN fabric, so an unauthenticated route to its administrative endpoints is a trust-boundary failure rather than an application bug, and it belongs in the perimeter SLA tier alongside firewalls and VPN concentrators. The packet places the defect in the Traefik reverse-proxy configuration in front of the orchestrator — which is also the layer an operator can constrain immediately: the vendor fix goes on within hours of the 2026-01-22 KEV listing, or the administrative and internal Actuator routes are removed from every untrusted-network path until it does. A routine appliance-patch window does not apply to the device that defines the fabric's policy plane, and 'orchestrator, not edge device' is exactly the classification error that keeps this system on the slow tier.",
+        "evidence": "Packet: CWE-288 improper authentication; vector states the flaw is in the Traefik reverse proxy configuration and allows an attacker to access administrative endpoints, with the internal Actuator endpoint leveraged for access to heap dumps and trace logs; attack_vector describes an unauthenticated attacker reaching administrative functionality on the Versa Concerto SD-WAN orchestrator; CISA KEV-listed 2026-01-22 with active_exploitation=confirmed; poc_available=true; CVSS 9.1, RWEP 77; patch_available=true, live_patch_available=false.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-network-security"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "The packet states the internal Actuator endpoint can be leveraged for heap dumps and trace logs — process memory and log content from the system that holds credentials, session material and policy for the whole SD-WAN fabric. Applying the vendor fix to a Concerto instance that was reachable during the confirmed-exploitation window closes the entry path but leaves everything already dumped valid, and it destroys nothing the attacker planted. Response for this CVE must therefore default to treating an exposed orchestrator as compromised: capture and review its configuration, rebuild the instance from a known-good image, and rotate every credential, token and key the orchestrator held or distributed to managed devices — patch-in-place is not a remediation verdict for a device whose exploitation primitive is memory disclosure.",
+        "evidence": "Packet: vector states the internal Actuator endpoint can be leveraged for access to heap dumps and trace logs, and that the improper authentication allows an attacker to access administrative endpoints; attack_vector confirms an unauthenticated attacker reaching administrative functionality on the SD-WAN orchestrator; cisa_kev=true, kev_date 2026-01-22, active_exploitation=confirmed, poc_available=true; patch_available=true (vendor fix exists, so this control governs what must accompany it, not a substitute for it).",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "UK-CAF-B2",
+          "NIS2-Art21-network-security"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-036",
+        "name": "FLEET-CONTROL-PLANE-ADMIN-PRIVILEGE-TIER",
+        "description": "An SD-WAN orchestrator is a fleet control plane in the same sense as an MDM or a configuration-management server: whoever reaches its administrative surface reaches every managed device's policy. The requirement that bites for this CVE is the access-path half of the tier — the Concerto management surface, including the internal Actuator endpoint, must be reachable only from a dedicated privileged-access segment and never from a general or untrusted network. Because the flaw is an unauthenticated bypass, admin identity hardening alone does not stop it; what does is that an anonymous caller has no network route to the bypassed endpoints in the first place. Frameworks that file an SD-WAN orchestrator as an ordinary application-admin surface leave it directly reachable and let a proxy-configuration defect become fabric-wide administrative access.",
+        "evidence": "Packet: attack_vector states an unauthenticated attacker reaches administrative functionality on the Versa Concerto SD-WAN orchestrator via an authentication bypass using an alternate path or channel (CWE-288); vector attributes the exposure to the Traefik reverse proxy configuration fronting administrative and internal Actuator endpoints; citing gaps include NIST-800-53-AC-6 (Least Privilege), UK-CAF-B2 (Identity and access control) and NIS2-Art21-network-security; CVSS 9.1 with active_exploitation=confirmed.",
+        "gap_closes": [
+          "UK-CAF-B2",
+          "NIST-800-53-AC-6",
+          "NIS2-Art21-network-security"
+        ]
+      }
+    ]
   },
   "CVE-2025-31125": {
     "name": "Vite Vitejs Improper Access Control Vulnerability",
@@ -14986,7 +16658,20 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "Vite is build-time developer tooling, and vulnerability-management programs routinely hold devDependencies outside the KEV clock entirely — yet this entry is KEV-listed with confirmed exploitation, so the same mitigation deadline that applies to a production server applies to the front-end toolchain. What makes the SLA achievable here is that the packet names a precondition, not just a version: only instances explicitly bound to the network via --host or the server.host config option are affected, so removing that binding is a documented compensating control that lands immediately across every project, while the Vite update is what actually closes the ?inline&import / ?raw?import read path. Sequence the response accordingly — unbind first, upgrade second — and treat the SLA as covering every repository, CI job, and container entrypoint that starts the dev server with --host, not only the instance that surfaced the finding. Because no live-patch tool is registered, the dev-server restart the update requires belongs inside the window.",
+        "evidence": "Packet: CISA KEV-listed 2026-01-22 with active_exploitation confirmed; CVSS 8.8, RWEP 77, poc_available true. Vector: \"exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.\" attack_vector adds that a remote attacker can read files including source and environment secrets outside the served root. patch_available true, live_patch_available false, live_patch_notes: \"No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.\"",
+        "gap_closes": [
+          "AU-Essential-8-App-Hardening",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      }
+    ]
   },
   "CVE-2025-54313": {
     "name": "Prettier eslint-config-prettier Embedded Malicious Code Vulnerability",
@@ -15161,7 +16846,32 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "This CVE is the case the control exists for. A CVSS 5.5, local, information-disclosure-only finding sorts to the bottom of a severity-ordered patch queue, yet the packet records it as KEV-listed 2026-01-13 with confirmed in-the-wild exploitation and a public PoC, scoring RWEP 77. The remediation clock must be started by the KEV listing and by the chain role — the packet describes the leak as a primitive whose kernel-address disclosure defeats KASLR for a follow-on escalation — not by the CVSS band or by the words 'information disclosure' in the title. The operator action here is the vendor update on every Windows endpoint carrying the affected Desktop Window Manager component, and because the packet records no live-patch path and states the fix typically requires a service restart or system reboot, 'verified mitigation' means the restart has happened on the endpoint, not that the update was approved or downloaded.",
+        "evidence": "Packet: CWE-200 information disclosure; vector states Microsoft Windows Desktop Window Manager allows an authorized attacker to disclose information locally; attack_vector states the flaw is used as a primitive in a privilege-escalation chain because kernel-address leaks defeat KASLR for follow-on exploits, and that LPEs of this class are routinely paired with an initial-access flaw by ransomware operators; cisa_kev=true, kev_date 2026-01-13, active_exploitation=confirmed, poc_available=true; CVSS 5.5 against RWEP 77; patch_available=true, live_patch_available=false with live_patch_notes recording that no live-patch tool is registered and that the vendor patch typically requires service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-patch-management",
+          "ISO-27001-2022-A.8.8"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-018",
+        "name": "SCANNER-PAPER-COMPLIANCE-TEST",
+        "description": "The packet records no live-patch path for this CVE and states the vendor fix typically requires a service restart or system reboot, which creates a specific paper-compliance state on Windows estates: the update is installed, the inventory or scanner reports the host as remediated, and the machine has not restarted — so the vulnerable Desktop Window Manager code is still the code in memory. Long-uptime workstations, session hosts and VDI golden-image children sit in exactly that state for weeks. The operational test for this CVE is therefore not 'is the update present' but 'is the host's last-boot time later than the update's install time'; any host failing that comparison must be counted as unremediated against the KEV clock rather than as patched. A scan that reports compliance from installed-package state alone certifies an estate that is still exploitable through the pending-reboot population.",
+        "evidence": "Packet: patch_available=true but live_patch_available=false, with live_patch_notes stating that no live-patch tool is registered for this entry and that the vendor patch typically requires service restart or system reboot per the KEV requiredAction; vector states the disclosure occurs locally to an authorized attacker in the Windows Desktop Window Manager; cisa_kev=true with kev_date 2026-01-13 and active_exploitation=confirmed, so the pending-reboot window is an actively-exploited window.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2025-8110": {
     "name": "Gogs Path Traversal Vulnerability",
@@ -15396,7 +17106,20 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "Applied here the control's real work is dragging a network video recorder inside the same remediation clock as a server. The packet records a vendor fix as available, so the required action from the 2025-12-22 KEV listing is the vendor firmware update — and because no live-patch path exists for this class and the update lands only across a device restart, the SLA has to include a scheduled recorder restart, not just a firmware file staged on a management console. Where the recorder cannot be updated inside the window, the control's alternative branch is the one to invoke and document: the DS-2105 Pro's web interface must be unreachable from any untrusted network until it is on fixed firmware, because until then a single unauthenticated request to time_tzsetup.cgi reaches a privileged command path with no credential required, and the CVSS 9.8 / confirmed-exploitation pairing means that request is being sent. The compliance failure this control is written against is precisely the one this device invites — an appliance that no patch ring inventories being reported as out of scope rather than as unremediated.",
+        "evidence": "The packet records a missing-authorization flaw (CWE-862) on the Digiever DS-2105 Pro allowing command injection via time_tzsetup.cgi, and describes it as letting an unauthenticated attacker reach privileged functionality on the network video recorder. CISA KEV-listed 2025-12-22 with active_exploitation 'confirmed' and poc_available true; CVSS 9.8, RWEP 77. patch_available is true and live_patch_available is false, with live_patch_notes recording that no live-patch tool is registered for this entry and that the vendor patch typically requires a service restart or system reboot per the KEV requiredAction. Three of the six citing gaps (ASD Essential Eight patch operating systems, ISO/IEC 27001:2022 A.8.8, NIST SP 800-53 SI-2) are remediation-cadence controls that state no exploitation-tied deadline.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      }
+    ]
   },
   "CVE-2025-14733": {
     "name": "WatchGuard Firebox Out of Bounds Write Vulnerability",
@@ -15456,7 +17179,40 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-030",
+        "name": "PERIMETER-DEVICE-ZERODAY-SLA-TIER",
+        "description": "The Firebox is the trust boundary, and the packet places the defect in the Fireware OS iked process — the IKEv2 daemon that has to answer unauthenticated packets for mobile-user VPN and for branch-office VPN with a dynamic gateway peer to work at all. That is what makes the standard appliance-patch window the wrong tier here: the vulnerable listener cannot be firewalled off without taking remote access down, and the dynamic-gateway-peer configuration the packet names does not pin a source address, so peer-address restriction is not available as a stopgap for those tunnels. The requirement is the fixed Fireware build within hours of KEV listing, with the reboot budgeted inside that clock, or the IKEv2 remote-access interface disabled until the upgrade lands — there is no live-patch path for this entry, so there is no third option that keeps the tunnel up on a vulnerable build.",
+        "evidence": "Packet vector: 'WatchGuard Fireware OS iked process contains an out of bounds write vulnerability in the OS iked process. This vulnerability may allow a remote unauthenticated attacker to execute arbitrary code and affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer.' CWE-787, CVSS 8.8, RWEP 77, poc_available true; CISA KEV-listed 2025-12-19 with active_exploitation 'confirmed'. patch_available true, live_patch_available false, and live_patch_notes states no live-patch tool is registered and that the vendor patch typically requires a service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "Exploitation of this one is confirmed in the wild and needs no credentials, so any Firebox that ran an affected Fireware build with its IKEv2 listener reachable has to be triaged as possibly-compromised rather than merely unpatched. The default response is to export and diff the configuration against a known-good baseline, rebuild onto the fixed Fireware release, and rotate what the appliance held — VPN pre-shared keys, IKEv2 credentials and certificates, firewall admin accounts, and any RADIUS or directory service account bound to the device — before the tunnels come back up. Upgrading in place closes the out-of-bounds write in iked and nothing else: an admin account, tunnel definition, or policy change an attacker added pre-upgrade survives the new firmware, and the upgrade ticket closes green.",
+        "evidence": "The packet describes an out-of-bounds write (CWE-787) in the Fireware OS iked process allowing 'a remote unauthenticated attacker to execute arbitrary code'; CISA KEV-listed 2025-12-19 with active_exploitation 'confirmed' and poc_available true; RWEP 77, CVSS 8.8. patch_available true with live_patch_available false, so the only remediation on offer is a version upgrade requiring a restart — which addresses the defect, not a pre-upgrade foothold.",
+        "gap_closes": [
+          "UK-CAF-B4",
+          "NIS2-Art21-network-security"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-031",
+        "name": "FIREWALL-EGRESS-TELEMETRY-SEPARATE-TRUST-ZONE",
+        "description": "Code execution in iked puts the attacker inside the Firebox, which is also the machine that generates the IKEv2 session records, admin-authentication events and policy-change logs an investigator needs to decide whether a given appliance was hit before the fixed Fireware build was installed. Firebox logging must therefore already be streaming to a SIEM in a different trust zone, under credentials the firewall itself cannot use to delete history, so the VPN negotiation and admin-account records survive an attacker who owns the device. The timing is the point: this control cannot be retrofitted usefully after the fact, because the evidence window that decides rebuild-versus-upgrade opened before the 2025-12-19 KEV listing, and telemetry that only ever lived on the appliance is already gone.",
+        "evidence": "The packet places the flaw in the Fireware OS iked process, exploitable by 'a remote unauthenticated attacker to execute arbitrary code' (CWE-787), CISA KEV-listed 2025-12-19 with active_exploitation 'confirmed' and poc_available true — the attacker's code runs on the same device that produces the firewall's own logs.",
+        "gap_closes": [
+          "NIS2-Art21-network-security"
+        ]
+      }
+    ]
   },
   "CVE-2025-59374": {
     "name": "ASUS Live Update Embedded Malicious Code Vulnerability",
@@ -15576,7 +17332,30 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-030",
+        "name": "PERIMETER-DEVICE-ZERODAY-SLA-TIER",
+        "description": "The SMA1000 is the remote-access trust boundary itself, so a KEV-confirmed exploited defect in its appliance management console belongs in a distinct SLA tier rather than the routine appliance-patch window — the ordinary 14/30-day cadence is priced on the assumption that a vulnerable asset sits behind a boundary, and this device is the boundary. The flaw here is missing authorization on the AMC yielding privilege escalation rather than a pre-auth RCE, but the tier logic is unchanged: deploy the vendor fix on a KEV-tied clock, accepting the service restart or reboot it requires, and where that restart genuinely cannot be scheduled inside the clock, isolate the AMC interface to an operator-only management segment so the unauthorized-privilege path is unreachable in the interim. Inventory must name every SMA1000 whose AMC is reachable from anything wider than that segment.",
+        "evidence": "Packet: SonicWall SMA1000, CWE-862 / CWE-250; CISA KEV-listed 2025-12-17 with active_exploitation 'confirmed'; RWEP 77 / CVSS 7.8; poc_available true. The packet's vector states the flaw 'could allow for privilege escalation appliance management console (AMC) of affected devices.' patch_available true; live_patch_available false, with live_patch_notes 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.'",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-network-security"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-036",
+        "name": "FLEET-CONTROL-PLANE-ADMIN-PRIVILEGE-TIER",
+        "description": "The SMA1000's appliance management console governs remote access for everyone who enters the network through the appliance, which makes AMC administration a control-plane tier rather than an application-admin tier. That distinction is load-bearing for this CVE specifically: the defect is a missing-authorization check inside AMC — the console invokes privileged functionality without confirming the caller is entitled to it — so no amount of role definition inside the console is reliable, and the residual control is reducing who can reach the console at all. Require PAM-jumphost-only reachability for AMC, step-up authentication per session, just-in-time elevation with approval, an AMC identity distinct from every other admin role, and dedicated privileged-access-workstation hardware. A framework that collapses 'appliance admin' into general admin leaves a wide population of accounts positioned on the escalation path.",
+        "evidence": "Packet: CWE-862 (missing authorization) plus CWE-250; the packet's attack_vector describes 'a missing-authorization flaw (CWE-862/CWE-250) on the SonicWall SMA1000 secure-access appliance, letting an attacker reach functionality with unnecessary privileges without proper authorization', and the vector locates it in the appliance management console (AMC). CISA KEV-listed 2025-12-17, active_exploitation 'confirmed', RWEP 77 / CVSS 7.8, poc_available true.",
+        "gap_closes": [
+          "UK-CAF-B2"
+        ]
+      }
+    ]
   },
   "CVE-2025-20393": {
     "name": "Cisco Multiple Products Improper Input Validation Vulnerability",
@@ -15756,7 +17535,38 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-124",
+        "name": "FRAMEWORK-DEFAULT-SECRET-DETECTION",
+        "description": "Because CentreStack and Triofox ship the same AES key material in every install, the constant an attacker needs to forge trusted material is obtainable from the product itself rather than from the target — which means no amount of credential hygiene on the operator's side reduces the exposure. Gate the deployment on key uniqueness instead: after applying the vendor update, verify that the instance's AES key material differs from the vendor-shipped constant and from every other instance you operate, and fail the deployment back out of service if it does not. Re-run the check after any restore-from-image, template clone or appliance rebuild, since those are the operations that quietly reintroduce the shipped key on a host that was previously remediated. The packet ties the weakness specifically to publicly exposed endpoints, so this gate belongs on every internet-facing CentreStack/Triofox node before it is returned to service.",
+        "evidence": "Packet vector states the products 'contain a hardcoded cryptographic keys vulnerability for their implementation of the AES cryptoscheme', that this 'degrades security for public exposed endpoints', and that it 'may offer arbitrary local file inclusion when provided a specially crafted request without authentication'; cwe_refs CWE-798; patch_available true.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "This entry is KEV-listed with confirmed in-the-wild exploitation and a public PoC against an internet-exposed file-sharing gateway, and the packet says the crafted request needs no authentication — so exposure begins at the first unauthenticated scan of the endpoint, not at a first successful login, and the usual 'internal users only' scoping argument does not apply. Run the clock from 2025-12-15 and define verified mitigation as two deliverables rather than one: the vendor update deployed, and evidence that the instance is no longer running the shipped AES key. Applying the update alone does not retire key material an attacker could already have taken from the product, so an SLA that closes on package version alone closes on the wrong condition for a hardcoded-key flaw.",
+        "evidence": "Packet records cisa_kev true, kev_date 2025-12-15, active_exploitation confirmed, poc_available true, rwep_score 77, cvss 8.8, patch_available true, live_patch_available false; vector describes exploitation of 'public exposed endpoints' by 'a specially crafted request without authentication'.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "A CentreStack or Triofox node is the trust boundary between the internet and the file estate behind it, and the packet records confirmed in-the-wild exploitation of an unauthenticated request path on exactly that surface. Any instance that was internet-exposed while vulnerable should therefore be handled as a suspected compromise rather than as a host awaiting a patch: capture and review its configuration off-box, rebuild the node, and rotate every credential and token that was stored on it or transited it — including anything an attacker could have read through the arbitrary local file inclusion the vector describes. Patch-in-place is the wrong default here twice over, because it leaves attacker-installed persistence intact and it leaves already-disclosed file contents and any material forged with the shared key still valid.",
+        "evidence": "Packet records active_exploitation confirmed, cisa_kev true with kev_date 2025-12-15, poc_available true, and a vector permitting 'arbitrary local file inclusion when provided a specially crafted request without authentication' against 'public exposed endpoints'; attack_vector describes forging trusted material 'to gain unauthorized access and code execution'.",
+        "gap_closes": [
+          "NIS2-Art21-vulnerability-management"
+        ]
+      }
+    ]
