@blamejs/exceptd-skills 0.19.6 → 0.19.7

package/data/zeroday-lessons.json

@@ -1,7 +1,7 @@
 {
   "_meta": {
     "schema_version": "1.1.0",
-    "last_updated": "2026-08-08",
+    "last_updated": "2026-08-09",
     "last_threat_review": "2026-05-17",
     "purpose": "Zero-day learning loop output. Each entry maps a CVE to: attack vector, defense chain analysis, framework coverage, new control requirements generated, and exposure scoring. v1.1.0 (2026-05-15): every entry now carries ai_discovered_zeroday boolean + ai_discovery_source enum + ai_discovery_date + ai_assist_factor ladder, per AGENTS.md Hard Rule #7.",
     "note": "Never delete entries. Closed gaps are marked status: closed. History is data.",
@@ -2545,7 +2545,40 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "human_researcher",
-    "ai_assist_factor": "low"
+    "ai_assist_factor": "low",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-036",
+        "name": "FLEET-CONTROL-PLANE-ADMIN-PRIVILEGE-TIER",
+        "description": "ScreenConnect is not an application server that happens to have admins — it is the control plane for every endpoint the affected MSP manages, and this CVE is what that distinction costs. The bypass is a URL suffix: appending /SetupWizard.aspx/anything defeats the auth filter and lands an unauthenticated caller in the admin setup endpoint, where a new admin account is created. No credential is guessed and no session is stolen, so console password policy, admin-account review and MFA-on-the-console all attest green while the takeover proceeds. What actually bites is treating ScreenConnect administration as a privilege tier above application admin: the admin and setup surface reachable only through a PAM jumphost rather than from the open internet (so /SetupWizard.aspx is not addressable by the attacker at all), and fleet-control-plane admin identities enumerated separately from every other admin role, so an account that appears without passing the just-in-time elevation and approval workflow is a detectable anomaly rather than one more row in the user table.",
+        "evidence": "Packet: cwe_refs CWE-287 + CWE-288, cvss 10, rwep_score 75, cisa_kev true, kev_date 2024-02-22, active_exploitation confirmed, poc_available true, patch_available true, live_patch_available false, live_patch_notes null. Attack vector as recorded: \"Path-traversal in the auth filter — appending /SetupWizard.aspx/anything to a request URL bypasses authentication and reaches the admin setup endpoint. Attacker creates a new admin account via the setup endpoint and gains full ScreenConnect control, including the ability to push remote-control payloads to every endpoint the affected MSP manages.\"",
+        "gap_closes": [
+          "UK-CAF-B2",
+          "NIST-800-53-AC-3",
+          "CIS-Controls-v8-Control6",
+          "ISO-27001-2022-A.5.15"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-037",
+        "name": "FLEET-COMPROMISE-IR-PLAYBOOK",
+        "description": "The vendor patch removes the bypass; it does not remove the admin account the bypass created, and it does not recall the payloads already pushed through that account. Because the packet's exploitation path ends at pushing remote-control payloads to every endpoint the affected MSP manages, one unpatched ScreenConnect server is not one compromised host — it is the whole downstream estate, and the response work is fleet-shaped rather than server-shaped. The runbook has to enumerate every admin account and remote session created since the exposure window opened, audit what was executed on managed endpoints during it, carry explicit quarantine criteria for endpoints that received a payload, and rotate credentials used on or through those endpoints. This has to be pre-rehearsed: an MSP discovering the compromise on the KEV date cannot start writing downstream-quarantine criteria while the attacker still holds an admin session.",
+        "evidence": "Packet: cisa_kev true, kev_date 2024-02-22, active_exploitation confirmed, poc_available true, cvss 10, rwep_score 75, patch_available true. Attack vector as recorded: the attacker \"creates a new admin account via the setup endpoint and gains full ScreenConnect control, including the ability to push remote-control payloads to every endpoint the affected MSP manages.\"",
+        "gap_closes": [
+          "UK-CAF-B2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "At CVSS 10 this reaches the top of any severity-ranked queue, so the question is not ranking but when the clock starts. The exploit primitive is a URL suffix with a public PoC — no chain to assemble, no credential to obtain, no user action to arrange — and it was KEV-listed 2024-02-22 with confirmed in-the-wild exploitation, so the interval between an operator's next maintenance window and an attacker's next internet scan is not a fair race. A patch SLA measured from the operator's monthly cycle is therefore the wrong instrument for a ScreenConnect instance: the clock has to start at the KEV listing, and where the restart cannot be booked inside it, the alternative is removing the instance from the internet, because the packet records no live-patch path for this entry.",
+        "evidence": "Packet: cisa_kev true, kev_date 2024-02-22, active_exploitation confirmed, cvss 10, rwep_score 75, poc_available true, patch_available true, live_patch_available false, live_patch_notes null, cwe_refs CWE-287 + CWE-288.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "NIS2-Art21-patch-management"
+        ]
+      }
+    ]
   },
   "CVE-2026-20182": {
     "name": "Cisco SD-WAN authentication bypass to admin",
@@ -2600,7 +2633,40 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "human_researcher",
-    "ai_assist_factor": "low"
+    "ai_assist_factor": "low",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-036",
+        "name": "FLEET-CONTROL-PLANE-ADMIN-PRIVILEGE-TIER",
+        "description": "A Cisco SD-WAN controller is not an application server that happens to have administrators — vManage is the policy plane for the whole WAN fabric, and this CVE is what that distinction costs. Because the bypass lands an unauthenticated caller in admin-equivalent state, every identity-layer attestation the operator holds stays green while the takeover proceeds: no credential is guessed, no session is stolen, and password policy, admin-account review and MFA-on-the-console are all evaluated on a login that never happens. The control that actually bites is treating controller administration as a privilege tier above application admin — the vManage/vEdge management surface reachable only through a PAM jumphost or operator network rather than from an untrusted one, so the bypassable endpoint is not addressable by the attacker at all; and fabric-control-plane admin identities enumerated separately from every other admin role, so an admin principal that appears on the controller without passing just-in-time elevation and the approval workflow is a detectable anomaly rather than one more row in the user table.",
+        "evidence": "Packet: cwe_refs CWE-287, cvss 10, rwep_score 65, cisa_kev true, kev_date 2026-05-14, active_exploitation confirmed, poc_available false, patch_available true, live_patch_available false, live_patch_notes null. Attack vector as recorded: \"Authentication bypass in the Cisco SD-WAN controller management plane (vManage / vEdge). An unauthenticated attacker reaches admin-equivalent state on the controller, giving control over the SD-WAN fabric's policy plane.\" The citing gaps recorded against this entry include NIST-800-53-IA-2, ISO-27001-2022-A.5.15 and UK-CAF-B2 — all three are marked insufficient here because the bypass resolves before the authentication control fires.",
+        "gap_closes": [
+          "UK-CAF-B2",
+          "ISO-27001-2022-A.5.15",
+          "NIST-800-53-IA-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "This entry is the case that a PoC-keyed remediation tier gets wrong. The packet records poc_available false alongside active_exploitation confirmed, so any SLA ladder whose fast lane opens on \"public exploit code exists\" routes a CVSS 10 controller takeover into a slow bucket while it is already being used. Keying the clock to the KEV listing itself — mitigation verified within 4 hours of listing or fix availability, whichever is later — is what puts this on the right lane. The packet records a vendor fix as available and no live-patch path, so the deliverable inside that window is the controller upgrade itself, and where the fabric's change-control cannot absorb a controller upgrade that fast, the SLA must be satisfied by the documented compensating control instead: withdrawing the vManage/vEdge management plane from untrusted reachability until the fixed build is on it. Recording \"scheduled for the next maintenance window\" is not a satisfied SLA under this control.",
+        "evidence": "Packet: cisa_kev true with kev_date 2026-05-14, active_exploitation confirmed, poc_available false, cvss 10, rwep_score 65, patch_available true, live_patch_available false, live_patch_notes null. The NIS2-Art21-network-security gap recorded against this entry states that Article 21 sets no CISA-KEV-tied response SLA for network-fabric controllers, so an operator can claim compliance with a generic 30-day patch SLA on this infrastructure; the DORA-Art-9 gap records that vendor-disclosure-to-action tempo is not differentiated per ICT-third-party-service category.",
+        "gap_closes": [
+          "NIS2-Art21-network-security",
+          "DORA-Art-9"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "Upgrading the controller closes the bypass and says nothing about what was done through it. Admin-equivalent state on an SD-WAN controller is exercised through the product's own legitimate functions — creating administrative accounts and API tokens, and editing the fabric policy and device templates that the controller pushes down to edge devices — so the attacker's artifacts are ordinary controller objects and ordinary pushed configuration, which no version scan and no malware signature will flag after the fixed build is installed. Any controller that was reachable from an untrusted network on a vulnerable build therefore has to be dispositioned as compromised rather than as remediated: export and diff the running controller configuration, policy definitions and device templates against the last known-good, audit every administrative account, token and template change since the exposure window opened, rotate the controller's local administrative credentials and the certificate and shared-secret material it holds for fabric membership, and re-verify the configuration actually resident on the edge devices rather than trusting the controller's own view of it.",
+        "evidence": "Packet: active_exploitation confirmed with cisa_kev true (kev_date 2026-05-14) — an exposed unpatched controller is an exploitation opportunity, not a hypothetical. The vector as recorded gives the attacker \"admin-equivalent state on the controller, giving control over the SD-WAN fabric's policy plane\" without authentication (CWE-287), so the post-exploitation actions are taken as a controller principal. patch_available true with live_patch_available false. The NIST-800-53-IA-2 gap recorded against this entry names the failure directly: an auth bypass that mints a privileged account satisfies whatever MFA policy applies, because the bypass happened at the create-account step rather than the login step, and its stated requirement is that privileged-account creation be audited independently of the MFA policy.",
+        "gap_closes": [
+          "NIST-800-53-IA-2",
+          "NIS2-Art21-network-security"
+        ]
+      }
+    ]
   },
   "CVE-2024-40635": {
     "name": "containerd integer overflow IP mask leak",
@@ -7742,7 +7808,32 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "Kentico Xperience sites must be moved to the vendor-fixed release on a clock started by the KEV listing rather than on a CMS-upgrade cycle, and the Staging Sync Server upload path named in the packet is the surface that sets the priority — that is where the traversal writes arbitrary data to path-relative locations. Because there is no live-patch path for this entry and the vendor fix requires a service restart or reboot, the SLA must cover the restart, not just the package upgrade. Where the restart cannot be taken inside the clock, the only remaining action is removing the staging/sync endpoint from untrusted network reach, since it is the reachable surface and no hot-fix option exists; leaving it reachable pending an upgrade window is exposure, not mitigation.",
+        "evidence": "Packet: Kentico Xperience path traversal (CWE-22) with unrestricted file upload (CWE-434). The packet's vector states the flaw 'could allow an authenticated user's Staging Sync Server to upload arbitrary data to path relative locations', and its attack_vector characterizes the result as writing a file outside the intended directory (e.g. a web shell) for code execution. CVSS 7.5, RWEP 77, poc_available true. CISA KEV-listed 2026-04-20 with active_exploitation confirmed. patch_available true; live_patch_available false, with the note that the vendor patch typically requires service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "For a Kentico Xperience instance that was reachable and unpatched while this CVE was being exploited, upgrading the CMS is not remediation. What this vulnerability produces is a file of the attacker's choosing written outside the intended directory — a web shell placed in the site tree survives the upgrade untouched and keeps serving requests afterwards. The response default must therefore be to treat the deployed web root and every writable content/media directory as attacker-modifiable: compare the live tree against the known-good deployment artifact, redeploy the site host from source of truth rather than patching in place, and rotate the credentials reachable from that foothold, including the CMS administrator accounts and the staging/sync credentials the affected endpoint uses. The distinguishing test is whether the upgrade record is accompanied by a file-integrity comparison of the deployed site tree; an upgrade ticket on its own cannot show the dropped file was removed.",
+        "evidence": "Packet: CWE-22 combined with CWE-434, described as letting an attacker write a file outside the intended directory (e.g. a web shell) for code execution via the Staging Sync Server upload path. CISA KEV-listed 2026-04-20 with active_exploitation confirmed and poc_available true, so exposed instances were being exploited before the fix was applied. patch_available true (restart or reboot required per the packet's live_patch_notes), which is precisely what makes patch-in-place the default operators reach for and why the gap matters.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "NIST-800-53-SI-2",
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2023-27351": {
     "name": "PaperCut NG/MF Improper Authentication Vulnerability",
@@ -8054,7 +8145,21 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "For this TeamCity flaw the SLA clock is unusual in shape and that is what makes the control bite: the vendor patch already exists, so the trigger is the 2026-04-20 KEV listing itself, and remediation is due within four hours of that listing rather than at the next build-infrastructure maintenance window. Two properties of this specific entry make a routine cadence unsafe. First, the flaw is a relative path traversal that lets an attacker reach restricted endpoints and bypass authentication without credentials, so an exposed TeamCity server has no login barrier buying time while a change ticket ages. Second, the packet records that the vendor patch requires a service restart with no live-patch option — meaning a CI/CD platform whose restarts are treated as change-controlled outage events will breach the four-hour SLA by process alone unless a pre-approved emergency restart path for the build server exists before the next KEV listing arrives.",
+        "evidence": "cisa_kev true with kev_date 2026-04-20 and active_exploitation confirmed; poc_available true; rwep_score 83 against cvss 7.5; patch_available true, live_patch_available false, live_patch_notes: 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.' attack_vector: 'a relative path-traversal flaw (CWE-23) letting an unauthenticated attacker reach restricted endpoints and bypass authentication.'",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-handling"
+        ]
+      }
+    ]
   },
   "CVE-2026-34197": {
     "name": "Apache ActiveMQ Improper Input Validation Vulnerability",
@@ -8276,7 +8381,20 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "Put the on-premises SharePoint Server farm on a clock that starts at the 2026-04-14 KEV listing rather than on the routine monthly server-patch ring. The exploitation path needs no account — the packet describes improper input validation reachable by an unauthorized attacker over the network — so tightening user access or admin rights does not defer the deadline. The remediation the packet actually records is the vendor patch with no live-patch path, and it notes the fix typically requires a service restart or system reboot per the KEV requiredAction. For a farm that means the SLA is met only when every web front-end and application server has been restarted onto the fixed build: a farm where the update is staged but the services were never recycled is unremediated, and must not be reported as patched-per-SLA. Where the restart cannot be completed inside the window, the deferral is a documented exposure with a time-bound action item, not a compensating control.",
+        "evidence": "cisa_kev is true with kev_date 2026-04-14 and active_exploitation 'confirmed'; CVSS 8.8, RWEP 77, poc_available true. The packet's vector states that Microsoft SharePoint Server contains an improper input validation vulnerability (CWE-20) that allows an unauthorized attacker to perform spoofing over a network, with the attack_vector recording that it is reachable by an unauthorized attacker and leads to compromise of the SharePoint server. patch_available is true, live_patch_available is false, and live_patch_notes states that no live-patch tool is registered and that the vendor patch typically requires service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management",
+          "NIST-800-53-SI-2"
+        ]
+      }
+    ]
   },
   "CVE-2012-1854": {
     "name": "Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability",
@@ -8386,7 +8504,22 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "For a Windows estate this flaw's remediation clock has to start at the KEV listing rather than at the next monthly patch ring, and the control has to be written so it survives the reboot dependency. The packet records a vendor fix as available but no live-patch path, with the patch landing only across a service restart or system reboot per the KEV requiredAction — so meeting a KEV-tied deadline on this CVE means a pre-authorized emergency restart deadline with user deferral disabled, not merely 'update approved in the ring'. Until a host is on the fixed build AND has rebooted, any local foothold on it can still redirect a privileged operation through the link-following path to reach SYSTEM, which is why the control's fallback state — documented compensating controls, with the host tracked as unremediated — must be recorded per host rather than the fleet being reported as patched once the update is published.",
+        "evidence": "The packet records CISA KEV listing on 2026-04-13 with active_exploitation 'confirmed' and poc_available true; RWEP 77 against CVSS 7.8, so real-world priority is driven by in-the-wild use rather than the base score. It describes a link-following / symlink-handling flaw (CWE-59) in a Windows component, exploited from a local foothold to redirect a privileged operation and gain SYSTEM, and notes that LPEs of this class are routinely paired with an initial-access flaw by ransomware operators. patch_available is true, live_patch_available is false, and live_patch_notes states that no live-patch tool is registered for this entry and that the vendor patch typically requires a service restart or system reboot per the KEV requiredAction. All five citing gaps (NIST SP 800-53 SI-2 Flaw Remediation, ISO/IEC 27001:2022 A.8.8, NIS2 Art 21 vulnerability handling and disclosure, ASD Essential Eight patch operating systems, UK CAF B4 system security) require timely remediation without binding a clock to confirmed exploitation.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management",
+          "NIST-800-53-SI-2",
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2023-21529": {
     "name": "Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability",
@@ -8840,7 +8973,41 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-MDM-GATEWAY-UNAUTH-CONFIG-ENDPOINT-NEUTRALIZE-AND-CONTAIN",
+        "name": "DEVICE-MANAGEMENT-GATEWAY-CONFIG-ENDPOINT-AUTH-INPUT-NEUTRALIZATION",
+        "description": "Ivanti EPMM is the device-management gateway itself, and this flaw reaches remote code execution on its management surface with no credentials at all - the injected code is interpreted before any authentication decision is made. Every EPMM message and configuration endpoint has to authenticate the caller before processing, neutralize injected code ahead of any interpreter or command sink, and no EPMM instance may be left with those endpoints reachable from an untrusted network. Distinguishing test: from an unauthenticated client on a staging EPMM, send each endpoint a payload that attempts code execution and confirm refusal before any interpreter runs. Because exploitation is confirmed, an instance whose endpoints were exposed before remediation also needs forensic triage rather than a patch-and-close.",
+        "evidence": "Packet: 'Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability that could allow attackers to achieve unauthenticated remote code execution'; attack_vector 'code injection (CWE-94) yielding unauthenticated remote code execution on the EPMM management surface'; cvss 9.8; poc_available true; cisa_kev true, kev_date 2026-04-08, active_exploitation confirmed.",
+        "gap_closes": [
+          "NIST-800-53-AC-6",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "EPMM was KEV-listed 2026-04-08 with exploitation confirmed and a public PoC, so the remediation window is hours rather than the routine patch cycle the framework controls assume. The packet records a vendor patch as available and no live-patch tool registered, with the vendor fix typically needing a service restart or system reboot per the KEV requiredAction - so the SLA for this entry must be written against a scheduled EPMM service outage, not against a hot-apply. Any EPMM instance that cannot take that restart inside the window has to be pulled off untrusted networks until it can, because there is no in-place mitigation path recorded here.",
+        "evidence": "Packet: cisa_kev true; kev_date 2026-04-08; active_exploitation confirmed; rwep_score 77; poc_available true; patch_available true; live_patch_available false; live_patch_notes 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.'",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "NIST-800-53-SI-2",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-037",
+        "name": "FLEET-COMPROMISE-IR-PLAYBOOK",
+        "description": "EPMM is the control plane for a managed mobile fleet, so unauthenticated code execution on it is a fleet-wide event rather than a single-host one: whoever holds the server inherits its ability to push configuration profiles and certificates to every enrolled device. For an instance that was reachable during the confirmed-exploitation window, installing the vendor patch closes the injection path but leaves any profile pushed, certificate issued, or credential that transited the server untouched. The playbook must cover EPMM-pushed certificate revocation, device-trust-state invalidation, an audit of configuration profiles changed since the exposure window opened, quarantine criteria for enrolled devices, and rotation of every account that authenticated through the server during that period.",
+        "evidence": "Packet: Ivanti Endpoint Manager Mobile (EPMM); unauthenticated remote code execution on the EPMM management surface (CWE-94); cisa_kev true, kev_date 2026-04-08, active_exploitation confirmed; patch_available true.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "AU-Essential-8-Patch"
+        ]
+      }
+    ]
   },
   "CVE-2026-35616": {
     "name": "Fortinet FortiClient EMS Improper Access Control Vulnerability",
@@ -8993,7 +9160,30 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-SUPPLYCHAIN-SIGNED-INSTALLER-INTEGRITY",
+        "name": "INDEPENDENT-INTEGRITY-VERIFICATION-OF-SIGNED-VENDOR-INSTALLERS",
+        "description": "TrueConf Client fetches update code without verifying its integrity, so nothing on the client side distinguishes the vendor's build from one substituted by an attacker who has gained influence over the delivery path. The operator response is to stop letting the in-app updater be the trust decision: pull TrueConf Client builds through managed software distribution, verify each build against an integrity source independent of the download itself — vendor-published per-release hashes obtained over a separate channel, or a behavioural baseline of the installed binaries — and only then push it to endpoints. This is the harder form of the control's premise: the original lesson was that a valid signature is not proof of integrity, whereas here the client performs no verification step at all, so an out-of-band check is the only thing standing between a tampered payload and execution in the updating process's context.",
+        "evidence": "The packet records a \"download of code without integrity check vulnerability\" (CWE-494) in which \"An attacker who is able to influence the update delivery path can substitute a tampered update payload. If the payload is executed or installed by the updater, this may result in arbitrary code execution in the context of the updating process or user,\" and identifies the delivery-path influence as \"a hijacked update endpoint or machine-in-the-middle.\" CISA KEV-listed 2026-04-02 with active_exploitation confirmed, poc_available true, CVSS 8.8, RWEP 77.",
+        "gap_closes": [
+          "UK-CAF-B4",
+          "NIS2-Art21-network-security"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "The KEV clock here governs a client fleet rather than a single server: every endpoint running TrueConf Client is independently exploitable by whoever can influence its update fetch, so the fixed client has to reach all of them on the KEV window rather than on the ordinary endpoint-software refresh cycle. Two facts make the rollout a scheduled fleet action rather than a background update — the packet registers no live-patch tool for this entry, and the vendor patch typically requires a service restart or system reboot per the KEV requiredAction. Until the fixed build is present on a given endpoint, the interim posture is to keep that endpoint's updater off networks where the delivery path can be influenced, because the vulnerable client will accept whatever the channel returns.",
+        "evidence": "cisa_kev is true with kev_date 2026-04-02 and active_exploitation confirmed; poc_available is true; patch_available is true and live_patch_available is false, with the packet noting \"No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.\" The exploitation precondition per the packet is an attacker who \"can influence the download channel (a hijacked update endpoint or machine-in-the-middle).\" CVSS 8.8, RWEP 77, CWE-494.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      }
+    ]
   },
   "CVE-2026-5281": {
     "name": "Google Dawn Use-After-Free Vulnerability",
@@ -9309,7 +9499,32 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-055",
+        "name": "SECURITY-TOOL-INTEGRITY-VERIFICATION",
+        "description": "Trivy is the scanner, not the scanned: it is invoked inside pipelines with broad read access precisely so it can inspect everything, which places it outside the asset inventory and patch SLA that the citing controls apply to production software. This CVE inverts that trust anchor — per the packet a Trivy distribution/component carried embedded malicious code (CWE-506) that executes in the vulnerability scanner's own trusted context in every environment it runs in. The control means enrolling the Trivy build deployed in each pipeline as a first-class inventoried asset with the same SLA as any other privileged software, pinning the version the pipeline resolves instead of a floating reference, requiring TLS with certificate pinning on the tool's update and vulnerability-database fetch channels, and running the trust-anchor-inversion audit test: execute the scanner against a crafted input in a sandbox and confirm it is rejected rather than trusted. Remediation per the packet: patch_available is true but live_patch_available is false, and live_patch_notes record that the vendor patch typically requires a service restart or system reboot per the KEV requiredAction — so the fix is a pipeline-image/binary replacement with restart, not an in-place hot fix. Because the packet's vector states the attacker reaches every token, SSH key, cloud credential, database password and in-memory configuration in the CI/CD environment, every secret a Trivy step could read during the exposure window must be treated as disclosed.",
+        "evidence": "Packet CVE-2026-33634 \"Aquasecurity Trivy Embedded Malicious Code Vulnerability\", cwe_refs CWE-506; cisa_kev true with kev_date 2026-03-26; active_exploitation confirmed; rwep_score 77; cvss 8.8; poc_available true. vector: \"Aquasecurity Trivy contains an embedded malicious code vulnerability that could allow an attacker to gain access to everything in the CI/CD environment, including all tokens, SSH keys, cloud credentials, database passwords, and any sensitive configuration in memory.\" attack_vector: \"a Trivy distribution/component contained embedded malicious code (CWE-506), executing in the trusted context of the vulnerability scanner across every environment it runs in.\" patch_available true; live_patch_available false; live_patch_notes: \"No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.\"",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-SUPPLYCHAIN-SIGNED-INSTALLER-INTEGRITY",
+        "name": "INDEPENDENT-INTEGRITY-VERIFICATION-OF-SIGNED-VENDOR-INSTALLERS",
+        "description": "The defect here is not a coding mistake in Trivy that a newer release fixes by accident — per the packet the malicious code was embedded in what shipped as a Trivy distribution/component. Every downstream check that derives its verdict from the distribution channel itself (publisher signature, registry provenance, an \"official\" designation) returns valid on that artifact, so a pipeline that gates promotion on signature validity promotes the payload. The control means the Trivy release a pipeline is about to adopt must be verified against an integrity source independent of the channel that delivered it: per-release hashes obtained through a separate channel, a reproducible-build attestation, or a behavioural baseline of the scanner binary — a scan step that begins reading credential paths and opening outbound connections beyond its vulnerability-database fetch is an integrity diff, not scanner noise. Gate promotion on that independent check, and treat any Trivy version bump as a supply-chain change requiring it. Remediation shape per the packet: patch_available true, live_patch_available false, with the vendor patch requiring a service restart or system reboot per the KEV requiredAction.",