   },
   "CVE-2018-4063": {
     "name": "Sierra Wireless AirLink ALEOS Unrestricted Upload of File with Dangerous Type Vulnerability",
@@ -15816,7 +17626,28 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "A 2018 CVE id added to CISA KEV on 2025-12-12 — the exploitation signal arrived roughly seven years after assignment, and every framework control cited against this entry keys its clock to disclosure and severity. An AirLink ALEOS gateway carrying a 2018 CVSS 8.8 sits in the aged-backlog tier of any normal patch program and is never re-prioritized when the flaw starts being used, which is exactly how a seven-year-old file-upload bug stays live on field-deployed cellular gateways at unstaffed sites. The control this CVE demands is a mitigation clock that starts at the KEV listing date regardless of CVE age: on 2025-12-12 every ALEOS unit in the fleet needed a verified mitigation — the vendor firmware update, which the packet records as available with no live-patch path and therefore a reboot-bearing field change, or removal of the device's web administration surface from any reachable network — inside the KEV response window, not at the next scheduled site visit.",
+        "evidence": "Packet: CVE id year 2018; CISA KEV-listed 2025-12-12 with active_exploitation 'confirmed'; RWEP 77 against CVSS 8.8; poc_available true. Sierra Wireless AirLink ALEOS, CWE-434 unrestricted upload of file with dangerous type: 'A specially crafted HTTP request can upload a file, resulting in executable code being uploaded, and routable, to the webserver.' attack_vector places the code execution on the cellular gateway. patch_available true; live_patch_available false with live_patch_notes recording no registered live-patch tool and a vendor patch that typically requires service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "The output of this defect is not a crash but a file: per the packet, executable code that is uploaded and routable to the gateway's own web server — a persistent web shell living in device storage, on a unit that is the WAN edge for a remote or unstaffed site where nobody is watching the console. A firmware update applied over an already-exploited gateway addresses the upload path while leaving that uploaded, reachable file in place, which is why 'firmware updated' is the wrong closure artifact for this CVE. For any ALEOS unit that was reachable before remediation, the required sequence is: preserve the configuration for forensics, reflash or factory-reset the device rather than upgrading in place, and rotate the credentials the gateway held, including its administrative and any stored management or VPN credentials. The packet gives no live-patch path, so the update is a reboot-bearing field action in either case — making the rebuild the more defensible use of that same maintenance visit.",
+        "evidence": "Packet: CWE-434 on Sierra Wireless AirLink ALEOS — 'A specially crafted HTTP request can upload a file, resulting in executable code being uploaded, and routable, to the webserver'; attack_vector describes uploading a file (e.g. a web shell) for code execution on the cellular gateway. CISA KEV-listed 2025-12-12 with active_exploitation 'confirmed'; poc_available true; CVSS 8.8, RWEP 77. patch_available true, live_patch_available false, live_patch_notes: no live-patch tool registered; vendor patch typically requires service restart or system reboot.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8"
+        ]
+      }
+    ]
   },
   "CVE-2025-58360": {
     "name": "OSGeo GeoServer Improper Restriction of XML External Entity Reference Vulnerability",
@@ -15876,7 +17707,30 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "GeoServer entered CISA KEV on 2025-12-11 with confirmed exploitation and a public PoC and a fix exists, so the KEV clock governs. Two properties of this deployment break the routine application-patch cadence: a GeoServer instance is usually an internet-facing map service owned by a GIS or data team rather than by the pipeline that patches the rest of the estate, and the entry records no live-patch path with a fix that requires a service restart per the KEV requiredAction. The SLA must therefore name an accountable owner for each GeoServer instance and pre-authorize the restart, because the vulnerable operation is reachable without authentication — every hour of deferral is an hour in which an unauthenticated caller can read server-side files, including the service's own configuration, and coerce requests from the server.",
+        "evidence": "OSGeo GeoServer XML external entity flaw (CWE-611) allowing an unauthenticated attacker to read server files and coerce server-side requests; the entry names the surface as XML input to /geoserver/wms, operation GetMap. CISA KEV-listed 2025-12-11 with active_exploitation=confirmed, poc_available=true, RWEP 77, CVSS 8.8. patch_available=true, live_patch_available=false, with a vendor patch that typically requires service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-025",
+        "name": "CONFIGURATION-SIDE-LIVE-PATCH-INVENTORY",
+        "description": "The exposed surface for this CVE is narrow and named — XML input to /geoserver/wms on the GetMap operation — which means a filtering path in front of the service can shorten the exposure window on a much shorter clock than the restart the vendor fix requires. Rejecting request bodies that carry DOCTYPE or external-entity declarations to that endpoint, or removing its anonymous reachability, is deployable without taking the map service down. What the control demands is that this path be inventoried, staged and rehearsed before a disclosure rather than improvised during one. Because the entry records no live-patch capability for GeoServer and a fix gated behind a service restart, the request-filtering route is the only lever an operator has between the 2025-12-11 KEV listing and whenever the restart window opens — and a vulnerability-management programme that recognises only the vendor-patch path will report that interval as unmitigated because it has nothing else to record.",
+        "evidence": "The entry states the flaw occurs when the application accepts XML input through a specific endpoint, /geoserver/wms operation GetMap, and that an attacker can define external entities within the XML request; exploitation is unauthenticated. live_patch_available=false and the vendor patch typically requires service restart or system reboot per the KEV requiredAction. CISA KEV-listed 2025-12-11, active_exploitation=confirmed, poc_available=true.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2025-6218": {
     "name": "RARLAB WinRAR Path Traversal Vulnerability",
@@ -16281,7 +18135,21 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "MOBILE-OS-MINIMUM-PATCH-LEVEL-ENFORCEMENT",
+        "name": "MOBILE-OS-MINIMUM-PATCH-LEVEL-ENFORCEMENT",
+        "description": "The Android Framework out-of-bounds read is closed only by advancing the handset's security-patch level, and the packet records no live-patch path - the device has to take the update and reboot. The MDM/EMM must read each managed device's security-patch level and block or quarantine handsets below the level carrying this Framework fix from organizational data, not merely surface the stale level on a dashboard. The second half matters more than usual here: the leak is consumed by a locally running app to defeat ASLR for the follow-on exploit, so devices that cannot yet update must also be prevented from installing untrusted or side-loaded apps - denying the local app that harvests the leak is the only mitigation available while the OEM update is out of reach. It is also the control that survives triage: at CVSS 5.5 this reads as a low-priority information disclosure, while the packet scores it RWEP 77 on confirmed in-the-wild use. Distinguishing test: enroll a device pinned below the fixing patch level and confirm it is denied protected resources.",
+        "evidence": "Packet vector: Android Framework contains an unspecified vulnerability that allows for information disclosure. attack_vector records an out-of-bounds read (CWE-125) in the Android Framework used by a local app as a primitive in a privilege-escalation chain, leaking memory to defeat ASLR for a follow-on exploit, and forming the local-escalation half of a mobile-spyware chain. CISA KEV-listed 2025-12-02, active_exploitation confirmed, PoC available, CVSS 5.5, RWEP 77. patch_available true; live_patch_available false, with live_patch_notes stating no live-patch tool is registered and that the vendor patch typically requires service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-patch-management"
+        ]
+      }
+    ]
   },
   "CVE-2025-48572": {
     "name": "Android Framework Privilege Escalation Vulnerability",
@@ -16511,7 +18379,33 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-057",
+        "name": "BROWSER-MANAGED-UPDATE-NO-DEFERRAL",
+        "description": "This bug is reached by any page the browser renders, so exposure is every browsing session until the fixed build is the one actually executing. Staged rollout percentages, pilot-ring soak periods, and admin-set update deferral on Chrome/Edge and other Chromium-derived browsers must be overridden for the security channel: push to the whole fleet at once and force the relaunch rather than waiting for the user to close their windows. The packet shows no live-patch path, so the update only takes effect on restart — an endpoint that has downloaded the fixed build but has not relaunched is still running the vulnerable V8 and must be reported as exposed, not as updated. Fleet reporting therefore has to key on the running browser version, not on update-channel assignment.",
+        "evidence": "The packet records a type confusion (CWE-843) in V8 \"exploitable by an attacker-controlled web page for code execution in the renderer\", CISA KEV-listed 2025-11-19 with active_exploitation \"confirmed\", poc_available true, CVSS 8.8, RWEP 77. patch_available is true, live_patch_available is false, and live_patch_notes state the vendor patch typically requires a service restart or system reboot per the KEV requiredAction. The packet also notes browser zero-days of this class are typically used in targeted-spyware or watering-hole chains.",
+        "gap_closes": [
+          "AU-Essential-8-App-Hardening",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management",
+          "NIST-800-53-SI-2",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "Browsers are routinely excluded from vulnerability-management SLAs on the assumption that they update themselves, so a KEV listing against Chromium lands on software no SLA is tracking. This entry has to be booked as a KEV item with a named owner and a deadline anchored to 2025-11-19, and the compliance evidence must be a count of endpoints still running a pre-fix V8 build at each checkpoint — not a screenshot of the update policy. Stragglers that cannot relaunch inside the window (kiosk, shared-session, or change-frozen hosts) need a documented compensating action for the delivery path, since the exploit arrives as ordinary web content rather than as an installed file.",
+        "evidence": "The packet records CISA KEV listing on 2025-11-19 with active_exploitation \"confirmed\", RWEP 77, CVSS 8.8, poc_available true, patch_available true and live_patch_available false. NIST SP 800-53 SI-2 (Flaw Remediation), ISO/IEC 27001:2022 A.8.8 and NIS2 Art. 21 patch management are the framework controls this entry already cites as insufficient.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management",
+          "NIST-800-53-SI-2"
+        ]
+      }
+    ]
   },
   "CVE-2025-58034": {
     "name": "Fortinet FortiWeb OS Command Injection Vulnerability",
@@ -16691,7 +18585,21 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "The exposure here is a provisioning-state defect, not an install-window one: the packet's vector text records that Triofox's initial setup pages stay reachable after setup is complete, so every already-provisioned server is affected for its whole service life and an unauthenticated caller reaches functionality reserved for authorized users. That places the KEV clock (listed 2025-11-12, exploitation confirmed) on production instances operators consider finished and therefore out of the active change queue — the SLA has to reach 'completed' deployments, not just ones under build. A vendor fix exists; the packet records no live-patch path and notes the vendor patch typically requires a service restart or system reboot, so restart authority must be pre-approved inside the window rather than negotiated after it. Because the flaw grants access rather than degrading the service, meeting this SLA means verifying the remediated state of each server — confirming the setup surface is no longer reachable unauthenticated — not recording a build number and closing the ticket.",
+        "evidence": "Packet fields for CVE-2025-12480 (Gladinet Triofox Improper Access Control Vulnerability): cwe_refs CWE-284; cisa_kev=true with kev_date 2025-11-12; active_exploitation=confirmed; poc_available=true; cvss 8.8; rwep_score 77; vector text states the product allows access to initial setup pages even after setup is complete; attack_vector states an unauthenticated attacker can reach functionality reserved for authorized users; patch_available=true; live_patch_available=false with live_patch_notes stating no live-patch tool is registered and that the vendor patch typically requires service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      }
+    ]
   },
   "CVE-2025-62215": {
     "name": "Microsoft Windows Race Condition Vulnerability",
@@ -16746,7 +18654,41 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "Windows hosts must reach the fixed kernel build on a KEV clock rather than the routine monthly workstation/server patch cycle, and for this CVE the SLA end-state has to be defined as the host running the patched kernel, not as the update being approved or staged. The packet records no live-patch path, so the clock only stops after the restart. Scope the SLA to the entire Windows estate rather than just internet-facing systems, because the flaw is reached from an existing local foothold, not from the network edge.",
+        "evidence": "CISA KEV-listed 2025-11-12 with active_exploitation recorded as confirmed, RWEP 77 against a CVSS of 7.8, and poc_available true. patch_available is true while live_patch_available is false; live_patch_notes states that no live-patch tool is registered for this entry and that the vendor patch typically requires service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-038",
+        "name": "MITIGATION-ACTIVE-PATCH-PENDING-VERDICT-CLASS",
+        "description": "For this kernel race condition the compliance verdict must separate 'update installed, restart pending' from 'vulnerability eliminated'. What is vulnerable is the kernel currently executing, so on any fleet that defers restarts — servers under change control, laptops that sleep instead of rebooting — deployment dashboards will report the host as remediated while the escalation to SYSTEM is still live. Audit evidence for this CVE must be the post-restart running build per host, and the installed-but-not-restarted population must be carried as its own time-bound exposure state with a named owner, not folded into the patched count.",
+        "evidence": "The packet records patch_available true and live_patch_available false, with live_patch_notes stating that no live-patch tool is registered and that the vendor patch typically requires service restart or system reboot per the KEV requiredAction — so a host can hold the fix and remain exploitable. Exploitation is confirmed in the wild per the 2025-11-12 KEV listing, and poc_available is true.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-003",
+        "name": "KERNEL-EXPLOITATION-DETECTION",
+        "description": "Because the fix only takes effect after a restart, the exposure window on this CWE-362 kernel race is measured in reboot cycles, and runtime detection is the only coverage inside it. Instrument Windows endpoints for kernel privilege-escalation indicators — a low-privilege process acquiring a SYSTEM token, token or process-handle duplication from an unprivileged parent, and SYSTEM-context children under a user-context parent — and treat a hit on a host that has not yet restarted onto the fixed build as an active-intrusion trigger rather than a routine alert, since this class arrives after an initial-access foothold is already established.",
+        "evidence": "The packet describes a Windows Kernel race condition (CWE-362) that lets a local attacker with low-level privileges escalate to SYSTEM-level access, records poc_available true, and states that LPEs of this class are routinely paired with an initial-access flaw by ransomware operators. Exploitation is confirmed in the wild per the 2025-11-12 KEV listing.",
+        "gap_closes": [
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2025-9242": {
     "name": "WatchGuard Firebox Out-of-Bounds Write Vulnerability",
@@ -16806,7 +18748,42 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-030",
+        "name": "PERIMETER-DEVICE-ZERODAY-SLA-TIER",
+        "description": "A WatchGuard Firebox is itself the network trust boundary, and the vulnerable code is the iked process that terminates IKE/VPN negotiation — reachable before authentication by anyone who can send IKE traffic to the gateway. Firebox firmware therefore cannot share a patch tier with server or workstation operating systems: the requirement is vendor firmware deployed within hours of the KEV listing, or the IKE/VPN listener restricted to known peer addresses until the firmware window can be taken. The packet records no live-patch path for this entry, so the update carries a device restart that drops the organization's VPN — which is exactly why routine change control pushes it into a maintenance window weeks out, and exactly why this tier has to name that outage as in-scope rather than as grounds to defer a pre-authentication code-execution flaw on the perimeter.",
+        "evidence": "Packet: out-of-bounds write (CWE-787) in the Firebox OS iked process that may allow a remote unauthenticated attacker to execute arbitrary code; characterized as memory-corruption remote code execution on the firewall via the Firebox IKE/VPN handling. CVSS 9.8, RWEP 77, poc_available true. CISA KEV-listed 2025-11-12 with active_exploitation confirmed. patch_available true; live_patch_available false, with live_patch_notes stating the vendor patch typically requires service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-network-security"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "Fireboxes that were reachable while this CVE was under active exploitation must be treated as compromised until proven otherwise, not simply firmware-updated. Unauthenticated code execution in iked runs inside the appliance that holds its own configuration, its VPN key material and certificates, and its administrative credentials — and a firmware update that preserves the running configuration also preserves anything an attacker added to it (accounts, tunnels, policy entries, management access). The default response is to export and review the configuration off the device, rebuild the appliance from a known-good configuration rather than updating in place, and rotate every credential the gateway held — VPN pre-shared keys, local user and administrator passwords, any directory or RADIUS service account bound to the gateway, and certificates — before the tunnels are returned to service.",
+        "evidence": "Packet: the flaw is an out-of-bounds write in the Firebox OS iked process allowing a remote unauthenticated attacker to execute arbitrary code on the firewall (CWE-787, CVSS 9.8, RWEP 77), with poc_available true, CISA KEV-listed 2025-11-12 and active_exploitation confirmed. Confirmed in-the-wild pre-authentication code execution on the device that enforces the perimeter is what makes update-in-place insufficient; the citing gaps stop at flaw remediation (NIST SP 800-53 SI-2) and management of technical vulnerabilities (ISO/IEC 27001:2022 A.8.8), neither of which requires post-exploitation rebuild or credential rotation.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "UK-CAF-B4",
+          "NIS2-Art21-network-security"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-031",
+        "name": "FIREWALL-EGRESS-TELEMETRY-SEPARATE-TRUST-ZONE",
+        "description": "Because this exploit executes attacker code inside the Firebox itself, the device's local log store and its logging configuration are within the attacker's control from the moment of compromise; the only records that can establish whether a given appliance was hit before its firmware was updated are records already off the box. Fireboxes must forward IKE/VPN negotiation and tunnel-establishment logs, management-plane authentication, and configuration-change events to a collector in a separate trust zone — different management plane, different credentials, different authentication path — with retention long enough to look backward past the KEV listing date. Without that, an operator asked after the fact whether the gateway was exploited can only answer using evidence produced by the device that was executing the attacker's code.",
+        "evidence": "Packet: out-of-bounds write in the Firebox OS iked process allowing a remote unauthenticated attacker to execute arbitrary code on the appliance (CWE-787, CVSS 9.8), poc_available true, CISA KEV-listed 2025-11-12 with active_exploitation confirmed. Attacker code execution on the appliance is the packet fact that places the device's own telemetry inside the blast radius.",
+        "gap_closes": [
+          "UK-CAF-B4",
+          "NIS2-Art21-network-security"
+        ]
+      }
+    ]
   },
   "CVE-2025-21042": {
     "name": "Samsung Mobile Devices Out-of-Bounds Write Vulnerability",
@@ -17096,7 +19073,21 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "XWiki's exposure here has no authentication gate to slow it down — the packet records that any guest can reach the eval-injection sink through a SolrSearch request and obtain arbitrary remote code execution — so every hour between KEV listing and deployment of the fixed build is an hour any reachable instance is exploitable by an unauthenticated caller against whom a PoC already exists. The packet records no live-patch path and a fix that typically requires a service restart or system reboot, so meeting the clock means scheduling that restart on the wiki, not deferring it to the next routine window. The SLA must name the XWiki application as its own tracked asset: self-hosted collaboration platforms are commonly patched on a separate cadence from the operating system of the host they run on, and an OS-patching attestation says nothing about the wiki's build.",
+        "evidence": "Packet: XWiki Platform, CWE-95 eval injection; vector 'XWiki Platform contains an eval injection vulnerability that could allow any guest to perform arbitrary remote code execution through a request to SolrSearch'; CISA KEV-listed 2025-10-30 with active_exploitation 'confirmed'; RWEP 77 / CVSS 9.8; poc_available true; patch_available true; live_patch_available false, with live_patch_notes 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.'",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management",
+          "NIST-800-53-SI-2"
+        ]
+      }
+    ]
   },
   "CVE-2025-6204": {
     "name": "Dassault Systèmes DELMIA Apriso Code Injection Vulnerability",
@@ -17626,7 +19617,20 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "The Windows SMB-client fleet is on the KEV clock that started 2025-10-20, and the packet's live-patch fields are the operational catch for this CVE. live_patch_available is false and the note records that the vendor patch typically requires a service restart or system reboot, so the fix is not in force until the host actually restarts. A patch console reporting the update 'deployed' across the estate is not evidence of remediation here: an unrebooted workstation or server is still running the vulnerable SMB client, and the coercion path in the packet — a crafted script making the victim machine connect back to the attacker's system over SMB and authenticate, with that authentication reflected back to reach SYSTEM — needs no credentials on the target and no attacker presence on the host beforehand. KEV-SLA compliance for this entry must therefore be measured on rebooted-and-verified hosts, with deferred-reboot machines counted as still exposed rather than as patched, and any host that cannot take the reboot inside the window treated as an open item with a named date.",
+        "evidence": "Packet fields for CVE-2025-33073: cisa_kev=true with kev_date 2025-10-20 and active_exploitation='confirmed'; vector states the Windows SMB Client improper access control flaw 'could allow for privilege escalation. An attacker could execute a specially crafted malicious script to coerce the victim machine to connect back to the attack system using SMB and authenticate'; attack_vector describes NTLM reflection back to the victim to gain SYSTEM and notes 'escalation flaws of this class form the second half of an intrusion chain'; poc_available=true; rwep_score=77, cvss=9.8; patch_available=true, live_patch_available=false; live_patch_notes: 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.'",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      }
+    ]
   },
   "CVE-2025-61884": {
     "name": "Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability",
@@ -17856,7 +19860,40 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-009",
+        "name": "KERNEL-MODULE-INVENTORY-AND-DISABLE",
+        "description": "The vulnerable component here is a modem driver that ships with Windows itself, so it is present and loadable on hosts whose owners never installed it and have no modem hardware. Operators need a per-host inventory of kernel-mode drivers that enumerates OS-supplied drivers, not only vendor-installed ones, with a business justification recorded per driver and a standing action to keep the Agere modem driver unloadable on machines with no modem function. Nothing in the citing frameworks obliges anyone to enumerate a privileged driver they never chose to deploy, which is exactly why this attack surface survived on fleets that pass driver-hygiene and asset-inventory audits.",
+        "evidence": "The packet identifies the affected component as the Microsoft Windows Agere Modem Driver, with an untrusted pointer dereference (CWE-822) that allows privilege escalation such that a successful attacker could gain administrator privileges, exploited from a local foothold. CISA KEV-listed 2025-10-14 with active_exploitation confirmed and poc_available true.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-123",
+        "name": "VULNERABLE-DRIVER-BLOCKLIST-ENFORCEMENT",
+        "description": "This is a signed kernel-mode driver whose untrusted-pointer-dereference primitive hands an unprivileged local process administrator-level kernel execution, so the enforcement question is whether the driver can be loaded at all rather than only whether the host took the latest update. Enable HVCI together with the vendor recommended-driver blocklist so the vulnerable Agere modem driver cannot load, and verify the enforcement on hosts rebuilt from older images or restored from backup — that is where a vulnerable driver binary reappears on a fleet that has otherwise been updated.",
+        "evidence": "The packet records an untrusted pointer dereference (CWE-822) in the Microsoft Windows Agere Modem Driver yielding privilege escalation to administrator privileges from a local foothold, with poc_available true, RWEP 77 against a CVSS of 7.8, and confirmed in-the-wild exploitation per the 2025-10-14 KEV listing.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "Put the driver fix on a KEV clock and scope the affected population to every Windows install that carries the in-box Agere modem driver, not to the small set of machines with modem hardware attached — the driver's presence, not its use, is what makes the host exploitable. As with other kernel-mode fixes in this packet the SLA can only be closed out on the restarted host, since no live-patch path is recorded, so exception tracking has to name the hosts still awaiting a restart.",
+        "evidence": "CISA KEV-listed 2025-10-14 with active_exploitation confirmed, RWEP 77 against a CVSS of 7.8, and poc_available true. patch_available is true while live_patch_available is false; live_patch_notes states no live-patch tool is registered for this entry and that the vendor patch typically requires service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "NIS2-Art21-patch-management",
+          "NIST-800-53-SI-2"
+        ]
+      }
+    ]
   },
   "CVE-2025-59230": {
     "name": "Microsoft Windows Improper Access Control Vulnerability",
@@ -18891,7 +20928,38 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-030",
+        "name": "PERIMETER-DEVICE-ZERODAY-SLA-TIER",
+        "description": "An inbound email security gateway occupies the same trust boundary as a firewall or WAF: every message from the internet is parsed by it before any mailbox sees it, so a command-injection defect in its compressed-attachment handling is reachable by anyone who can send mail to the organization — no account, no foothold, no user click needed. Libraesva ESG therefore needs a distinct SLA tier keyed to the KEV listing (vendor mitigation deployed within hours of 2025-09-29, or inbound message flow diverted away from the vulnerable appliance), not the routine appliance-maintenance window that 'patch operating systems' and flaw-remediation controls assume for infrastructure gear. Because the packet records no live-patch path for this entry, that tier must budget for the service restart or reboot the vendor update requires — the change window is part of the SLA, not an excuse to miss it.",
+        "evidence": "Packet: Libraesva Email Security Gateway (ESG) command injection, CWE-77, 'command injection via a compressed e-mail attachment'; attack_vector records remote command execution on the mail-security appliance triggered via a crafted email/attachment. CVSS 9.8, RWEP 77, poc_available true. CISA KEV-listed 2025-09-29 with active_exploitation 'confirmed'. patch_available true, live_patch_available false, live_patch_notes: 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.'",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-055",
+        "name": "SECURITY-TOOL-INTEGRITY-VERIFICATION",
+        "description": "The vulnerable product is itself a security control, and the exploited path is the very function it was bought for: inspecting compressed attachments on inbound mail. Vulnerability-management scope has to name the ESG appliance's own firmware as a managed, privileged software surface on the same SLA as the mail infrastructure behind it, rather than counting the gateway only as a mitigating control in the risk register. The audit evidence must be a trust-anchor-inversion test — detonate a crafted compressed attachment against a staging ESG and confirm the archive is inspected with no command executed — because an attestation that 'an email security gateway is deployed and filtering' is exactly the paper finding this CVE defeats: the filter was the execution sink.",
+        "evidence": "Packet: CWE-77 command injection in Libraesva Email Security Gateway (ESG), reached 'via a compressed e-mail attachment' — i.e. through the appliance's own attachment-inspection path. CVSS 9.8, RWEP 77, poc_available true, active_exploitation 'confirmed', CISA KEV-listed 2025-09-29. Framework gaps already citing this CVE include ISO/IEC 27001:2022 A.8.8 (management of technical vulnerabilities) and UK CAF B4 (system security).",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "Successful exploitation runs attacker-chosen commands on the ESG appliance, and that appliance holds every message it has processed plus its mail-routing configuration and stored credentials. With confirmed in-the-wild exploitation and a 2025-09-29 KEV listing, any instance that was accepting internet mail while unpatched has to be handled as potentially executed-against: capture and preserve the configuration, rebuild the appliance from vendor media, and rotate the credentials it held — instead of installing the update and closing the ticket. This is why NIS2's incident-handling obligation is cited against this entry rather than only its patching obligation: on a device where an attacker could already run commands, 'patched' and 'not compromised' are two different findings, and the vendor update (which per the packet needs a service restart or reboot and has no live-patch alternative) only settles the first.",
+        "evidence": "Packet: command-injection flaw (CWE-77) enabling remote command execution on the mail-security appliance; CISA KEV-listed 2025-09-29 with active_exploitation 'confirmed'; poc_available true; CVSS 9.8, RWEP 77. patch_available true but live_patch_available false, live_patch_notes state no live-patch tool is registered and the vendor patch typically requires a service restart or system reboot. NIS2-Art21-incident-handling is among the framework gaps already citing this CVE.",
+        "gap_closes": [
+          "NIS2-Art21-incident-handling"
+        ]
+      }
+    ]
   },
   "CVE-2025-10035": {
     "name": "Fortra GoAnywhere MFT Deserialization of Untrusted Data Vulnerability",
@@ -19011,7 +21079,30 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-030",
+        "name": "PERIMETER-DEVICE-ZERODAY-SLA-TIER",
+        "description": "The exposed surface here is the SNMP subsystem of IOS and IOS XE, and the packet's fix path requires a device restart or reload — on routing and switching gear that means a change window measured in weeks under the routine cadence, while a low-privileged attacker can already force the reload as a denial of service and a high-privileged one can execute code as root. This control requires the alternative to be exercised on the KEV clock instead of waiting: restrict the SNMP listener to a management ACL and trusted collectors, or take SNMP out of service on exposed devices, within hours of listing, because that is the only action that closes the reachable path before the reload window arrives. The citing gaps frame this as operating-system patching; the device is the network's trust boundary and its management protocol is the exposed interface, so it needs its own SLA tier with interface isolation as a first-class satisfying action.",
+        "evidence": "Packet: cisa_kev true, kev_date 2025-09-29, active_exploitation \"confirmed\", RWEP 77, CVSS 9.8, poc_available true, CWE-121. Vector: \"Cisco IOS and IOS XE contains a stack-based buffer overflow vulnerability in the Simple Network Management Protocol (SNMP) subsystem that could allow for denial of service or remote code execution. A successful exploit could allow a low-privileged attacker to cause the affected system to reload, resulting in a DoS condition, or allow a high-privileged attacker to execute arbitrary code as the root user and obtain full control of the affected system.\" patch_available true; live_patch_available false; live_patch_notes: \"No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.\"",
+        "gap_closes": [
+          "NIS2-Art21-network-security",
+          "UK-CAF-B4",
+          "AU-Essential-8-Patch"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "The packet's high-privilege path ends in arbitrary code as the root user with full control of the device, and exploitation is confirmed in the wild — so for any IOS or IOS XE device whose SNMP surface was reachable during the exposure window, loading the fixed image remediates the flaw but not the device. The runbook must default to exporting and diffing the running and startup configuration against a known-good baseline, rebuilding from a verified image, and rotating every credential the device held (its SNMP credentials, local and privileged-mode secrets, and any AAA or routing-protocol keys stored on it) before returning it to service. Reloading into the patched image and closing the ticket preserves whatever a root-level attacker changed on the box, which is precisely what the SI-2 and A.8.8 flaw-remediation gaps score as remediated.",
+        "evidence": "Packet: cisa_kev true, kev_date 2025-09-29, active_exploitation \"confirmed\", RWEP 77, CVSS 9.8, poc_available true. Vector states a high-privileged attacker can \"execute arbitrary code as the root user and obtain full control of the affected system,\" and a low-privileged attacker can cause the system to reload for a DoS condition; the attack_vector summary records the flaw as exploitable for denial of service and remote code execution. patch_available true; live_patch_available false; live_patch_notes: \"No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.\"",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "ISO-27001-2022-A.8.8"
+        ]
+      }
+    ]
   },
   "CVE-2021-21311": {
     "name": "Adminer Server-Side Request Forgery Vulnerability",
@@ -19426,7 +21517,32 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "The TL-WR841N flaw ends in disclosure of the credentials the router itself stores, which makes firmware an incomplete remediation by construction: an attacker who spoofed authentication against the httpd service on TCP 80 keeps every secret already read off the device, and those secrets stay valid after the update lands. For any unit that was reachable during the exploitation window the response has to assume the router's configuration was exfiltrated — reset the device to a known-good configuration rather than updating in place, and rotate every credential stored on it or reachable through it before it is returned to the network. This is the router-perimeter case the control exists for: a vulnerability-management program that closes the finding on 'firmware updated' leaves the attacker holding working credentials to the network the router fronts.",
+        "evidence": "Packet: vector states the flaw is 'within the httpd service, which listens on TCP port 80 by default, leading to the disclose of stored credentials' (CWE-290, authentication bypass by spoofing). active_exploitation 'confirmed', poc_available true, CISA KEV-listed 2025-09-03, CVSS 9.1, RWEP 77. patch_available true, live_patch_available false; live_patch_notes: 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.' Nothing in the packet indicates the update invalidates credentials already disclosed.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "ISO-27001-2022-A.8.8",
+          "UK-CAF-B2",
+          "NIS2-Art21-network-security"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "TL-WR841N units are consumer-grade routers that typically sit outside a managed patch pipeline, so a KEV listing produces no action at all unless the SLA explicitly enumerates them as in-scope assets. Bind the 2025-09-03 listing to a 4-hour clock covering every deployed unit, and use the control's own allowance for documented compensating controls as the closure path where a supported firmware release does not exist for the specific hardware revision: removing the port-80 httpd management surface from any untrusted segment satisfies the SLA where an update cannot. This matters because the packet's KEV text also records that the affected products could be end-of-life or end-of-service with a discontinue-use instruction — an SLA that can only be discharged by patching will not close at all across part of this fleet.",
+        "evidence": "Packet: CISA KEV-listed 2025-09-03, active_exploitation 'confirmed', poc_available true, CVSS 9.1, RWEP 77, patch_available true, live_patch_available false. Vector text: 'The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.' The httpd service 'listens on TCP port 80 by default'. The control's own definition admits patch, live patch, or documented compensating controls as valid mitigation.",
+        "gap_closes": [
+          "AU-ISM-1546",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      }
+    ]
   },
   "CVE-2025-9377": {
     "name": "TP-Link Archer C7(EU) and TL-WR841N/ND(MS) OS Command Injection Vulnerability",
@@ -19601,7 +21717,39 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-121",
+        "name": "MOBILE-ZERO-CLICK-HARDENING",
+        "description": "WhatsApp's linked-device synchronization path causes the target handset to fetch and process content from an attacker-named URL with no action by the target, so no awareness, phishing-report or attachment-scanning control has anything to act on. For high-risk users (journalists, executives, legal, activist-adjacent contacts) the pre-patch control is to stop the handset from automatically retrieving and rendering message-delivered content: enable the platform's reduced-attack-surface mode (Lockdown Mode on Apple devices and the equivalent hardening on Android), turn off automatic media download and link previews in the messaging client, and — because this flaw rides the linked-device sync channel specifically — audit each account's linked-device list on a schedule and unlink any session the user does not recognise. This closes the delivery step rather than the memory-corruption step: the chained Apple ImageIO flaw only gets its input once the attacker-named content has been fetched.",
+        "evidence": "Packet: CWE-863 incorrect authorization arising from incomplete authorization of linked-device synchronization messages, which 'could allow an unrelated user to trigger processing of content from an arbitrary URL on a target's device'; characterised as the zero-click delivery half of a mobile-spyware chain, paired in the wild with CVE-2025-43300. cisa_kev true, kev_date 2025-09-02, active_exploitation 'confirmed', poc_available true, cvss 8.8, rwep_score 77.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-056",
+        "name": "MOBILE-ENDPOINT-MDM-ENFORCED-KEV-SLA",
+        "description": "WhatsApp is a consumer-store application updated on the user's own schedule, which is precisely the class of software that falls outside an OS-centric patch programme — the fixed client reaches most handsets only when the user next opens the app store. A managed fleet must treat the fixed WhatsApp build as an MDM/UEM-pushed, deferral-disallowed update on the KEV clock: forced app update and managed-app configuration on corporate-owned devices, and a conditional-access block that denies organisational data to BYOD handsets still reporting a vulnerable build. The paired Apple flaw must be pushed on the same clock, since the two halves of this chain ship from different vendors through different update channels and a fleet that closes only one of them is still chainable.",
+        "evidence": "Packet: patch_available true; live_patch_available false, with live_patch_notes 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction' — so deploying the vendor-fixed build is the only remediation this entry records. cisa_kev true, kev_date 2025-09-02, active_exploitation 'confirmed'. The chained flaw named in the packet, CVE-2025-43300, is an Apple issue, i.e. a separate vendor's update channel from the messaging client.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-043",
+        "name": "NATION-STATE-INITIAL-ACCESS-IR-ESCALATION",
+        "description": "A zero-click compromise of this kind produces no user-reportable artefact — nothing was clicked, nothing was opened — so it enters incident response only through a vendor threat notification or an anomalous linked-device entry, and commodity handling ('reinstall the app, reset the phone') destroys the evidence while leaving the second-stage implant unexamined. The runbook needs an explicit targeted-intrusion path triggered by that signal rather than by an actor name: preserve and image the handset before any update, wipe or re-enrolment; contact the target out-of-band on a different device; treat every account, token and credential reachable from that handset as exposed across the responder-established exposure window; and proceed on the assumption that the chained content-processing stage succeeded, rather than requiring proof of it before escalating.",
+        "evidence": "Packet: active_exploitation 'confirmed' with CISA KEV listing 2025-09-02 and poc_available true; the entry is described as the zero-click delivery half of a mobile-spyware chain paired in the wild with CVE-2025-43300, and exploitation requires no interaction from the target (an unrelated user triggers the processing). NIS2-Art21-incident-handling is among the framework gaps that already cite this CVE as evidence.",
+        "gap_closes": [
+          "NIS2-Art21-incident-handling"
+        ]
+      }
+    ]
   },
   "CVE-2025-57819": {
     "name": "Sangoma FreePBX Authentication Bypass Vulnerability",
@@ -19661,7 +21809,40 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "A FreePBX instance reached through this flaw is not partially compromised — the packet's path goes from unauthenticated request straight to FreePBX Administrator, arbitrary database manipulation and remote code execution, so there is no intermediate privilege state where a slower patch window is survivable. The KEV listing, not the telephony team's change calendar, has to start the clock, and PBX estates that are normally patched on a call-quality-driven schedule need the update pulled forward to hours. Because the packet records no live-patch tool for this entry and notes the vendor patch typically requires service restart or system reboot, the SLA must budget the call-affecting restart inside the same window instead of parking the fix until the next low-traffic maintenance slot.",
+        "evidence": "Packet: CISA KEV-listed 2025-08-29 with active_exploitation 'confirmed', poc_available true, CVSS 9.8, RWEP 77, CWE-89 and CWE-288. Vector: 'authentication bypass vulnerability due to insufficiently sanitized user-supplied data allows unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution.' patch_available true, live_patch_available false, live_patch_notes states the vendor patch typically requires service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-085",
+        "name": "DB-ABSTRACTION-LAYER-PARAMETERIZATION-VERIFICATION",
+        "description": "The injection sink in this CVE sits on a request path that is reached before any administrator login, so the two boundaries operators normally point at during an audit — the FreePBX admin authentication gate and a WAF in front of the PBX — are both downstream of the defect and neither can be treated as the control. Verification has to happen where the SQL is composed: the PBX application's data-access layer and every installed module that builds a query, with evidence that request-supplied values are bound as parameters rather than concatenated, on the pre-authentication handlers specifically. Attesting 'input is validated' or 'a WAF is deployed' is precisely the attestation this CVE defeats, because the unsanitized value is accepted by the application itself before authentication is evaluated.",