+        "evidence": "Packet CVE-2026-33634, cwe_refs CWE-506 (embedded malicious code) with attack_vector \"a Trivy distribution/component contained embedded malicious code (CWE-506), executing in the trusted context of the vulnerability scanner across every environment it runs in\"; cisa_kev true, kev_date 2026-03-26; active_exploitation confirmed; poc_available true; rwep_score 77; cvss 8.8; ai_discovered false. patch_available true; live_patch_available false; live_patch_notes: \"No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.\"",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      }
+    ]
   },
   "CVE-2026-25592": {
     "name": "Microsoft Semantic Kernel SessionsPythonPlugin Path Traversal — Prompt-Injection to Host RCE",
@@ -12375,7 +12590,20 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "The delivery path is ordinary mail. The packet records abuse of CSS @import directives in email HTML against the ZCS Classic UI, so exploitation requires only that a message reaches a mailbox and the recipient opens it in the web client — the attacker needs no account, no network position and no interaction beyond normal mail reading. That is why the CVSS 6.1 rating misleads a severity-ranked patch queue: the score reflects the impact ceiling of script execution in one session, while the real-world priority (RWEP 77, KEV-listed 2026-03-18, confirmed in-the-wild exploitation, public PoC) reflects that every Classic UI user is reachable by anyone who can send them email. The remediation cost is exactly what keeps such a queue deferring it — the packet records no live-patch tool for this entry and states the vendor patch typically requires a service restart or system reboot per the KEV requiredAction, so closing it means booking a mail-service outage. The SLA therefore has to be pinned to the KEV listing date rather than the CVSS band, because a message that exploits it may already be sitting in mailboxes.",
+        "evidence": "Packet: cwe_refs CWE-79, cvss 6.1, rwep_score 77, cisa_kev true, kev_date 2026-03-18, active_exploitation confirmed, poc_available true, patch_available true, live_patch_available false, live_patch_notes \"No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.\" Vector as recorded: \"Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability in the Classic UI where attackers could abuse Cascading Style Sheets (CSS) @import directives in email HTML.\" Attack vector: \"a cross-site scripting flaw (CWE-79) on the ZCS web client, letting an attacker run script in a victim's authenticated session.\"",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management"
+        ]
+      }
+    ]
   },
   "CVE-2026-20963": {
     "name": "Microsoft SharePoint Deserialization of Untrusted Data Vulnerability",
@@ -12519,7 +12747,21 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "This Wing FTP entry is the case that a severity-banded patch policy silently drops. It scores CVSS 5.5 because the payoff is only the disclosure of the installation / local file path, so any remediation queue keyed to High-and-Critical never schedules it — yet it is KEV-listed with confirmed in-the-wild exploitation, a public PoC, and an RWEP of 77, and the disclosed path is the reconnaissance input that makes a follow-on attack on the same file server land. The SLA must therefore be triggered by KEV membership rather than the CVSS band, starting at the 2026-03-16 listing since the vendor fix already exists. Two specifics of this entry shape the four-hour response: the trigger is a single crafted request — an oversized or malformed UID cookie against loginok.html — so there is no exploitation toolchain slowing an attacker down, and the vendor patch needs a service restart with no live-patch option, which means the restart of an internet-facing file-transfer service must be pre-authorized rather than negotiated inside the SLA window.",
+        "evidence": "cvss 5.5 but rwep_score 77; cisa_kev true with kev_date 2026-03-16 and active_exploitation confirmed; poc_available true. attack_vector: 'Generation of an error message containing sensitive information (CWE-209) in Wing FTP Server: an oversized or malformed UID session cookie triggers an error (on loginok.html) that discloses the installation / local file path, aiding a follow-on attack.' patch_available true, live_patch_available false, live_patch_notes: 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.'",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      }
+    ]
   },
   "CVE-2026-3910": {
     "name": "Google Chromium V8 Improper Restriction of Operations Within the Bounds of a Memory Buffer Vulnerability",
@@ -13192,7 +13434,31 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-056",
+        "name": "MOBILE-ENDPOINT-MDM-ENFORCED-KEV-SLA",
+        "description": "The affected surface here is the general-purpose Apple estate — macOS, iOS, iPadOS and Safari — where Apple ships the fix but it only reaches a device when a user accepts a restart, and this class of flaw is reached simply by rendering a web page. Enforce the update through device management against a hard deadline measured from the 2026-03-05 KEV listing rather than a notification: push a declarative software-update deadline, remove the deferral option, and quarantine devices past the deadline from organisational data. A management console that reports how many devices are behind is not the control — the enforcement is. The citing patch controls are satisfied by an estate-wide policy existing; this entry is exploited on the individual handset that deferred.",
+        "evidence": "The packet's vector states that Apple macOS, iOS, iPadOS, and Safari 16.6 contain the use-after-free, triggered by processing maliciously crafted web content. cisa_kev is true with kev_date 2026-03-05, active_exploitation is 'confirmed', poc_available is true, RWEP is 77 at CVSS 8.8. patch_available is true and live_patch_available is false, with live_patch_notes recording that remediation requires a service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-121",
+        "name": "MOBILE-ZERO-CLICK-HARDENING",
+        "description": "Reachability is ordinary web-content rendering, so the exposure is live for anyone who opens a page or previews a link in the interval between disclosure and the device actually restarting — and the packet places this class in targeted-spyware chains, which means a named cohort (executives, legal, journalists, security staff) carries far more of the risk than the estate average. Put that cohort in the platform's reduced-attack-surface mode (Lockdown Mode) as standing configuration, not as an incident response, so the complex web-content processing paths this use-after-free is reached through are not exercised at all. This is compensating cover for the gap between disclosure and restart — the Apple update still has to land, and NEW-CTRL-056 is what makes it land.",
+        "evidence": "vector records a use-after-free arising from the processing of maliciously crafted web content across Apple macOS, iOS, iPadOS and Safari 16.6. attack_vector records its role as a sandbox-escape step in an exploit chain and notes that Apple zero-days of this class are typically used in targeted-spyware chains. active_exploitation is 'confirmed', cisa_kev true with kev_date 2026-03-05, poc_available true.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2021-30952": {
     "name": "Apple Multiple Products Integer Overflow or Wraparound Vulnerability",
@@ -13326,7 +13592,30 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-056",
+        "name": "MOBILE-ENDPOINT-MDM-ENFORCED-KEV-SLA",
+        "description": "This is an iOS/iPadOS use-after-free that yields arbitrary code execution with kernel privileges, KEV-listed 2026-03-05 with exploitation confirmed, and the only remediation the packet records is the vendor update - no live-patch tool is registered for the platform. On a mobile estate the operative failure is user deferral: an update prompt dismissed on a personally-carried device silently extends exposure to a confirmed-exploited kernel bug for weeks, while the compliance dashboard still shows the fleet as enrolled and managed. The update must be pushed as a device-management enforcement with a deadline measured in hours, deferral disallowed, and devices still on an unpatched build past the deadline cut off from organizational data.",
+        "evidence": "Packet: 'Apple iOS and iPadOS contain a use-after-free vulnerability. An app may be able to execute arbitrary code with kernel privileges.' cwe_refs CWE-416; cisa_kev true, kev_date 2026-03-05, active_exploitation confirmed; rwep_score 77; cvss 8.8; poc_available true; patch_available true; live_patch_available false; live_patch_notes 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.'",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "NIST-800-53-SI-2",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-121",
+        "name": "MOBILE-ZERO-CLICK-HARDENING",
+        "description": "The packet places this use-after-free as a sandbox-escape step inside an exploit chain, of the class typically used in targeted-spyware operations - which means a delivery stage runs before it, usually untrusted content the device processes automatically. Putting the high-risk subset of the iOS/iPadOS estate into the platform's reduced-attack-surface mode removes that automatic processing of untrusted attachments, fonts and link previews, so the chain loses its delivery step even on a device that has not yet taken the update. This is the only control here that covers the interval between the 2026-03-05 KEV listing and completed fleet remediation, which matters because the packet records no live-patch path that could shorten that interval.",
+        "evidence": "Packet attack_vector: 'a use-after-free (CWE-416) on iOS/iPadOS used as a sandbox-escape step in an exploit chain. CISA KEV-listed 2026-03-05 with confirmed in-the-wild exploitation (Apple zero-days of this class are typically used in targeted-spyware chains).' live_patch_available false; active_exploitation confirmed.",
+        "gap_closes": [
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2026-22719": {
     "name": "Broadcom VMware Aria Operations Command Injection Vulnerability",
@@ -13386,7 +13675,30 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "Run the Aria Operations appliance on a KEV clock starting 2026-03-03, tracked separately from the guest-OS patch cadence that the Essential Eight and SI-2 controls are audited against — the vulnerable surface is the appliance's own management stack, not an OS package inside a monitored VM, and an unauthenticated caller reaches arbitrary command execution on it. The packet records a vendor patch as available with no live-patch path, and notes the fix typically requires a service restart or system reboot per the KEV requiredAction, so the mitigation deadline must be measured against the appliance actually restarting onto the fixed build. Deferring that restart to the next infrastructure maintenance window is a breach of the SLA rather than a compensating control, and the appliance stays reachable-and-vulnerable for the whole deferral. The same clock covers any support-assisted product migration activity, which the packet names as the path on which the command execution occurs.",
+        "evidence": "cisa_kev is true with kev_date 2026-03-03 and active_exploitation 'confirmed'; CVSS 9.8, RWEP 77, poc_available true. The packet's vector states that Broadcom VMware Aria Operations, formerly vRealize Operations (vROps), contains a command injection vulnerability allowing an unauthenticated attacker to execute arbitrary commands, potentially leading to remote code execution during support-assisted product migration; the attack_vector records command injection (CWE-77) giving command execution on the Aria Operations management surface. patch_available is true, live_patch_available is false, and live_patch_notes states that no live-patch tool is registered and that the vendor patch typically requires service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-036",
+        "name": "FLEET-CONTROL-PLANE-ADMIN-PRIVILEGE-TIER",
+        "description": "Classify the Aria Operations administrators and the appliance's own integration/service identities as a management-plane privilege tier above ordinary application admins, instead of folding them into the generic admin scope that AC-6 is audited against. This does not prevent the vulnerability — no admin tiering gates an unauthenticated request, and the packet's attacker needs no credential — but it bounds what the attacker inherits the moment command execution lands on the appliance. Under the tier, the standing estate-integration credentials the appliance holds become just-in-time, approval-gated grants rather than always-live ones; the Aria console is reachable only from a PAM jumphost rather than from general internal networks; and the identities used to administer it are distinct from any other admin role, so credentials or sessions captured on a compromised appliance are not replayable against the rest of the estate. The support-assisted product migration path named in the packet has to sit inside that tier as well: a vendor-assisted migration is a privileged-access event requiring JIT elevation and an approval record, not a standing exception on the management surface where this command-injection sink lives.",
+        "evidence": "The packet lists NIST-800-53-AC-6 (Least Privilege) among the framework gaps citing this CVE, alongside the patch-timeliness gaps. The attack_vector records command injection (CWE-77) giving command execution on the Aria Operations management surface, and the vector states the attacker is unauthenticated; CVSS is 9.8 with RWEP 77 and poc_available true. cisa_kev is true with kev_date 2026-03-03 and active_exploitation 'confirmed'. The packet names support-assisted product migration as the context in which the command execution can lead to remote code execution.",
+        "gap_closes": [
+          "NIST-800-53-AC-6"
+        ]
+      }
+    ]
   },
   "CVE-2026-21385": {
     "name": "Qualcomm Multiple Chipsets Memory Corruption Vulnerability",
@@ -13707,7 +14019,30 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "The Roundcube fix has to run on a KEV clock rather than the next webmail maintenance window, and the SLA must be written so it ends at a restarted service, not at a staged package. The packet records no live-patch path for this entry and notes the vendor patch typically requires a service restart or system reboot per the KEV requiredAction, so a Roundcube install that has the fixed release on disk but has not been restarted is still serving the vulnerable program/actions/settings/upload.php handler and is still exploitable. Because the sink is reached with an ordinary mailbox session rather than an admin one, every hour of deferral is exposed to any credential the organization has already lost, so the interim position until the restart is a documented compensating restriction on reachability of that settings upload path.",
+        "evidence": "CISA KEV-listed 2026-02-20 with active_exploitation 'confirmed'; RWEP 77 against CVSS 9.8; poc_available true. patch_available true, live_patch_available false, and live_patch_notes states no live-patch tool is registered for this entry and that the vendor patch typically requires a service restart or system reboot per the KEV requiredAction. The packet locates the flaw (CWE-502) in the unvalidated _from parameter in program/actions/settings/upload.php, reachable by authenticated users.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-040",
+        "name": "OWA-PER-REQUEST-SIEM-INGESTION",
+        "description": "The same webmail-logging requirement the control states for Exchange OWA applies to Roundcube, and this CVE is the case that shows why: the exploit request is issued inside an already-authenticated mailbox session, so authentication-event logging captures nothing but a successful login while the crafted _from value travels to program/actions/settings/upload.php as ordinary session traffic. Roundcube must ship per-request web access records — request path and parameter names for the settings upload handler included — to a collector off the webmail host, retained long enough to answer which sessions touched that handler in the window before the fixed release was restarted into service. Off-host is the load-bearing part: the flaw yields code execution on the mail server itself, so any log the attacker's own process can reach is not evidence.",
+        "evidence": "The packet's vector states the vulnerability 'allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php' — the malicious request rides an authenticated session rather than creating an authentication event. CISA KEV-listed 2026-02-20, active_exploitation 'confirmed', poc_available true, CVSS 9.8, RWEP 77.",
+        "gap_closes": [
+          "UK-CAF-B2"
+        ]
+      }
+    ]
   },
   "CVE-2025-68461": {
     "name": "RoundCube Webmail Cross-site Scripting Vulnerability",
@@ -13767,7 +14102,39 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "The number that gets this entry mishandled is CVSS 6.1. A severity-driven queue reads \"Medium XSS\" and buckets a webmail flaw at 30 or 90 days, while the packet records it as KEV-listed with confirmed in-the-wild exploitation and a public PoC — the conditions under which the real requirement is hours. Keying the clock to KEV status rather than to base score is the whole point here: 4 hours from listing or fix availability to a verified mitigation on every Roundcube instance. Two packet facts shape what that window has to contain. There is no live-patch path registered for this entry, and the packet notes the vendor patch typically requires a service restart or system reboot per the KEV requiredAction — so the SLA must be planned as an upgrade plus a scheduled webmail service restart, not as a hot fix that can be slipped in without an outage. An operator whose change process cannot restart the mail front end inside the window needs the alternative recorded as a documented compensating control with a conversion deadline, not as an accepted 90-day queue position.",
+        "evidence": "Packet: cisa_kev true with kev_date 2026-02-20, active_exploitation confirmed, poc_available true, cvss 6.1 against rwep_score 77, patch_available true, live_patch_available false, live_patch_notes \"No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.\" The ISO-27001-2022-A.8.8 gap recorded against this entry states that \"appropriate timescales\" is undefined and interpreted as 30 days for Critical and 90 days for Medium with no KEV-aware response category; the NIST-800-53-SI-2 gap states the required tier is 4h for KEV plus public PoC.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-042",
+        "name": "INCOMPLETE-PATCH-SEQUENCE-SEVERITY-MULTIPLIER",
+        "description": "The packet records this flaw as a later variant of the Roundcube XSS class, and that word is the finding. The sink is an animate tag inside an SVG document — markup the message renderer's sanitizer was already supposed to be filtering — so what the CVE demonstrates is not one missed tag but that the allowlist governing SVG and animation markup in the mail body renderer keeps admitting script, one element at a time. Per-CVE severity scoring cannot express that: each instance lands as another 6.1 reflected-script issue, the structural defect never surfaces, and the operator has no basis for predicting the next one. A vulnerability-management program covering webmail must therefore carry a multiplier for the Nth flaw on the same sanitizer primitive — escalating handling above what the base score alone would trigger, and treating the renderer's markup filter as a standing area of exposure that warrants defence at the rendering layer rather than a series of unrelated Medium tickets closed on the routine queue.",
+        "evidence": "Packet attack vector as recorded: \"a cross-site scripting flaw (CWE-79) in Roundcube Webmail (a later variant), letting an attacker run script in a victim's authenticated session via a crafted email\" — the entry is explicitly recorded as a later variant, not a first instance. The vector field names the sink: \"a cross-site scripting vulnerability via the animate tag in an SVG document.\" cvss 6.1 against rwep_score 77 is the scoring divergence itself. The NIS2-Art21-vulnerability-management gap recorded against this entry states that on-prem mailflow XSS is not enumerated as a distinct vulnerability class deserving accelerated handling.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-040",
+        "name": "OWA-PER-REQUEST-SIEM-INGESTION",
+        "description": "The script executes inside a session the victim opened legitimately, so the authentication record for a successful exploitation of this CVE is one ordinary login by the right user from the right place. Everything the attacker then does — reading and searching the mailbox, adding a forwarding or filter rule, pulling the address book, calling the webmail API with the victim's own session — arrives as authenticated application traffic that an auth-event-only log pipeline never records. For a Roundcube deployment this means per-request access logs from the webmail front end, not just the login events, must be shipped off the mail host to a SIEM with retention long enough to cover the window between the KEV listing and the day the upgrade and its service restart actually land. That window is the operative one here: the packet records no vendor workaround short of the fix, so during it the only available posture is detection — a monitored interim state with a documented deadline for conversion to the vendor patch, rather than an unobserved wait.",
+        "evidence": "Packet attack vector as recorded: the flaw lets \"an attacker run script in a victim's authenticated session via a crafted email\" — the malicious activity therefore flows over an already-authenticated session, which is exactly the telemetry class this control exists for. cisa_kev true (kev_date 2026-02-20), active_exploitation confirmed, poc_available true. patch_available true with live_patch_available false and live_patch_notes recording that the vendor patch typically requires a service restart or system reboot, so a non-zero exposure window between listing and remediation is expected rather than exceptional. The UK-CAF-B4 gap recorded against this entry states that no compensating-control posture is named for the interval before the vendor patch, and that any such posture must be reversible, monitored, and carry a documented conversion SLA to the binary patch.",
+        "gap_closes": [
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2021-22175": {
     "name": "GitLab Server-Side Request Forgery (SSRF) Vulnerability",
@@ -13827,7 +14194,30 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "This is a 2021 identifier that CISA listed on 2026-02-18 — years after the vendor fix shipped and long after any normal patch window closed. That inversion is precisely why the control's 'KEV listing or patch availability, whichever is later' wording matters here: the clock starts at the listing date, not at disclosure. Vulnerability programmes age findings out by disclosure year and de-prioritise anything that has been open long enough to look inert, so an instance still exposed to this flaw is by definition one that survived every prior scan-and-triage cycle — the age of the identifier is the reason it is still there, not a reason to relax. Inside that window the work is inventory-led rather than patch-led: enumerate every self-managed GitLab instance including team-run and forgotten ones (the same lack of ownership that let a years-old flaw persist is what will hide instances from the sweep), confirm each running version against the fixed release, and apply the vendor update with the service restart the packet says it requires. Confirmed in-the-wild exploitation with a public PoC on an unauthenticated flaw means the interval between listing and remediation is contested time, not a grace period.",
+        "evidence": "Packet: CVE identifier year 2021 against kev_date 2026-02-18, cisa_kev true, active_exploitation confirmed, poc_available true, RWEP 77 against CVSS 7.5. attack_vector describes 'a server-side request forgery flaw (CWE-918) letting an unauthenticated attacker coerce the server into making requests to internal resources'. patch_available true; live_patch_available false with live_patch_notes 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.'",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-038",
+        "name": "MITIGATION-ACTIVE-PATCH-PENDING-VERDICT-CLASS",
+        "description": "The packet scopes exposure with a configuration condition rather than a version alone: the SSRF is present when requests to the internal network for webhooks are enabled. That means an unpatched GitLab instance with that setting off and an instance running the fixed release look identical in any compliance report that carries only vulnerable/not-vulnerable — and they are not the same risk. The first is one settings change away from exposure, and the change is one a legitimate internal integration will eventually ask for; whoever re-enables local-network webhook delivery will not know they are re-opening a KEV-listed unauthenticated SSRF. Record the configuration-based state as mitigation-active/patch-pending with a named owner and a deadline, distinct from the fixed release, and re-assert the setting on every configuration audit. This matters more than usual on an entry whose fix predates its KEV listing by years: over that span the workaround is exactly the kind of setting that gets quietly reverted somewhere in an estate, and a version-only verdict will never surface it.",
+        "evidence": "Packet: vector states 'GitLab contains a server-side request forgery (SSRF) vulnerability when requests to the internal network for webhooks are enabled.' attack_vector: 'a server-side request forgery flaw (CWE-918) letting an unauthenticated attacker coerce the server into making requests to internal resources', cwe_refs CWE-918. patch_available true, live_patch_available false, cisa_kev true with kev_date 2026-02-18 on a 2021 identifier, active_exploitation confirmed.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      }
+    ]
   },
   "CVE-2026-22769": {
     "name": "Dell RecoverPoint for Virtual Machines (RP4VMs) Use of Hard-coded Credentials Vulnerability",
@@ -13981,7 +14371,21 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "The remediation problem for CVE-2020-7796 is discovery timing, not fix availability. This is a 2020-assigned CVE that CISA added to KEV on 2026-02-17 — the affected systems are long-running Zimbra Collaboration Suite deployments where the WebEx zimlet happens to be installed and zimlet JSP happens to be enabled, a configuration nobody re-examines six years after commissioning. Programs that queue work by CVE publication year, or that treat an aged advisory as historically handled, will never raise it; the exposure has been continuous and silent. Requirement: the KEV listing date starts the clock, not the CVE year. A KEV-triggered sweep must re-inventory the ZCS estate against the precondition the packet names — WebEx zimlet installed AND zimlet JSP enabled — and deploy the vendor fix on the KEV-tied window, accepting the service restart the packet's live-patch note says the update requires, rather than letting a six-year-old identifier route the work into a routine cycle. Age is not a mitigating factor here; it is the reason the vulnerable configuration survived.",
+        "evidence": "Packet: CWE-918 server-side request forgery in Synacor Zimbra Collaboration Suite (ZCS), present 'if WebEx zimlet installed and zimlet JSP is enabled', letting an unauthenticated attacker coerce the server into making requests to internal resources. CISA KEV-listed 2026-02-17 with active_exploitation 'confirmed' and poc_available true — an identifier assigned in 2020 reaching confirmed in-the-wild exploitation roughly six years later. RWEP 77 against CVSS 7.5. patch_available true; live_patch_available false, live_patch_notes: 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.' The citing gaps (ISO-27001-2022-A.8.8, NIST-800-53-SI-2, NIS2-Art21-vulnerability-management, UK-CAF-B4) schedule remediation off severity and disclosure recency, neither of which surfaces a 2020 CVE in 2026.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management",
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2024-7694": {
     "name": "TeamT5 ThreatSonar Anti-Ransomware Unrestricted Upload of File with Dangerous Type Vulnerability",
@@ -14298,7 +14702,32 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-056",
+        "name": "MOBILE-ENDPOINT-MDM-ENFORCED-KEV-SLA",
+        "description": "The packet names iOS, macOS, tvOS, watchOS and visionOS as affected by the same memory-buffer flaw, which is broader than the device classes a typical Apple update policy actually enforces — most estates enforce phones and laptops through management and leave watches, TV devices and headsets to whatever the user gets around to, so a single KEV entry leaves enforced and unenforced device classes carrying the same defect. Enforcement must therefore cover the whole managed Apple estate, including personally-owned devices under BYOD enrollment, pushed through declarative device management with user deferral disabled and a hard enforcement deadline. 'Update deferred by user' has to be treated as a non-compliant state that loses access to organizational data, not a line on a compliance report. The vendor update is the remediation and it is available; the packet registers no live-patch path and notes the fix typically requires restart, so the enforced deadline must include the device restart, not merely the download.",
+        "evidence": "Packet name and vector: 'Apple iOS, macOS, tvOS, watchOS, and visionOS contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow an attacker with memory write the capability to execute arbitrary code' (CWE-119). CISA KEV-listed 2026-02-12 with active_exploitation 'confirmed', poc_available true, CVSS 8.8, RWEP 77. patch_available true; live_patch_available false, with live_patch_notes recording that the vendor patch typically requires service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-121",
+        "name": "MOBILE-ZERO-CLICK-HARDENING",