+        "evidence": "Packet: CWE-89 (SQL injection) is carried alongside CWE-288 (authentication bypass), and the vector attributes both to 'insufficiently sanitized user-supplied data' reaching FreePBX Administrator without authentication, yielding 'arbitrary database manipulation and remote code execution'. CISA KEV-listed 2025-08-29, active_exploitation 'confirmed', poc_available true, CVSS 9.8, RWEP 77.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "Applying the vendor update fixes the code path but leaves everything the attacker wrote behind it. This flaw grants arbitrary database manipulation, so a patched-in-place FreePBX can still carry attacker-created administrator accounts, extensions, trunks and dialplan entries, plus whatever the remote code execution dropped on disk — all of which survive the update and the restart it requires. For any instance whose administrator interface was reachable from an untrusted network during the exposure window, the default response has to be capture the configuration and database for forensic review, rebuild the PBX from known-good media at the fixed release, and rotate every secret the box held (administrator logins, SIP/extension and trunk credentials, database credentials) — not patch and resume calls.",
+        "evidence": "Packet vector: unauthenticated access to FreePBX Administrator 'leading to arbitrary database manipulation and remote code execution' (CWE-89, CWE-288) — the compromise writes persistent state, which patching does not remove. CISA KEV-listed 2025-08-29 with active_exploitation 'confirmed' and poc_available true means exposed instances must be assumed reached, not merely reachable; CVSS 9.8, RWEP 77. live_patch_available is false and live_patch_notes records that the vendor patch typically requires service restart or system reboot.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "NIST-800-53-SI-2",
+          "UK-CAF-B2"
+        ]
+      }
+    ]
   },
   "CVE-2025-7775": {
     "name": "Citrix NetScaler Memory Overflow Vulnerability",
@@ -19721,7 +21902,33 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-030",
+        "name": "PERIMETER-DEVICE-ZERODAY-SLA-TIER",
+        "description": "NetScaler ADC and NetScaler Gateway are not servers behind the perimeter — they are the perimeter, terminating remote access and fronting the applications behind them. CVE-2025-7775 is a memory-overflow flaw reachable pre-authentication for remote code execution and/or denial of service, so the exposure condition is simply 'internet-reachable and unpatched'; no user action, credential, or foothold is required to start the clock. A patch SLA that measures this appliance on the same cadence as the general server estate is measuring the wrong thing, because a compromise here is not one host — it is the authentication and traffic boundary for everything behind it. Requirement: NetScaler ADC/Gateway carries its own SLA tier — vendor fix deployed within hours of the KEV listing, or the appliance's internet-facing interface withdrawn from exposure until it is. Because no live-patch path is registered for this entry, taking the fix means a service restart or reboot of the appliance per the KEV required action, so the maintenance window has to be pre-authorized as a standing condition of operating the device rather than negotiated with change management after a KEV listing lands.",
+        "evidence": "Packet: CWE-119 memory overflow in Citrix NetScaler ADC and NetScaler Gateway, described as exploitable by an unauthenticated attacker for remote code execution (vector also notes denial of service). CISA KEV-listed 2025-08-26 with active_exploitation 'confirmed' and poc_available true; CVSS 9.8, RWEP 77. patch_available true, live_patch_available false, live_patch_notes: 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.' Every citing gap that concerns remediation timing (AU-Essential-8-Patch, ISO-27001-2022-A.8.8, NIS2-Art21-patch-management, NIST-800-53-SI-2, UK-CAF-B4) is a generic estate-wide vulnerability-management control; none of them separates the device that enforces the trust boundary from the assets it protects.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management",
+          "NIST-800-53-SI-2",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "Because exploitation of CVE-2025-7775 is confirmed in the wild and the flaw needs no authentication, any NetScaler that was internet-reachable while unpatched has to be treated as possibly already executed against — the absence of an alert is not evidence, since code execution on the appliance runs with the appliance's own privilege over its own local state and logs. Applying the vendor update to such a box restores the vulnerable binary but says nothing about what was installed, added to the configuration, or read out of it beforehand, so 'patched' is not a defensible closure statement for this CVE. Requirement: the IR runbook for a NetScaler exposed during the pre-patch window must default to exporting and reviewing the running configuration, rebuilding the appliance from vendor media rather than patching in place, and rotating every credential and certificate the appliance held or could authenticate with — with that path rehearsed in advance, because the decision cannot be made well under the time pressure a KEV-listed pre-auth RCE creates.",
+        "evidence": "Packet: unauthenticated remote code execution on Citrix NetScaler ADC/Gateway (CWE-119), CISA KEV-listed 2025-08-26 with active_exploitation 'confirmed' and poc_available true, RWEP 77 / CVSS 9.8. patch_available true but live_patch_available false, with live_patch_notes stating the vendor patch typically requires service restart or system reboot per the KEV requiredAction — i.e. the only available remediation is a disruptive update applied after the exposure window, not a hot fix that precedes it. The citing gaps (AU-Essential-8-Patch, ISO-27001-2022-A.8.8, NIS2-Art21-patch-management, NIST-800-53-SI-2, UK-CAF-B4) all treat deployment of the fix as the terminal state and carry no post-exploitation integrity step.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management",
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2025-48384": {
     "name": "Git Link Following Vulnerability",
@@ -19776,7 +21983,31 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "Git is KEV-listed with confirmed exploitation, but it is not the kind of asset the citing patch controls enumerate: it exists on developer workstations, inside CI runner images, in container base layers, and bundled inside IDEs and build tooling, so an estate can be fully compliant with 'patch operating systems' and still run the vulnerable Git everywhere code is fetched. The KEV clock must therefore be applied to the Git binary as its own tracked component with an explicit inventory of every place it is embedded. There is no live-patch path for this entry, so the only remediation is shipping the vendor-fixed Git itself — which for image-resident copies means rebuilding and redeploying the image, not waiting on a host maintenance window; the packet notes the vendor patch follows the KEV requiredAction (service restart or system reboot).",
+        "evidence": "CISA KEV-listed 2025-08-25 with active_exploitation confirmed; RWEP 77, CVSS 8.8, poc_available true. patch_available true, live_patch_available false; live_patch_notes: 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.' Cited as evidence against AU-Essential-8-Patch ('Patch operating systems'), ISO-27001-2022-A.8.8, NIST-800-53-SI-2 and NIS2-Art21-vulnerability-management.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-116",
+        "name": "MULTI-TRIGGER-DEPENDENCY-EXECUTION-POLICY",
+        "description": "This Git flaw adds a trigger that no dependency-execution policy enumerates: source-acquisition time. Git's inconsistent handling of carriage return characters in configuration files lets a malicious repository write a file outside the working tree — a hook — during clone/checkout, which then executes when the victim next works with the repository. No package installs, no module imports, no build script runs, so ignore-scripts defaults, lockfile pinning and build-step sandboxes all miss it entirely; the code runs with whatever privilege the cloning identity holds, which on a CI runner or a developer workstation is the identity holding source, build and publishing credentials. Policy must therefore list clone/checkout alongside install-time, import-time and compile-time as an execution trigger: fetch untrusted repositories only under a least-privilege, egress-restricted identity, and never onto a context that holds credentials the fetch itself does not need.",
+        "evidence": "CWE-59 (link following) and CWE-436 (interpretation conflict). Packet vector: 'Git contains a link following vulnerability that stems from Git's inconsistent handling of carriage return characters in configuration files.' Packet attack_vector: a malicious repository can 'write files outside the working tree on clone/checkout (e.g. a hook), leading to code execution when the victim works with the repository.' poc_available true; active_exploitation confirmed. Cited as evidence against NIST-800-53-AC-6 (Least Privilege) and UK-CAF-B4 (System security).",
+        "gap_closes": [
+          "NIST-800-53-AC-6",
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2024-8068": {
     "name": "Citrix Session Recording Improper Privilege Management Vulnerability",
@@ -20476,7 +22707,31 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-036",
+        "name": "FLEET-CONTROL-PLANE-ADMIN-PRIVILEGE-TIER",
+        "description": "This PaperCut flaw never touches the server directly — it rides the browser of a signed-in PaperCut administrator, forcing a state-changing request that alters a security setting and opens the code-execution path. The countermeasure is therefore not on the server but on the administrator's browsing context: PaperCut NG/MF console access only from a dedicated privileged-access workstation or PAM jumphost, a separate admin identity that is never used for general web browsing or mail, just-in-time elevation so no long-lived authenticated admin session is sitting in a tab waiting to be targeted, and FIDO2 step-up on the console itself. PaperCut administers a fleet of print endpoints and pushes client software to them, which is what makes its console a control plane rather than an ordinary application; frameworks that collapse it into generic 'application admin' preserve precisely the always-signed-in admin browser this attack requires.",
+        "evidence": "Packet: attack_vector states 'an attacker who lures an authenticated administrator to a malicious page can force a state-changing request (e.g. enabling a setting that leads to code execution), part of the PaperCut exploitation chain' (CWE-352, cross-site request forgery). Vector: the flaw 'under specific conditions, could potentially enable an attacker to alter security settings or execute arbitrary code.' CISA KEV-listed 2025-07-28, active_exploitation 'confirmed', poc_available true, CVSS 8.8, RWEP 77.",
+        "gap_closes": [
+          "NIST-800-53-AC-6"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "The usual deferral argument for a print server — internal only, not internet-facing, patch next cycle — does not survive this bug class. Exploitation needs only an administrator to open a page, so an internal PaperCut NG/MF server is exactly as reachable through that administrator's browser as an externally exposed one, and network placement buys no time. Bind the 2025-07-28 KEV listing to a 4-hour clock to deploy the vendor update. No live-patch path is registered for this entry and the fix requires a service restart, so the print-service interruption is part of the SLA to be scheduled, not a reason to slip past it; until the update is deployed, the only real compensating control is denying the admin console session any general-web browsing context.",
+        "evidence": "Packet: CISA KEV-listed 2025-07-28, active_exploitation 'confirmed', poc_available true, CVSS 8.8, RWEP 77. patch_available true; live_patch_available false; live_patch_notes: 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.' attack_vector: the CSRF is triggered by luring an authenticated administrator to a malicious page, so reachability does not depend on the server being internet-facing.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management",
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2025-20337": {
     "name": "Cisco Identity Services Engine Injection Vulnerability",
@@ -20536,7 +22791,40 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "Cisco ISE and ISE-PIC nodes must be driven to the fixed release on a KEV-tied clock measured in hours, not on the estate's routine appliance-maintenance cadence. The flaw is reached pre-authentication through a crafted API request and yields root on the box that arbitrates network admission, so the exposure is not confined to the appliance: while it stands, an anonymous caller owns the RADIUS/TACACS+ policy decision point. Because no live-patch primitive is registered for this entry, the fix is a vendor patch that takes a service restart or reboot, which means the restart window has to be pre-authorized against the KEV clock rather than negotiated after the listing. Any ISE node that cannot be patched inside the SLA must have its API surface restricted to management networks as an interim measure and be recorded as unremediated, not as 'scheduled'.",
+        "evidence": "Packet: CISA KEV-listed 2025-07-28 with active_exploitation=confirmed; CVSS 9.8, RWEP 77, poc_available=true. The vector records an injection flaw in a specific API of Cisco ISE and Cisco ISE-PIC caused by insufficient validation of user-supplied input, exploitable by submitting a crafted API request, with successful exploitation allowing remote code execution and root privileges on an affected device (CWE-74); the attack_vector records the code execution as unauthenticated. patch_available=true, live_patch_available=false, and live_patch_notes state the vendor patch typically requires service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "An ISE node that was reachable while unpatched must be treated as compromised rather than merely vulnerable. Because the defect runs attacker code as root before authentication, the default response is configuration export, rebuild from vendor media, and rotation of every secret the node holds — RADIUS and TACACS+ shared secrets, the directory join credential, administrator and API accounts, and certificate material — instead of applying the update to the running appliance. Patch-in-place closes the API defect while leaving any root-level implant, attacker-added admin account, or exported policy database untouched, and the restart the patch itself requires is easily mistaken for evidence that the node came back clean.",
+        "evidence": "Packet: active_exploitation=confirmed with a CISA KEV listing dated 2025-07-28 and poc_available=true, so exposure of an unpatched node is an exploitation opportunity rather than a theoretical one (RWEP 77, CVSS 9.8). The vector states successful exploitation allows an attacker to perform remote code execution and obtain root privileges on an affected device via a crafted API request; the attack_vector records that execution as unauthenticated. patch_available=true and live_patch_available=false — the packet's only remediation is a vendor patch requiring a service restart or system reboot, so the outage a rebuild needs is already budgeted by the remediation itself.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-patch-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-037",
+        "name": "FLEET-COMPROMISE-IR-PLAYBOOK",
+        "description": "Root on ISE is root on the identity decision point for every endpoint the network admits, so the playbook has to extend past the appliance itself: invalidate device trust state and posture verdicts issued during the exposure window, revoke and re-issue certificates the deployment enrolled or vouched for, audit policy-set and authorization-profile changes made since the KEV listing date, define quarantine criteria for endpoints admitted under a policy that may have been rewritten, and rotate credentials for every administrator and service account that authenticated through the affected deployment. Without that downstream sweep the operator patches the node and leaves the attacker's admission decisions and enrolled endpoints in force.",
+        "evidence": "Packet: the vector records an injection flaw reached through a crafted API request to a specific API of Cisco Identity Services Engine and ISE-PIC, allowing remote code execution and root privileges on an affected device; the attack_vector records it as unauthenticated code execution on Cisco ISE. active_exploitation=confirmed, CISA KEV-listed 2025-07-28, poc_available=true, RWEP 77, CVSS 9.8 — the interval from that listing date to patch deployment is the window whose identity decisions need review.",
+        "gap_closes": [
+          "UK-CAF-B2"
+        ]
+      }
+    ]
   },
   "CVE-2025-20281": {
     "name": "Cisco Identity Services Engine Injection Vulnerability (variant: CVE-2025-20281)",
@@ -20596,7 +22884,39 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-030",
+        "name": "PERIMETER-DEVICE-ZERODAY-SLA-TIER",
+        "description": "Cisco ISE and ISE-PIC decide which endpoints and users are admitted to the network, so an unauthenticated crafted-API-request path to root execution on that device is a trust-boundary compromise, not an application-server bug on a 30-day cycle. This CVE needs its own SLA tier: the fixed release deployed within hours of the KEV listing, or the affected API surface isolated so it is reachable only from the management network until the upgrade lands. Standard appliance-patch windows are the wrong instrument here because the appliance is the enforcement point the rest of the network's access control depends on.",
+        "evidence": "The packet describes an injection flaw (CWE-74) in a specific API of Cisco ISE and Cisco ISE-PIC caused by insufficient validation of user-supplied input, exploitable by submitting a crafted API request, with successful exploitation allowing remote code execution and root privileges on an affected device. CVSS 9.8, RWEP 77, poc_available true, and CISA KEV-listed 2025-07-28 with active_exploitation confirmed.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-network-security"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "Any ISE or ISE-PIC node that was reachable from an untrusted network before the fixed release was applied must be handled as presumed-compromised rather than simply upgraded: export the configuration off-box for analysis, rebuild the node from vendor media at the fixed release, and rotate every secret the node held — RADIUS and TACACS+ shared secrets, the directory join and bind accounts, admin and API credentials, and certificates issued by the node's internal CA. Upgrading in place closes the injection path but leaves any root-level persistence installed through it intact on the device that authorizes network access.",
+        "evidence": "Per the packet the flaw allows remote code execution and root privileges on an affected Cisco ISE / ISE-PIC device from an unauthenticated crafted API request (CWE-74), with active_exploitation confirmed and a CISA KEV listing dated 2025-07-28; poc_available is true and CVSS is 9.8. The packet records patch_available true with live_patch_available false and notes the vendor patch typically requires service restart or system reboot per the KEV requiredAction, so the remediation outage is already unavoidable — rebuilding costs the same window as upgrading in place.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-network-security"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-037",
+        "name": "FLEET-COMPROMISE-IR-PLAYBOOK",
+        "description": "Root on ISE is a fleet event rather than a single-appliance event, because the device holds the trust state for every endpoint it admits. The playbook for this CVE has to cover: revocation of certificates issued by the ISE internal CA during the exposure window, invalidation of endpoint trust state (posture results, endpoint identity-group membership, and profiling or MAB entries an attacker could have added to admit their own device), a diff of authorization policy and administrator accounts against a known-good export, quarantine criteria for devices admitted through the affected node, and rotation of credentials for every account that authenticated through it while it was exposed.",
+        "evidence": "The packet records unauthenticated remote code execution with root privileges on Cisco ISE and ISE-PIC via a crafted API request (CWE-74), CVSS 9.8 and RWEP 77, poc_available true, and confirmed in-the-wild exploitation per the CISA KEV listing dated 2025-07-28.",
+        "gap_closes": [
+          "UK-CAF-B2"
+        ]
+      }
+    ]
   },
   "CVE-2025-2775": {
     "name": "SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability",
@@ -20656,7 +22976,21 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "The vulnerable surface on SysAid On-Prem is the Checkin processing functionality, which parses XML before any authentication step, so the exposure clock on a reachable instance starts at first packet — there is no credential barrier to slow an attacker while a maintenance window is scheduled, and per the packet exploitation is confirmed with a PoC already public. The citing controls treat this as ordinary technical-vulnerability management on a routine patching cadence, which leaves an unauthenticated file-read and server-side-request-coercion primitive live for weeks after the 2025-07-22 KEV listing. The control means the SysAid update is deployed within hours of that listing, accepting the service restart or system reboot the packet records the vendor patch requires (live_patch_available is false — there is no in-place option to defer the restart to); where the restart genuinely cannot be taken immediately, the Checkin endpoint is removed from untrusted-network reachability and that compensating control is recorded with a deadline rather than the instance sitting exposed through a cycle. Because the primitive is server-file read plus request coercion leading toward administrator takeover, an instance that was reachable from untrusted networks before the update also needs its SysAid administrator credentials and any secrets held in server-side files handled on the assumption the read already happened.",
+        "evidence": "Packet CVE-2025-2775 \"SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability\", cwe_refs CWE-611; cisa_kev true with kev_date 2025-07-22; active_exploitation confirmed; rwep_score 77; cvss 8.8; poc_available true. vector: \"SysAid On-Prem contains an improper restriction of XML external entity reference vulnerability in the Checkin processing functionality, allowing for administrator account takeover and file read primitives.\" attack_vector: \"an XML external entity (XXE) flaw (CWE-611) letting an unauthenticated attacker read server files and coerce server-side requests (a step toward administrator takeover and code execution).\" patch_available true; live_patch_available false; live_patch_notes: \"No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.\" All six citing gaps are patch-cadence or generic access controls, none carrying a KEV-tied clock.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      }
+    ]
   },
   "CVE-2025-2776": {
     "name": "SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability (variant: CVE-2025-2776)",
@@ -21071,7 +23405,38 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-030",
+        "name": "PERIMETER-DEVICE-ZERODAY-SLA-TIER",
+        "description": "FortiWeb is a web application firewall — the exact device class this SLA tier exists for, and the one whose compromise inverts the protection model, because the appliance sits inline in front of every application it fronts. The packet's flaw is reachable unauthenticated over crafted HTTP or HTTPS requests, which is the same channel the appliance must keep open to do its job, so 'restrict management access' is not a substitute for speed here. The requirement this CVE demonstrates: vendor mitigation deployed within hours of the 2025-07-18 KEV listing, or the vulnerable interface isolated, rather than the 14/30-day cycle that Essential Eight patching, NIS2 patch management, and SI-2 flaw remediation permit for infrastructure appliances. With no live-patch path recorded for this entry, the fixed release lands with a service restart or reboot, so the maintenance window must be pre-authorized before the next KEV listing, not negotiated after it.",