+        "description": "The packet describes this overflow as reachable via attacker-controlled content and places the class in targeted-spyware chains, which means delivery happens when content arrives at the device rather than when a user takes an action an awareness policy could influence — the interval between in-the-wild use and an enforced estate-wide update is unprotected by any patch SLA, however short it is written. For users at elevated targeting risk (executives, legal, security staff, anyone handling sensitive negotiations), the reduced-attack-surface mode must be enabled as a standing configuration, so untrusted message attachments, fonts and link previews are not auto-processed, and it must stay on across Apple's platforms in the estate rather than being switched on reactively after a specific CVE is announced. This is the control that covers the next member of the class before its patch exists, which is the same position operators were in when this one was listed.",
+        "evidence": "Packet attack_vector: 'a buffer overflow (CWE-119) reachable via attacker-controlled content. CISA KEV-listed 2026-02-12 with confirmed in-the-wild exploitation (Apple zero-days of this class are typically used in targeted-spyware chains).' The vector adds that an attacker with memory-write capability can execute arbitrary code. poc_available true, CVSS 8.8, RWEP 77; live_patch_available false, so there is no mid-window fix that avoids the update-and-restart cycle.",
+        "gap_closes": [
+          "UK-CAF-B4",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      }
+    ]
   },
   "CVE-2024-43468": {
     "name": "Microsoft Configuration Manager SQL Injection Vulnerability",
@@ -14450,7 +14879,39 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "Notepad++ is fleet-wide desktop software that updates itself through WinGUp, so the KEV clock lands on every workstation carrying the vulnerable build rather than on a small set of managed servers. The mitigation that satisfies the SLA must be a managed software-deployment push of the fixed build, not a prompt to run the in-application update check — that check is the exact channel the flaw lets an attacker redirect, so using it as the remediation mechanism runs the attack. No live-patch path is registered for this entry and the packet records that a patch of this class typically requires a restart, so the SLA has to be met with the vendor update plus that restart, or with a documented compensating control (blocking or disabling the in-app update check) until the fleet is on the fixed build.",
+        "evidence": "CISA KEV-listed 2026-02-12 with active_exploitation 'confirmed', RWEP 77, CVSS 9.8, and poc_available true. patch_available is true; live_patch_available is false, and live_patch_notes states no live-patch tool is registered and that the vendor patch typically requires service restart or system reboot per the KEV requiredAction. The packet's vector states that Notepad++, when using the WinGUp updater, downloads code without an integrity check, allowing an attacker to intercept or redirect update traffic to download and execute an attacker-controlled installer with the privileges of the user.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-SUPPLYCHAIN-SIGNED-INSTALLER-INTEGRITY",
+        "name": "INDEPENDENT-INTEGRITY-VERIFICATION-OF-SIGNED-VENDOR-INSTALLERS",
+        "description": "The Notepad++ update path makes the delivery channel the trust anchor: whatever WinGUp retrieves is executed. The organization must therefore verify the Notepad++ installer against an integrity source independent of the channel that delivered it — a published per-release hash fetched over a separate path — and deploy only the verified artifact, instead of allowing endpoints to accept whatever the updater fetches. The distinguishing test for this CVE: on a staging workstation, serve a substituted installer from an operator-controlled endpoint in place of the real update host and confirm the deployment tooling refuses the artifact on hash mismatch before it runs. A software-supply-chain policy that only asserts 'we install vendor software from the vendor' passes while this exact substitution succeeds.",
+        "evidence": "The packet's CWE is CWE-494 (download of code without integrity check), and the vector states the WinGUp updater downloads code without an integrity check so that intercepted or redirected update traffic results in an attacker-controlled installer being downloaded and executed. KEV-listed 2026-02-12 with confirmed active exploitation and poc_available true.",
+        "gap_closes": [
+          "NIS2-Art21-supply-chain",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-120",
+        "name": "DOWNLOAD-PROVENANCE-ENFORCEMENT",
+        "description": "Application-control and provenance policy on the endpoint must refuse to execute an installer image that an application fetched from the network unless it carries verified publisher provenance, so that a redirected Notepad++ update cannot run on a host that has not yet reached the fixed build. Reputation-service verdicts are worthless against this specific path: the defect is the absence of any integrity check on the fetched payload, so the payload never has to defeat a reputation check to be executed by the updater. The distinguishing test: on a staging endpoint, have a non-vendor-signed installer be launched by the updater process and confirm execution is blocked by policy rather than allowed on the basis of the parent application's own trust.",
+        "evidence": "The vector states the attacker-controlled installer is downloaded and executed, yielding arbitrary code execution with the privileges of the user. patch_available is true and live_patch_available is false, so the only in-window alternative to deploying the fixed build is blocking the execution step.",
+        "gap_closes": [
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2025-40536": {
     "name": "SolarWinds Web Help Desk Security Control Bypass Vulnerability",
@@ -14731,7 +15192,33 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-120",
+        "name": "DOWNLOAD-PROVENANCE-ENFORCEMENT",
+        "description": "The defect is in the Windows Shell's handling of the provenance signal itself: content fetched over the network executes without the SmartScreen / Mark-of-the-Web warning that the surrounding endpoint controls assume will fire. Enforcement must therefore be moved off the Shell's verdict — apply and preserve MotW on every internet-sourced file, propagate it rather than letting a handler drop it, and use AppLocker/WDAC or equivalent to refuse execution of provenance-stripped shortcuts, installers and script hosts outright, so an attacker-supplied payload is denied by policy rather than by a dialog this flaw suppresses. Any Windows endpoint whose only barrier between a downloaded file and execution is the SmartScreen prompt has no barrier at all for this CVE, and that remains true for every unrebooted host in the estate.",
+        "evidence": "Packet attack_vector: 'a protection-mechanism failure (CWE-693) in the Windows Shell that bypasses SmartScreen / Mark-of-the-Web, letting downloaded content run without the expected warning'; the vector records an unauthorized attacker bypassing a security feature over a network. CISA KEV-listed 2026-02-10, active_exploitation confirmed, poc_available true, CVSS 8.8, RWEP 77. patch_available is true, but live_patch_available is false and live_patch_notes records the vendor patch typically requires a service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "NIST-800-53-SI-2",
+          "NIST-800-53-AC-6",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-041",
+        "name": "PROTECTION-MECHANISM-FAILURE-CLASS-REGRESSION",
+        "description": "For this CVE 'the update is installed' is not evidence of remediation, because what failed was a protection mechanism, not a service — a Shell whose SmartScreen / MotW path is silently inert is indistinguishable from a patched one by inventory alone. Detonation-chamber, EDR and AppLocker/WDAC coverage for the MOTW/SmartScreen class must be run as a battery on every Windows patch deployment, exercising the historic bypass primitives for that class and not just this CVE's, and the reboot cycle must not be signed off until a freshly downloaded test payload actually raises the expected warning on a representative endpoint. That test is the only thing that converts a completed patch window into demonstrated closure here.",
+        "evidence": "Packet: protection-mechanism failure (CWE-693) in the Windows Shell bypassing SmartScreen / Mark-of-the-Web, letting downloaded content run without the expected warning. CISA KEV-listed 2026-02-10 with confirmed in-the-wild exploitation and poc_available true. patch_available true, live_patch_available false, live_patch_notes: the vendor patch typically requires a service restart or system reboot per the KEV requiredAction — so remediation is a discrete reboot event whose success is directly testable at that moment.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management",
+          "NIST-800-53-SI-2"
+        ]
+      }
+    ]
   },
   "CVE-2026-21533": {
     "name": "Microsoft Windows Improper Privilege Management Vulnerability",
@@ -14910,7 +15397,39 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-041",
+        "name": "PROTECTION-MECHANISM-FAILURE-CLASS-REGRESSION",
+        "description": "Protected View is the mechanism Word uses to open untrusted documents in a sandbox, and this CVE shows the decision to apply it can be driven by input the attacker supplies. Verifying the fix for this one document therefore proves nothing about the mechanism: the detonation-chamber, EDR and ASR rule sets covering the document-sandbox decision must carry a class-level regression battery — every known way a document has been made to open outside Protected View — re-executed on every Office update, not a one-off retest of this CVE's sample. Test artifact for this class: a document set that reaches the handler through each delivery path in use, with the pass condition being that Word opens each one in Protected View rather than in full trust.",
+        "evidence": "CWE-807 (reliance on untrusted inputs in a security decision) in Microsoft Office Word. The packet's attack_vector states the flaw bypasses a document security feature (Protected View) so attacker content opens without the expected protection. KEV-listed 2026-02-10 with active_exploitation 'confirmed', poc_available true, RWEP 77, CVSS 8.8.",
+        "gap_closes": [
+          "AU-Essential-8-App-Hardening",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-119",
+        "name": "ARCHIVE-CONTENT-TYPE-PROVENANCE",
+        "description": "For this CVE the requirement is that Word's Protected View decision be taken from verified provenance of the file — established outside the document — rather than from metadata that travels with the document and that an attacker controls, and that the untrusted-origin marking survive whatever container the document is delivered in so the handler still sees it as externally sourced. The operator-side expression of the control: the mail gateway and file-share boundary apply and preserve the untrusted-origin marking themselves, so the sandbox decision does not depend on the application deriving it from attacker-supplied input. The distinguishing test: deliver an externally-sourced document through each ingress path and confirm it reaches Word marked untrusted, instead of confirming only that Protected View is enabled in policy.",
+        "evidence": "The packet classifies this as CWE-807, reliance on untrusted inputs in a security decision, in Microsoft Office Word, and states the effect is that a document security feature (Protected View) is bypassed so attacker content opens without the expected protection. KEV-listed 2026-02-10 with confirmed in-the-wild exploitation.",
+        "gap_closes": [
+          "AU-Essential-8-App-Hardening",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "Office is user software on the whole estate, so meeting the KEV clock here means the update reaching every workstation, and the packet registers no live-patch path — remediation is the vendor update with the restart the KEV requiredAction implies. What makes the interim window unusual for this CVE is that the application's own protective decision is the thing that failed, so 'Protected View is enforced by policy' cannot be recorded as the compensating control during that window; the compensating control has to be external to Word, such as quarantining or blocking externally-sourced Office documents until the update lands.",
+        "evidence": "KEV-listed 2026-02-10, active_exploitation 'confirmed', RWEP 77, CVSS 8.8, poc_available true. patch_available is true; live_patch_available is false and live_patch_notes states no live-patch tool is registered and that the vendor patch typically requires service restart or system reboot per the KEV requiredAction. attack_vector: content opens without the expected Protected View protection.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      }
+    ]
   },
   "CVE-2025-11953": {
     "name": "React Native Community CLI OS Command Injection Vulnerability",
@@ -15030,7 +15549,32 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "There is no exploitation prerequisite here to buy an operator time. The ConnectToHub API method is missing authentication entirely (CWE-306), so the sequence is: reach the SmarterMail instance, point it at an attacker-controlled HTTP server, and the instance fetches and executes the OS command that server returns. At RWEP 83 with a public PoC and confirmed in-the-wild exploitation from the 2026-02-05 KEV listing, exposure is bounded only by how quickly the instance is found on the internet, which makes a routine mail-server patch window a schedule rather than a control. The packet records no live-patch tool for this entry and notes the vendor patch typically requires a service restart or system reboot per the KEV requiredAction, so the SLA has to carry that outage inside it: book the restart against the KEV clock, and where it cannot be booked, take the instance off untrusted networks until it can.",
+        "evidence": "Packet: cwe_refs CWE-306, cvss 9.1, rwep_score 83, cisa_kev true, kev_date 2026-02-05, active_exploitation confirmed, poc_available true, patch_available true, live_patch_available false, live_patch_notes \"No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.\" Vector as recorded: \"SmarterTools SmarterMail contains a missing authentication for critical function vulnerability in the ConnectToHub API method. This could allow the attacker to point the SmarterMail instance to a malicious HTTP server which serves the malicious OS command and could lead to command execution.\"",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-handling"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "Updating SmarterMail closes the unauthenticated ConnectToHub path; it says nothing about what already ran through it. The packet's path ends in OS command execution driven by content the instance fetched from an attacker's HTTP server, on a host that holds mailbox data and the mail service's own credentials, with exploitation confirmed in the wild since the 2026-02-05 KEV listing — so any internet-reachable instance that was unpatched during that window has to be triaged as possibly-executed-upon, not merely as vulnerable-and-now-fixed. The operator default should be capture the configuration, rebuild the mail server from known-good media, and rotate every credential the instance held or could reach, rather than patch in place and ask the anti-malware agent whether anything is present: a command supplied at runtime by a remote HTTP server leaves nothing the vendor patch removes and nothing a signature is guaranteed to name.",
+        "evidence": "Packet: cwe_refs CWE-306, cvss 9.1, rwep_score 83, cisa_kev true, kev_date 2026-02-05, active_exploitation confirmed, poc_available true, patch_available true, live_patch_available false. Vector as recorded: the attacker can \"point the SmarterMail instance to a malicious HTTP server which serves the malicious OS command and could lead to command execution.\" Attack vector: \"missing authentication for a critical function (CWE-306) on SmarterMail, reachable by an unauthenticated attacker.\"",
+        "gap_closes": [
+          "CIS-Controls-v8-10.1",
+          "NIST-800-53-SI-2",
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2021-39935": {
     "name": "GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability",
@@ -15476,7 +16020,39 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "Anchor the remediation clock for this Linux kernel flaw to its CISA KEV listing date (2026-01-26), not to the 2018 CVE identifier and not to the 8.8 CVSS. A vulnerability-management program that ages findings from CVE publication, or that ranks local-only flaws beneath network-reachable ones, will have this kernel sitting years past every SLA window and therefore invisible on the dashboard on the day it becomes KEV-listed with confirmed exploitation. The SLA must also define what 'mitigated' means for this specific fix path: the packet's live-patch note says the vendor patch typically needs a service restart or reboot, so a host that has installed the updated kernel package but has not rebooted is still executing the vulnerable create_elf_tables() path and must not be counted as remediated in the evidence pack.",
+        "evidence": "Packet records cisa_kev true with kev_date 2026-01-26 and active_exploitation confirmed for a CVE carrying a 2018 identifier; poc_available true; rwep_score 77 against cvss 8.8; patch_available true; live_patch_available false with live_patch_notes 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.'",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-002",
+        "name": "LIVE-PATCH-CAPABILITY",
+        "description": "The only fix path the packet records for this entry is a kernel update whose activation requires a reboot, and it explicitly notes that no live-patch tool is registered for it. On long-uptime Linux hosts — exactly the ones most likely to still be carrying a kernel with the vulnerable create_elf_tables() path — that turns remediation into a negotiation with a change window instead of a countdown against an SLA, and every deferred reboot leaves a working local root path for any user who can reach a SUID or otherwise privileged binary. Deploying and quarterly-testing kpatch / livepatch / kGraft ahead of the next kernel LPE is what makes same-day kernel remediation possible on production Linux fleets; it is a prerequisite capability, not something that can be procured after a KEV listing lands.",
+        "evidence": "Packet records live_patch_available false with live_patch_notes 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.', patch_available true, and a vector describing an integer overflow (CWE-190) in create_elf_tables() that allows an unprivileged local user with access to a SUID (or otherwise privileged) binary to escalate privileges.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-003",
+        "name": "KERNEL-EXPLOITATION-DETECTION",
+        "description": "Between the KEV listing and the reboot that actually activates the fixed kernel, detection is the only coverage these hosts have, and the packet says a public PoC already exists — so the attempt is cheap for an attacker who has any unprivileged foothold. Instrument auditd or eBPF for the shape this bug takes on a Linux host: an unprivileged process invoking a SUID or otherwise privileged binary, followed by an unexplained transition to uid 0 whose parent chain is an ordinary user session rather than a legitimate privileged service. Alert inside 60 seconds and treat a hit on a host still pending its kernel reboot as a confirmed escalation, not a tuning candidate, because the packet notes LPEs of this class are routinely paired with an initial-access primitive — the escalation is the second half of an intrusion already underway.",
+        "evidence": "Packet records poc_available true, active_exploitation confirmed, rwep_score 77, and a vector in which an unprivileged local user with access to a SUID (or otherwise privileged) binary escalates privileges on the system; attack_vector notes 'LPEs of this class are routinely paired with an initial-access primitive'; live_patch_available false and the vendor patch 'typically requires service restart or system reboot', leaving an exposure window on hosts awaiting reboot.",
+        "gap_closes": [
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2025-52691": {
     "name": "SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability",
@@ -15621,7 +16197,32 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "SmarterMail's force-reset-password endpoint accepts anonymous requests and never checks the existing password or a reset token, so there is no exploitation-difficulty buffer between KEV listing and administrator takeover — one request naming a system administrator account is the whole exploit. The response clock must therefore start at the 2026-01-26 KEV listing rather than at the mail server's next maintenance window. The packet records the vendor update as the only remediation available (no live-patch tool is registered for this entry), and applying it requires the service restart or reboot the KEV requiredAction calls for, so that restart has to be scheduled inside the SLA window rather than used as the reason to defer past it.",
+        "evidence": "Packet: CISA KEV-listed 2026-01-26 with active_exploitation confirmed; CVSS 9.8, RWEP 83, poc_available true. patch_available true, live_patch_available false, live_patch_notes: \"No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.\"",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-handling"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "The end state of this exploit is a system administrator account whose password the attacker chose. Installing the SmarterMail update closes the anonymous force-reset-password path but leaves that credential valid, so patch-in-place is not eviction for this CVE — an operator who patches and closes the ticket has locked the door on an attacker already holding admin. Any instance that was network-reachable before the update must be treated as potentially compromised: audit the system-administrator account list and password-change history across an exposure window that opened no later than the 2026-01-26 KEV listing, rotate every administrator credential rather than only ones that look wrong, and review the administrative changes an attacker in that context could have made (added or re-enabled accounts, altered mail routing, delegated mailbox access) before declaring the instance clean.",
+        "evidence": "Packet vector: \"The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts. This could allow an unauthenticated attacker to supply a target administrator username and a new password to reset the account, resulting in full administrative compromise of the SmarterMail instance.\" active_exploitation confirmed, CISA KEV-listed 2026-01-26, poc_available true, CVSS 9.8, RWEP 83.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "UK-CAF-B2"
+        ]
+      }
+    ]
   },
   "CVE-2026-24061": {
     "name": "GNU InetUtils Argument Injection Vulnerability",
@@ -15681,7 +16282,29 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "The exploit path here needs no credential and no user interaction — setting the USER environment variable to a '-f root' value drives telnetd into an authentication bypass — so any reachable unpatched listener is exploitable by whoever can open the port, and the KEV clock has to be met on every host and image where the inetutils telnetd binary is actually in service, not only on the hosts the patch-management inventory happens to enumerate. No live-patch tool is registered for this entry, so the SLA is satisfied by the vendor update with the restart the KEV requiredAction implies; stopping or firewalling the telnetd listener is the mitigation available inside the window, and it must be recorded as a compensating control rather than as remediation.",
+        "evidence": "CISA KEV-listed 2026-01-26 with active_exploitation 'confirmed', RWEP 77, CVSS 9.1, poc_available true. patch_available is true; live_patch_available is false and live_patch_notes states no live-patch tool is registered and that the vendor patch typically requires service restart or system reboot per the KEV requiredAction. The vector states GNU InetUtils contains an argument injection vulnerability in telnetd allowing remote authentication bypass via a '-f root' value for the USER environment variable.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-038",
+        "name": "MITIGATION-ACTIVE-PATCH-PENDING-VERDICT-CLASS",
+        "description": "For this CVE two remediation states report identically on a vulnerability dashboard and are not equivalent: (a) inetutils updated to the fixed build, and (b) the telnetd listener stopped or firewalled while the vulnerable binary stays on disk. State (b) does close the path, but only for as long as the listener stays down — a host rebuild from an unpatched image, a re-enable of the service, or any dependent tooling that starts telnetd restores an unauthenticated path to root with no new vulnerability being introduced. Audit output must carry the state per host with a time-bound action to reach (a), instead of collapsing both into 'remediated' and losing the fact that the exposure is one service-start away.",
+        "evidence": "The packet gives patch_available true and live_patch_available false, so both a patch path and a service-disable path exist for the same entry. The vector states the flaw is an argument injection in telnetd yielding remote authentication bypass via a '-f root' value for the USER environment variable. KEV-listed 2026-01-26 with confirmed in-the-wild exploitation, CVSS 9.1, RWEP 77.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2026-21509": {
     "name": "Microsoft Office Security Feature Bypass Vulnerability",
@@ -15939,7 +16562,43 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-030",
+        "name": "PERIMETER-DEVICE-ZERODAY-SLA-TIER",
+        "description": "Versa Concerto orchestrates the SD-WAN fabric, so an unauthenticated route to its administrative endpoints is a trust-boundary failure rather than an application bug, and it belongs in the perimeter SLA tier alongside firewalls and VPN concentrators. The packet places the defect in the Traefik reverse-proxy configuration in front of the orchestrator — which is also the layer an operator can constrain immediately: the vendor fix goes on within hours of the 2026-01-22 KEV listing, or the administrative and internal Actuator routes are removed from every untrusted-network path until it does. A routine appliance-patch window does not apply to the device that defines the fabric's policy plane, and 'orchestrator, not edge device' is exactly the classification error that keeps this system on the slow tier.",
+        "evidence": "Packet: CWE-288 improper authentication; vector states the flaw is in the Traefik reverse proxy configuration and allows an attacker to access administrative endpoints, with the internal Actuator endpoint leveraged for access to heap dumps and trace logs; attack_vector describes an unauthenticated attacker reaching administrative functionality on the Versa Concerto SD-WAN orchestrator; CISA KEV-listed 2026-01-22 with active_exploitation=confirmed; poc_available=true; CVSS 9.1, RWEP 77; patch_available=true, live_patch_available=false.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-network-security"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "The packet states the internal Actuator endpoint can be leveraged for heap dumps and trace logs — process memory and log content from the system that holds credentials, session material and policy for the whole SD-WAN fabric. Applying the vendor fix to a Concerto instance that was reachable during the confirmed-exploitation window closes the entry path but leaves everything already dumped valid, and it destroys nothing the attacker planted. Response for this CVE must therefore default to treating an exposed orchestrator as compromised: capture and review its configuration, rebuild the instance from a known-good image, and rotate every credential, token and key the orchestrator held or distributed to managed devices — patch-in-place is not a remediation verdict for a device whose exploitation primitive is memory disclosure.",
+        "evidence": "Packet: vector states the internal Actuator endpoint can be leveraged for access to heap dumps and trace logs, and that the improper authentication allows an attacker to access administrative endpoints; attack_vector confirms an unauthenticated attacker reaching administrative functionality on the SD-WAN orchestrator; cisa_kev=true, kev_date 2026-01-22, active_exploitation=confirmed, poc_available=true; patch_available=true (vendor fix exists, so this control governs what must accompany it, not a substitute for it).",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "UK-CAF-B2",
+          "NIS2-Art21-network-security"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-036",
+        "name": "FLEET-CONTROL-PLANE-ADMIN-PRIVILEGE-TIER",
+        "description": "An SD-WAN orchestrator is a fleet control plane in the same sense as an MDM or a configuration-management server: whoever reaches its administrative surface reaches every managed device's policy. The requirement that bites for this CVE is the access-path half of the tier — the Concerto management surface, including the internal Actuator endpoint, must be reachable only from a dedicated privileged-access segment and never from a general or untrusted network. Because the flaw is an unauthenticated bypass, admin identity hardening alone does not stop it; what does is that an anonymous caller has no network route to the bypassed endpoints in the first place. Frameworks that file an SD-WAN orchestrator as an ordinary application-admin surface leave it directly reachable and let a proxy-configuration defect become fabric-wide administrative access.",
+        "evidence": "Packet: attack_vector states an unauthenticated attacker reaches administrative functionality on the Versa Concerto SD-WAN orchestrator via an authentication bypass using an alternate path or channel (CWE-288); vector attributes the exposure to the Traefik reverse proxy configuration fronting administrative and internal Actuator endpoints; citing gaps include NIST-800-53-AC-6 (Least Privilege), UK-CAF-B2 (Identity and access control) and NIS2-Art21-network-security; CVSS 9.1 with active_exploitation=confirmed.",
+        "gap_closes": [
+          "UK-CAF-B2",
+          "NIST-800-53-AC-6",
+          "NIS2-Art21-network-security"
+        ]
+      }
+    ]
   },
   "CVE-2025-31125": {
     "name": "Vite Vitejs Improper Access Control Vulnerability",
@@ -15999,7 +16658,20 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "Vite is build-time developer tooling, and vulnerability-management programs routinely hold devDependencies outside the KEV clock entirely — yet this entry is KEV-listed with confirmed exploitation, so the same mitigation deadline that applies to a production server applies to the front-end toolchain. What makes the SLA achievable here is that the packet names a precondition, not just a version: only instances explicitly bound to the network via --host or the server.host config option are affected, so removing that binding is a documented compensating control that lands immediately across every project, while the Vite update is what actually closes the ?inline&import / ?raw?import read path. Sequence the response accordingly — unbind first, upgrade second — and treat the SLA as covering every repository, CI job, and container entrypoint that starts the dev server with --host, not only the instance that surfaced the finding. Because no live-patch tool is registered, the dev-server restart the update requires belongs inside the window.",
+        "evidence": "Packet: CISA KEV-listed 2026-01-22 with active_exploitation confirmed; CVSS 8.8, RWEP 77, poc_available true. Vector: \"exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.\" attack_vector adds that a remote attacker can read files including source and environment secrets outside the served root. patch_available true, live_patch_available false, live_patch_notes: \"No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.\"",
+        "gap_closes": [
+          "AU-Essential-8-App-Hardening",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      }
+    ]
   },
   "CVE-2025-54313": {
     "name": "Prettier eslint-config-prettier Embedded Malicious Code Vulnerability",
@@ -16174,7 +16846,32 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "This CVE is the case the control exists for. A CVSS 5.5, local, information-disclosure-only finding sorts to the bottom of a severity-ordered patch queue, yet the packet records it as KEV-listed 2026-01-13 with confirmed in-the-wild exploitation and a public PoC, scoring RWEP 77. The remediation clock must be started by the KEV listing and by the chain role — the packet describes the leak as a primitive whose kernel-address disclosure defeats KASLR for a follow-on escalation — not by the CVSS band or by the words 'information disclosure' in the title. The operator action here is the vendor update on every Windows endpoint carrying the affected Desktop Window Manager component, and because the packet records no live-patch path and states the fix typically requires a service restart or system reboot, 'verified mitigation' means the restart has happened on the endpoint, not that the update was approved or downloaded.",
+        "evidence": "Packet: CWE-200 information disclosure; vector states Microsoft Windows Desktop Window Manager allows an authorized attacker to disclose information locally; attack_vector states the flaw is used as a primitive in a privilege-escalation chain because kernel-address leaks defeat KASLR for follow-on exploits, and that LPEs of this class are routinely paired with an initial-access flaw by ransomware operators; cisa_kev=true, kev_date 2026-01-13, active_exploitation=confirmed, poc_available=true; CVSS 5.5 against RWEP 77; patch_available=true, live_patch_available=false with live_patch_notes recording that no live-patch tool is registered and that the vendor patch typically requires service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-patch-management",
+          "ISO-27001-2022-A.8.8"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-018",
+        "name": "SCANNER-PAPER-COMPLIANCE-TEST",
+        "description": "The packet records no live-patch path for this CVE and states the vendor fix typically requires a service restart or system reboot, which creates a specific paper-compliance state on Windows estates: the update is installed, the inventory or scanner reports the host as remediated, and the machine has not restarted — so the vulnerable Desktop Window Manager code is still the code in memory. Long-uptime workstations, session hosts and VDI golden-image children sit in exactly that state for weeks. The operational test for this CVE is therefore not 'is the update present' but 'is the host's last-boot time later than the update's install time'; any host failing that comparison must be counted as unremediated against the KEV clock rather than as patched. A scan that reports compliance from installed-package state alone certifies an estate that is still exploitable through the pending-reboot population.",
+        "evidence": "Packet: patch_available=true but live_patch_available=false, with live_patch_notes stating that no live-patch tool is registered for this entry and that the vendor patch typically requires service restart or system reboot per the KEV requiredAction; vector states the disclosure occurs locally to an authorized attacker in the Windows Desktop Window Manager; cisa_kev=true with kev_date 2026-01-13 and active_exploitation=confirmed, so the pending-reboot window is an actively-exploited window.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2025-8110": {
     "name": "Gogs Path Traversal Vulnerability",
@@ -16409,7 +17106,20 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "Applied here the control's real work is dragging a network video recorder inside the same remediation clock as a server. The packet records a vendor fix as available, so the required action from the 2025-12-22 KEV listing is the vendor firmware update — and because no live-patch path exists for this class and the update lands only across a device restart, the SLA has to include a scheduled recorder restart, not just a firmware file staged on a management console. Where the recorder cannot be updated inside the window, the control's alternative branch is the one to invoke and document: the DS-2105 Pro's web interface must be unreachable from any untrusted network until it is on fixed firmware, because until then a single unauthenticated request to time_tzsetup.cgi reaches a privileged command path with no credential required, and the CVSS 9.8 / confirmed-exploitation pairing means that request is being sent. The compliance failure this control is written against is precisely the one this device invites — an appliance that no patch ring inventories being reported as out of scope rather than as unremediated.",
+        "evidence": "The packet records a missing-authorization flaw (CWE-862) on the Digiever DS-2105 Pro allowing command injection via time_tzsetup.cgi, and describes it as letting an unauthenticated attacker reach privileged functionality on the network video recorder. CISA KEV-listed 2025-12-22 with active_exploitation 'confirmed' and poc_available true; CVSS 9.8, RWEP 77. patch_available is true and live_patch_available is false, with live_patch_notes recording that no live-patch tool is registered for this entry and that the vendor patch typically requires a service restart or system reboot per the KEV requiredAction. Three of the six citing gaps (ASD Essential Eight patch operating systems, ISO/IEC 27001:2022 A.8.8, NIST SP 800-53 SI-2) are remediation-cadence controls that state no exploitation-tied deadline.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      }
+    ]
   },
   "CVE-2025-14733": {
     "name": "WatchGuard Firebox Out of Bounds Write Vulnerability",
@@ -16469,7 +17179,40 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-030",
+        "name": "PERIMETER-DEVICE-ZERODAY-SLA-TIER",
+        "description": "The Firebox is the trust boundary, and the packet places the defect in the Fireware OS iked process — the IKEv2 daemon that has to answer unauthenticated packets for mobile-user VPN and for branch-office VPN with a dynamic gateway peer to work at all. That is what makes the standard appliance-patch window the wrong tier here: the vulnerable listener cannot be firewalled off without taking remote access down, and the dynamic-gateway-peer configuration the packet names does not pin a source address, so peer-address restriction is not available as a stopgap for those tunnels. The requirement is the fixed Fireware build within hours of KEV listing, with the reboot budgeted inside that clock, or the IKEv2 remote-access interface disabled until the upgrade lands — there is no live-patch path for this entry, so there is no third option that keeps the tunnel up on a vulnerable build.",
+        "evidence": "Packet vector: 'WatchGuard Fireware OS iked process contains an out of bounds write vulnerability in the OS iked process. This vulnerability may allow a remote unauthenticated attacker to execute arbitrary code and affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer.' CWE-787, CVSS 8.8, RWEP 77, poc_available true; CISA KEV-listed 2025-12-19 with active_exploitation 'confirmed'. patch_available true, live_patch_available false, and live_patch_notes states no live-patch tool is registered and that the vendor patch typically requires a service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "Exploitation of this one is confirmed in the wild and needs no credentials, so any Firebox that ran an affected Fireware build with its IKEv2 listener reachable has to be triaged as possibly-compromised rather than merely unpatched. The default response is to export and diff the configuration against a known-good baseline, rebuild onto the fixed Fireware release, and rotate what the appliance held — VPN pre-shared keys, IKEv2 credentials and certificates, firewall admin accounts, and any RADIUS or directory service account bound to the device — before the tunnels come back up. Upgrading in place closes the out-of-bounds write in iked and nothing else: an admin account, tunnel definition, or policy change an attacker added pre-upgrade survives the new firmware, and the upgrade ticket closes green.",
+        "evidence": "The packet describes an out-of-bounds write (CWE-787) in the Fireware OS iked process allowing 'a remote unauthenticated attacker to execute arbitrary code'; CISA KEV-listed 2025-12-19 with active_exploitation 'confirmed' and poc_available true; RWEP 77, CVSS 8.8. patch_available true with live_patch_available false, so the only remediation on offer is a version upgrade requiring a restart — which addresses the defect, not a pre-upgrade foothold.",
+        "gap_closes": [
+          "UK-CAF-B4",
+          "NIS2-Art21-network-security"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-031",
+        "name": "FIREWALL-EGRESS-TELEMETRY-SEPARATE-TRUST-ZONE",
+        "description": "Code execution in iked puts the attacker inside the Firebox, which is also the machine that generates the IKEv2 session records, admin-authentication events and policy-change logs an investigator needs to decide whether a given appliance was hit before the fixed Fireware build was installed. Firebox logging must therefore already be streaming to a SIEM in a different trust zone, under credentials the firewall itself cannot use to delete history, so the VPN negotiation and admin-account records survive an attacker who owns the device. The timing is the point: this control cannot be retrofitted usefully after the fact, because the evidence window that decides rebuild-versus-upgrade opened before the 2025-12-19 KEV listing, and telemetry that only ever lived on the appliance is already gone.",
+        "evidence": "The packet places the flaw in the Fireware OS iked process, exploitable by 'a remote unauthenticated attacker to execute arbitrary code' (CWE-787), CISA KEV-listed 2025-12-19 with active_exploitation 'confirmed' and poc_available true — the attacker's code runs on the same device that produces the firewall's own logs.",
+        "gap_closes": [
+          "NIS2-Art21-network-security"
+        ]
+      }
+    ]
   },
   "CVE-2025-59374": {
     "name": "ASUS Live Update Embedded Malicious Code Vulnerability",
@@ -16589,7 +17332,30 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-030",
+        "name": "PERIMETER-DEVICE-ZERODAY-SLA-TIER",
+        "description": "The SMA1000 is the remote-access trust boundary itself, so a KEV-confirmed exploited defect in its appliance management console belongs in a distinct SLA tier rather than the routine appliance-patch window — the ordinary 14/30-day cadence is priced on the assumption that a vulnerable asset sits behind a boundary, and this device is the boundary. The flaw here is missing authorization on the AMC yielding privilege escalation rather than a pre-auth RCE, but the tier logic is unchanged: deploy the vendor fix on a KEV-tied clock, accepting the service restart or reboot it requires, and where that restart genuinely cannot be scheduled inside the clock, isolate the AMC interface to an operator-only management segment so the unauthorized-privilege path is unreachable in the interim. Inventory must name every SMA1000 whose AMC is reachable from anything wider than that segment.",
+        "evidence": "Packet: SonicWall SMA1000, CWE-862 / CWE-250; CISA KEV-listed 2025-12-17 with active_exploitation 'confirmed'; RWEP 77 / CVSS 7.8; poc_available true. The packet's vector states the flaw 'could allow for privilege escalation appliance management console (AMC) of affected devices.' patch_available true; live_patch_available false, with live_patch_notes 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.'",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-network-security"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-036",
+        "name": "FLEET-CONTROL-PLANE-ADMIN-PRIVILEGE-TIER",
+        "description": "The SMA1000's appliance management console governs remote access for everyone who enters the network through the appliance, which makes AMC administration a control-plane tier rather than an application-admin tier. That distinction is load-bearing for this CVE specifically: the defect is a missing-authorization check inside AMC — the console invokes privileged functionality without confirming the caller is entitled to it — so no amount of role definition inside the console is reliable, and the residual control is reducing who can reach the console at all. Require PAM-jumphost-only reachability for AMC, step-up authentication per session, just-in-time elevation with approval, an AMC identity distinct from every other admin role, and dedicated privileged-access-workstation hardware. A framework that collapses 'appliance admin' into general admin leaves a wide population of accounts positioned on the escalation path.",
+        "evidence": "Packet: CWE-862 (missing authorization) plus CWE-250; the packet's attack_vector describes 'a missing-authorization flaw (CWE-862/CWE-250) on the SonicWall SMA1000 secure-access appliance, letting an attacker reach functionality with unnecessary privileges without proper authorization', and the vector locates it in the appliance management console (AMC). CISA KEV-listed 2025-12-17, active_exploitation 'confirmed', RWEP 77 / CVSS 7.8, poc_available true.",
+        "gap_closes": [
+          "UK-CAF-B2"
+        ]
+      }
+    ]
   },
   "CVE-2025-20393": {
     "name": "Cisco Multiple Products Improper Input Validation Vulnerability",
@@ -16769,7 +17535,38 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-124",
+        "name": "FRAMEWORK-DEFAULT-SECRET-DETECTION",
+        "description": "Because CentreStack and Triofox ship the same AES key material in every install, the constant an attacker needs to forge trusted material is obtainable from the product itself rather than from the target — which means no amount of credential hygiene on the operator's side reduces the exposure. Gate the deployment on key uniqueness instead: after applying the vendor update, verify that the instance's AES key material differs from the vendor-shipped constant and from every other instance you operate, and fail the deployment back out of service if it does not. Re-run the check after any restore-from-image, template clone or appliance rebuild, since those are the operations that quietly reintroduce the shipped key on a host that was previously remediated. The packet ties the weakness specifically to publicly exposed endpoints, so this gate belongs on every internet-facing CentreStack/Triofox node before it is returned to service.",
+        "evidence": "Packet vector states the products 'contain a hardcoded cryptographic keys vulnerability for their implementation of the AES cryptoscheme', that this 'degrades security for public exposed endpoints', and that it 'may offer arbitrary local file inclusion when provided a specially crafted request without authentication'; cwe_refs CWE-798; patch_available true.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "This entry is KEV-listed with confirmed in-the-wild exploitation and a public PoC against an internet-exposed file-sharing gateway, and the packet says the crafted request needs no authentication — so exposure begins at the first unauthenticated scan of the endpoint, not at a first successful login, and the usual 'internal users only' scoping argument does not apply. Run the clock from 2025-12-15 and define verified mitigation as two deliverables rather than one: the vendor update deployed, and evidence that the instance is no longer running the shipped AES key. Applying the update alone does not retire key material an attacker could already have taken from the product, so an SLA that closes on package version alone closes on the wrong condition for a hardcoded-key flaw.",
+        "evidence": "Packet records cisa_kev true, kev_date 2025-12-15, active_exploitation confirmed, poc_available true, rwep_score 77, cvss 8.8, patch_available true, live_patch_available false; vector describes exploitation of 'public exposed endpoints' by 'a specially crafted request without authentication'.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "A CentreStack or Triofox node is the trust boundary between the internet and the file estate behind it, and the packet records confirmed in-the-wild exploitation of an unauthenticated request path on exactly that surface. Any instance that was internet-exposed while vulnerable should therefore be handled as a suspected compromise rather than as a host awaiting a patch: capture and review its configuration off-box, rebuild the node, and rotate every credential and token that was stored on it or transited it — including anything an attacker could have read through the arbitrary local file inclusion the vector describes. Patch-in-place is the wrong default here twice over, because it leaves attacker-installed persistence intact and it leaves already-disclosed file contents and any material forged with the shared key still valid.",
+        "evidence": "Packet records active_exploitation confirmed, cisa_kev true with kev_date 2025-12-15, poc_available true, and a vector permitting 'arbitrary local file inclusion when provided a specially crafted request without authentication' against 'public exposed endpoints'; attack_vector describes forging trusted material 'to gain unauthorized access and code execution'.",
+        "gap_closes": [
+          "NIS2-Art21-vulnerability-management"
+        ]
+      }
+    ]
   },
   "CVE-2018-4063": {
     "name": "Sierra Wireless AirLink ALEOS Unrestricted Upload of File with Dangerous Type Vulnerability",
@@ -16829,7 +17626,28 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "A 2018 CVE id added to CISA KEV on 2025-12-12 — the exploitation signal arrived roughly seven years after assignment, and every framework control cited against this entry keys its clock to disclosure and severity. An AirLink ALEOS gateway carrying a 2018 CVSS 8.8 sits in the aged-backlog tier of any normal patch program and is never re-prioritized when the flaw starts being used, which is exactly how a seven-year-old file-upload bug stays live on field-deployed cellular gateways at unstaffed sites. The control this CVE demands is a mitigation clock that starts at the KEV listing date regardless of CVE age: on 2025-12-12 every ALEOS unit in the fleet needed a verified mitigation — the vendor firmware update, which the packet records as available with no live-patch path and therefore a reboot-bearing field change, or removal of the device's web administration surface from any reachable network — inside the KEV response window, not at the next scheduled site visit.",
+        "evidence": "Packet: CVE id year 2018; CISA KEV-listed 2025-12-12 with active_exploitation 'confirmed'; RWEP 77 against CVSS 8.8; poc_available true. Sierra Wireless AirLink ALEOS, CWE-434 unrestricted upload of file with dangerous type: 'A specially crafted HTTP request can upload a file, resulting in executable code being uploaded, and routable, to the webserver.' attack_vector places the code execution on the cellular gateway. patch_available true; live_patch_available false with live_patch_notes recording no registered live-patch tool and a vendor patch that typically requires service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "The output of this defect is not a crash but a file: per the packet, executable code that is uploaded and routable to the gateway's own web server — a persistent web shell living in device storage, on a unit that is the WAN edge for a remote or unstaffed site where nobody is watching the console. A firmware update applied over an already-exploited gateway addresses the upload path while leaving that uploaded, reachable file in place, which is why 'firmware updated' is the wrong closure artifact for this CVE. For any ALEOS unit that was reachable before remediation, the required sequence is: preserve the configuration for forensics, reflash or factory-reset the device rather than upgrading in place, and rotate the credentials the gateway held, including its administrative and any stored management or VPN credentials. The packet gives no live-patch path, so the update is a reboot-bearing field action in either case — making the rebuild the more defensible use of that same maintenance visit.",
+        "evidence": "Packet: CWE-434 on Sierra Wireless AirLink ALEOS — 'A specially crafted HTTP request can upload a file, resulting in executable code being uploaded, and routable, to the webserver'; attack_vector describes uploading a file (e.g. a web shell) for code execution on the cellular gateway. CISA KEV-listed 2025-12-12 with active_exploitation 'confirmed'; poc_available true; CVSS 8.8, RWEP 77. patch_available true, live_patch_available false, live_patch_notes: no live-patch tool registered; vendor patch typically requires service restart or system reboot.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8"
+        ]
+      }
+    ]
   },
   "CVE-2025-58360": {
     "name": "OSGeo GeoServer Improper Restriction of XML External Entity Reference Vulnerability",
@@ -17317,7 +18135,21 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "MOBILE-OS-MINIMUM-PATCH-LEVEL-ENFORCEMENT",
+        "name": "MOBILE-OS-MINIMUM-PATCH-LEVEL-ENFORCEMENT",
+        "description": "The Android Framework out-of-bounds read is closed only by advancing the handset's security-patch level, and the packet records no live-patch path - the device has to take the update and reboot. The MDM/EMM must read each managed device's security-patch level and block or quarantine handsets below the level carrying this Framework fix from organizational data, not merely surface the stale level on a dashboard. The second half matters more than usual here: the leak is consumed by a locally running app to defeat ASLR for the follow-on exploit, so devices that cannot yet update must also be prevented from installing untrusted or side-loaded apps - denying the local app that harvests the leak is the only mitigation available while the OEM update is out of reach. It is also the control that survives triage: at CVSS 5.5 this reads as a low-priority information disclosure, while the packet scores it RWEP 77 on confirmed in-the-wild use. Distinguishing test: enroll a device pinned below the fixing patch level and confirm it is denied protected resources.",
+        "evidence": "Packet vector: Android Framework contains an unspecified vulnerability that allows for information disclosure. attack_vector records an out-of-bounds read (CWE-125) in the Android Framework used by a local app as a primitive in a privilege-escalation chain, leaking memory to defeat ASLR for a follow-on exploit, and forming the local-escalation half of a mobile-spyware chain. CISA KEV-listed 2025-12-02, active_exploitation confirmed, PoC available, CVSS 5.5, RWEP 77. patch_available true; live_patch_available false, with live_patch_notes stating no live-patch tool is registered and that the vendor patch typically requires service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-patch-management"
+        ]
+      }
+    ]
   },
   "CVE-2025-48572": {
     "name": "Android Framework Privilege Escalation Vulnerability",
@@ -17822,7 +18654,41 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "Windows hosts must reach the fixed kernel build on a KEV clock rather than the routine monthly workstation/server patch cycle, and for this CVE the SLA end-state has to be defined as the host running the patched kernel, not as the update being approved or staged. The packet records no live-patch path, so the clock only stops after the restart. Scope the SLA to the entire Windows estate rather than just internet-facing systems, because the flaw is reached from an existing local foothold, not from the network edge.",
+        "evidence": "CISA KEV-listed 2025-11-12 with active_exploitation recorded as confirmed, RWEP 77 against a CVSS of 7.8, and poc_available true. patch_available is true while live_patch_available is false; live_patch_notes states that no live-patch tool is registered for this entry and that the vendor patch typically requires service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-038",
+        "name": "MITIGATION-ACTIVE-PATCH-PENDING-VERDICT-CLASS",
+        "description": "For this kernel race condition the compliance verdict must separate 'update installed, restart pending' from 'vulnerability eliminated'. What is vulnerable is the kernel currently executing, so on any fleet that defers restarts — servers under change control, laptops that sleep instead of rebooting — deployment dashboards will report the host as remediated while the escalation to SYSTEM is still live. Audit evidence for this CVE must be the post-restart running build per host, and the installed-but-not-restarted population must be carried as its own time-bound exposure state with a named owner, not folded into the patched count.",
+        "evidence": "The packet records patch_available true and live_patch_available false, with live_patch_notes stating that no live-patch tool is registered and that the vendor patch typically requires service restart or system reboot per the KEV requiredAction — so a host can hold the fix and remain exploitable. Exploitation is confirmed in the wild per the 2025-11-12 KEV listing, and poc_available is true.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-003",
+        "name": "KERNEL-EXPLOITATION-DETECTION",
+        "description": "Because the fix only takes effect after a restart, the exposure window on this CWE-362 kernel race is measured in reboot cycles, and runtime detection is the only coverage inside it. Instrument Windows endpoints for kernel privilege-escalation indicators — a low-privilege process acquiring a SYSTEM token, token or process-handle duplication from an unprivileged parent, and SYSTEM-context children under a user-context parent — and treat a hit on a host that has not yet restarted onto the fixed build as an active-intrusion trigger rather than a routine alert, since this class arrives after an initial-access foothold is already established.",
+        "evidence": "The packet describes a Windows Kernel race condition (CWE-362) that lets a local attacker with low-level privileges escalate to SYSTEM-level access, records poc_available true, and states that LPEs of this class are routinely paired with an initial-access flaw by ransomware operators. Exploitation is confirmed in the wild per the 2025-11-12 KEV listing.",
+        "gap_closes": [
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2025-9242": {
     "name": "WatchGuard Firebox Out-of-Bounds Write Vulnerability",
@@ -17882,7 +18748,42 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-030",
+        "name": "PERIMETER-DEVICE-ZERODAY-SLA-TIER",
+        "description": "A WatchGuard Firebox is itself the network trust boundary, and the vulnerable code is the iked process that terminates IKE/VPN negotiation — reachable before authentication by anyone who can send IKE traffic to the gateway. Firebox firmware therefore cannot share a patch tier with server or workstation operating systems: the requirement is vendor firmware deployed within hours of the KEV listing, or the IKE/VPN listener restricted to known peer addresses until the firmware window can be taken. The packet records no live-patch path for this entry, so the update carries a device restart that drops the organization's VPN — which is exactly why routine change control pushes it into a maintenance window weeks out, and exactly why this tier has to name that outage as in-scope rather than as grounds to defer a pre-authentication code-execution flaw on the perimeter.",
+        "evidence": "Packet: out-of-bounds write (CWE-787) in the Firebox OS iked process that may allow a remote unauthenticated attacker to execute arbitrary code; characterized as memory-corruption remote code execution on the firewall via the Firebox IKE/VPN handling. CVSS 9.8, RWEP 77, poc_available true. CISA KEV-listed 2025-11-12 with active_exploitation confirmed. patch_available true; live_patch_available false, with live_patch_notes stating the vendor patch typically requires service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-network-security"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "Fireboxes that were reachable while this CVE was under active exploitation must be treated as compromised until proven otherwise, not simply firmware-updated. Unauthenticated code execution in iked runs inside the appliance that holds its own configuration, its VPN key material and certificates, and its administrative credentials — and a firmware update that preserves the running configuration also preserves anything an attacker added to it (accounts, tunnels, policy entries, management access). The default response is to export and review the configuration off the device, rebuild the appliance from a known-good configuration rather than updating in place, and rotate every credential the gateway held — VPN pre-shared keys, local user and administrator passwords, any directory or RADIUS service account bound to the gateway, and certificates — before the tunnels are returned to service.",
+        "evidence": "Packet: the flaw is an out-of-bounds write in the Firebox OS iked process allowing a remote unauthenticated attacker to execute arbitrary code on the firewall (CWE-787, CVSS 9.8, RWEP 77), with poc_available true, CISA KEV-listed 2025-11-12 and active_exploitation confirmed. Confirmed in-the-wild pre-authentication code execution on the device that enforces the perimeter is what makes update-in-place insufficient; the citing gaps stop at flaw remediation (NIST SP 800-53 SI-2) and management of technical vulnerabilities (ISO/IEC 27001:2022 A.8.8), neither of which requires post-exploitation rebuild or credential rotation.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "UK-CAF-B4",
+          "NIS2-Art21-network-security"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-031",
+        "name": "FIREWALL-EGRESS-TELEMETRY-SEPARATE-TRUST-ZONE",