+        "evidence": "Packet: Fortinet FortiWeb SQL injection, CWE-89 — 'may allow an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests'; attack_vector records it as reachable unauthenticated and escalating to compromise. CVSS 9.8, RWEP 77, poc_available true. CISA KEV-listed 2025-07-18 with active_exploitation 'confirmed'. patch_available true, live_patch_available false, live_patch_notes: no live-patch tool registered; vendor patch typically requires service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "NIS2-Art21-patch-management",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "The packet describes this SQL injection as escalating to compromise of the FortiWeb appliance itself, reachable by an unauthenticated attacker over ordinary HTTP/HTTPS. A WAF terminates traffic for the applications behind it, so a compromised unit is positioned to read request bodies, session material, and its own stored administrative and backend credentials. For any appliance that was internet-reachable and unpatched before the 2025-07-18 KEV listing, remediation therefore has to default to configuration capture, rebuild from vendor media, and rotation of every credential the appliance held — not an in-place upgrade. A technical-vulnerability-management process that records the fixed release as the closure artifact marks this finding resolved on a device an attacker may already own; the vendor update, which the packet places behind a service restart or reboot with no live-patch alternative, ends the exposure but does not evict an existing foothold.",
+        "evidence": "Packet: 'SQL injection (CWE-89) on the FortiWeb surface, reachable unauthenticated and escalating to compromise. CISA KEV-listed 2025-07-18 with confirmed in-the-wild exploitation.' CVSS 9.8, RWEP 77, poc_available true, active_exploitation 'confirmed'. patch_available true; live_patch_available false with live_patch_notes recording no registered live-patch tool and a vendor patch that typically requires service restart or system reboot.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-085",
+        "name": "DB-ABSTRACTION-LAYER-PARAMETERIZATION-VERIFICATION",
+        "description": "This CVE is the case that breaks the standard injection compensating control: across frameworks and audits, 'an inline WAF is deployed' is accepted as the mitigation for the SQL-injection class, and here the concatenation sink was inside the WAF's own request handling. Parameterization has to be evidenced at the product's query-builder layer — for security appliances that means procurement and assurance asking the vendor for it, and security-testing scope covering the appliance's own HTTP and management surfaces with SQL metacharacters in every request field, on a staging unit, confirming the query is parameterized rather than concatenated. Operators cannot patch Fortinet's data-access code; what they can stop doing is counting the presence of this appliance as proof that the injection class is controlled anywhere in the estate, including on the appliance itself. The concrete action remains the fixed release, which per the packet arrives with a service restart or reboot and no live-patch option.",
+        "evidence": "Packet: CWE-89 SQL injection in Fortinet FortiWeb — a web application firewall — where an unauthenticated attacker executes unauthorized SQL code or commands via crafted HTTP or HTTPs requests. CVSS 9.8, RWEP 77, poc_available true, CISA KEV-listed 2025-07-18 with confirmed in-the-wild exploitation. UK-CAF-B4 (system security) is among the framework gaps already citing this CVE.",
+        "gap_closes": [
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2025-47812": {
     "name": "Wing FTP Server Improper Neutralization of Null Byte or NUL Character Vulnerability",
@@ -21191,7 +23556,42 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "Installing the NetScaler fix stops the overread but does nothing about the session material already read out of the appliance's memory — the packet records this CitrixBleed-2-class flaw as having been used in the wild for session hijack, so an attacker holding a stolen token retains a valid, already-authenticated path through a fully patched appliance. The runbook for an actively-exploited NetScaler ADC/Gateway must therefore treat patching as step one only: terminate and invalidate every session on the Gateway virtual servers named in the vector (VPN vserver, ICA Proxy, CVPN, RDP Proxy) and the AAA virtual server, rotate credentials and secrets that could have transited the gateway during the exposure window, and audit the appliance configuration for attacker changes before it returns to service. Closing the change ticket at reboot leaves the attacker's access untouched.",
+        "evidence": "Packet attack_vector: out-of-bounds read (CWE-125) on Citrix NetScaler ADC/Gateway, the CitrixBleed-2 class, 'disclosing memory containing authenticated session material that has been used in the wild for session hijack'. Vector: memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server. CISA KEV-listed 2025-07-10, active_exploitation confirmed, poc_available true, RWEP 83. patch_available true; live_patch_available false, with live_patch_notes recording that the vendor patch typically requires a service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "AU-Essential-8-MFA",
+          "UK-CAF-B2",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-vulnerability-handling"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-030",
+        "name": "PERIMETER-DEVICE-ZERODAY-SLA-TIER",
+        "description": "A severity-keyed patch SLA files this CVE in the wrong queue. It scores CVSS 5.5 because the primitive is only a memory read, while its real-world priority is RWEP 83 — KEV-listed, confirmed exploitation, public PoC — because the memory being read holds authenticated session material on the device that terminates remote access. NetScaler ADC/Gateway instances configured as a Gateway (VPN vserver, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server need a distinct perimeter tier whose clock starts at KEV listing rather than at a CVSS threshold, with the affected Gateway/AAA virtual servers isolated if the restart window the vendor fix requires cannot be taken immediately. A program that routes medium-CVSS findings to a 30- or 90-day bucket will leave this appliance exposed for the entire period it is being exploited.",
+        "evidence": "Packet: CVSS 5.5 against rwep_score 83; CISA KEV-listed 2025-07-10 with active_exploitation confirmed and poc_available true. Affected configurations named in the vector: Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server. patch_available true, live_patch_available false, and live_patch_notes records the vendor patch typically requires a service restart or system reboot per the KEV requiredAction — so remediation costs an availability window that a low-tier SLA will not authorize promptly.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-handling"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-031",
+        "name": "FIREWALL-EGRESS-TELEMETRY-SEPARATE-TRUST-ZONE",
+        "description": "A session hijack built on material read out of NetScaler memory drops no binary and generates no failed logon — the attacker arrives as an already-authenticated Gateway user — so endpoint anti-malware across the estate behind the appliance has nothing to match. The only record an operator can hunt over is the appliance's own authentication, ICA/CVPN session and access logging, and that sits on the very device whose memory is being disclosed. NetScaler ADC/Gateway must forward those logs to a SIEM in a separate trust zone, reached with different credentials and a different management path, so that post-KEV hunting for a session resumed from a new address, geography or client fingerprint runs against telemetry the attacker cannot reach or truncate.",
+        "evidence": "Packet attack_vector: the out-of-bounds read discloses memory containing authenticated session material 'that has been used in the wild for session hijack'; CISA KEV-listed 2025-07-10 with active_exploitation confirmed and poc_available true. CIS Controls v8 10.1 (Deploy and Maintain Anti-Malware Software) is recorded in this entry's citing framework gaps, and the exploitation path described produces authenticated session traffic rather than malware for that control to detect.",
+        "gap_closes": [
+          "CIS-Controls-v8-10.1",
+          "UK-CAF-B2"
+        ]
+      }
+    ]
   },
   "CVE-2019-9621": {
     "name": "Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery (SSRF) Vulnerability",
@@ -21481,7 +23881,43 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-057",
+        "name": "BROWSER-MANAGED-UPDATE-NO-DEFERRAL",
+        "description": "The V8 type confusion is reached by any attacker-controlled web page, so the exposure window for this CVE is the time until every Chromium-derived browser in the estate is running the fixed build — a clock the OS patch cycle does not govern. The packet's vector states the flaw affects multiple browsers built on Chromium including Chrome, Edge and Opera, so an enterprise update policy that covers only the primary browser leaves the secondary and vendor-bundled Chromium browsers on the vulnerable renderer. No update-ring deferral may be applied to the browser security channel for this class. The packet records no live-patch path and notes the vendor patch typically requires a service restart or reboot, so an endpoint that has downloaded the update but not relaunched the browser is still exploitable; the policy must force the relaunch rather than wait for the user to close the browser.",
+        "evidence": "Packet: CWE-843 type confusion in the Chromium V8 engine; vector states a remote attacker can perform arbitrary read/write via a crafted HTML page and that the flaw affects multiple Chromium-based browsers including Google Chrome, Microsoft Edge and Opera; CISA KEV-listed 2025-07-02 with active_exploitation=confirmed; poc_available=true; CVSS 8.8, RWEP 77; patch_available=true, live_patch_available=false with the note that the vendor patch typically requires service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management",
+          "NIST-800-53-SI-2",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-042",
+        "name": "INCOMPLETE-PATCH-SEQUENCE-SEVERITY-MULTIPLIER",
+        "description": "The packet classes this CVE as a variant of the recurring V8 type-confusion class, not an isolated defect. Vulnerability management must therefore score it with the class multiplier: another type-confusion variant reaching the same V8 primitive is likely, so the remediation posture for Chromium browsers has to be standing capability (tested forced-relaunch push, rollback path, per-endpoint version telemetry) rather than a one-off ticket opened when this CVE ID appears. Treating each V8 type-confusion CVE as discrete produces a queue that re-learns the same emergency every cycle and obscures that the renderer is a repeat trust-boundary failure in this estate.",
+        "evidence": "Packet: attack_vector describes the flaw as a type confusion (CWE-843) in the V8 JavaScript engine and explicitly as \"a variant of the recurring V8 type-confusion class\", exploitable by an attacker-controlled web page for code execution in the renderer, and notes that browser zero-days of this class are typically used in targeted-spyware or watering-hole chains; active_exploitation=confirmed with poc_available=true.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "For this CVE the KEV clock starts at the 2025-07-02 listing, and the mitigation that stops it is the vendor browser update — but the packet records live_patch_available=false and states the patch typically requires a service restart or system reboot, so the SLA must be measured to restart-completion on each endpoint rather than to update-approval in the management console. A fleet dashboard showing the fixed version as \"deployed\" while long-running browser sessions have never relaunched is an unmet SLA, not a met one. With confirmed in-the-wild exploitation and a public PoC recorded in the packet, the verification step — per-endpoint confirmation that the vulnerable renderer is no longer running — is the part of the control that carries the risk reduction.",
+        "evidence": "Packet: cisa_kev=true with kev_date 2025-07-02; active_exploitation=confirmed; poc_available=true; RWEP 77 against CVSS 8.8; patch_available=true; live_patch_available=false with live_patch_notes recording that no live-patch tool is registered and that the vendor patch typically requires service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-patch-management"
+        ]
+      }
+    ]
   },
   "CVE-2025-48928": {
     "name": "TeleMessage TM SGNL Exposure of Core Dump File to an Unauthorized Control Sphere Vulnerability",
@@ -22066,7 +24502,31 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-120",
+        "name": "DOWNLOAD-PROVENANCE-ENFORCEMENT",
+        "description": "The delivered object in this exploit is an Internet Shortcut (.url) whose WorkingDirectory attribute points at an attacker-controlled WebDAV path. The shortcut carries no payload of its own — it is a pointer, and the binary that runs is fetched from the remote WebDAV share at the moment the user opens it. That is why provenance has to be enforced on the shortcut itself: internet-sourced .url files must retain Mark-of-the-Web and be blocked from opening outright, because a reputation verdict on the shortcut inspects an inert text file while the executable content never crosses the download path a scanner watches. Blocking execution of provenance-stripped shortcuts is the user-application-hardening step that still works against an attacker who plants no local executable at all, and it holds on endpoints that have not yet taken the reboot the vendor fix requires.",
+        "evidence": "cwe_refs is CWE-73 (external control of file name or path). vector: 'Microsoft Windows contains an external control of file name or path vulnerability that could allow an attacker to execute code from a remote WebDAV location specified by the WorkingDirectory attribute of Internet Shortcut files.' attack_vector adds that 'a crafted Internet Shortcut (.url) sets the working directory to an attacker-controlled WebDAV path so that opening it executes an attacker-supplied binary (exploited by the Stealth Falcon group).' cisa_kev true, kev_date 2025-06-10, active_exploitation confirmed.",
+        "gap_closes": [
+          "AU-Essential-8-App-Hardening",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "This fix is an operating-system update, so the SLA lands across the whole endpoint fleet rather than on one server — every workstation capable of opening an Internet Shortcut needs it. The packet records a service restart or system reboot as the apply step and no live-patch path, which is exactly the point at which ring-based rollout normally permits user deferral, and deferral here is what leaves the exploit live. The clock therefore has to start at the 2025-06-10 KEV listing rather than at the next monthly maintenance window: the attack needs only a delivered .url file plus a single user action, with no prior foothold or credential to acquire, and the packet already records both a public PoC and in-the-wild use by a named group.",
+        "evidence": "cisa_kev true with kev_date 2025-06-10; active_exploitation confirmed; poc_available true; cvss 8.8; rwep_score 77. patch_available true, live_patch_available false, live_patch_notes: 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.' attack_vector attributes exploitation to the Stealth Falcon group.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management",
+          "NIST-800-53-SI-2",
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2025-24016": {
     "name": "Wazuh Server Deserialization of Untrusted Data Vulnerability",
@@ -22356,7 +24816,38 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "MOBILE-OS-MINIMUM-PATCH-LEVEL-ENFORCEMENT",
+        "name": "MOBILE-OS-MINIMUM-PATCH-LEVEL-ENFORCEMENT",
+        "description": "An operator cannot remediate this flaw in place — the incorrect-authorization defect is in the Qualcomm chipset's GPU driver, so it closes only when the handset is running a build that carries the vendor fix. The enforcing control is therefore a minimum device security-patch level as a condition of access to organizational data, not as a reported attribute: the MDM/EMM must read each enrolled device's patch level, block or quarantine devices below the level carrying the Qualcomm fix, and — because the unauthorized GPU command sequence has to be issued by code already running on the device — constrain side-loaded and untrusted app installation on devices that cannot yet update. The distinguishing test: enroll a device pinned below the fixing patch level and confirm policy denies it access to protected resources; if the only outcome is a stale-patch-level row on a dashboard, the estate is attesting patch management it is not enforcing.",
+        "evidence": "Packet: incorrect authorization (CWE-863) in the Qualcomm Adreno GPU driver across multiple Qualcomm chipsets, allowing unauthorized GPU command execution in the GPU micronode while executing a specific sequence of commands, corrupting memory to escalate privilege; exploited in the wild in Android targeted chains. patch_available true, live_patch_available false, and live_patch_notes records that no live-patch tool is registered and the vendor patch typically requires service restart or system reboot per the KEV requiredAction — remediation lands only when the device itself updates and restarts. RWEP 77, CVSS 8.8, poc_available true.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "The remediation clock for this entry must run from the KEV listing date, not from an internal severity triage of a chipset advisory the organization cannot act on directly. Because the fix is device-resident, 'mitigation deployed' has to be evidenced per handset — the count of devices confirmed on a fixed build and restarted — rather than as a single closed advisory ticket. The packet records no live-patch path for this CVE, so there is no in-place option that avoids the restart; devices that cannot take the update inside the SLA must be moved out of scope for organizational data as a documented compensating decision rather than being carried indefinitely as 'pending patch'.",
+        "evidence": "Packet: cisa_kev true with kev_date 2025-06-03 and active_exploitation confirmed; poc_available true; patch_available true with live_patch_available false, and live_patch_notes stating no live-patch tool is registered and that the vendor patch typically requires service restart or system reboot per the KEV requiredAction. RWEP 77 against CVSS 8.8.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-121",
+        "name": "MOBILE-ZERO-CLICK-HARDENING",
+        "description": "This CVE is an escalation primitive, not an entry point — the unauthorized GPU command sequence must be issued by code already executing on the handset, and the packet notes that LPEs of this class are routinely paired with an initial-access primitive in the Android targeted chains where it was exploited. For high-risk users, the control that acts inside the window before a fixed build reaches the device is a reduced-attack-surface mode that stops automatic processing of untrusted message attachments, fonts and link previews, removing the delivery leg the GPU escalation is chained to. This is additive to the device update, not a substitute for it: the vendor fix exists and still has to land, with the restart the KEV requiredAction implies.",
+        "evidence": "Packet: incorrect authorization (CWE-863) in the Qualcomm Adreno GPU driver; memory corruption via unauthorized command execution in the GPU micronode; exploited in the wild in Android targeted chains, with the packet stating that LPEs of this class are routinely paired with an initial-access primitive. cisa_kev true, kev_date 2025-06-03, active_exploitation confirmed, RWEP 77, poc_available true; live_patch_available false with the vendor patch requiring restart or reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2025-21480": {
     "name": "Qualcomm Multiple Chipsets Incorrect Authorization Vulnerability (variant: CVE-2025-21480)",
@@ -22411,7 +24902,42 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "MOBILE-OS-MINIMUM-PATCH-LEVEL-ENFORCEMENT",
+        "name": "MOBILE-OS-MINIMUM-PATCH-LEVEL-ENFORCEMENT",
+        "description": "A Qualcomm chipset fix reaches a handset only once the OEM folds it into a device security-patch level, so the enforcement point available to the operator is the MDM/EMM, not the software. Managed Android fleets must read the device security-patch level and deny or quarantine handsets below the level carrying this Adreno GPU-driver fix — as a condition of access to organizational data, not as a dashboard metric — and must block untrusted/side-loaded app installation on handsets that cannot yet update. The blocking half is load-bearing here specifically because the unauthorized GPU-micronode command sequence is issued by code already executing on the device: constraining what runs on an unpatched handset is the only thing standing between the KEV listing and the OEM rollout. A fleet whose mobile-patching attestation reports patch levels without gating on them leaves every stale handset exploitable in production.",
+        "evidence": "Packet: incorrect-authorization flaw (CWE-863) in the Qualcomm Adreno GPU driver allowing unauthorized GPU command execution that corrupts memory to escalate privilege; the vector records memory corruption 'due to unauthorized command execution in GPU micronode while executing specific sequence of commands'. CISA KEV-listed 2025-06-03, active_exploitation confirmed, poc_available true, CVSS 8.8, RWEP 77. patch_available is true, but live_patch_available is false and live_patch_notes records that the vendor patch typically requires a service restart or system reboot per the KEV requiredAction — there is no in-place fix, so handsets stay exploitable across the whole update-and-reboot window.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-121",
+        "name": "MOBILE-ZERO-CLICK-HARDENING",
+        "description": "This CVE is the escalation half of a chain, not an entry point: the unauthorized GPU command sequence only runs once attacker-controlled code is already on the handset, and the packet records exploitation in Android targeted chains with LPEs of this class routinely paired with an initial-access primitive. High-risk users on affected Qualcomm chipsets must therefore be placed in a reduced-attack-surface mode that stops automatic processing of untrusted message attachments, fonts and link previews, closing the delivery half while the OEM patch is in flight. For this entry that posture is not defence-in-depth garnish — it is the only remediation the operator can apply on their own clock, because the fix itself must traverse the chipset vendor and the OEM before it is installable.",
+        "evidence": "Packet attack_vector: 'exploited in the wild in Android targeted chains' and 'LPEs of this class are routinely paired with an initial-access primitive'. CISA KEV-listed 2025-06-03, active_exploitation confirmed, poc_available true. live_patch_available is false and live_patch_notes records the vendor patch typically requires a service restart or system reboot per the KEV requiredAction, so no interim in-place remediation exists.",
+        "gap_closes": [