+        "description": "Because this exploit executes attacker code inside the Firebox itself, the device's local log store and its logging configuration are within the attacker's control from the moment of compromise; the only records that can establish whether a given appliance was hit before its firmware was updated are records already off the box. Fireboxes must forward IKE/VPN negotiation and tunnel-establishment logs, management-plane authentication, and configuration-change events to a collector in a separate trust zone — different management plane, different credentials, different authentication path — with retention long enough to look backward past the KEV listing date. Without that, an operator asked after the fact whether the gateway was exploited can only answer using evidence produced by the device that was executing the attacker's code.",
+        "evidence": "Packet: out-of-bounds write in the Firebox OS iked process allowing a remote unauthenticated attacker to execute arbitrary code on the appliance (CWE-787, CVSS 9.8), poc_available true, CISA KEV-listed 2025-11-12 with active_exploitation confirmed. Attacker code execution on the appliance is the packet fact that places the device's own telemetry inside the blast radius.",
+        "gap_closes": [
+          "UK-CAF-B4",
+          "NIS2-Art21-network-security"
+        ]
+      }
+    ]
   },
   "CVE-2025-21042": {
     "name": "Samsung Mobile Devices Out-of-Bounds Write Vulnerability",
@@ -18172,7 +19073,21 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "XWiki's exposure here has no authentication gate to slow it down — the packet records that any guest can reach the eval-injection sink through a SolrSearch request and obtain arbitrary remote code execution — so every hour between KEV listing and deployment of the fixed build is an hour any reachable instance is exploitable by an unauthenticated caller against whom a PoC already exists. The packet records no live-patch path and a fix that typically requires a service restart or system reboot, so meeting the clock means scheduling that restart on the wiki, not deferring it to the next routine window. The SLA must name the XWiki application as its own tracked asset: self-hosted collaboration platforms are commonly patched on a separate cadence from the operating system of the host they run on, and an OS-patching attestation says nothing about the wiki's build.",
+        "evidence": "Packet: XWiki Platform, CWE-95 eval injection; vector 'XWiki Platform contains an eval injection vulnerability that could allow any guest to perform arbitrary remote code execution through a request to SolrSearch'; CISA KEV-listed 2025-10-30 with active_exploitation 'confirmed'; RWEP 77 / CVSS 9.8; poc_available true; patch_available true; live_patch_available false, with live_patch_notes 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.'",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management",
+          "NIST-800-53-SI-2"
+        ]
+      }
+    ]
   },
   "CVE-2025-6204": {
     "name": "Dassault Systèmes DELMIA Apriso Code Injection Vulnerability",
@@ -18702,7 +19617,20 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "The Windows SMB-client fleet is on the KEV clock that started 2025-10-20, and the packet's live-patch fields are the operational catch for this CVE. live_patch_available is false and the note records that the vendor patch typically requires a service restart or system reboot, so the fix is not in force until the host actually restarts. A patch console reporting the update 'deployed' across the estate is not evidence of remediation here: an unrebooted workstation or server is still running the vulnerable SMB client, and the coercion path in the packet — a crafted script making the victim machine connect back to the attacker's system over SMB and authenticate, with that authentication reflected back to reach SYSTEM — needs no credentials on the target and no attacker presence on the host beforehand. KEV-SLA compliance for this entry must therefore be measured on rebooted-and-verified hosts, with deferred-reboot machines counted as still exposed rather than as patched, and any host that cannot take the reboot inside the window treated as an open item with a named date.",
+        "evidence": "Packet fields for CVE-2025-33073: cisa_kev=true with kev_date 2025-10-20 and active_exploitation='confirmed'; vector states the Windows SMB Client improper access control flaw 'could allow for privilege escalation. An attacker could execute a specially crafted malicious script to coerce the victim machine to connect back to the attack system using SMB and authenticate'; attack_vector describes NTLM reflection back to the victim to gain SYSTEM and notes 'escalation flaws of this class form the second half of an intrusion chain'; poc_available=true; rwep_score=77, cvss=9.8; patch_available=true, live_patch_available=false; live_patch_notes: 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.'",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      }
+    ]
   },
   "CVE-2025-61884": {
     "name": "Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability",
@@ -18932,7 +19860,40 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-009",
+        "name": "KERNEL-MODULE-INVENTORY-AND-DISABLE",
+        "description": "The vulnerable component here is a modem driver that ships with Windows itself, so it is present and loadable on hosts whose owners never installed it and have no modem hardware. Operators need a per-host inventory of kernel-mode drivers that enumerates OS-supplied drivers, not only vendor-installed ones, with a business justification recorded per driver and a standing action to keep the Agere modem driver unloadable on machines with no modem function. Nothing in the citing frameworks obliges anyone to enumerate a privileged driver they never chose to deploy, which is exactly why this attack surface survived on fleets that pass driver-hygiene and asset-inventory audits.",
+        "evidence": "The packet identifies the affected component as the Microsoft Windows Agere Modem Driver, with an untrusted pointer dereference (CWE-822) that allows privilege escalation such that a successful attacker could gain administrator privileges, exploited from a local foothold. CISA KEV-listed 2025-10-14 with active_exploitation confirmed and poc_available true.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-123",
+        "name": "VULNERABLE-DRIVER-BLOCKLIST-ENFORCEMENT",
+        "description": "This is a signed kernel-mode driver whose untrusted-pointer-dereference primitive hands an unprivileged local process administrator-level kernel execution, so the enforcement question is whether the driver can be loaded at all rather than only whether the host took the latest update. Enable HVCI together with the vendor recommended-driver blocklist so the vulnerable Agere modem driver cannot load, and verify the enforcement on hosts rebuilt from older images or restored from backup — that is where a vulnerable driver binary reappears on a fleet that has otherwise been updated.",
+        "evidence": "The packet records an untrusted pointer dereference (CWE-822) in the Microsoft Windows Agere Modem Driver yielding privilege escalation to administrator privileges from a local foothold, with poc_available true, RWEP 77 against a CVSS of 7.8, and confirmed in-the-wild exploitation per the 2025-10-14 KEV listing.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "Put the driver fix on a KEV clock and scope the affected population to every Windows install that carries the in-box Agere modem driver, not to the small set of machines with modem hardware attached — the driver's presence, not its use, is what makes the host exploitable. As with other kernel-mode fixes in this packet the SLA can only be closed out on the restarted host, since no live-patch path is recorded, so exception tracking has to name the hosts still awaiting a restart.",
+        "evidence": "CISA KEV-listed 2025-10-14 with active_exploitation confirmed, RWEP 77 against a CVSS of 7.8, and poc_available true. patch_available is true while live_patch_available is false; live_patch_notes states no live-patch tool is registered for this entry and that the vendor patch typically requires service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "NIS2-Art21-patch-management",
+          "NIST-800-53-SI-2"
+        ]
+      }
+    ]
   },
   "CVE-2025-59230": {
     "name": "Microsoft Windows Improper Access Control Vulnerability",
@@ -19967,7 +20928,38 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-030",
+        "name": "PERIMETER-DEVICE-ZERODAY-SLA-TIER",
+        "description": "An inbound email security gateway occupies the same trust boundary as a firewall or WAF: every message from the internet is parsed by it before any mailbox sees it, so a command-injection defect in its compressed-attachment handling is reachable by anyone who can send mail to the organization — no account, no foothold, no user click needed. Libraesva ESG therefore needs a distinct SLA tier keyed to the KEV listing (vendor mitigation deployed within hours of 2025-09-29, or inbound message flow diverted away from the vulnerable appliance), not the routine appliance-maintenance window that 'patch operating systems' and flaw-remediation controls assume for infrastructure gear. Because the packet records no live-patch path for this entry, that tier must budget for the service restart or reboot the vendor update requires — the change window is part of the SLA, not an excuse to miss it.",
+        "evidence": "Packet: Libraesva Email Security Gateway (ESG) command injection, CWE-77, 'command injection via a compressed e-mail attachment'; attack_vector records remote command execution on the mail-security appliance triggered via a crafted email/attachment. CVSS 9.8, RWEP 77, poc_available true. CISA KEV-listed 2025-09-29 with active_exploitation 'confirmed'. patch_available true, live_patch_available false, live_patch_notes: 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.'",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-055",
+        "name": "SECURITY-TOOL-INTEGRITY-VERIFICATION",
+        "description": "The vulnerable product is itself a security control, and the exploited path is the very function it was bought for: inspecting compressed attachments on inbound mail. Vulnerability-management scope has to name the ESG appliance's own firmware as a managed, privileged software surface on the same SLA as the mail infrastructure behind it, rather than counting the gateway only as a mitigating control in the risk register. The audit evidence must be a trust-anchor-inversion test — detonate a crafted compressed attachment against a staging ESG and confirm the archive is inspected with no command executed — because an attestation that 'an email security gateway is deployed and filtering' is exactly the paper finding this CVE defeats: the filter was the execution sink.",
+        "evidence": "Packet: CWE-77 command injection in Libraesva Email Security Gateway (ESG), reached 'via a compressed e-mail attachment' — i.e. through the appliance's own attachment-inspection path. CVSS 9.8, RWEP 77, poc_available true, active_exploitation 'confirmed', CISA KEV-listed 2025-09-29. Framework gaps already citing this CVE include ISO/IEC 27001:2022 A.8.8 (management of technical vulnerabilities) and UK CAF B4 (system security).",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "Successful exploitation runs attacker-chosen commands on the ESG appliance, and that appliance holds every message it has processed plus its mail-routing configuration and stored credentials. With confirmed in-the-wild exploitation and a 2025-09-29 KEV listing, any instance that was accepting internet mail while unpatched has to be handled as potentially executed-against: capture and preserve the configuration, rebuild the appliance from vendor media, and rotate the credentials it held — instead of installing the update and closing the ticket. This is why NIS2's incident-handling obligation is cited against this entry rather than only its patching obligation: on a device where an attacker could already run commands, 'patched' and 'not compromised' are two different findings, and the vendor update (which per the packet needs a service restart or reboot and has no live-patch alternative) only settles the first.",
+        "evidence": "Packet: command-injection flaw (CWE-77) enabling remote command execution on the mail-security appliance; CISA KEV-listed 2025-09-29 with active_exploitation 'confirmed'; poc_available true; CVSS 9.8, RWEP 77. patch_available true but live_patch_available false, live_patch_notes state no live-patch tool is registered and the vendor patch typically requires a service restart or system reboot. NIS2-Art21-incident-handling is among the framework gaps already citing this CVE.",
+        "gap_closes": [
+          "NIS2-Art21-incident-handling"
+        ]
+      }
+    ]
   },
   "CVE-2025-10035": {
     "name": "Fortra GoAnywhere MFT Deserialization of Untrusted Data Vulnerability",
@@ -20525,7 +21517,32 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "The TL-WR841N flaw ends in disclosure of the credentials the router itself stores, which makes firmware an incomplete remediation by construction: an attacker who spoofed authentication against the httpd service on TCP 80 keeps every secret already read off the device, and those secrets stay valid after the update lands. For any unit that was reachable during the exploitation window the response has to assume the router's configuration was exfiltrated — reset the device to a known-good configuration rather than updating in place, and rotate every credential stored on it or reachable through it before it is returned to the network. This is the router-perimeter case the control exists for: a vulnerability-management program that closes the finding on 'firmware updated' leaves the attacker holding working credentials to the network the router fronts.",
+        "evidence": "Packet: vector states the flaw is 'within the httpd service, which listens on TCP port 80 by default, leading to the disclose of stored credentials' (CWE-290, authentication bypass by spoofing). active_exploitation 'confirmed', poc_available true, CISA KEV-listed 2025-09-03, CVSS 9.1, RWEP 77. patch_available true, live_patch_available false; live_patch_notes: 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.' Nothing in the packet indicates the update invalidates credentials already disclosed.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "ISO-27001-2022-A.8.8",
+          "UK-CAF-B2",
+          "NIS2-Art21-network-security"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "TL-WR841N units are consumer-grade routers that typically sit outside a managed patch pipeline, so a KEV listing produces no action at all unless the SLA explicitly enumerates them as in-scope assets. Bind the 2025-09-03 listing to a 4-hour clock covering every deployed unit, and use the control's own allowance for documented compensating controls as the closure path where a supported firmware release does not exist for the specific hardware revision: removing the port-80 httpd management surface from any untrusted segment satisfies the SLA where an update cannot. This matters because the packet's KEV text also records that the affected products could be end-of-life or end-of-service with a discontinue-use instruction — an SLA that can only be discharged by patching will not close at all across part of this fleet.",
+        "evidence": "Packet: CISA KEV-listed 2025-09-03, active_exploitation 'confirmed', poc_available true, CVSS 9.1, RWEP 77, patch_available true, live_patch_available false. Vector text: 'The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.' The httpd service 'listens on TCP port 80 by default'. The control's own definition admits patch, live patch, or documented compensating controls as valid mitigation.",
+        "gap_closes": [
+          "AU-ISM-1546",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      }
+    ]
   },
   "CVE-2025-9377": {
     "name": "TP-Link Archer C7(EU) and TL-WR841N/ND(MS) OS Command Injection Vulnerability",
@@ -20792,7 +21809,40 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "A FreePBX instance reached through this flaw is not partially compromised — the packet's path goes from unauthenticated request straight to FreePBX Administrator, arbitrary database manipulation and remote code execution, so there is no intermediate privilege state where a slower patch window is survivable. The KEV listing, not the telephony team's change calendar, has to start the clock, and PBX estates that are normally patched on a call-quality-driven schedule need the update pulled forward to hours. Because the packet records no live-patch tool for this entry and notes the vendor patch typically requires service restart or system reboot, the SLA must budget the call-affecting restart inside the same window instead of parking the fix until the next low-traffic maintenance slot.",
+        "evidence": "Packet: CISA KEV-listed 2025-08-29 with active_exploitation 'confirmed', poc_available true, CVSS 9.8, RWEP 77, CWE-89 and CWE-288. Vector: 'authentication bypass vulnerability due to insufficiently sanitized user-supplied data allows unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution.' patch_available true, live_patch_available false, live_patch_notes states the vendor patch typically requires service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-085",
+        "name": "DB-ABSTRACTION-LAYER-PARAMETERIZATION-VERIFICATION",
+        "description": "The injection sink in this CVE sits on a request path that is reached before any administrator login, so the two boundaries operators normally point at during an audit — the FreePBX admin authentication gate and a WAF in front of the PBX — are both downstream of the defect and neither can be treated as the control. Verification has to happen where the SQL is composed: the PBX application's data-access layer and every installed module that builds a query, with evidence that request-supplied values are bound as parameters rather than concatenated, on the pre-authentication handlers specifically. Attesting 'input is validated' or 'a WAF is deployed' is precisely the attestation this CVE defeats, because the unsanitized value is accepted by the application itself before authentication is evaluated.",
+        "evidence": "Packet: CWE-89 (SQL injection) is carried alongside CWE-288 (authentication bypass), and the vector attributes both to 'insufficiently sanitized user-supplied data' reaching FreePBX Administrator without authentication, yielding 'arbitrary database manipulation and remote code execution'. CISA KEV-listed 2025-08-29, active_exploitation 'confirmed', poc_available true, CVSS 9.8, RWEP 77.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "Applying the vendor update fixes the code path but leaves everything the attacker wrote behind it. This flaw grants arbitrary database manipulation, so a patched-in-place FreePBX can still carry attacker-created administrator accounts, extensions, trunks and dialplan entries, plus whatever the remote code execution dropped on disk — all of which survive the update and the restart it requires. For any instance whose administrator interface was reachable from an untrusted network during the exposure window, the default response has to be capture the configuration and database for forensic review, rebuild the PBX from known-good media at the fixed release, and rotate every secret the box held (administrator logins, SIP/extension and trunk credentials, database credentials) — not patch and resume calls.",
+        "evidence": "Packet vector: unauthenticated access to FreePBX Administrator 'leading to arbitrary database manipulation and remote code execution' (CWE-89, CWE-288) — the compromise writes persistent state, which patching does not remove. CISA KEV-listed 2025-08-29 with active_exploitation 'confirmed' and poc_available true means exposed instances must be assumed reached, not merely reachable; CVSS 9.8, RWEP 77. live_patch_available is false and live_patch_notes records that the vendor patch typically requires service restart or system reboot.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "NIST-800-53-SI-2",
+          "UK-CAF-B2"
+        ]
+      }
+    ]
   },
   "CVE-2025-7775": {
     "name": "Citrix NetScaler Memory Overflow Vulnerability",
@@ -20852,7 +21902,33 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-030",
+        "name": "PERIMETER-DEVICE-ZERODAY-SLA-TIER",
+        "description": "NetScaler ADC and NetScaler Gateway are not servers behind the perimeter — they are the perimeter, terminating remote access and fronting the applications behind them. CVE-2025-7775 is a memory-overflow flaw reachable pre-authentication for remote code execution and/or denial of service, so the exposure condition is simply 'internet-reachable and unpatched'; no user action, credential, or foothold is required to start the clock. A patch SLA that measures this appliance on the same cadence as the general server estate is measuring the wrong thing, because a compromise here is not one host — it is the authentication and traffic boundary for everything behind it. Requirement: NetScaler ADC/Gateway carries its own SLA tier — vendor fix deployed within hours of the KEV listing, or the appliance's internet-facing interface withdrawn from exposure until it is. Because no live-patch path is registered for this entry, taking the fix means a service restart or reboot of the appliance per the KEV required action, so the maintenance window has to be pre-authorized as a standing condition of operating the device rather than negotiated with change management after a KEV listing lands.",
+        "evidence": "Packet: CWE-119 memory overflow in Citrix NetScaler ADC and NetScaler Gateway, described as exploitable by an unauthenticated attacker for remote code execution (vector also notes denial of service). CISA KEV-listed 2025-08-26 with active_exploitation 'confirmed' and poc_available true; CVSS 9.8, RWEP 77. patch_available true, live_patch_available false, live_patch_notes: 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.' Every citing gap that concerns remediation timing (AU-Essential-8-Patch, ISO-27001-2022-A.8.8, NIS2-Art21-patch-management, NIST-800-53-SI-2, UK-CAF-B4) is a generic estate-wide vulnerability-management control; none of them separates the device that enforces the trust boundary from the assets it protects.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management",
+          "NIST-800-53-SI-2",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "Because exploitation of CVE-2025-7775 is confirmed in the wild and the flaw needs no authentication, any NetScaler that was internet-reachable while unpatched has to be treated as possibly already executed against — the absence of an alert is not evidence, since code execution on the appliance runs with the appliance's own privilege over its own local state and logs. Applying the vendor update to such a box restores the vulnerable binary but says nothing about what was installed, added to the configuration, or read out of it beforehand, so 'patched' is not a defensible closure statement for this CVE. Requirement: the IR runbook for a NetScaler exposed during the pre-patch window must default to exporting and reviewing the running configuration, rebuilding the appliance from vendor media rather than patching in place, and rotating every credential and certificate the appliance held or could authenticate with — with that path rehearsed in advance, because the decision cannot be made well under the time pressure a KEV-listed pre-auth RCE creates.",
+        "evidence": "Packet: unauthenticated remote code execution on Citrix NetScaler ADC/Gateway (CWE-119), CISA KEV-listed 2025-08-26 with active_exploitation 'confirmed' and poc_available true, RWEP 77 / CVSS 9.8. patch_available true but live_patch_available false, with live_patch_notes stating the vendor patch typically requires service restart or system reboot per the KEV requiredAction — i.e. the only available remediation is a disruptive update applied after the exposure window, not a hot fix that precedes it. The citing gaps (AU-Essential-8-Patch, ISO-27001-2022-A.8.8, NIS2-Art21-patch-management, NIST-800-53-SI-2, UK-CAF-B4) all treat deployment of the fix as the terminal state and carry no post-exploitation integrity step.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management",
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2025-48384": {
     "name": "Git Link Following Vulnerability",
@@ -20907,7 +21983,31 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "Git is KEV-listed with confirmed exploitation, but it is not the kind of asset the citing patch controls enumerate: it exists on developer workstations, inside CI runner images, in container base layers, and bundled inside IDEs and build tooling, so an estate can be fully compliant with 'patch operating systems' and still run the vulnerable Git everywhere code is fetched. The KEV clock must therefore be applied to the Git binary as its own tracked component with an explicit inventory of every place it is embedded. There is no live-patch path for this entry, so the only remediation is shipping the vendor-fixed Git itself — which for image-resident copies means rebuilding and redeploying the image, not waiting on a host maintenance window; the packet notes the vendor patch follows the KEV requiredAction (service restart or system reboot).",
+        "evidence": "CISA KEV-listed 2025-08-25 with active_exploitation confirmed; RWEP 77, CVSS 8.8, poc_available true. patch_available true, live_patch_available false; live_patch_notes: 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.' Cited as evidence against AU-Essential-8-Patch ('Patch operating systems'), ISO-27001-2022-A.8.8, NIST-800-53-SI-2 and NIS2-Art21-vulnerability-management.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-116",
+        "name": "MULTI-TRIGGER-DEPENDENCY-EXECUTION-POLICY",
+        "description": "This Git flaw adds a trigger that no dependency-execution policy enumerates: source-acquisition time. Git's inconsistent handling of carriage return characters in configuration files lets a malicious repository write a file outside the working tree — a hook — during clone/checkout, which then executes when the victim next works with the repository. No package installs, no module imports, no build script runs, so ignore-scripts defaults, lockfile pinning and build-step sandboxes all miss it entirely; the code runs with whatever privilege the cloning identity holds, which on a CI runner or a developer workstation is the identity holding source, build and publishing credentials. Policy must therefore list clone/checkout alongside install-time, import-time and compile-time as an execution trigger: fetch untrusted repositories only under a least-privilege, egress-restricted identity, and never onto a context that holds credentials the fetch itself does not need.",
+        "evidence": "CWE-59 (link following) and CWE-436 (interpretation conflict). Packet vector: 'Git contains a link following vulnerability that stems from Git's inconsistent handling of carriage return characters in configuration files.' Packet attack_vector: a malicious repository can 'write files outside the working tree on clone/checkout (e.g. a hook), leading to code execution when the victim works with the repository.' poc_available true; active_exploitation confirmed. Cited as evidence against NIST-800-53-AC-6 (Least Privilege) and UK-CAF-B4 (System security).",
+        "gap_closes": [
+          "NIST-800-53-AC-6",
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2024-8068": {
     "name": "Citrix Session Recording Improper Privilege Management Vulnerability",
@@ -21607,7 +22707,31 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-036",
+        "name": "FLEET-CONTROL-PLANE-ADMIN-PRIVILEGE-TIER",
+        "description": "This PaperCut flaw never touches the server directly — it rides the browser of a signed-in PaperCut administrator, forcing a state-changing request that alters a security setting and opens the code-execution path. The countermeasure is therefore not on the server but on the administrator's browsing context: PaperCut NG/MF console access only from a dedicated privileged-access workstation or PAM jumphost, a separate admin identity that is never used for general web browsing or mail, just-in-time elevation so no long-lived authenticated admin session is sitting in a tab waiting to be targeted, and FIDO2 step-up on the console itself. PaperCut administers a fleet of print endpoints and pushes client software to them, which is what makes its console a control plane rather than an ordinary application; frameworks that collapse it into generic 'application admin' preserve precisely the always-signed-in admin browser this attack requires.",
+        "evidence": "Packet: attack_vector states 'an attacker who lures an authenticated administrator to a malicious page can force a state-changing request (e.g. enabling a setting that leads to code execution), part of the PaperCut exploitation chain' (CWE-352, cross-site request forgery). Vector: the flaw 'under specific conditions, could potentially enable an attacker to alter security settings or execute arbitrary code.' CISA KEV-listed 2025-07-28, active_exploitation 'confirmed', poc_available true, CVSS 8.8, RWEP 77.",
+        "gap_closes": [
+          "NIST-800-53-AC-6"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "The usual deferral argument for a print server — internal only, not internet-facing, patch next cycle — does not survive this bug class. Exploitation needs only an administrator to open a page, so an internal PaperCut NG/MF server is exactly as reachable through that administrator's browser as an externally exposed one, and network placement buys no time. Bind the 2025-07-28 KEV listing to a 4-hour clock to deploy the vendor update. No live-patch path is registered for this entry and the fix requires a service restart, so the print-service interruption is part of the SLA to be scheduled, not a reason to slip past it; until the update is deployed, the only real compensating control is denying the admin console session any general-web browsing context.",
+        "evidence": "Packet: CISA KEV-listed 2025-07-28, active_exploitation 'confirmed', poc_available true, CVSS 8.8, RWEP 77. patch_available true; live_patch_available false; live_patch_notes: 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.' attack_vector: the CSRF is triggered by luring an authenticated administrator to a malicious page, so reachability does not depend on the server being internet-facing.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management",
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2025-20337": {
     "name": "Cisco Identity Services Engine Injection Vulnerability",
@@ -21760,7 +22884,39 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-030",
+        "name": "PERIMETER-DEVICE-ZERODAY-SLA-TIER",
+        "description": "Cisco ISE and ISE-PIC decide which endpoints and users are admitted to the network, so an unauthenticated crafted-API-request path to root execution on that device is a trust-boundary compromise, not an application-server bug on a 30-day cycle. This CVE needs its own SLA tier: the fixed release deployed within hours of the KEV listing, or the affected API surface isolated so it is reachable only from the management network until the upgrade lands. Standard appliance-patch windows are the wrong instrument here because the appliance is the enforcement point the rest of the network's access control depends on.",