+          "UK-CAF-B4",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-017",
+        "name": "BUG-FAMILY-MITIGATION-PERSISTENCE",
+        "description": "The catalog carries this entry as a variant within the same Qualcomm Adreno GPU-driver incorrect-authorization primitive, which is the signature of a recurring bug family rather than an isolated defect. The compensating posture built for it — patch-level access gating, side-load restriction, reduced-attack-surface mode on high-risk handsets — must stay in force through a stated soak period after the OEM patch lands, not be retired the day the fleet reports the fixed security-patch level. A sibling flaw in the same GPU command-authorization path is reachable by exactly the same local-code route, and on this platform the operator cannot re-deploy a mitigation faster than the OEM can ship the next fix.",
+        "evidence": "The packet names the entry 'Qualcomm Multiple Chipsets Incorrect Authorization Vulnerability (variant: CVE-2025-21480)' and describes it as an incorrect-authorization flaw (CWE-863) in the Qualcomm Adreno GPU driver, '(a related variant)'. CISA KEV-listed 2025-06-03 with confirmed in-the-wild exploitation and poc_available true; RWEP 77 against CVSS 8.8.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      }
+    ]
   },
   "CVE-2025-27038": {
     "name": "Qualcomm Multiple Chipsets Use-After-Free Vulnerability",
@@ -23531,7 +26057,41 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "The CLFS driver fix must be scheduled off a KEV clock rather than a change-advisory maintenance window, on servers as well as workstations, because this is the escalation half of a ransomware intrusion: the packet records that LPEs of this class are routinely paired with an initial-access flaw, so the window between a phishing foothold and domain-wide SYSTEM is measured in minutes, not in patch cycles. There is no live-patch path for this entry and the fix is a kernel-driver replacement that only becomes active after the restart or reboot the KEV requiredAction calls for, so the SLA must be tracked to reboot-completed per host. Production servers whose owners defer reboots — the exact machines whose compromise is worth the most to an operator — are the population this control exists to force through, and 'patched, pending reboot' must be reported as unremediated.",
+        "evidence": "Packet fields for CVE-2025-32706: cisa_kev true, kev_date 2025-05-13, active_exploitation confirmed, rwep_score 77, cvss 9.8, poc_available true, cwe_refs CWE-122. patch_available true, live_patch_available false, live_patch_notes \"No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.\" Packet attack_vector: \"a heap-based buffer overflow (CWE-122) in the Windows Common Log File System (CLFS) driver — a recurring kernel-LPE target — exploited by a local foothold to escalate to SYSTEM ... LPEs of this class are routinely paired with an initial-access flaw by ransomware operators.\"",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-003",
+        "name": "KERNEL-EXPLOITATION-DETECTION",
+        "description": "Between KEV listing and the reboot that actually activates the CLFS driver fix, detection of the escalation attempt is the only control still standing, and the cited framework controls do not require it. Hosts must carry telemetry that alerts inside a minute on kernel privilege-escalation indicators for this path: a non-privileged process acquiring a SYSTEM token, and anomalous creation or manipulation of CLFS log files by user-context processes. The escalation runs entirely on the host from a foothold the attacker already has, so it produces no network-side indicator for a perimeter sensor to catch, and least-privilege posture does not contain it — the packet's own description is a local foothold reaching SYSTEM, which means standard-user-only accounts are not a mitigating control here and cannot be attested as one.",
+        "evidence": "Packet fields for CVE-2025-32706: cwe_refs CWE-122, cvss 9.8, rwep_score 77, poc_available true, cisa_kev true (kev_date 2025-05-13), active_exploitation confirmed. Packet attack_vector: \"a heap-based buffer overflow (CWE-122) in the Windows Common Log File System (CLFS) driver ... exploited by a local foothold to escalate to SYSTEM.\" live_patch_available false; live_patch_notes states the vendor patch \"typically requires service restart or system reboot per the KEV requiredAction,\" leaving a detection-only interval on hosts awaiting restart. Citing gaps include NIST-800-53-AC-6 (Least Privilege) and UK-CAF-B4 (System security).",
+        "gap_closes": [
+          "NIST-800-53-AC-6",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-042",
+        "name": "INCOMPLETE-PATCH-SEQUENCE-SEVERITY-MULTIPLIER",
+        "description": "The packet characterizes the CLFS driver as a recurring kernel-LPE target, which means a vulnerability-management program that scores this heap overflow as a discrete finding will re-learn the same lesson at the next CLFS CVE. Any CVE landing on the CLFS driver should carry a severity multiplier over an equivalent-CVSS flaw in a component with no exploitation history, and the CLFS surface should sit on a standing watchlist so the next advisory is triaged as a likely-exploited repeat rather than routed through generic intake. Practically: a host estate that has applied and rebooted for this CVE still carries elevated structural risk on the same primitive, and that residual should be stated in the risk register rather than being closed out when the patch record goes green.",
+        "evidence": "Packet attack_vector for CVE-2025-32706 describes the Windows Common Log File System (CLFS) driver as \"a recurring kernel-LPE target.\" Supporting packet fields: cwe_refs CWE-122, cvss 9.8, rwep_score 77, cisa_kev true with kev_date 2025-05-13, active_exploitation confirmed, poc_available true.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      }
+    ]
   },
   "CVE-2025-32701": {
     "name": "Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability",
@@ -24577,7 +27137,44 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "This is the case the control exists for, and Connect Secure is the appliance terminating remote access into the network. Per the packet the flaw was exploited as a zero-day from mid-December 2024 by the suspected China-nexus cluster UNC5337/UNC5221 — before the 2025-01-08 advisory — so any internet-exposed appliance sat reachable through a window in which no advisory or vendor signature existed, and the operator has no basis to assume their instance was missed. The packet states patch-in-place is insufficient where the appliance is already compromised, and that a factory reset / rebuild is required to evict SPAWN-ecosystem persistence (SPAWNANT / SPAWNMOLE / SPAWNSNAIL). The control means the runbook for these gateways defaults, for any appliance exposed during that pre-advisory window, to: export configuration off-box, factory-reset / rebuild rather than upgrade in place, and rotate every credential the appliance held or brokered — local administrator, service accounts, VPN user credentials, and any secret carried in the exported configuration — because the packet names DRYHOOK as a credential stealer deployed alongside the PHASEJAM dropper. A firmware upgrade restores the code and, per live_patch_notes, requires an appliance reboot to do so, but it neither invalidates credentials already taken nor substitutes for the reset the packet says eviction requires.",
+        "evidence": "Packet CVE-2025-0282 \"Ivanti Connect Secure / Policy Secure / Neurons for ZTA stack-overflow preauth RCE\", cwe_refs CWE-121 and CWE-787; cisa_kev true with kev_date 2025-01-08; active_exploitation confirmed; rwep_score 85; cvss 9.0; poc_available true. attack_vector: \"Exploited as a zero-day from mid-December 2024 by the suspected China-nexus cluster UNC5337/UNC5221, deploying the SPAWN malware ecosystem (SPAWNANT/SPAWNMOLE/SPAWNSNAIL), the PHASEJAM dropper, and the DRYHOOK credential stealer, before the 2025-01-08 advisory. Patch-in-place is insufficient where the appliance is already compromised.\" live_patch_available false; live_patch_notes: \"Connect Secure firmware upgrade requires an appliance reboot; no live-patching primitive. Patch alone is insufficient where ICT indicates compromise - a factory reset / rebuild is required to evict SPAWN-ecosystem persistence.\" vector adds that Ivanti's guidance is to patch and, on indicators of compromise, factory-reset.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "PCI-DSS-4.0-6.3.3",
+          "AU-ISM-1546",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-030",
+        "name": "PERIMETER-DEVICE-ZERODAY-SLA-TIER",
+        "description": "Connect Secure is a remote-access gateway, so the device under discussion is the trust boundary itself, and the packet describes an unauthenticated stack-based buffer overflow reachable over the network at RWEP 85 / CVSS 9.0 with a PoC available. What makes the standard SLA tier unusable here is recorded in the packet's own vector: no interim configuration workaround fully mitigates an internet-exposed appliance. That removes the branch most patch programmes lean on — apply the vendor's mitigation rule now, schedule the firmware for the next window — and leaves exactly two states, fixed firmware (which per live_patch_notes requires an appliance reboot; there is no live-patching primitive) or the exposed interface taken off untrusted networks. The control means the framework carries an explicit tier for pre-auth RCE on remote-access gateways: firmware deployed with its reboot within hours of the 2025-01-08 KEV listing, or the gateway's internet-facing interface isolated until it is, instead of the routine multi-week windows the citing patch controls accept for systems generally. Isolation is a first-class satisfying action in this tier, not a failure to meet it.",
+        "evidence": "Packet CVE-2025-0282, cwe_refs CWE-121 and CWE-787; cisa_kev true with kev_date 2025-01-08; active_exploitation confirmed; rwep_score 85; cvss 9.0; poc_available true; patch_available true; live_patch_available false. vector: \"Unauthenticated remote attacker sends crafted input that overflows a stack buffer in the Connect Secure web surface, achieving code execution on the appliance. No interim configuration workaround fully mitigates an internet-exposed appliance; Ivanti's guidance is to patch and, on indicators of compromise, factory-reset.\" live_patch_notes: \"Connect Secure firmware upgrade requires an appliance reboot; no live-patching primitive.\" attack_vector records exploitation from mid-December 2024, before the 2025-01-08 advisory.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "PCI-DSS-4.0-6.3.3",
+          "AU-ISM-1546",
+          "NIS2-Art21-network-security"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-031",
+        "name": "FIREWALL-EGRESS-TELEMETRY-SEPARATE-TRUST-ZONE",
+        "description": "For this CVE the remediation branch is evidence-conditional, not automatic: the packet's guidance is patch, and factory-reset where indicators of compromise are present. That determination has to cover mid-December 2024 through the 2025-01-08 advisory — a window in which, per the packet, the appliance was being exploited by UNC5337/UNC5221 and carrying the PHASEJAM dropper and DRYHOOK credential stealer. An operator whose only record of that period lives on the Connect Secure appliance is asking a host that may be running attacker-installed persistence to testify about its own integrity, and a clean local log is then indistinguishable from a compromised one. The control means the gateway's syslog, authentication and session telemetry is already landing in a SIEM in a separate trust zone — different management plane, different credentials, different authentication path — with retention long enough to span a pre-disclosure zero-day window, so the patch-versus-rebuild decision this CVE forces can be answered from records the appliance never had the ability to alter. This has to be in place before the disclosure event; it cannot be retrofitted once the window has already passed.",
+        "evidence": "Packet CVE-2025-0282; active_exploitation confirmed; kev_date 2025-01-08. attack_vector: \"Exploited as a zero-day from mid-December 2024 by the suspected China-nexus cluster UNC5337/UNC5221, deploying the SPAWN malware ecosystem (SPAWNANT/SPAWNMOLE/SPAWNSNAIL), the PHASEJAM dropper, and the DRYHOOK credential stealer, before the 2025-01-08 advisory.\" live_patch_notes: \"Patch alone is insufficient where ICT indicates compromise - a factory reset / rebuild is required to evict SPAWN-ecosystem persistence.\" vector: \"Ivanti's guidance is to patch and, on indicators of compromise, factory-reset.\"",
+        "gap_closes": [
+          "DORA-Art-9",
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2025-22457": {
     "name": "Ivanti Connect Secure stack-overflow preauth RCE (mis-triaged DoS weaponized to RCE)",
@@ -24842,7 +27439,30 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "The \"whichever is later\" half of this control is the operative one here. Adobe shipped the fix in APSB09-15 in 2009, so every SLA anchored to patch availability expired more than a decade ago and reports green today, while the event that actually reopens the exposure is CISA's 2026-05-20 listing. Estates must re-run the KEV clock from that listing date against their installed Acrobat and Reader inventory, treat any host still on a pre-APSB09-15 build as an open KEV item on an hours-level deadline, and record the verified action as the application update — there is no live-patch path for this entry, so remediation means the reader binaries on the endpoint changed, not that a policy was reasserted. A KEV programme that only enqueues recently-published CVEs will never generate this work item at all.",
+        "evidence": "The packet records CISA KEV listing on 2026-05-20 with active_exploitation \"confirmed\", RWEP 65, CVSS 8.8 and poc_available true, for a heap-based buffer overflow (CWE-122) triggered by an attacker-controlled PDF for code execution in the reader process. patch_available is true, live_patch_available is false, and live_patch_notes name \"Adobe patch APSB09-15 (2009); application update\".",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-074",
+        "name": "CVE-REGRESSION-WATCHER",
+        "description": "No advisory feed re-announces a 2009 CVE, so nothing in a new-CVE-driven intake pipeline surfaced this entry; it became visible only when CISA re-listed it, by which point exploitation was already confirmed. Threat intake for document-reader software must therefore watch current exploitation and PoC signal for historical CVE ids and route each hit straight to an inventory query for pre-fix Acrobat/Reader builds — CVE-2009-3459 clears the watcher's historical-id threshold by seventeen years. The triage outcome here resolves to a long-tail unpatched estate rather than a code regression, and that is the point: the watcher is the only mechanism that raises an aged, still-exploited flaw at all, whichever way the triage lands.",
+        "evidence": "The CVE id is from 2009 while the packet's KEV listing is dated 2026-05-20, with active_exploitation \"confirmed\" and poc_available true. The packet states the legacy re-listing exists \"because long-tail unpatched/end-of-life estates remain exposed\".",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      }
+    ]
   },
   "CVE-2010-0249": {
     "name": "Microsoft Internet Explorer Use-After-Free (Operation Aurora)",
@@ -25377,7 +27997,30 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "human_researcher",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-025",
+        "name": "CONFIGURATION-SIDE-LIVE-PATCH-INVENTORY",
+        "description": "Postfix SMTP smuggling is remediable two ways, and the frameworks only recognise one. The packet records that on pre-3.8.5 the exposure closes with two configuration directives — smtpd_forbid_unauth_pipelining=yes and smtpd_discard_ehlo_keywords=chunking — with an upgrade as the alternative; remediation needs a service restart, not a host reboot, and no live-patch primitive applies. An MTA operator who cannot take an upgrade window (a mail gateway carrying production flow, a vendor-packaged Postfix on a frozen release) can shut the smuggling path today, and the compliance program must have that directive path already inventoried, tested against a smuggled-envelope case, and deployable independently of the vendor-version path. Treating the configuration change as second-class evidence is what leaves an MTA accepting <LF>.<LF> for the length of a patch cycle.",
+        "evidence": "Packet vector: 'Postfix accepts the non-standard end-of-data sequences <LF>.<LF> and <LF>.<CR><LF> in DATA, where RFC 5321 mandates <CR><LF>.<CR><LF>... Fix: smtpd_forbid_unauth_pipelining=yes + smtpd_discard_ehlo_keywords=chunking on pre-3.8.5, or upgrade.' patch_available true; live_patch_available false; live_patch_notes: 'Remediation is a software update (and, for the smuggling/STARTTLS classes, a server configuration change); no live-patch primitive applies. Service restart, not host reboot.' CVSS 5.3, RWEP 35, poc_available true, cisa_kev false, active_exploitation suspected. Disclosed Dec 2023 (SEC Consult). Cited against AU-Essential-8-App-Hardening, NIST-800-53-SI-2 and PCI-DSS-4.0-6.3.3.",
+        "gap_closes": [
+          "AU-Essential-8-App-Hardening",
+          "NIST-800-53-SI-2",
+          "PCI-DSS-4.0-6.3.3"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-018",
+        "name": "SCANNER-PAPER-COMPLIANCE-TEST",
+        "description": "Because this Postfix exposure can be closed either by version or by configuration, a scanner verdict derived from the Postfix package version alone is paper compliance in both directions: it reports a pre-3.8.5 host as vulnerable when the two directives are already set, and — worse for an auditor — it cannot show that a host reported 'patched' actually rejects the non-standard end-of-data sequence. The operational test that distinguishes real remediation is behavioural, not version-based: open a session against the MTA, submit a DATA body terminated with <LF>.<LF> carrying a second embedded envelope, and confirm the smuggled message is not accepted and does not inherit the outer connection's SPF/DKIM/DMARC result. A vulnerability-management program that cannot produce that result for its mail gateways has attested to a version string, not to the absence of sender spoofing.",
+        "evidence": "Packet vector states both remediation paths (the two smtpd_* directives on pre-3.8.5, or upgrade), so package version alone does not determine exposure. Attack_vector: 'the MTA accepts a non-standard end-of-data sequence, letting an attacker smuggle a second message that inherits the outer connection's SPF/DKIM/DMARC pass and delivers a spoofed sender.' CWE-345 (insufficient verification of data authenticity) and CWE-93 (CRLF injection); poc_available true. Cited against ISO-27001-2022-A.8.8 (management of technical vulnerabilities) and UK-CAF-B4 (system security).",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2023-51765": {
     "name": "Sendmail SMTP smuggling (non-standard end-of-data sequence enables sender spoofing past SPF/DKIM/DMARC)",
@@ -25552,7 +28195,30 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "human_researcher",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-008",
+        "name": "CRYPTO-SUBSYSTEM-CVE-DISCLOSURE",
+        "description": "The affected subsystem here is the one other controls are resting on. Exim's STARTTLS does not discard data buffered before the TLS handshake, so an on-path attacker's pre-handshake bytes are processed inside the encrypted session — which means that while an Exim MTA is unpatched, 'SMTP traffic is protected by TLS in transit' is not a valid compensating control for that hop and must not be counted as one in the risk assessment or in the network-security evidence pack. The requirement is to enumerate every control and attestation that leans on opportunistic STARTTLS between MTAs, mark each as void for the affected hops until the MTA is on a fixed release, and re-assert them only after remediation. Remediation is the software update (the packet names upgrading past 4.94.2, i.e. 4.95+); no live-patch primitive applies and it takes a service restart, not a host reboot, so the exposure window is a mail-service restart rather than a machine maintenance window.",
+        "evidence": "CWE-74. Packet vector: 'The STARTTLS feature in Exim does not discard data buffered before the TLS handshake, so an on-path attacker can inject responses (response injection / buffering) that the client applies after STARTTLS completes. Fix: upgrade past 4.94.2 (4.95+).' Attack_vector adds that injected plaintext SMTP commands/responses are 'processed inside the encrypted session'. patch_available true, live_patch_available false; live_patch_notes: 'Remediation is a software update (and, for the smuggling/STARTTLS classes, a server configuration change); no live-patch primitive applies. Service restart, not host reboot.' Cited against NIS2-Art21-network-security and UK-CAF-B4.",
+        "gap_closes": [
+          "NIS2-Art21-network-security",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-042",
+        "name": "INCOMPLETE-PATCH-SEQUENCE-SEVERITY-MULTIPLIER",
+        "description": "On its own scoring this Exim flaw sorts to the bottom of any patch queue — no KEV listing, no observed exploitation, RWEP 21 — and every citing control (SI-2, ISO A.8.8, AU-ISM-1546) would rank it accordingly, because each treats a CVE as a discrete item. The packet records what that framing loses: this is part of the NO STARTTLS research lineage running from 2011 Postfix to the 2021 multi-MTA round, the same pre-handshake buffering primitive resurfacing across a decade and across independent MTA implementations. A vulnerability-management program must apply a severity multiplier on that basis and act on the class rather than the entry: raise this above its nominal rank, and when the fixed Exim lands, re-test the pre-handshake buffer-discard behaviour on every other MTA and mail-submission agent in the estate rather than closing the ticket on the one product named in the advisory.",
+        "evidence": "Packet attack_vector: 'STARTTLS command/response injection: the server/client does not discard bytes buffered before the TLS handshake... Part of the NO STARTTLS research lineage (2011 Postfix -> 2021 multi-MTA).' cisa_kev false, kev_date null, active_exploitation none, rwep_score 21, cvss 7.5, poc_available true. Cited against ISO-27001-2022-A.8.8, NIST-800-53-SI-2 and AU-ISM-1546 ('Patch operating systems and applications').",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "AU-ISM-1546"
+        ]
+      }
+    ]
   },
   "CVE-2021-33515": {
     "name": "Dovecot lib-smtp STARTTLS command injection (submission service)",
@@ -25782,7 +28448,30 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "academic_ai_fuzzing",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-017",
+        "name": "BUG-FAMILY-MITIGATION-PERSISTENCE",
+        "description": "The vendor fix bounds NSEC3 iteration and closest-encloser work, but the packet records a second worst-case-work primitive in the same validating path disclosed alongside it (key-tag collision handling), which is exactly the sibling-bug condition this control exists for. Resolver operators must keep the query-side limits they ran before upgrading — recursion restricted to known client ranges, per-client query and CPU budgets, response-rate limiting, and alerting on validator CPU saturation — in force after the upgrade, for a stated soak period, rather than retiring them on the strength of a version bump. Dropping them leaves the resolver defended only against the specific iteration-counting path this CVE names, inside a validation routine where a second forced-work primitive has already been demonstrated. The soak also has to be tracked per resolver instance, because the fix only takes effect on the instances that have actually been restarted.",
+        "evidence": "Packet: the vector states that validating an NSEC3 closest-encloser proof for a crafted response forces the resolver to perform a large number of SHA-1 hash iterations, and that the fix is vendor patches bounding the NSEC3 iteration/closest-encloser work. The attack_vector describes the class as a single crafted DNSSEC response forcing worst-case signature/hash work, naming both KeyTrap key-tag collisions and NSEC3 iteration enumeration as co-disclosed (Feb 2024), stalling the resolver for all clients. CWE-400, CVSS 7.5, RWEP 37, poc_available=true, active_exploitation=suspected, cisa_kev=false. patch_available=true, live_patch_available=false, and live_patch_notes state remediation is a software update requiring a service restart, not a host reboot.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "ISO-27001-2022-A.8.8",
+          "AU-Essential-8-Patch"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-008",
+        "name": "CRYPTO-SUBSYSTEM-CVE-DISCLOSURE",
+        "description": "DNSSEC validation is the cryptographic subsystem this flaw attacks, so while a resolver runs an unbounded-iteration build the organization cannot count 'DNSSEC validation enabled' as a compensating control for DNS response integrity — turning it on is precisely what exposes the resolver to a single crafted response that stalls resolution for every client behind it. Any risk narrative that leans on DNSSEC to cover spoofing or cache-poisoning risk must record that dependency explicitly, state the availability trade-off, and stop presenting a validating resolver as a net-positive control until the bounded build is deployed and each instance restarted. This matters most where one validating resolver is a shared dependency of the whole service estate, since its stall is a simultaneous outage for every dependent service rather than a single-system fault.",
+        "evidence": "Packet: CWE-400 resource exhaustion located in the DNSSEC validation path — the vector states that validating an NSEC3 closest-encloser proof for a crafted response drives a large number of SHA-1 hash iterations and consumes CPU, and the attack_vector states a single crafted DNSSEC response stalls the resolver for all clients. CVSS 7.5, RWEP 37, poc_available=true, active_exploitation=suspected, cisa_kev=false (no KEV clock applies). patch_available=true with live_patch_available=false; live_patch_notes state the remediation is a software update requiring a service restart rather than a host reboot, so exposure persists on each instance until that restart happens.",
+        "gap_closes": [
+          "DORA-Art-9",
+          "ISO-27001-2022-A.8.8"
+        ]
+      }
+    ]
   },
   "CVE-2023-44487": {
     "name": "HTTP/2 Rapid Reset — stream open-then-RST_STREAM flood (record-breaking DDoS)",
@@ -25842,7 +28531,40 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-062",
+        "name": "HTTP2-STREAM-RESET-ACCOUNTING",
+        "description": "Every HTTP/2 terminator in the request path — edge proxy, load balancer, ingress controller, origin application server — must keep the backend work a stream has already started counted against the connection's concurrency budget after the client sends RST_STREAM, and must cap the rate of client-initiated stream resets per connection and close connections that exceed it. Rapid Reset works precisely because the HEADERS-then-immediate-RST_STREAM pattern frees the client-visible stream slot while the server's per-stream setup and teardown work is still outstanding: counting only client-visible open streams against MAX_CONCURRENT_STREAMS is what makes the flood free for the attacker and expensive for the server. Because the accounting has to hold on every hop, a patched origin behind a proxy that still counts only open streams is not covered.",
+        "evidence": "Packet: CWE-400; CISA KEV-listed 2023-10-10 with active_exploitation 'confirmed'; RWEP 80 / CVSS 7.5; poc_available true. The packet's vector gives the mechanism verbatim — 'HTTP/2 multiplexing lets a client open a stream (HEADERS) and immediately cancel it (RST_STREAM) before the server responds. Because cancellation is cheap for the client but the server still does per-stream setup/teardown work, an attacker cycles open-then-reset at high rate to exhaust the server with minimal cost' — and names the fix: 'cap the rate of client-initiated stream resets per connection and close abusive connections.' The packet characterizes it as a record-breaking DDoS primitive.",
+        "gap_closes": [
+          "NIS2-Art21-network-security",
+          "DORA-Art-9"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "For Rapid Reset the KEV clock is cheaper to meet than for most KEV entries and is still routinely missed: the packet records patch_available true and remediation as a software update requiring a service restart, not a host reboot, so the fixed HTTP/2 build can land without a host maintenance window. The SLA must therefore be tracked per HTTP/2 terminator in the estate — each reverse proxy, load balancer, CDN edge and application server that speaks HTTP/2 to clients — rather than once against a 'web server' asset class, because a single unpatched terminator in front of otherwise-patched origins still absorbs the entire flood on the estate's behalf.",
+        "evidence": "Packet: cisa_kev true, kev_date 2023-10-10, active_exploitation 'confirmed', poc_available true, patch_available true, live_patch_available false, live_patch_notes 'Remediation is a software update (and, for the smuggling/STARTTLS classes, a server configuration change); no live-patch primitive applies. Service restart, not host reboot.'",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-025",
+        "name": "CONFIGURATION-SIDE-LIVE-PATCH-INVENTORY",
+        "description": "The packet records no live-patch primitive for this class, so the only lever available between the start of a flood and the deployment of the fixed build is configuration-side. Where an HTTP/2 terminator exposes a per-connection reset-rate limit or abusive-connection close as a configuration directive, that directive must be written, tested against a reset flood, and inventoried per product ahead of time, deployable independently of the vendor build; where a terminator exposes no such knob, that fact must be recorded too, because for those hops the fixed build is the only path and the KEV clock is the whole defence. Discovering during an active flood that the reset-limit directive was never exercised on this product is the failure this control exists to prevent.",
+        "evidence": "Packet: live_patch_available false; live_patch_notes 'no live-patch primitive applies. Service restart, not host reboot.' The packet's vector names the fix as capping the rate of client-initiated stream resets per connection and closing abusive connections. CISA KEV-listed 2023-10-10 with active_exploitation 'confirmed' and poc_available true, so the exposure window is not hypothetical.",
+        "gap_closes": [
+          "UK-CAF-D1",
+          "AU-Essential-8-Patch"
+        ]
+      }
+    ]
   },
   "CVE-2022-0492": {
     "name": "Linux Kernel cgroups v1 release_agent Privilege Escalation / Container Escape",
@@ -27878,7 +30600,30 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "human_researcher",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "Windows estates must run the vendor update for this forced-authentication flaw on a KEV-tied clock rather than a CVSS-tiered one. At CVSS 6.5 the entry falls into a 'medium' bucket that most patch policies schedule into a monthly window, while its RWEP is 81 with confirmed in-the-wild exploitation and a public PoC. The clock has to cover every Windows endpoint whose users receive external mail or download archives, not just servers, because the leak fires in Explorer on an ordinary user's desktop. No live-patch path is registered for this product class, so the vendor update plus the compensating controls named alongside it are the only remediation available during the interval.",
+        "evidence": "CISA KEV-listed 2025-04-17 with active_exploitation 'confirmed' and poc_available true, yet CVSS is 6.5 against an RWEP of 81. patch_available is true and live_patch_available is false; the entry's live-patch note states remediation is the vendor update plus the named compensating controls until it lands.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-119",
+        "name": "ARCHIVE-CONTENT-TYPE-PROVENANCE",
+        "description": "The exploit arrives as a .library-ms file inside a ZIP delivered by malspam or a Dropbox link, and the NTLMv2-SSP leak fires while Explorer parses that file when the user merely views or single-clicks the containing folder - nothing is opened or executed. Provenance therefore has to survive archive extraction and gate the handler at parse time: every member extracted from an internet-sourced archive must inherit the internet-provenance marking, and the shell must decide how to handle a library-description file from its verified content rather than from the name shown in the folder. A provenance model that attaches only at download time and gates only execution never reaches this path.",
+        "evidence": "The entry's attack description states the malicious .library-ms is delivered inside a ZIP archive via malspam or a Dropbox link, and that Windows Explorer's parsing - triggered by navigating to, viewing, or single-clicking the containing folder, with no file actually opened - initiates the outbound SMB/NTLM authentication that leaks the victim's NTLMv2-SSP hash.",
+        "gap_closes": [
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2025-31201": {
     "name": "Apple Multiple Products Arbitrary Read and Write Vulnerability",
@@ -28648,7 +31393,30 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "human_researcher",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-054",
+        "name": "BACKUP-TIER-NETWORK-ISOLATION",
+        "description": "The NAKIVO Director web service must be reachable only from the operator subnets that administer it. The vulnerable /c/router dispatcher takes no authentication at all, so network reachability is the entire precondition for the arbitrary file read — there is no credential to strengthen and no session to shorten. Isolation also bounds the second stage: the Director keeps the encryption key in config.properties next to the bundled H2 database holding PhysicalDiscovery credentials for the systems it protects, so a Director reachable from a general-purpose segment is one unauthenticated request away from estate-wide credential disclosure. The backup tier's routes to the hypervisors and hosts it protects should likewise be pull-only from the backup side rather than a standing privileged path an attacker inherits along with the decrypted credentials.",
+        "evidence": "The packet states the Director \"exposes an unauthenticated /c/router dispatcher; the STPreLoadFacade.getImageByPath handler takes an attacker-controlled path, naively rewrites the leading \\\"/c\\\" to \\\"userdata\\\" and passes the result straight to a File read, so an absolute path such as C:/windows/win.ini or /etc/passwd escapes the intended directory and yields arbitrary file read (CWE-36, no auth, network-reachable).\" It further records the escalation: \"the encryption key in config.properties plus the bundled H2 database let an attacker decrypt the PhysicalDiscovery feature's stored cleartext credentials for the systems being backed up,\" pivoting into \"broad credential theft and remote code execution on integrated hypervisors/hosts, which is why the CVSS scope is Changed (8.6).\" live_patch_available is false and the packet states remediation is \"the vendor update plus the named compensating controls until it lands.\"",
+        "gap_closes": [
+          "UK-CAF-B4",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "A backup Director whose compromise yields cleartext credentials for every system it protects cannot sit in a routine 14- or 30-day patch window. Once this entry was KEV-listed the fixed NAKIVO release — which replaces the path handling with FilenameUtils.getName() so any directory component is stripped before the read — has to land on a KEV clock, and where that window cannot be met the compensating control (removing the Director's reachability from non-operator networks) must be documented and actually active in the interim rather than planned. The urgency is compounded by what the update does not do: it stops the read, but it does not invalidate credentials an attacker already decrypted out of the H2 database, so every hour of exposure converts into permanent cleanup rather than recoverable risk.",
+        "evidence": "cisa_kev is true with kev_date 2025-03-19 and active_exploitation confirmed; poc_available is true; patch_available is true and live_patch_available is false. The packet states \"Patched releases replace the path handling with FilenameUtils.getName(), stripping any directory component before the read,\" and that with no live-patch path for this product class \"remediation is the vendor update plus the named compensating controls until it lands.\" CVSS 8.6 with scope Changed, RWEP 70, CWE-36.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      }
+    ]
   },
   "CVE-2025-1316": {
     "name": "Edimax IC-7100 IP Camera OS Command Injection Vulnerability",
@@ -28868,7 +31636,40 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "This NTFS heap overflow reads low on every routine triage input — CVSS 7.8, local vector, user interaction required, and no public PoC — which is exactly the profile a 30-day OS-patch SLA absorbs without comment. The KEV listing plus confirmed in-the-wild use is what should actually set the clock: the packet's own path needs only a delivered disk image and one double-click, and the parsing happens in the file-system driver, so a successful run is an ordinary user to SYSTEM on the host — a ransomware staging position, not a local nuisance. The SLA must therefore be driven off the KEV listing date rather than the CVSS band, and it must run to the reboot that makes the update effective, not to the moment the update is approved. The packet's remediation note is explicit that there is no live-patch path for this product class and that remediation is the vendor update plus compensating controls until it lands; for this delivery path those compensating controls are blocking internet- and mail-sourced disk-image files from reaching users and denying mount of untrusted images, and they are what carries hosts whose reboot cannot be pulled inside the KEV clock.",
+        "evidence": "Packet: cwe_refs CWE-122; cisa_kev true, kev_date 2025-03-11, active_exploitation confirmed; poc_available false; CVSS 7.8 against RWEP 61. vector states an attacker 'crafts a malicious VHD/VHDX (or other disk image) and induces a local user to mount it — Windows auto-mounts a double-clicked VHD through Explorer, so this needs only file delivery plus a single user action (UI:R)', that the parsing happens 'in the file-system driver running with high privilege', and that a successful exploit 'escalates from an ordinary user to SYSTEM, giving full host compromise that can stage ransomware or further implants'. patch_available true; live_patch_available false with live_patch_notes 'No live-patch path for this product class; remediation is the vendor update plus the named compensating controls until it lands.'",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-120",
+        "name": "DOWNLOAD-PROVENANCE-ENFORCEMENT",
+        "description": "The entire exploit precondition is file delivery: a crafted VHD/VHDX has to reach a user's disk and be double-clicked, at which point Explorer auto-mounts it and hands the attacker's on-disk NTFS metadata straight to a high-privilege kernel parser. Provenance enforcement is the control that breaks that step ahead of the reboot. Internet- and mail-sourced files in the mountable-container class (.vhd, .vhdx, .iso and equivalents) must carry Mark-of-the-Web from the gateway through to the endpoint, and the mount action on a provenance-marked image must be blocked outright rather than warned about — a warning dialog is the same single user action the exploit already assumes. A reputation verdict is no substitute here and the control's 'regardless of a reputation service verdict' clause is load-bearing: the malicious bytes are inert file-system metadata, not executable content, so a reputation or detonation service has little to score and the image will look clean right up to the moment it is mounted. This is the only control in the set that works on hosts that cannot be rebooted inside the KEV window.",
+        "evidence": "Packet: vector describes the attacker crafting 'a malicious VHD/VHDX (or other disk image)' and inducing 'a local user to mount it', notes 'Windows auto-mounts a double-clicked VHD through Explorer, so this needs only file delivery plus a single user action (UI:R)', and that 'the malformed NTFS structure causes improper bounds checking in the driver to overflow a heap buffer (CWE-122)'. poc_available false while active_exploitation is confirmed and cisa_kev is true (kev_date 2025-03-11). patch_available true but live_patch_available false, live_patch_notes: 'No live-patch path for this product class; remediation is the vendor update plus the named compensating controls until it lands.'",
+        "gap_closes": [
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-038",
+        "name": "MITIGATION-ACTIVE-PATCH-PENDING-VERDICT-CLASS",
+        "description": "The packet's own remediation note puts this CVE in the state most audit reports cannot express. The vendor update exists, but there is no live-patch path for this product class, so between the KEV listing and the reboot every affected host is running on compensating controls alone. An audit that records 'patched per SLA' the moment the update is approved, downloaded or installed is describing a host whose vulnerable file-system driver is still the loaded, running one — the driver is not replaced until reboot, and this exploit path executes inside that driver. The verdict taxonomy for this entry must separate: rebooted onto the fixed driver; update installed but pre-reboot, with disk-image provenance blocking as the named active compensating control and a time-bound reboot action item; and neither. For estates with long-uptime workstations or servers on quarterly reboot windows, the middle state is where most of the fleet actually lives after a Patch Tuesday, and it is a distinct residual-risk position rather than a pass.",
+        "evidence": "Packet: live_patch_available false with live_patch_notes 'No live-patch path for this product class; remediation is the vendor update plus the named compensating controls until it lands', alongside patch_available true. vector states the flaw is reached 'via the NTFS driver (ntfs.sys) parsing attacker-controlled on-disk metadata' and that 'the parsing happens in the file-system driver running with high privilege'. cisa_kev true, kev_date 2025-03-11, active_exploitation confirmed.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      }
+    ]
   },
   "CVE-2025-24991": {
     "name": "Microsoft Windows NTFS Out-Of-Bounds Read Vulnerability",
@@ -28978,7 +31779,33 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-120",
+        "name": "DOWNLOAD-PROVENANCE-ENFORCEMENT",
+        "description": "The interdictable step in CVE-2025-24985 is delivery, not privilege. The packet states reachability requires a local user to be tricked into mounting an attacker-crafted VHD/VHDX; once mounted, the kernel's own Fast FAT parser reads the malformed metadata and the size miscalculation overflows the heap allocation. Nothing inside the image has to be executed, no prior privileges are needed, and the user is not running anything they would recognise as code — which is exactly why execution-focused endpoint policy misses it. That makes the disk-image container itself a provenance-bearing file class. Requirement: Mark-of-the-Web must survive on VHD/VHDX and equivalent disk images arriving by mail, browser, or chat, and mounting a provenance-marked image must be refused by policy rather than surfaced as a warning the user can click through. A reputation verdict is the wrong gate here — the attacker authors the image, so reputation carries no information about the malformed FAT metadata inside it. On any host that has not yet taken the vendor update this is the only measure that removes exposure, because the packet records no live-patch path for this product class.",
+        "evidence": "Packet vector: 'Reachability requires a local user to be tricked into mounting an attacker-crafted virtual hard disk (VHD/VHDX); when the kernel parses the malformed FAT metadata, the size miscalculation overflows a heap allocation,' and 'Net effect is local code execution gated only by user interaction (the mount), with no prior privileges required.' patch_available true, live_patch_available false, live_patch_notes: 'No live-patch path for this product class; remediation is the vendor update plus the named compensating controls until it lands' — the packet itself states a compensating control is required during the unpatched window, and the mount is the only step in the described chain an operator can interdict. Active_exploitation 'confirmed', CISA KEV-listed 2025-03-11, poc_available true.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "NIS2-Art21-vulnerability-management",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "This is a flaw in an in-box Windows file-system driver, so the affected population is every managed Windows endpoint, not a named server tier — remediation is a fleet rollout problem, and fleet rollouts are exactly what monthly rings slow down. The packet puts it in KEV on 2025-03-11 with confirmed in-the-wild exploitation and a public PoC, and the outcome is kernel-mode code execution escalating an ordinary user to SYSTEM. Requirement: the clock runs from the KEV listing date across the whole endpoint estate, and because the packet records no live-patch path for this product class, the interim state is not 'accepted risk pending the next ring' — it is the compensating control (policy denial of untrusted VHD/VHDX mounts) enforced on every host that has not yet taken the vendor update, with hosts tracked individually until the update lands rather than reported as an aggregate compliance percentage.",
+        "evidence": "Packet: CWE-190 integer overflow in the Windows Fast FAT file-system driver (fastfat.sys) leading to a CWE-122 heap-based buffer overflow, yielding kernel-mode memory corruption that escalates a normal user to SYSTEM. CISA KEV-listed 2025-03-11, active_exploitation 'confirmed', poc_available true. RWEP 79 ranks it above what its CVSS 7.8 alone would place it at. patch_available true; live_patch_available false with live_patch_notes: 'No live-patch path for this product class; remediation is the vendor update plus the named compensating controls until it lands.' The citing gaps (AU-Essential-8-Patch, ISO-27001-2022-A.8.8, NIST-800-53-SI-2, NIS2-Art21-vulnerability-management, UK-CAF-B4) are severity-scheduled remediation controls; none of them re-tiers on KEV listing or on confirmed exploitation.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management",
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2025-24984": {
     "name": "Microsoft Windows NTFS Information Disclosure Vulnerability",
@@ -31805,7 +34632,40 @@
         "adequate": false,
         "gap": "Response and recovery planning must account for the firewall entering maintenance mode under repeated attack, since the perimeter defense device itself becomes unavailable."