+        "evidence": "The packet describes an injection flaw (CWE-74) in a specific API of Cisco ISE and Cisco ISE-PIC caused by insufficient validation of user-supplied input, exploitable by submitting a crafted API request, with successful exploitation allowing remote code execution and root privileges on an affected device. CVSS 9.8, RWEP 77, poc_available true, and CISA KEV-listed 2025-07-28 with active_exploitation confirmed.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-network-security"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "Any ISE or ISE-PIC node that was reachable from an untrusted network before the fixed release was applied must be handled as presumed-compromised rather than simply upgraded: export the configuration off-box for analysis, rebuild the node from vendor media at the fixed release, and rotate every secret the node held — RADIUS and TACACS+ shared secrets, the directory join and bind accounts, admin and API credentials, and certificates issued by the node's internal CA. Upgrading in place closes the injection path but leaves any root-level persistence installed through it intact on the device that authorizes network access.",
+        "evidence": "Per the packet the flaw allows remote code execution and root privileges on an affected Cisco ISE / ISE-PIC device from an unauthenticated crafted API request (CWE-74), with active_exploitation confirmed and a CISA KEV listing dated 2025-07-28; poc_available is true and CVSS is 9.8. The packet records patch_available true with live_patch_available false and notes the vendor patch typically requires service restart or system reboot per the KEV requiredAction, so the remediation outage is already unavoidable — rebuilding costs the same window as upgrading in place.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-network-security"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-037",
+        "name": "FLEET-COMPROMISE-IR-PLAYBOOK",
+        "description": "Root on ISE is a fleet event rather than a single-appliance event, because the device holds the trust state for every endpoint it admits. The playbook for this CVE has to cover: revocation of certificates issued by the ISE internal CA during the exposure window, invalidation of endpoint trust state (posture results, endpoint identity-group membership, and profiling or MAB entries an attacker could have added to admit their own device), a diff of authorization policy and administrator accounts against a known-good export, quarantine criteria for devices admitted through the affected node, and rotation of credentials for every account that authenticated through it while it was exposed.",
+        "evidence": "The packet records unauthenticated remote code execution with root privileges on Cisco ISE and ISE-PIC via a crafted API request (CWE-74), CVSS 9.8 and RWEP 77, poc_available true, and confirmed in-the-wild exploitation per the CISA KEV listing dated 2025-07-28.",
+        "gap_closes": [
+          "UK-CAF-B2"
+        ]
+      }
+    ]
   },
   "CVE-2025-2775": {
     "name": "SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability",
@@ -21820,7 +22976,21 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "The vulnerable surface on SysAid On-Prem is the Checkin processing functionality, which parses XML before any authentication step, so the exposure clock on a reachable instance starts at first packet — there is no credential barrier to slow an attacker while a maintenance window is scheduled, and per the packet exploitation is confirmed with a PoC already public. The citing controls treat this as ordinary technical-vulnerability management on a routine patching cadence, which leaves an unauthenticated file-read and server-side-request-coercion primitive live for weeks after the 2025-07-22 KEV listing. The control means the SysAid update is deployed within hours of that listing, accepting the service restart or system reboot the packet records the vendor patch requires (live_patch_available is false — there is no in-place option to defer the restart to); where the restart genuinely cannot be taken immediately, the Checkin endpoint is removed from untrusted-network reachability and that compensating control is recorded with a deadline rather than the instance sitting exposed through a cycle. Because the primitive is server-file read plus request coercion leading toward administrator takeover, an instance that was reachable from untrusted networks before the update also needs its SysAid administrator credentials and any secrets held in server-side files handled on the assumption the read already happened.",
+        "evidence": "Packet CVE-2025-2775 \"SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability\", cwe_refs CWE-611; cisa_kev true with kev_date 2025-07-22; active_exploitation confirmed; rwep_score 77; cvss 8.8; poc_available true. vector: \"SysAid On-Prem contains an improper restriction of XML external entity reference vulnerability in the Checkin processing functionality, allowing for administrator account takeover and file read primitives.\" attack_vector: \"an XML external entity (XXE) flaw (CWE-611) letting an unauthenticated attacker read server files and coerce server-side requests (a step toward administrator takeover and code execution).\" patch_available true; live_patch_available false; live_patch_notes: \"No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.\" All six citing gaps are patch-cadence or generic access controls, none carrying a KEV-tied clock.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      }
+    ]
   },
   "CVE-2025-2776": {
     "name": "SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability (variant: CVE-2025-2776)",
@@ -22235,7 +23405,38 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-030",
+        "name": "PERIMETER-DEVICE-ZERODAY-SLA-TIER",
+        "description": "FortiWeb is a web application firewall — the exact device class this SLA tier exists for, and the one whose compromise inverts the protection model, because the appliance sits inline in front of every application it fronts. The packet's flaw is reachable unauthenticated over crafted HTTP or HTTPS requests, which is the same channel the appliance must keep open to do its job, so 'restrict management access' is not a substitute for speed here. The requirement this CVE demonstrates: vendor mitigation deployed within hours of the 2025-07-18 KEV listing, or the vulnerable interface isolated, rather than the 14/30-day cycle that Essential Eight patching, NIS2 patch management, and SI-2 flaw remediation permit for infrastructure appliances. With no live-patch path recorded for this entry, the fixed release lands with a service restart or reboot, so the maintenance window must be pre-authorized before the next KEV listing, not negotiated after it.",
+        "evidence": "Packet: Fortinet FortiWeb SQL injection, CWE-89 — 'may allow an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests'; attack_vector records it as reachable unauthenticated and escalating to compromise. CVSS 9.8, RWEP 77, poc_available true. CISA KEV-listed 2025-07-18 with active_exploitation 'confirmed'. patch_available true, live_patch_available false, live_patch_notes: no live-patch tool registered; vendor patch typically requires service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "NIS2-Art21-patch-management",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "The packet describes this SQL injection as escalating to compromise of the FortiWeb appliance itself, reachable by an unauthenticated attacker over ordinary HTTP/HTTPS. A WAF terminates traffic for the applications behind it, so a compromised unit is positioned to read request bodies, session material, and its own stored administrative and backend credentials. For any appliance that was internet-reachable and unpatched before the 2025-07-18 KEV listing, remediation therefore has to default to configuration capture, rebuild from vendor media, and rotation of every credential the appliance held — not an in-place upgrade. A technical-vulnerability-management process that records the fixed release as the closure artifact marks this finding resolved on a device an attacker may already own; the vendor update, which the packet places behind a service restart or reboot with no live-patch alternative, ends the exposure but does not evict an existing foothold.",
+        "evidence": "Packet: 'SQL injection (CWE-89) on the FortiWeb surface, reachable unauthenticated and escalating to compromise. CISA KEV-listed 2025-07-18 with confirmed in-the-wild exploitation.' CVSS 9.8, RWEP 77, poc_available true, active_exploitation 'confirmed'. patch_available true; live_patch_available false with live_patch_notes recording no registered live-patch tool and a vendor patch that typically requires service restart or system reboot.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-085",
+        "name": "DB-ABSTRACTION-LAYER-PARAMETERIZATION-VERIFICATION",
+        "description": "This CVE is the case that breaks the standard injection compensating control: across frameworks and audits, 'an inline WAF is deployed' is accepted as the mitigation for the SQL-injection class, and here the concatenation sink was inside the WAF's own request handling. Parameterization has to be evidenced at the product's query-builder layer — for security appliances that means procurement and assurance asking the vendor for it, and security-testing scope covering the appliance's own HTTP and management surfaces with SQL metacharacters in every request field, on a staging unit, confirming the query is parameterized rather than concatenated. Operators cannot patch Fortinet's data-access code; what they can stop doing is counting the presence of this appliance as proof that the injection class is controlled anywhere in the estate, including on the appliance itself. The concrete action remains the fixed release, which per the packet arrives with a service restart or reboot and no live-patch option.",
+        "evidence": "Packet: CWE-89 SQL injection in Fortinet FortiWeb — a web application firewall — where an unauthenticated attacker executes unauthorized SQL code or commands via crafted HTTP or HTTPs requests. CVSS 9.8, RWEP 77, poc_available true, CISA KEV-listed 2025-07-18 with confirmed in-the-wild exploitation. UK-CAF-B4 (system security) is among the framework gaps already citing this CVE.",
+        "gap_closes": [
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2025-47812": {
     "name": "Wing FTP Server Improper Neutralization of Null Byte or NUL Character Vulnerability",
@@ -22355,7 +23556,42 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "Installing the NetScaler fix stops the overread but does nothing about the session material already read out of the appliance's memory — the packet records this CitrixBleed-2-class flaw as having been used in the wild for session hijack, so an attacker holding a stolen token retains a valid, already-authenticated path through a fully patched appliance. The runbook for an actively-exploited NetScaler ADC/Gateway must therefore treat patching as step one only: terminate and invalidate every session on the Gateway virtual servers named in the vector (VPN vserver, ICA Proxy, CVPN, RDP Proxy) and the AAA virtual server, rotate credentials and secrets that could have transited the gateway during the exposure window, and audit the appliance configuration for attacker changes before it returns to service. Closing the change ticket at reboot leaves the attacker's access untouched.",
+        "evidence": "Packet attack_vector: out-of-bounds read (CWE-125) on Citrix NetScaler ADC/Gateway, the CitrixBleed-2 class, 'disclosing memory containing authenticated session material that has been used in the wild for session hijack'. Vector: memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server. CISA KEV-listed 2025-07-10, active_exploitation confirmed, poc_available true, RWEP 83. patch_available true; live_patch_available false, with live_patch_notes recording that the vendor patch typically requires a service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "AU-Essential-8-MFA",
+          "UK-CAF-B2",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-vulnerability-handling"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-030",
+        "name": "PERIMETER-DEVICE-ZERODAY-SLA-TIER",
+        "description": "A severity-keyed patch SLA files this CVE in the wrong queue. It scores CVSS 5.5 because the primitive is only a memory read, while its real-world priority is RWEP 83 — KEV-listed, confirmed exploitation, public PoC — because the memory being read holds authenticated session material on the device that terminates remote access. NetScaler ADC/Gateway instances configured as a Gateway (VPN vserver, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server need a distinct perimeter tier whose clock starts at KEV listing rather than at a CVSS threshold, with the affected Gateway/AAA virtual servers isolated if the restart window the vendor fix requires cannot be taken immediately. A program that routes medium-CVSS findings to a 30- or 90-day bucket will leave this appliance exposed for the entire period it is being exploited.",
+        "evidence": "Packet: CVSS 5.5 against rwep_score 83; CISA KEV-listed 2025-07-10 with active_exploitation confirmed and poc_available true. Affected configurations named in the vector: Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server. patch_available true, live_patch_available false, and live_patch_notes records the vendor patch typically requires a service restart or system reboot per the KEV requiredAction — so remediation costs an availability window that a low-tier SLA will not authorize promptly.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-handling"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-031",
+        "name": "FIREWALL-EGRESS-TELEMETRY-SEPARATE-TRUST-ZONE",
+        "description": "A session hijack built on material read out of NetScaler memory drops no binary and generates no failed logon — the attacker arrives as an already-authenticated Gateway user — so endpoint anti-malware across the estate behind the appliance has nothing to match. The only record an operator can hunt over is the appliance's own authentication, ICA/CVPN session and access logging, and that sits on the very device whose memory is being disclosed. NetScaler ADC/Gateway must forward those logs to a SIEM in a separate trust zone, reached with different credentials and a different management path, so that post-KEV hunting for a session resumed from a new address, geography or client fingerprint runs against telemetry the attacker cannot reach or truncate.",
+        "evidence": "Packet attack_vector: the out-of-bounds read discloses memory containing authenticated session material 'that has been used in the wild for session hijack'; CISA KEV-listed 2025-07-10 with active_exploitation confirmed and poc_available true. CIS Controls v8 10.1 (Deploy and Maintain Anti-Malware Software) is recorded in this entry's citing framework gaps, and the exploitation path described produces authenticated session traffic rather than malware for that control to detect.",
+        "gap_closes": [
+          "CIS-Controls-v8-10.1",
+          "UK-CAF-B2"
+        ]
+      }
+    ]
   },
   "CVE-2019-9621": {
     "name": "Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery (SSRF) Vulnerability",
@@ -22645,7 +23881,43 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-057",
+        "name": "BROWSER-MANAGED-UPDATE-NO-DEFERRAL",
+        "description": "The V8 type confusion is reached by any attacker-controlled web page, so the exposure window for this CVE is the time until every Chromium-derived browser in the estate is running the fixed build — a clock the OS patch cycle does not govern. The packet's vector states the flaw affects multiple browsers built on Chromium including Chrome, Edge and Opera, so an enterprise update policy that covers only the primary browser leaves the secondary and vendor-bundled Chromium browsers on the vulnerable renderer. No update-ring deferral may be applied to the browser security channel for this class. The packet records no live-patch path and notes the vendor patch typically requires a service restart or reboot, so an endpoint that has downloaded the update but not relaunched the browser is still exploitable; the policy must force the relaunch rather than wait for the user to close the browser.",
+        "evidence": "Packet: CWE-843 type confusion in the Chromium V8 engine; vector states a remote attacker can perform arbitrary read/write via a crafted HTML page and that the flaw affects multiple Chromium-based browsers including Google Chrome, Microsoft Edge and Opera; CISA KEV-listed 2025-07-02 with active_exploitation=confirmed; poc_available=true; CVSS 8.8, RWEP 77; patch_available=true, live_patch_available=false with the note that the vendor patch typically requires service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management",
+          "NIST-800-53-SI-2",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-042",
+        "name": "INCOMPLETE-PATCH-SEQUENCE-SEVERITY-MULTIPLIER",
+        "description": "The packet classes this CVE as a variant of the recurring V8 type-confusion class, not an isolated defect. Vulnerability management must therefore score it with the class multiplier: another type-confusion variant reaching the same V8 primitive is likely, so the remediation posture for Chromium browsers has to be standing capability (tested forced-relaunch push, rollback path, per-endpoint version telemetry) rather than a one-off ticket opened when this CVE ID appears. Treating each V8 type-confusion CVE as discrete produces a queue that re-learns the same emergency every cycle and obscures that the renderer is a repeat trust-boundary failure in this estate.",
+        "evidence": "Packet: attack_vector describes the flaw as a type confusion (CWE-843) in the V8 JavaScript engine and explicitly as \"a variant of the recurring V8 type-confusion class\", exploitable by an attacker-controlled web page for code execution in the renderer, and notes that browser zero-days of this class are typically used in targeted-spyware or watering-hole chains; active_exploitation=confirmed with poc_available=true.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "For this CVE the KEV clock starts at the 2025-07-02 listing, and the mitigation that stops it is the vendor browser update — but the packet records live_patch_available=false and states the patch typically requires a service restart or system reboot, so the SLA must be measured to restart-completion on each endpoint rather than to update-approval in the management console. A fleet dashboard showing the fixed version as \"deployed\" while long-running browser sessions have never relaunched is an unmet SLA, not a met one. With confirmed in-the-wild exploitation and a public PoC recorded in the packet, the verification step — per-endpoint confirmation that the vulnerable renderer is no longer running — is the part of the control that carries the risk reduction.",
+        "evidence": "Packet: cisa_kev=true with kev_date 2025-07-02; active_exploitation=confirmed; poc_available=true; RWEP 77 against CVSS 8.8; patch_available=true; live_patch_available=false with live_patch_notes recording that no live-patch tool is registered and that the vendor patch typically requires service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-patch-management"
+        ]
+      }
+    ]
   },
   "CVE-2025-48928": {
     "name": "TeleMessage TM SGNL Exposure of Core Dump File to an Unauthorized Control Sphere Vulnerability",
@@ -23230,7 +24502,31 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-120",
+        "name": "DOWNLOAD-PROVENANCE-ENFORCEMENT",
+        "description": "The delivered object in this exploit is an Internet Shortcut (.url) whose WorkingDirectory attribute points at an attacker-controlled WebDAV path. The shortcut carries no payload of its own — it is a pointer, and the binary that runs is fetched from the remote WebDAV share at the moment the user opens it. That is why provenance has to be enforced on the shortcut itself: internet-sourced .url files must retain Mark-of-the-Web and be blocked from opening outright, because a reputation verdict on the shortcut inspects an inert text file while the executable content never crosses the download path a scanner watches. Blocking execution of provenance-stripped shortcuts is the user-application-hardening step that still works against an attacker who plants no local executable at all, and it holds on endpoints that have not yet taken the reboot the vendor fix requires.",
+        "evidence": "cwe_refs is CWE-73 (external control of file name or path). vector: 'Microsoft Windows contains an external control of file name or path vulnerability that could allow an attacker to execute code from a remote WebDAV location specified by the WorkingDirectory attribute of Internet Shortcut files.' attack_vector adds that 'a crafted Internet Shortcut (.url) sets the working directory to an attacker-controlled WebDAV path so that opening it executes an attacker-supplied binary (exploited by the Stealth Falcon group).' cisa_kev true, kev_date 2025-06-10, active_exploitation confirmed.",
+        "gap_closes": [
+          "AU-Essential-8-App-Hardening",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "This fix is an operating-system update, so the SLA lands across the whole endpoint fleet rather than on one server — every workstation capable of opening an Internet Shortcut needs it. The packet records a service restart or system reboot as the apply step and no live-patch path, which is exactly the point at which ring-based rollout normally permits user deferral, and deferral here is what leaves the exploit live. The clock therefore has to start at the 2025-06-10 KEV listing rather than at the next monthly maintenance window: the attack needs only a delivered .url file plus a single user action, with no prior foothold or credential to acquire, and the packet already records both a public PoC and in-the-wild use by a named group.",
+        "evidence": "cisa_kev true with kev_date 2025-06-10; active_exploitation confirmed; poc_available true; cvss 8.8; rwep_score 77. patch_available true, live_patch_available false, live_patch_notes: 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.' attack_vector attributes exploitation to the Stealth Falcon group.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management",
+          "NIST-800-53-SI-2",
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2025-24016": {
     "name": "Wazuh Server Deserialization of Untrusted Data Vulnerability",
@@ -23606,7 +24902,42 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "MOBILE-OS-MINIMUM-PATCH-LEVEL-ENFORCEMENT",
+        "name": "MOBILE-OS-MINIMUM-PATCH-LEVEL-ENFORCEMENT",
+        "description": "A Qualcomm chipset fix reaches a handset only once the OEM folds it into a device security-patch level, so the enforcement point available to the operator is the MDM/EMM, not the software. Managed Android fleets must read the device security-patch level and deny or quarantine handsets below the level carrying this Adreno GPU-driver fix — as a condition of access to organizational data, not as a dashboard metric — and must block untrusted/side-loaded app installation on handsets that cannot yet update. The blocking half is load-bearing here specifically because the unauthorized GPU-micronode command sequence is issued by code already executing on the device: constraining what runs on an unpatched handset is the only thing standing between the KEV listing and the OEM rollout. A fleet whose mobile-patching attestation reports patch levels without gating on them leaves every stale handset exploitable in production.",
+        "evidence": "Packet: incorrect-authorization flaw (CWE-863) in the Qualcomm Adreno GPU driver allowing unauthorized GPU command execution that corrupts memory to escalate privilege; the vector records memory corruption 'due to unauthorized command execution in GPU micronode while executing specific sequence of commands'. CISA KEV-listed 2025-06-03, active_exploitation confirmed, poc_available true, CVSS 8.8, RWEP 77. patch_available is true, but live_patch_available is false and live_patch_notes records that the vendor patch typically requires a service restart or system reboot per the KEV requiredAction — there is no in-place fix, so handsets stay exploitable across the whole update-and-reboot window.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-121",
+        "name": "MOBILE-ZERO-CLICK-HARDENING",
+        "description": "This CVE is the escalation half of a chain, not an entry point: the unauthorized GPU command sequence only runs once attacker-controlled code is already on the handset, and the packet records exploitation in Android targeted chains with LPEs of this class routinely paired with an initial-access primitive. High-risk users on affected Qualcomm chipsets must therefore be placed in a reduced-attack-surface mode that stops automatic processing of untrusted message attachments, fonts and link previews, closing the delivery half while the OEM patch is in flight. For this entry that posture is not defence-in-depth garnish — it is the only remediation the operator can apply on their own clock, because the fix itself must traverse the chipset vendor and the OEM before it is installable.",
+        "evidence": "Packet attack_vector: 'exploited in the wild in Android targeted chains' and 'LPEs of this class are routinely paired with an initial-access primitive'. CISA KEV-listed 2025-06-03, active_exploitation confirmed, poc_available true. live_patch_available is false and live_patch_notes records the vendor patch typically requires a service restart or system reboot per the KEV requiredAction, so no interim in-place remediation exists.",
+        "gap_closes": [
+          "UK-CAF-B4",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-017",
+        "name": "BUG-FAMILY-MITIGATION-PERSISTENCE",
+        "description": "The catalog carries this entry as a variant within the same Qualcomm Adreno GPU-driver incorrect-authorization primitive, which is the signature of a recurring bug family rather than an isolated defect. The compensating posture built for it — patch-level access gating, side-load restriction, reduced-attack-surface mode on high-risk handsets — must stay in force through a stated soak period after the OEM patch lands, not be retired the day the fleet reports the fixed security-patch level. A sibling flaw in the same GPU command-authorization path is reachable by exactly the same local-code route, and on this platform the operator cannot re-deploy a mitigation faster than the OEM can ship the next fix.",
+        "evidence": "The packet names the entry 'Qualcomm Multiple Chipsets Incorrect Authorization Vulnerability (variant: CVE-2025-21480)' and describes it as an incorrect-authorization flaw (CWE-863) in the Qualcomm Adreno GPU driver, '(a related variant)'. CISA KEV-listed 2025-06-03 with confirmed in-the-wild exploitation and poc_available true; RWEP 77 against CVSS 8.8.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      }
+    ]
   },
   "CVE-2025-27038": {
     "name": "Qualcomm Multiple Chipsets Use-After-Free Vulnerability",
@@ -25806,7 +27137,44 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "This is the case the control exists for, and Connect Secure is the appliance terminating remote access into the network. Per the packet the flaw was exploited as a zero-day from mid-December 2024 by the suspected China-nexus cluster UNC5337/UNC5221 — before the 2025-01-08 advisory — so any internet-exposed appliance sat reachable through a window in which no advisory or vendor signature existed, and the operator has no basis to assume their instance was missed. The packet states patch-in-place is insufficient where the appliance is already compromised, and that a factory reset / rebuild is required to evict SPAWN-ecosystem persistence (SPAWNANT / SPAWNMOLE / SPAWNSNAIL). The control means the runbook for these gateways defaults, for any appliance exposed during that pre-advisory window, to: export configuration off-box, factory-reset / rebuild rather than upgrade in place, and rotate every credential the appliance held or brokered — local administrator, service accounts, VPN user credentials, and any secret carried in the exported configuration — because the packet names DRYHOOK as a credential stealer deployed alongside the PHASEJAM dropper. A firmware upgrade restores the code and, per live_patch_notes, requires an appliance reboot to do so, but it neither invalidates credentials already taken nor substitutes for the reset the packet says eviction requires.",
+        "evidence": "Packet CVE-2025-0282 \"Ivanti Connect Secure / Policy Secure / Neurons for ZTA stack-overflow preauth RCE\", cwe_refs CWE-121 and CWE-787; cisa_kev true with kev_date 2025-01-08; active_exploitation confirmed; rwep_score 85; cvss 9.0; poc_available true. attack_vector: \"Exploited as a zero-day from mid-December 2024 by the suspected China-nexus cluster UNC5337/UNC5221, deploying the SPAWN malware ecosystem (SPAWNANT/SPAWNMOLE/SPAWNSNAIL), the PHASEJAM dropper, and the DRYHOOK credential stealer, before the 2025-01-08 advisory. Patch-in-place is insufficient where the appliance is already compromised.\" live_patch_available false; live_patch_notes: \"Connect Secure firmware upgrade requires an appliance reboot; no live-patching primitive. Patch alone is insufficient where ICT indicates compromise - a factory reset / rebuild is required to evict SPAWN-ecosystem persistence.\" vector adds that Ivanti's guidance is to patch and, on indicators of compromise, factory-reset.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "PCI-DSS-4.0-6.3.3",
+          "AU-ISM-1546",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-030",
+        "name": "PERIMETER-DEVICE-ZERODAY-SLA-TIER",
+        "description": "Connect Secure is a remote-access gateway, so the device under discussion is the trust boundary itself, and the packet describes an unauthenticated stack-based buffer overflow reachable over the network at RWEP 85 / CVSS 9.0 with a PoC available. What makes the standard SLA tier unusable here is recorded in the packet's own vector: no interim configuration workaround fully mitigates an internet-exposed appliance. That removes the branch most patch programmes lean on — apply the vendor's mitigation rule now, schedule the firmware for the next window — and leaves exactly two states, fixed firmware (which per live_patch_notes requires an appliance reboot; there is no live-patching primitive) or the exposed interface taken off untrusted networks. The control means the framework carries an explicit tier for pre-auth RCE on remote-access gateways: firmware deployed with its reboot within hours of the 2025-01-08 KEV listing, or the gateway's internet-facing interface isolated until it is, instead of the routine multi-week windows the citing patch controls accept for systems generally. Isolation is a first-class satisfying action in this tier, not a failure to meet it.",