       }
-    }
+    },
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-030",
+        "name": "PERIMETER-DEVICE-ZERODAY-SLA-TIER",
+        "description": "The tier as written covers pre-auth RCE on the trust boundary; this CVE shows it has to cover pre-auth availability loss on the same devices. An unauthenticated packet arriving through the firewall's data plane reboots it, and repeated packets drive it into maintenance mode — the trust boundary stops enforcing policy without the attacker ever touching the management plane or holding a credential. A 14/30-day operating-system patch window is meaningless against that: the device whose uptime every other control depends on is remotely switchable-off by anyone who can reach it. The tier requirement for this entry is the vendor PAN-OS update deployed on the KEV clock, or the exposed DNS-inspection path taken out of service until it can be, and there is no live-patch option that avoids the restart.",
+        "evidence": "CISA KEV-listed 2024-12-30 with active_exploitation confirmed; RWEP 58, CVSS 7.5. The packet's vector: 'A Denial of Service vulnerability in the DNS Security feature of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to send a malicious packet through the data plane of the firewall that reboots the firewall. Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode.' patch_available true; live_patch_available false; live_patch_notes null; poc_available false; CWE-754.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-network-security"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-025",
+        "name": "CONFIGURATION-SIDE-LIVE-PATCH-INVENTORY",
+        "description": "The packet conditions the crash on DNS Security logging being enabled, which means there is a configuration-side route out of the exploitable state that does not wait for the PAN-OS update or its restart window. That route is only useful if it was inventoried before the KEV listing: which firewalls have that logging enabled, what detection coverage the organisation gives up while it is off, who is authorised to change it under an incident clock, and how the change is verified on each device. Because live_patch_available is false for this entry, an operator has exactly two options — the configuration change now, or the vendor update plus restart later — and frameworks that only recognise the second leave the hours in between uncovered on an actively exploited firewall.",
+        "evidence": "The packet's attack_vector states the crash occurs 'on devices with DNS Security logging enabled', tying reachability to a configuration state. live_patch_available false and live_patch_notes null — no in-place hot fix is recorded. patch_available true. CISA KEV-listed 2024-12-30, active_exploitation confirmed, RWEP 58, CVSS 7.5.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "AU-Essential-8-Patch"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-031",
+        "name": "FIREWALL-EGRESS-TELEMETRY-SEPARATE-TRUST-ZONE",
+        "description": "The device that would record this attack is the device the attack knocks over. A firewall that reboots on a crafted DNS packet — and that after repeated packets sits in maintenance mode — is not forwarding anything during the window that matters, so on-box threat and system logs are the worst possible place to hold the evidence that an outage was an attack rather than a hardware or software fault. Continuous forwarding of syslog and threat logs to a SIEM in a separate trust zone (separate management plane, separate credentials, separate authentication path) is what converts 'the firewall rebooted again' into a correlated repeat-attempt pattern with source data, and it is what gives responders a timeline while the device itself is unreachable. That matters more here than for a typical exploit because there is no public PoC to signature against — the reboot pattern is the detection.",
+        "evidence": "Per the packet, 'Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode', and the triggering packet arrives unauthenticated through the data plane. poc_available false — no public exploit artifact to build a signature from. CISA KEV-listed 2024-12-30 with active_exploitation confirmed; RWEP 58, CVSS 7.5; CWE-754.",
+        "gap_closes": [
+          "NIST-800-53-SI-4",
+          "UK-CAF-D1"
+        ]
+      }
+    ]
   },
   "CVE-2021-44207": {
     "name": "Acclaim Systems USAHERDS Use of Hard-Coded Credentials Vulnerability",
@@ -32106,7 +34966,40 @@
         "adequate": false,
         "gap": "EU operators running unpatched Windows kernel-mode driver updates past the reboot-requiring maintenance window remain exploitable for privilege escalation; Art. 21 patch management must account for reboot-dependent kernel fixes specifically."
       }
-    }
+    },
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "This is a local elevation of privilege, and at CVSS 7.8 it competes for a patch slot against remotely reachable criticals - but it is KEV-listed with confirmed exploitation and a public PoC, and its function is to convert code execution an intruder already holds into SYSTEM. The KEV clock therefore has to cover the whole workstation and server fleet rather than an internet-facing subset, because the precondition (the attacker already runs code on the host) is satisfied by whatever phishing or commodity-malware step precedes it. No live-patch path is registered for this entry, so a host remains exploitable until the vendor update is actually installed on it - fleet completion, not deployment start, is the measure.",
+        "evidence": "CISA KEV-listed 2024-12-16 with active_exploitation 'confirmed' and poc_available true; CVSS is 7.8 against an RWEP of 77. patch_available is true, live_patch_available is false, and live_patch_notes is null. The entry's attack path begins with a local attacker who already has code execution on the host.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-patch-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-003",
+        "name": "KERNEL-EXPLOITATION-DETECTION",
+        "description": "The escalation happens entirely inside one host: a process the attacker already controls sends a crafted IOCTL_KS_PROPERTY request to the Kernel Streaming Service driver with a manipulated RequestorMode field and comes back running as SYSTEM. There is no network stage to intercept and no privilege the defender can withhold - the caller is an ordinary user process right up until it is not, which is why least privilege is listed as insufficient for this entry. What remains is behavioural detection of the escalation itself: monitoring rules that fire within a minute on kernel-driver IOCTL sequences from unexpected callers and on a process token changing to SYSTEM without a legitimate service-start or elevation path, kept running on patched hosts as well as unpatched ones.",
+        "evidence": "The entry's attack path is a local attacker with code execution on the host issuing a crafted IOCTL_KS_PROPERTY request to the Kernel Streaming Service driver, manipulating the RequestorMode field to bypass a security check so the driver dereferences an attacker-controlled pointer, elevating the calling process to SYSTEM. NIST-800-53-AC-6 (Least Privilege) is among the framework controls this entry already cites as insufficient.",
+        "gap_closes": [
+          "NIST-800-53-AC-6"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-038",
+        "name": "MITIGATION-ACTIVE-PATCH-PENDING-VERDICT-CLASS",
+        "description": "Between the KEV listing and the moment a given host is running the fixed build, this entry has nothing to put in the mitigation column: it registers no live-patch path and no live-patch notes, so there is no interim vendor mitigation to report as active. Audit reporting must place every not-yet-updated host in the 'no mitigation, no patch' class rather than the 'mitigating pending patch' class a vulnerability-management process will otherwise accept, so residual exposure to a kernel LPE with confirmed exploitation is counted as a host list with a time-bound action, not described as remediation in progress.",
+        "evidence": "For this entry live_patch_available is false and live_patch_notes is null, while patch_available is true; active_exploitation is 'confirmed' and it was CISA KEV-listed 2024-12-16.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management"
+        ]
+      }
+    ]
   },
   "CVE-2024-20767": {
     "name": "Adobe ColdFusion Improper Access Control Vulnerability",
@@ -33555,7 +36448,39 @@
         "adequate": false,
         "gap": "Patch Operating Systems (48-hour extreme-risk target) is frequently missed for kernel updates that require coordinated reboot scheduling."
       }
-    }
+    },
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "For this CVE the SLA has to be measured to the restart, not to the download. The packet records no live-patch path, so the fixed kernel code only runs once the update is installed and the host reboots; a fleet whose patch console shows the update applied still contains a population of never-restarted workstations where a standard-user foothold converts to SYSTEM. That population is precisely what an actor already inside the network escalates on, and this flaw has confirmed in-the-wild use by APT34 for exactly that post-compromise step. The clock starts at the KEV listing rather than at the next monthly maintenance cycle, and completion evidence is per-host restart, not per-host package state.",
+        "evidence": "CISA KEV-listed 2024-10-15 with active_exploitation confirmed; RWEP 81, CVSS 7.0; poc_available true; patch_available true; live_patch_available false with live_patch_notes null. Per the packet's attack_vector, 'APT34 leveraged this for post-compromise privilege escalation' after 'A local attacker who already has code execution wins a timing race in the Windows kernel's NtQueryInformationToken handling'. CWE-367 (TOCTOU race condition).",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "NIS2-Art21-patch-management",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-003",
+        "name": "KERNEL-EXPLOITATION-DETECTION",
+        "description": "A check-then-use race in the kernel's NtQueryInformationToken handling drops no file, loads no driver and calls nothing a standard user is not entitled to call — the attacker already has code execution and simply repeats a legitimate token query until the validated token changes inside the window. Winning a race means retrying, so the observable is a burst of repeated token-query activity from a single low-privilege process followed by that process or a child running as SYSTEM; the integrity-level transition, not the API call, is the signature. Kernel-privilege-escalation telemetry with a fast alert is the only control that fires on this path, because least privilege cannot deny the attacker's starting position and the escalation happens entirely inside the kernel.",
+        "evidence": "Per the packet's attack_vector: 'A local attacker who already has code execution wins a timing race in the Windows kernel's NtQueryInformationToken handling — the token is validated (check) and then used after it may have changed (use) — to escalate from a standard user to SYSTEM; APT34 leveraged this for post-compromise privilege escalation.' CWE-367. CISA KEV-listed 2024-10-15, active_exploitation confirmed, poc_available true, RWEP 81, CVSS 7.0.",
+        "gap_closes": [
+          "NIST-800-53-AC-6",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-018",
+        "name": "SCANNER-PAPER-COMPLIANCE-TEST",
+        "description": "The paper-compliance failure specific to this CVE is counting an installed update as a remediated host. With no live-patch path recorded for this entry, the vulnerable kernel keeps executing until the machine restarts, so a scanner or management console reporting 'update applied' can show a clean fleet while every pending-restart host still carries a working standard-user-to-SYSTEM escalation with a public PoC. The operational test: join the patch report to last-boot time per host and count any host whose uptime predates the update installation as unremediated — if the vulnerability-management program cannot produce that number, its remediation percentage for this CVE is unverified rather than achieved.",
+        "evidence": "patch_available true, live_patch_available false, live_patch_notes null; poc_available true; CISA KEV-listed 2024-10-15 with active_exploitation confirmed; RWEP 81, CVSS 7.0. The packet's attack_vector establishes that exploitation requires only that the attacker 'already has code execution' as a local standard user, and records APT34 use for post-compromise privilege escalation.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8"
+        ]
+      }
+    ]
   },
   "CVE-2024-28987": {
     "name": "SolarWinds Web Help Desk Hardcoded Credential Vulnerability",
@@ -35435,7 +38360,41 @@
         "adequate": false,
         "gap": "Least-functionality does not disable unprivileged user namespaces by default on many distros, leaving the exploit precondition present unless kernel.unprivileged_userns_clone is explicitly hardened."
       }
-    }
+    },
+    "new_control_requirements": [
+      {
+        "id": "CONTAINER-HOST-NAMESPACE-ESCAPE-HARDENING",
+        "name": "CONTAINER-HOST-NAMESPACE-ESCAPE-HARDENING",
+        "description": "This flaw is the case the control is written for: the packet's own reachability precondition is that unprivileged user namespaces are enabled (otherwise namespaced CAP_SYS_ADMIN is required), and the escalation is stated to include breaking out of a container — so the namespace boundary provides no containment and the host kernel is the only thing between a tenant workload and root. The two compensating controls named here map one-to-one onto that precondition: disabling unprivileged user namespaces on hosts whose workloads do not need them, and dropping CAP_SYS_ADMIN from container specs, each removes reachability without touching the kernel, which matters for nodes waiting on a change window. Confining every workload with an AppArmor or SELinux profile plus seccomp additionally constrains which filesystem types a confined process can ask the kernel to mount, and mounting a filesystem that falls back to legacy handling is the step that reaches the overflowing parser. On this entry the live-kernel-patch branch of the control is real rather than aspirational, so host remediation and namespace hardening can land on the same day.",
+        "evidence": "vector: heap-based buffer overflow in legacy_parse_param in the Filesystem Context functionality, reachable by 'An unprivileged (in case of unprivileged user namespaces enabled, otherwise needs namespaced CAP_SYS_ADMIN privilege) local user able to open a filesystem that does not support the Filesystem Context API (and thus fallbacks to legacy handling)'. attack_vector: the local user escalates to root 'including breaking out of a container'. cisa_kev true with kev_date 2024-08-21, active_exploitation 'confirmed', poc_available true, RWEP 65, CVSS 8.4. live_patch_available true, live_patch_notes: 'Distros shipped livepatchable fixes for the legacy_parse_param overflow, allowing remediation without an immediate reboot on supported kernels.'",
+        "gap_closes": [
+          "NIST-800-53-CM-7",
+          "UK-CAF-B4",
+          "AU-Essential-8-Patch"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-002",
+        "name": "LIVE-PATCH-CAPABILITY",
+        "description": "This is one of the entries where the live-patch branch is not hypothetical — the packet records distro-shipped livepatchable fixes for the overflowing parser, so a host with kpatch/livepatch already deployed and exercised closes a confirmed-exploited local root escalation the same day, while an otherwise identical host without that capability holds the exposure open until its next reboot window. On container hosts the deferral is the expensive part: because the escalation path breaks out of a container, every tenant workload scheduled onto an unrebooted node stays one local syscall path away from host root for the entire length of the wait, and the node cannot be honestly reported as remediated in the interim. The capability has to be in place before the disclosure rather than procured in response to it, which is why the requirement is deployed-and-quarterly-tested rather than 'use live patching where available' — a livepatch stream that has never been exercised on these kernels will not be trusted enough to apply under time pressure.",
+        "evidence": "live_patch_available true with live_patch_notes: 'Distros shipped livepatchable fixes for the legacy_parse_param overflow, allowing remediation without an immediate reboot on supported kernels.' patch_available also true. cisa_kev true with kev_date 2024-08-21, active_exploitation 'confirmed', poc_available true, RWEP 65 against CVSS 8.4. attack_vector: an unprivileged local user escalates to root, 'including breaking out of a container'.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "AU-Essential-8-Patch",
+          "NIS2-Art21-patch-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-009",
+        "name": "KERNEL-MODULE-INVENTORY-AND-DISABLE",
+        "description": "Reachability here depends on the local user being able to open a filesystem that does not support the Filesystem Context API and therefore falls back to the legacy parameter parser, so the set of legacy filesystem drivers a host will load is the actual attack surface — and a production host or container node typically needs only a handful of them. Inventory which legacy filesystem modules a node can load and blacklist in modprobe the ones no business workload mounts. The scope of that control is narrow and has to be stated: a modprobe blacklist only prevents a future autoload, so it removes the fallback path only for modules that are built as loadable AND are not currently loaded. A driver compiled into the kernel, or one already resident, stays reachable until it is unloaded or the host reboots — for those the blacklist is preparation for the next boot, not a mitigation now, and the node must be counted as unremediated until the kernel update lands. Validate at runtime rather than from the config file: enumerate what /proc/filesystems and the loaded-module list actually show on the node, not what the blacklist intends. The quarterly review is what keeps it honest on container hosts: CSI drivers and storage plugins mount filesystems that cause the HOST kernel to autoload a driver a build-time blacklist never covered, and a blacklist that silently stopped covering a mountable legacy filesystem restores reachability without any alert.",
+        "evidence": "vector: the heap overflow in legacy_parse_param is reached by 'a local user able to open a filesystem that does not support the Filesystem Context API (and thus fallbacks to legacy handling)'. The entry already records NIST-800-53-CM-7 (Least Functionality) as an insufficient framework control. cisa_kev true with kev_date 2024-08-21, active_exploitation 'confirmed', poc_available true.",
+        "gap_closes": [
+          "NIST-800-53-CM-7",
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2021-33045": {
     "name": "Dahua IP Camera Authentication Bypass Vulnerability (CVE-2021-33045)",
@@ -44990,7 +47949,40 @@
         "adequate": false,
         "gap": "A.8.8 technical-vulnerability management had nothing to action at disclosure because no CVE fix existed; the exposure persisted until Microsoft's later cumulative update despite the vulnerability being tracked and exploited."
       }
-    }
+    },
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-120",
+        "name": "DOWNLOAD-PROVENANCE-ENFORCEMENT",
+        "description": "Provenance enforcement is the control that actually breaks this specific exploit path: the spearphished Office document pulls a remote payload through the Windows Search (search-ms) handler precisely so the file's internet origin stops being visible to the shell and the protected-view warning never fires. For a Windows/Office estate, that means Mark-of-the-Web must be enforced on every file arriving by mail or download and must survive the handoff to a protocol handler, and execution of provenance-stripped shortcuts, installers and script hosts must be blocked outright rather than being allowed on a reputation-service verdict — the exploit's entire purpose is to remove the marking that any reputation or warning decision is keyed on. The binary fix for this CVE ships in the Windows/Office cumulative update and requires a reboot, with no live-patch path, so provenance enforcement is what has to hold the affected hosts through the interval before that reboot lands.",
+        "evidence": "The packet's attack_vector: 'A spearphished Office document loads a remote payload that abuses the Windows Search (search-ms) handler to bypass Mark-of-the-Web, causing internet-origin content to execute without the protected-view warning and dropping a RomCom/Underground backdoor.' cisa_kev true, kev_date 2023-07-17, active_exploitation confirmed, poc_available true, CVSS 7.5, RWEP 73. patch_available true but live_patch_available false; live_patch_notes: 'No live-patch path; Microsoft's fix ships in the Windows/Office cumulative update (requires a reboot).'",
+        "gap_closes": [
+          "AU-Essential-8-App-Hardening",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-038",
+        "name": "MITIGATION-ACTIVE-PATCH-PENDING-VERDICT-CLASS",
+        "description": "This CVE is the canonical case for a three-state compliance verdict, because for the whole zero-day window the only defenses available on affected Windows/Office hosts were the FEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATION registry setting and Office ASR rules — vendor-mitigation rules, not a binary patch. An audit that recorded 'registry key deployed by GPO, ASR rules enabled' as remediation would have reported the estate green while every host still carried the vulnerable search-ms code path, one defect or one policy-scope miss in those rules away from the same Mark-of-the-Web bypass. The verdict class must record those hosts as state (b) — mitigation active, patch pending — with a time-bound action item that only clears when the Windows/Office cumulative update and its reboot have actually landed, and it must not let the registry-plus-ASR posture be filed as 'patched per SLA'.",
+        "evidence": "live_patch_notes for this entry: 'No live-patch path; Microsoft's fix ships in the Windows/Office cumulative update (requires a reboot). During the zero-day window the only mitigation was the FEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATION registry setting and Office ASR rules.' live_patch_available false, patch_available true. cisa_kev true, kev_date 2023-07-17, active_exploitation confirmed.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-patch-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-041",
+        "name": "PROTECTION-MECHANISM-FAILURE-CLASS-REGRESSION",
+        "description": "What this CVE defeats is not a data-handling bug but a protection mechanism itself — Mark-of-the-Web and the protected-view warning that depends on it — so remediation cannot end when the Windows/Office cumulative update is installed. The search-ms cross-protocol file-navigation primitive must be added as a permanent case in the detonation-chamber and ASR/AppLocker regression battery for the MOTW class and re-run on every subsequent cumulative update, because that update requires a reboot and changes the very shell code path under test. The same two artifacts the packet names as the zero-day-window mitigation — the FEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATION registry setting and the Office ASR rules — are what the regression run has to keep proving still take effect, rather than being retired from the test set once this CVE is marked closed.",
+        "evidence": "attack_vector records a Windows Search (search-ms) handler abuse that bypasses Mark-of-the-Web so internet-origin content executes without the protected-view warning. live_patch_notes names the FEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATION registry setting and Office ASR rules as the zero-day-window mitigation, and states the fix ships in the Windows/Office cumulative update requiring a reboot. poc_available true; cisa_kev true, kev_date 2023-07-17, active_exploitation confirmed.",
+        "gap_closes": [
+          "AU-Essential-8-App-Hardening",
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2022-29303": {
     "name": "SolarView Compact Command Injection Vulnerability",