+        "evidence": "Packet CVE-2025-0282, cwe_refs CWE-121 and CWE-787; cisa_kev true with kev_date 2025-01-08; active_exploitation confirmed; rwep_score 85; cvss 9.0; poc_available true; patch_available true; live_patch_available false. vector: \"Unauthenticated remote attacker sends crafted input that overflows a stack buffer in the Connect Secure web surface, achieving code execution on the appliance. No interim configuration workaround fully mitigates an internet-exposed appliance; Ivanti's guidance is to patch and, on indicators of compromise, factory-reset.\" live_patch_notes: \"Connect Secure firmware upgrade requires an appliance reboot; no live-patching primitive.\" attack_vector records exploitation from mid-December 2024, before the 2025-01-08 advisory.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "PCI-DSS-4.0-6.3.3",
+          "AU-ISM-1546",
+          "NIS2-Art21-network-security"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-031",
+        "name": "FIREWALL-EGRESS-TELEMETRY-SEPARATE-TRUST-ZONE",
+        "description": "For this CVE the remediation branch is evidence-conditional, not automatic: the packet's guidance is patch, and factory-reset where indicators of compromise are present. That determination has to cover mid-December 2024 through the 2025-01-08 advisory — a window in which, per the packet, the appliance was being exploited by UNC5337/UNC5221 and carrying the PHASEJAM dropper and DRYHOOK credential stealer. An operator whose only record of that period lives on the Connect Secure appliance is asking a host that may be running attacker-installed persistence to testify about its own integrity, and a clean local log is then indistinguishable from a compromised one. The control means the gateway's syslog, authentication and session telemetry is already landing in a SIEM in a separate trust zone — different management plane, different credentials, different authentication path — with retention long enough to span a pre-disclosure zero-day window, so the patch-versus-rebuild decision this CVE forces can be answered from records the appliance never had the ability to alter. This has to be in place before the disclosure event; it cannot be retrofitted once the window has already passed.",
+        "evidence": "Packet CVE-2025-0282; active_exploitation confirmed; kev_date 2025-01-08. attack_vector: \"Exploited as a zero-day from mid-December 2024 by the suspected China-nexus cluster UNC5337/UNC5221, deploying the SPAWN malware ecosystem (SPAWNANT/SPAWNMOLE/SPAWNSNAIL), the PHASEJAM dropper, and the DRYHOOK credential stealer, before the 2025-01-08 advisory.\" live_patch_notes: \"Patch alone is insufficient where ICT indicates compromise - a factory reset / rebuild is required to evict SPAWN-ecosystem persistence.\" vector: \"Ivanti's guidance is to patch and, on indicators of compromise, factory-reset.\"",
+        "gap_closes": [
+          "DORA-Art-9",
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2025-22457": {
     "name": "Ivanti Connect Secure stack-overflow preauth RCE (mis-triaged DoS weaponized to RCE)",
@@ -26629,7 +27997,30 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "human_researcher",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-025",
+        "name": "CONFIGURATION-SIDE-LIVE-PATCH-INVENTORY",
+        "description": "Postfix SMTP smuggling is remediable two ways, and the frameworks only recognise one. The packet records that on pre-3.8.5 the exposure closes with two configuration directives — smtpd_forbid_unauth_pipelining=yes and smtpd_discard_ehlo_keywords=chunking — with an upgrade as the alternative; remediation needs a service restart, not a host reboot, and no live-patch primitive applies. An MTA operator who cannot take an upgrade window (a mail gateway carrying production flow, a vendor-packaged Postfix on a frozen release) can shut the smuggling path today, and the compliance program must have that directive path already inventoried, tested against a smuggled-envelope case, and deployable independently of the vendor-version path. Treating the configuration change as second-class evidence is what leaves an MTA accepting <LF>.<LF> for the length of a patch cycle.",
+        "evidence": "Packet vector: 'Postfix accepts the non-standard end-of-data sequences <LF>.<LF> and <LF>.<CR><LF> in DATA, where RFC 5321 mandates <CR><LF>.<CR><LF>... Fix: smtpd_forbid_unauth_pipelining=yes + smtpd_discard_ehlo_keywords=chunking on pre-3.8.5, or upgrade.' patch_available true; live_patch_available false; live_patch_notes: 'Remediation is a software update (and, for the smuggling/STARTTLS classes, a server configuration change); no live-patch primitive applies. Service restart, not host reboot.' CVSS 5.3, RWEP 35, poc_available true, cisa_kev false, active_exploitation suspected. Disclosed Dec 2023 (SEC Consult). Cited against AU-Essential-8-App-Hardening, NIST-800-53-SI-2 and PCI-DSS-4.0-6.3.3.",
+        "gap_closes": [
+          "AU-Essential-8-App-Hardening",
+          "NIST-800-53-SI-2",
+          "PCI-DSS-4.0-6.3.3"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-018",
+        "name": "SCANNER-PAPER-COMPLIANCE-TEST",
+        "description": "Because this Postfix exposure can be closed either by version or by configuration, a scanner verdict derived from the Postfix package version alone is paper compliance in both directions: it reports a pre-3.8.5 host as vulnerable when the two directives are already set, and — worse for an auditor — it cannot show that a host reported 'patched' actually rejects the non-standard end-of-data sequence. The operational test that distinguishes real remediation is behavioural, not version-based: open a session against the MTA, submit a DATA body terminated with <LF>.<LF> carrying a second embedded envelope, and confirm the smuggled message is not accepted and does not inherit the outer connection's SPF/DKIM/DMARC result. A vulnerability-management program that cannot produce that result for its mail gateways has attested to a version string, not to the absence of sender spoofing.",
+        "evidence": "Packet vector states both remediation paths (the two smtpd_* directives on pre-3.8.5, or upgrade), so package version alone does not determine exposure. Attack_vector: 'the MTA accepts a non-standard end-of-data sequence, letting an attacker smuggle a second message that inherits the outer connection's SPF/DKIM/DMARC pass and delivers a spoofed sender.' CWE-345 (insufficient verification of data authenticity) and CWE-93 (CRLF injection); poc_available true. Cited against ISO-27001-2022-A.8.8 (management of technical vulnerabilities) and UK-CAF-B4 (system security).",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2023-51765": {
     "name": "Sendmail SMTP smuggling (non-standard end-of-data sequence enables sender spoofing past SPF/DKIM/DMARC)",
@@ -26804,7 +28195,30 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "human_researcher",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-008",
+        "name": "CRYPTO-SUBSYSTEM-CVE-DISCLOSURE",
+        "description": "The affected subsystem here is the one other controls are resting on. Exim's STARTTLS does not discard data buffered before the TLS handshake, so an on-path attacker's pre-handshake bytes are processed inside the encrypted session — which means that while an Exim MTA is unpatched, 'SMTP traffic is protected by TLS in transit' is not a valid compensating control for that hop and must not be counted as one in the risk assessment or in the network-security evidence pack. The requirement is to enumerate every control and attestation that leans on opportunistic STARTTLS between MTAs, mark each as void for the affected hops until the MTA is on a fixed release, and re-assert them only after remediation. Remediation is the software update (the packet names upgrading past 4.94.2, i.e. 4.95+); no live-patch primitive applies and it takes a service restart, not a host reboot, so the exposure window is a mail-service restart rather than a machine maintenance window.",
+        "evidence": "CWE-74. Packet vector: 'The STARTTLS feature in Exim does not discard data buffered before the TLS handshake, so an on-path attacker can inject responses (response injection / buffering) that the client applies after STARTTLS completes. Fix: upgrade past 4.94.2 (4.95+).' Attack_vector adds that injected plaintext SMTP commands/responses are 'processed inside the encrypted session'. patch_available true, live_patch_available false; live_patch_notes: 'Remediation is a software update (and, for the smuggling/STARTTLS classes, a server configuration change); no live-patch primitive applies. Service restart, not host reboot.' Cited against NIS2-Art21-network-security and UK-CAF-B4.",
+        "gap_closes": [
+          "NIS2-Art21-network-security",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-042",
+        "name": "INCOMPLETE-PATCH-SEQUENCE-SEVERITY-MULTIPLIER",
+        "description": "On its own scoring this Exim flaw sorts to the bottom of any patch queue — no KEV listing, no observed exploitation, RWEP 21 — and every citing control (SI-2, ISO A.8.8, AU-ISM-1546) would rank it accordingly, because each treats a CVE as a discrete item. The packet records what that framing loses: this is part of the NO STARTTLS research lineage running from 2011 Postfix to the 2021 multi-MTA round, the same pre-handshake buffering primitive resurfacing across a decade and across independent MTA implementations. A vulnerability-management program must apply a severity multiplier on that basis and act on the class rather than the entry: raise this above its nominal rank, and when the fixed Exim lands, re-test the pre-handshake buffer-discard behaviour on every other MTA and mail-submission agent in the estate rather than closing the ticket on the one product named in the advisory.",
+        "evidence": "Packet attack_vector: 'STARTTLS command/response injection: the server/client does not discard bytes buffered before the TLS handshake... Part of the NO STARTTLS research lineage (2011 Postfix -> 2021 multi-MTA).' cisa_kev false, kev_date null, active_exploitation none, rwep_score 21, cvss 7.5, poc_available true. Cited against ISO-27001-2022-A.8.8, NIST-800-53-SI-2 and AU-ISM-1546 ('Patch operating systems and applications').",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "AU-ISM-1546"
+        ]
+      }
+    ]
   },
   "CVE-2021-33515": {
     "name": "Dovecot lib-smtp STARTTLS command injection (submission service)",
@@ -27117,7 +28531,40 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-062",
+        "name": "HTTP2-STREAM-RESET-ACCOUNTING",
+        "description": "Every HTTP/2 terminator in the request path — edge proxy, load balancer, ingress controller, origin application server — must keep the backend work a stream has already started counted against the connection's concurrency budget after the client sends RST_STREAM, and must cap the rate of client-initiated stream resets per connection and close connections that exceed it. Rapid Reset works precisely because the HEADERS-then-immediate-RST_STREAM pattern frees the client-visible stream slot while the server's per-stream setup and teardown work is still outstanding: counting only client-visible open streams against MAX_CONCURRENT_STREAMS is what makes the flood free for the attacker and expensive for the server. Because the accounting has to hold on every hop, a patched origin behind a proxy that still counts only open streams is not covered.",
+        "evidence": "Packet: CWE-400; CISA KEV-listed 2023-10-10 with active_exploitation 'confirmed'; RWEP 80 / CVSS 7.5; poc_available true. The packet's vector gives the mechanism verbatim — 'HTTP/2 multiplexing lets a client open a stream (HEADERS) and immediately cancel it (RST_STREAM) before the server responds. Because cancellation is cheap for the client but the server still does per-stream setup/teardown work, an attacker cycles open-then-reset at high rate to exhaust the server with minimal cost' — and names the fix: 'cap the rate of client-initiated stream resets per connection and close abusive connections.' The packet characterizes it as a record-breaking DDoS primitive.",
+        "gap_closes": [
+          "NIS2-Art21-network-security",
+          "DORA-Art-9"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "For Rapid Reset the KEV clock is cheaper to meet than for most KEV entries and is still routinely missed: the packet records patch_available true and remediation as a software update requiring a service restart, not a host reboot, so the fixed HTTP/2 build can land without a host maintenance window. The SLA must therefore be tracked per HTTP/2 terminator in the estate — each reverse proxy, load balancer, CDN edge and application server that speaks HTTP/2 to clients — rather than once against a 'web server' asset class, because a single unpatched terminator in front of otherwise-patched origins still absorbs the entire flood on the estate's behalf.",
+        "evidence": "Packet: cisa_kev true, kev_date 2023-10-10, active_exploitation 'confirmed', poc_available true, patch_available true, live_patch_available false, live_patch_notes 'Remediation is a software update (and, for the smuggling/STARTTLS classes, a server configuration change); no live-patch primitive applies. Service restart, not host reboot.'",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-025",
+        "name": "CONFIGURATION-SIDE-LIVE-PATCH-INVENTORY",
+        "description": "The packet records no live-patch primitive for this class, so the only lever available between the start of a flood and the deployment of the fixed build is configuration-side. Where an HTTP/2 terminator exposes a per-connection reset-rate limit or abusive-connection close as a configuration directive, that directive must be written, tested against a reset flood, and inventoried per product ahead of time, deployable independently of the vendor build; where a terminator exposes no such knob, that fact must be recorded too, because for those hops the fixed build is the only path and the KEV clock is the whole defence. Discovering during an active flood that the reset-limit directive was never exercised on this product is the failure this control exists to prevent.",
+        "evidence": "Packet: live_patch_available false; live_patch_notes 'no live-patch primitive applies. Service restart, not host reboot.' The packet's vector names the fix as capping the rate of client-initiated stream resets per connection and closing abusive connections. CISA KEV-listed 2023-10-10 with active_exploitation 'confirmed' and poc_available true, so the exposure window is not hypothetical.",
+        "gap_closes": [
+          "UK-CAF-D1",
+          "AU-Essential-8-Patch"
+        ]
+      }
+    ]
   },
   "CVE-2022-0492": {
     "name": "Linux Kernel cgroups v1 release_agent Privilege Escalation / Container Escape",
@@ -29153,7 +30600,30 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "human_researcher",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "Windows estates must run the vendor update for this forced-authentication flaw on a KEV-tied clock rather than a CVSS-tiered one. At CVSS 6.5 the entry falls into a 'medium' bucket that most patch policies schedule into a monthly window, while its RWEP is 81 with confirmed in-the-wild exploitation and a public PoC. The clock has to cover every Windows endpoint whose users receive external mail or download archives, not just servers, because the leak fires in Explorer on an ordinary user's desktop. No live-patch path is registered for this product class, so the vendor update plus the compensating controls named alongside it are the only remediation available during the interval.",
+        "evidence": "CISA KEV-listed 2025-04-17 with active_exploitation 'confirmed' and poc_available true, yet CVSS is 6.5 against an RWEP of 81. patch_available is true and live_patch_available is false; the entry's live-patch note states remediation is the vendor update plus the named compensating controls until it lands.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-119",
+        "name": "ARCHIVE-CONTENT-TYPE-PROVENANCE",
+        "description": "The exploit arrives as a .library-ms file inside a ZIP delivered by malspam or a Dropbox link, and the NTLMv2-SSP leak fires while Explorer parses that file when the user merely views or single-clicks the containing folder - nothing is opened or executed. Provenance therefore has to survive archive extraction and gate the handler at parse time: every member extracted from an internet-sourced archive must inherit the internet-provenance marking, and the shell must decide how to handle a library-description file from its verified content rather than from the name shown in the folder. A provenance model that attaches only at download time and gates only execution never reaches this path.",
+        "evidence": "The entry's attack description states the malicious .library-ms is delivered inside a ZIP archive via malspam or a Dropbox link, and that Windows Explorer's parsing - triggered by navigating to, viewing, or single-clicking the containing folder, with no file actually opened - initiates the outbound SMB/NTLM authentication that leaks the victim's NTLMv2-SSP hash.",
+        "gap_closes": [
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2025-31201": {
     "name": "Apple Multiple Products Arbitrary Read and Write Vulnerability",
@@ -29923,7 +31393,30 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "human_researcher",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-054",
+        "name": "BACKUP-TIER-NETWORK-ISOLATION",
+        "description": "The NAKIVO Director web service must be reachable only from the operator subnets that administer it. The vulnerable /c/router dispatcher takes no authentication at all, so network reachability is the entire precondition for the arbitrary file read — there is no credential to strengthen and no session to shorten. Isolation also bounds the second stage: the Director keeps the encryption key in config.properties next to the bundled H2 database holding PhysicalDiscovery credentials for the systems it protects, so a Director reachable from a general-purpose segment is one unauthenticated request away from estate-wide credential disclosure. The backup tier's routes to the hypervisors and hosts it protects should likewise be pull-only from the backup side rather than a standing privileged path an attacker inherits along with the decrypted credentials.",
+        "evidence": "The packet states the Director \"exposes an unauthenticated /c/router dispatcher; the STPreLoadFacade.getImageByPath handler takes an attacker-controlled path, naively rewrites the leading \\\"/c\\\" to \\\"userdata\\\" and passes the result straight to a File read, so an absolute path such as C:/windows/win.ini or /etc/passwd escapes the intended directory and yields arbitrary file read (CWE-36, no auth, network-reachable).\" It further records the escalation: \"the encryption key in config.properties plus the bundled H2 database let an attacker decrypt the PhysicalDiscovery feature's stored cleartext credentials for the systems being backed up,\" pivoting into \"broad credential theft and remote code execution on integrated hypervisors/hosts, which is why the CVSS scope is Changed (8.6).\" live_patch_available is false and the packet states remediation is \"the vendor update plus the named compensating controls until it lands.\"",
+        "gap_closes": [
+          "UK-CAF-B4",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "A backup Director whose compromise yields cleartext credentials for every system it protects cannot sit in a routine 14- or 30-day patch window. Once this entry was KEV-listed the fixed NAKIVO release — which replaces the path handling with FilenameUtils.getName() so any directory component is stripped before the read — has to land on a KEV clock, and where that window cannot be met the compensating control (removing the Director's reachability from non-operator networks) must be documented and actually active in the interim rather than planned. The urgency is compounded by what the update does not do: it stops the read, but it does not invalidate credentials an attacker already decrypted out of the H2 database, so every hour of exposure converts into permanent cleanup rather than recoverable risk.",
+        "evidence": "cisa_kev is true with kev_date 2025-03-19 and active_exploitation confirmed; poc_available is true; patch_available is true and live_patch_available is false. The packet states \"Patched releases replace the path handling with FilenameUtils.getName(), stripping any directory component before the read,\" and that with no live-patch path for this product class \"remediation is the vendor update plus the named compensating controls until it lands.\" CVSS 8.6 with scope Changed, RWEP 70, CWE-36.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      }
+    ]
   },
   "CVE-2025-1316": {
     "name": "Edimax IC-7100 IP Camera OS Command Injection Vulnerability",
@@ -30143,7 +31636,40 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "This NTFS heap overflow reads low on every routine triage input — CVSS 7.8, local vector, user interaction required, and no public PoC — which is exactly the profile a 30-day OS-patch SLA absorbs without comment. The KEV listing plus confirmed in-the-wild use is what should actually set the clock: the packet's own path needs only a delivered disk image and one double-click, and the parsing happens in the file-system driver, so a successful run is an ordinary user to SYSTEM on the host — a ransomware staging position, not a local nuisance. The SLA must therefore be driven off the KEV listing date rather than the CVSS band, and it must run to the reboot that makes the update effective, not to the moment the update is approved. The packet's remediation note is explicit that there is no live-patch path for this product class and that remediation is the vendor update plus compensating controls until it lands; for this delivery path those compensating controls are blocking internet- and mail-sourced disk-image files from reaching users and denying mount of untrusted images, and they are what carries hosts whose reboot cannot be pulled inside the KEV clock.",
+        "evidence": "Packet: cwe_refs CWE-122; cisa_kev true, kev_date 2025-03-11, active_exploitation confirmed; poc_available false; CVSS 7.8 against RWEP 61. vector states an attacker 'crafts a malicious VHD/VHDX (or other disk image) and induces a local user to mount it — Windows auto-mounts a double-clicked VHD through Explorer, so this needs only file delivery plus a single user action (UI:R)', that the parsing happens 'in the file-system driver running with high privilege', and that a successful exploit 'escalates from an ordinary user to SYSTEM, giving full host compromise that can stage ransomware or further implants'. patch_available true; live_patch_available false with live_patch_notes 'No live-patch path for this product class; remediation is the vendor update plus the named compensating controls until it lands.'",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-120",
+        "name": "DOWNLOAD-PROVENANCE-ENFORCEMENT",
+        "description": "The entire exploit precondition is file delivery: a crafted VHD/VHDX has to reach a user's disk and be double-clicked, at which point Explorer auto-mounts it and hands the attacker's on-disk NTFS metadata straight to a high-privilege kernel parser. Provenance enforcement is the control that breaks that step ahead of the reboot. Internet- and mail-sourced files in the mountable-container class (.vhd, .vhdx, .iso and equivalents) must carry Mark-of-the-Web from the gateway through to the endpoint, and the mount action on a provenance-marked image must be blocked outright rather than warned about — a warning dialog is the same single user action the exploit already assumes. A reputation verdict is no substitute here and the control's 'regardless of a reputation service verdict' clause is load-bearing: the malicious bytes are inert file-system metadata, not executable content, so a reputation or detonation service has little to score and the image will look clean right up to the moment it is mounted. This is the only control in the set that works on hosts that cannot be rebooted inside the KEV window.",
+        "evidence": "Packet: vector describes the attacker crafting 'a malicious VHD/VHDX (or other disk image)' and inducing 'a local user to mount it', notes 'Windows auto-mounts a double-clicked VHD through Explorer, so this needs only file delivery plus a single user action (UI:R)', and that 'the malformed NTFS structure causes improper bounds checking in the driver to overflow a heap buffer (CWE-122)'. poc_available false while active_exploitation is confirmed and cisa_kev is true (kev_date 2025-03-11). patch_available true but live_patch_available false, live_patch_notes: 'No live-patch path for this product class; remediation is the vendor update plus the named compensating controls until it lands.'",
+        "gap_closes": [
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-038",
+        "name": "MITIGATION-ACTIVE-PATCH-PENDING-VERDICT-CLASS",
+        "description": "The packet's own remediation note puts this CVE in the state most audit reports cannot express. The vendor update exists, but there is no live-patch path for this product class, so between the KEV listing and the reboot every affected host is running on compensating controls alone. An audit that records 'patched per SLA' the moment the update is approved, downloaded or installed is describing a host whose vulnerable file-system driver is still the loaded, running one — the driver is not replaced until reboot, and this exploit path executes inside that driver. The verdict taxonomy for this entry must separate: rebooted onto the fixed driver; update installed but pre-reboot, with disk-image provenance blocking as the named active compensating control and a time-bound reboot action item; and neither. For estates with long-uptime workstations or servers on quarterly reboot windows, the middle state is where most of the fleet actually lives after a Patch Tuesday, and it is a distinct residual-risk position rather than a pass.",
+        "evidence": "Packet: live_patch_available false with live_patch_notes 'No live-patch path for this product class; remediation is the vendor update plus the named compensating controls until it lands', alongside patch_available true. vector states the flaw is reached 'via the NTFS driver (ntfs.sys) parsing attacker-controlled on-disk metadata' and that 'the parsing happens in the file-system driver running with high privilege'. cisa_kev true, kev_date 2025-03-11, active_exploitation confirmed.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      }
+    ]
   },
   "CVE-2025-24991": {
     "name": "Microsoft Windows NTFS Out-Of-Bounds Read Vulnerability",
@@ -30253,7 +31779,33 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-120",
+        "name": "DOWNLOAD-PROVENANCE-ENFORCEMENT",
+        "description": "The interdictable step in CVE-2025-24985 is delivery, not privilege. The packet states reachability requires a local user to be tricked into mounting an attacker-crafted VHD/VHDX; once mounted, the kernel's own Fast FAT parser reads the malformed metadata and the size miscalculation overflows the heap allocation. Nothing inside the image has to be executed, no prior privileges are needed, and the user is not running anything they would recognise as code — which is exactly why execution-focused endpoint policy misses it. That makes the disk-image container itself a provenance-bearing file class. Requirement: Mark-of-the-Web must survive on VHD/VHDX and equivalent disk images arriving by mail, browser, or chat, and mounting a provenance-marked image must be refused by policy rather than surfaced as a warning the user can click through. A reputation verdict is the wrong gate here — the attacker authors the image, so reputation carries no information about the malformed FAT metadata inside it. On any host that has not yet taken the vendor update this is the only measure that removes exposure, because the packet records no live-patch path for this product class.",
+        "evidence": "Packet vector: 'Reachability requires a local user to be tricked into mounting an attacker-crafted virtual hard disk (VHD/VHDX); when the kernel parses the malformed FAT metadata, the size miscalculation overflows a heap allocation,' and 'Net effect is local code execution gated only by user interaction (the mount), with no prior privileges required.' patch_available true, live_patch_available false, live_patch_notes: 'No live-patch path for this product class; remediation is the vendor update plus the named compensating controls until it lands' — the packet itself states a compensating control is required during the unpatched window, and the mount is the only step in the described chain an operator can interdict. Active_exploitation 'confirmed', CISA KEV-listed 2025-03-11, poc_available true.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "NIS2-Art21-vulnerability-management",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "This is a flaw in an in-box Windows file-system driver, so the affected population is every managed Windows endpoint, not a named server tier — remediation is a fleet rollout problem, and fleet rollouts are exactly what monthly rings slow down. The packet puts it in KEV on 2025-03-11 with confirmed in-the-wild exploitation and a public PoC, and the outcome is kernel-mode code execution escalating an ordinary user to SYSTEM. Requirement: the clock runs from the KEV listing date across the whole endpoint estate, and because the packet records no live-patch path for this product class, the interim state is not 'accepted risk pending the next ring' — it is the compensating control (policy denial of untrusted VHD/VHDX mounts) enforced on every host that has not yet taken the vendor update, with hosts tracked individually until the update lands rather than reported as an aggregate compliance percentage.",
+        "evidence": "Packet: CWE-190 integer overflow in the Windows Fast FAT file-system driver (fastfat.sys) leading to a CWE-122 heap-based buffer overflow, yielding kernel-mode memory corruption that escalates a normal user to SYSTEM. CISA KEV-listed 2025-03-11, active_exploitation 'confirmed', poc_available true. RWEP 79 ranks it above what its CVSS 7.8 alone would place it at. patch_available true; live_patch_available false with live_patch_notes: 'No live-patch path for this product class; remediation is the vendor update plus the named compensating controls until it lands.' The citing gaps (AU-Essential-8-Patch, ISO-27001-2022-A.8.8, NIST-800-53-SI-2, NIS2-Art21-vulnerability-management, UK-CAF-B4) are severity-scheduled remediation controls; none of them re-tiers on KEV listing or on confirmed exploitation.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management",
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2025-24984": {
     "name": "Microsoft Windows NTFS Information Disclosure Vulnerability",
@@ -33080,7 +34632,40 @@
         "adequate": false,
         "gap": "Response and recovery planning must account for the firewall entering maintenance mode under repeated attack, since the perimeter defense device itself becomes unavailable."
       }
-    }
+    },
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-030",
+        "name": "PERIMETER-DEVICE-ZERODAY-SLA-TIER",
+        "description": "The tier as written covers pre-auth RCE on the trust boundary; this CVE shows it has to cover pre-auth availability loss on the same devices. An unauthenticated packet arriving through the firewall's data plane reboots it, and repeated packets drive it into maintenance mode — the trust boundary stops enforcing policy without the attacker ever touching the management plane or holding a credential. A 14/30-day operating-system patch window is meaningless against that: the device whose uptime every other control depends on is remotely switchable-off by anyone who can reach it. The tier requirement for this entry is the vendor PAN-OS update deployed on the KEV clock, or the exposed DNS-inspection path taken out of service until it can be, and there is no live-patch option that avoids the restart.",
+        "evidence": "CISA KEV-listed 2024-12-30 with active_exploitation confirmed; RWEP 58, CVSS 7.5. The packet's vector: 'A Denial of Service vulnerability in the DNS Security feature of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to send a malicious packet through the data plane of the firewall that reboots the firewall. Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode.' patch_available true; live_patch_available false; live_patch_notes null; poc_available false; CWE-754.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-network-security"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-025",
+        "name": "CONFIGURATION-SIDE-LIVE-PATCH-INVENTORY",
+        "description": "The packet conditions the crash on DNS Security logging being enabled, which means there is a configuration-side route out of the exploitable state that does not wait for the PAN-OS update or its restart window. That route is only useful if it was inventoried before the KEV listing: which firewalls have that logging enabled, what detection coverage the organisation gives up while it is off, who is authorised to change it under an incident clock, and how the change is verified on each device. Because live_patch_available is false for this entry, an operator has exactly two options — the configuration change now, or the vendor update plus restart later — and frameworks that only recognise the second leave the hours in between uncovered on an actively exploited firewall.",
+        "evidence": "The packet's attack_vector states the crash occurs 'on devices with DNS Security logging enabled', tying reachability to a configuration state. live_patch_available false and live_patch_notes null — no in-place hot fix is recorded. patch_available true. CISA KEV-listed 2024-12-30, active_exploitation confirmed, RWEP 58, CVSS 7.5.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "AU-Essential-8-Patch"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-031",
+        "name": "FIREWALL-EGRESS-TELEMETRY-SEPARATE-TRUST-ZONE",
+        "description": "The device that would record this attack is the device the attack knocks over. A firewall that reboots on a crafted DNS packet — and that after repeated packets sits in maintenance mode — is not forwarding anything during the window that matters, so on-box threat and system logs are the worst possible place to hold the evidence that an outage was an attack rather than a hardware or software fault. Continuous forwarding of syslog and threat logs to a SIEM in a separate trust zone (separate management plane, separate credentials, separate authentication path) is what converts 'the firewall rebooted again' into a correlated repeat-attempt pattern with source data, and it is what gives responders a timeline while the device itself is unreachable. That matters more here than for a typical exploit because there is no public PoC to signature against — the reboot pattern is the detection.",
+        "evidence": "Per the packet, 'Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode', and the triggering packet arrives unauthenticated through the data plane. poc_available false — no public exploit artifact to build a signature from. CISA KEV-listed 2024-12-30 with active_exploitation confirmed; RWEP 58, CVSS 7.5; CWE-754.",
+        "gap_closes": [
+          "NIST-800-53-SI-4",
+          "UK-CAF-D1"
+        ]
+      }
+    ]
   },
   "CVE-2021-44207": {
     "name": "Acclaim Systems USAHERDS Use of Hard-Coded Credentials Vulnerability",
@@ -33381,7 +34966,40 @@
         "adequate": false,
         "gap": "EU operators running unpatched Windows kernel-mode driver updates past the reboot-requiring maintenance window remain exploitable for privilege escalation; Art. 21 patch management must account for reboot-dependent kernel fixes specifically."
       }
-    }
+    },
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "This is a local elevation of privilege, and at CVSS 7.8 it competes for a patch slot against remotely reachable criticals - but it is KEV-listed with confirmed exploitation and a public PoC, and its function is to convert code execution an intruder already holds into SYSTEM. The KEV clock therefore has to cover the whole workstation and server fleet rather than an internet-facing subset, because the precondition (the attacker already runs code on the host) is satisfied by whatever phishing or commodity-malware step precedes it. No live-patch path is registered for this entry, so a host remains exploitable until the vendor update is actually installed on it - fleet completion, not deployment start, is the measure.",
+        "evidence": "CISA KEV-listed 2024-12-16 with active_exploitation 'confirmed' and poc_available true; CVSS is 7.8 against an RWEP of 77. patch_available is true, live_patch_available is false, and live_patch_notes is null. The entry's attack path begins with a local attacker who already has code execution on the host.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-patch-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-003",
+        "name": "KERNEL-EXPLOITATION-DETECTION",
+        "description": "The escalation happens entirely inside one host: a process the attacker already controls sends a crafted IOCTL_KS_PROPERTY request to the Kernel Streaming Service driver with a manipulated RequestorMode field and comes back running as SYSTEM. There is no network stage to intercept and no privilege the defender can withhold - the caller is an ordinary user process right up until it is not, which is why least privilege is listed as insufficient for this entry. What remains is behavioural detection of the escalation itself: monitoring rules that fire within a minute on kernel-driver IOCTL sequences from unexpected callers and on a process token changing to SYSTEM without a legitimate service-start or elevation path, kept running on patched hosts as well as unpatched ones.",
+        "evidence": "The entry's attack path is a local attacker with code execution on the host issuing a crafted IOCTL_KS_PROPERTY request to the Kernel Streaming Service driver, manipulating the RequestorMode field to bypass a security check so the driver dereferences an attacker-controlled pointer, elevating the calling process to SYSTEM. NIST-800-53-AC-6 (Least Privilege) is among the framework controls this entry already cites as insufficient.",
+        "gap_closes": [
+          "NIST-800-53-AC-6"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-038",
+        "name": "MITIGATION-ACTIVE-PATCH-PENDING-VERDICT-CLASS",
+        "description": "Between the KEV listing and the moment a given host is running the fixed build, this entry has nothing to put in the mitigation column: it registers no live-patch path and no live-patch notes, so there is no interim vendor mitigation to report as active. Audit reporting must place every not-yet-updated host in the 'no mitigation, no patch' class rather than the 'mitigating pending patch' class a vulnerability-management process will otherwise accept, so residual exposure to a kernel LPE with confirmed exploitation is counted as a host list with a time-bound action, not described as remediation in progress.",
+        "evidence": "For this entry live_patch_available is false and live_patch_notes is null, while patch_available is true; active_exploitation is 'confirmed' and it was CISA KEV-listed 2024-12-16.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management"
+        ]
+      }
+    ]
   },
   "CVE-2024-20767": {
     "name": "Adobe ColdFusion Improper Access Control Vulnerability",
@@ -34830,7 +36448,39 @@
         "adequate": false,
         "gap": "Patch Operating Systems (48-hour extreme-risk target) is frequently missed for kernel updates that require coordinated reboot scheduling."
       }
-    }
+    },
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "For this CVE the SLA has to be measured to the restart, not to the download. The packet records no live-patch path, so the fixed kernel code only runs once the update is installed and the host reboots; a fleet whose patch console shows the update applied still contains a population of never-restarted workstations where a standard-user foothold converts to SYSTEM. That population is precisely what an actor already inside the network escalates on, and this flaw has confirmed in-the-wild use by APT34 for exactly that post-compromise step. The clock starts at the KEV listing rather than at the next monthly maintenance cycle, and completion evidence is per-host restart, not per-host package state.",
+        "evidence": "CISA KEV-listed 2024-10-15 with active_exploitation confirmed; RWEP 81, CVSS 7.0; poc_available true; patch_available true; live_patch_available false with live_patch_notes null. Per the packet's attack_vector, 'APT34 leveraged this for post-compromise privilege escalation' after 'A local attacker who already has code execution wins a timing race in the Windows kernel's NtQueryInformationToken handling'. CWE-367 (TOCTOU race condition).",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "NIS2-Art21-patch-management",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-003",
+        "name": "KERNEL-EXPLOITATION-DETECTION",
+        "description": "A check-then-use race in the kernel's NtQueryInformationToken handling drops no file, loads no driver and calls nothing a standard user is not entitled to call — the attacker already has code execution and simply repeats a legitimate token query until the validated token changes inside the window. Winning a race means retrying, so the observable is a burst of repeated token-query activity from a single low-privilege process followed by that process or a child running as SYSTEM; the integrity-level transition, not the API call, is the signature. Kernel-privilege-escalation telemetry with a fast alert is the only control that fires on this path, because least privilege cannot deny the attacker's starting position and the escalation happens entirely inside the kernel.",
+        "evidence": "Per the packet's attack_vector: 'A local attacker who already has code execution wins a timing race in the Windows kernel's NtQueryInformationToken handling — the token is validated (check) and then used after it may have changed (use) — to escalate from a standard user to SYSTEM; APT34 leveraged this for post-compromise privilege escalation.' CWE-367. CISA KEV-listed 2024-10-15, active_exploitation confirmed, poc_available true, RWEP 81, CVSS 7.0.",
+        "gap_closes": [
+          "NIST-800-53-AC-6",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-018",
+        "name": "SCANNER-PAPER-COMPLIANCE-TEST",
+        "description": "The paper-compliance failure specific to this CVE is counting an installed update as a remediated host. With no live-patch path recorded for this entry, the vulnerable kernel keeps executing until the machine restarts, so a scanner or management console reporting 'update applied' can show a clean fleet while every pending-restart host still carries a working standard-user-to-SYSTEM escalation with a public PoC. The operational test: join the patch report to last-boot time per host and count any host whose uptime predates the update installation as unremediated — if the vulnerability-management program cannot produce that number, its remediation percentage for this CVE is unverified rather than achieved.",
+        "evidence": "patch_available true, live_patch_available false, live_patch_notes null; poc_available true; CISA KEV-listed 2024-10-15 with active_exploitation confirmed; RWEP 81, CVSS 7.0. The packet's attack_vector establishes that exploitation requires only that the attacker 'already has code execution' as a local standard user, and records APT34 use for post-compromise privilege escalation.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8"
+        ]
+      }
+    ]
   },
   "CVE-2024-28987": {
     "name": "SolarWinds Web Help Desk Hardcoded Credential Vulnerability",
@@ -36710,7 +38360,41 @@
         "adequate": false,
         "gap": "Least-functionality does not disable unprivileged user namespaces by default on many distros, leaving the exploit precondition present unless kernel.unprivileged_userns_clone is explicitly hardened."
       }
-    }
+    },
+    "new_control_requirements": [
+      {
+        "id": "CONTAINER-HOST-NAMESPACE-ESCAPE-HARDENING",
+        "name": "CONTAINER-HOST-NAMESPACE-ESCAPE-HARDENING",
+        "description": "This flaw is the case the control is written for: the packet's own reachability precondition is that unprivileged user namespaces are enabled (otherwise namespaced CAP_SYS_ADMIN is required), and the escalation is stated to include breaking out of a container — so the namespace boundary provides no containment and the host kernel is the only thing between a tenant workload and root. The two compensating controls named here map one-to-one onto that precondition: disabling unprivileged user namespaces on hosts whose workloads do not need them, and dropping CAP_SYS_ADMIN from container specs, each removes reachability without touching the kernel, which matters for nodes waiting on a change window. Confining every workload with an AppArmor or SELinux profile plus seccomp additionally constrains which filesystem types a confined process can ask the kernel to mount, and mounting a filesystem that falls back to legacy handling is the step that reaches the overflowing parser. On this entry the live-kernel-patch branch of the control is real rather than aspirational, so host remediation and namespace hardening can land on the same day.",
+        "evidence": "vector: heap-based buffer overflow in legacy_parse_param in the Filesystem Context functionality, reachable by 'An unprivileged (in case of unprivileged user namespaces enabled, otherwise needs namespaced CAP_SYS_ADMIN privilege) local user able to open a filesystem that does not support the Filesystem Context API (and thus fallbacks to legacy handling)'. attack_vector: the local user escalates to root 'including breaking out of a container'. cisa_kev true with kev_date 2024-08-21, active_exploitation 'confirmed', poc_available true, RWEP 65, CVSS 8.4. live_patch_available true, live_patch_notes: 'Distros shipped livepatchable fixes for the legacy_parse_param overflow, allowing remediation without an immediate reboot on supported kernels.'",
+        "gap_closes": [
+          "NIST-800-53-CM-7",
+          "UK-CAF-B4",
+          "AU-Essential-8-Patch"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-002",
+        "name": "LIVE-PATCH-CAPABILITY",
+        "description": "This is one of the entries where the live-patch branch is not hypothetical — the packet records distro-shipped livepatchable fixes for the overflowing parser, so a host with kpatch/livepatch already deployed and exercised closes a confirmed-exploited local root escalation the same day, while an otherwise identical host without that capability holds the exposure open until its next reboot window. On container hosts the deferral is the expensive part: because the escalation path breaks out of a container, every tenant workload scheduled onto an unrebooted node stays one local syscall path away from host root for the entire length of the wait, and the node cannot be honestly reported as remediated in the interim. The capability has to be in place before the disclosure rather than procured in response to it, which is why the requirement is deployed-and-quarterly-tested rather than 'use live patching where available' — a livepatch stream that has never been exercised on these kernels will not be trusted enough to apply under time pressure.",
+        "evidence": "live_patch_available true with live_patch_notes: 'Distros shipped livepatchable fixes for the legacy_parse_param overflow, allowing remediation without an immediate reboot on supported kernels.' patch_available also true. cisa_kev true with kev_date 2024-08-21, active_exploitation 'confirmed', poc_available true, RWEP 65 against CVSS 8.4. attack_vector: an unprivileged local user escalates to root, 'including breaking out of a container'.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "AU-Essential-8-Patch",
+          "NIS2-Art21-patch-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-009",
+        "name": "KERNEL-MODULE-INVENTORY-AND-DISABLE",
+        "description": "Reachability here depends on the local user being able to open a filesystem that does not support the Filesystem Context API and therefore falls back to the legacy parameter parser, so the set of legacy filesystem drivers a host will load is the actual attack surface — and a production host or container node typically needs only a handful of them. Inventory which legacy filesystem modules a node can load and blacklist in modprobe the ones no business workload mounts. The scope of that control is narrow and has to be stated: a modprobe blacklist only prevents a future autoload, so it removes the fallback path only for modules that are built as loadable AND are not currently loaded. A driver compiled into the kernel, or one already resident, stays reachable until it is unloaded or the host reboots — for those the blacklist is preparation for the next boot, not a mitigation now, and the node must be counted as unremediated until the kernel update lands. Validate at runtime rather than from the config file: enumerate what /proc/filesystems and the loaded-module list actually show on the node, not what the blacklist intends. The quarterly review is what keeps it honest on container hosts: CSI drivers and storage plugins mount filesystems that cause the HOST kernel to autoload a driver a build-time blacklist never covered, and a blacklist that silently stopped covering a mountable legacy filesystem restores reachability without any alert.",
+        "evidence": "vector: the heap overflow in legacy_parse_param is reached by 'a local user able to open a filesystem that does not support the Filesystem Context API (and thus fallbacks to legacy handling)'. The entry already records NIST-800-53-CM-7 (Least Functionality) as an insufficient framework control. cisa_kev true with kev_date 2024-08-21, active_exploitation 'confirmed', poc_available true.",
+        "gap_closes": [
+          "NIST-800-53-CM-7",
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2021-33045": {
     "name": "Dahua IP Camera Authentication Bypass Vulnerability (CVE-2021-33045)",
@@ -46265,7 +47949,40 @@
         "adequate": false,
         "gap": "A.8.8 technical-vulnerability management had nothing to action at disclosure because no CVE fix existed; the exposure persisted until Microsoft's later cumulative update despite the vulnerability being tracked and exploited."
       }
-    }
+    },
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-120",
+        "name": "DOWNLOAD-PROVENANCE-ENFORCEMENT",
+        "description": "Provenance enforcement is the control that actually breaks this specific exploit path: the spearphished Office document pulls a remote payload through the Windows Search (search-ms) handler precisely so the file's internet origin stops being visible to the shell and the protected-view warning never fires. For a Windows/Office estate, that means Mark-of-the-Web must be enforced on every file arriving by mail or download and must survive the handoff to a protocol handler, and execution of provenance-stripped shortcuts, installers and script hosts must be blocked outright rather than being allowed on a reputation-service verdict — the exploit's entire purpose is to remove the marking that any reputation or warning decision is keyed on. The binary fix for this CVE ships in the Windows/Office cumulative update and requires a reboot, with no live-patch path, so provenance enforcement is what has to hold the affected hosts through the interval before that reboot lands.",
+        "evidence": "The packet's attack_vector: 'A spearphished Office document loads a remote payload that abuses the Windows Search (search-ms) handler to bypass Mark-of-the-Web, causing internet-origin content to execute without the protected-view warning and dropping a RomCom/Underground backdoor.' cisa_kev true, kev_date 2023-07-17, active_exploitation confirmed, poc_available true, CVSS 7.5, RWEP 73. patch_available true but live_patch_available false; live_patch_notes: 'No live-patch path; Microsoft's fix ships in the Windows/Office cumulative update (requires a reboot).'",
+        "gap_closes": [
+          "AU-Essential-8-App-Hardening",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-038",
+        "name": "MITIGATION-ACTIVE-PATCH-PENDING-VERDICT-CLASS",
+        "description": "This CVE is the canonical case for a three-state compliance verdict, because for the whole zero-day window the only defenses available on affected Windows/Office hosts were the FEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATION registry setting and Office ASR rules — vendor-mitigation rules, not a binary patch. An audit that recorded 'registry key deployed by GPO, ASR rules enabled' as remediation would have reported the estate green while every host still carried the vulnerable search-ms code path, one defect or one policy-scope miss in those rules away from the same Mark-of-the-Web bypass. The verdict class must record those hosts as state (b) — mitigation active, patch pending — with a time-bound action item that only clears when the Windows/Office cumulative update and its reboot have actually landed, and it must not let the registry-plus-ASR posture be filed as 'patched per SLA'.",
+        "evidence": "live_patch_notes for this entry: 'No live-patch path; Microsoft's fix ships in the Windows/Office cumulative update (requires a reboot). During the zero-day window the only mitigation was the FEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATION registry setting and Office ASR rules.' live_patch_available false, patch_available true. cisa_kev true, kev_date 2023-07-17, active_exploitation confirmed.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-patch-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-041",
+        "name": "PROTECTION-MECHANISM-FAILURE-CLASS-REGRESSION",
+        "description": "What this CVE defeats is not a data-handling bug but a protection mechanism itself — Mark-of-the-Web and the protected-view warning that depends on it — so remediation cannot end when the Windows/Office cumulative update is installed. The search-ms cross-protocol file-navigation primitive must be added as a permanent case in the detonation-chamber and ASR/AppLocker regression battery for the MOTW class and re-run on every subsequent cumulative update, because that update requires a reboot and changes the very shell code path under test. The same two artifacts the packet names as the zero-day-window mitigation — the FEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATION registry setting and the Office ASR rules — are what the regression run has to keep proving still take effect, rather than being retired from the test set once this CVE is marked closed.",
+        "evidence": "attack_vector records a Windows Search (search-ms) handler abuse that bypasses Mark-of-the-Web so internet-origin content executes without the protected-view warning. live_patch_notes names the FEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATION registry setting and Office ASR rules as the zero-day-window mitigation, and states the fix ships in the Windows/Office cumulative update requiring a reboot. poc_available true; cisa_kev true, kev_date 2023-07-17, active_exploitation confirmed.",
+        "gap_closes": [
+          "AU-Essential-8-App-Hardening",
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2022-29303": {
     "name": "SolarView Compact Command Injection Vulnerability",