@blamejs/exceptd-skills 0.19.8 → 0.19.10

package/data/zeroday-lessons.json

@@ -1,7 +1,7 @@
 {
   "_meta": {
     "schema_version": "1.1.0",
-    "last_updated": "2026-08-09",
+    "last_updated": "2026-08-10",
     "last_threat_review": "2026-05-17",
     "purpose": "Zero-day learning loop output. Each entry maps a CVE to: attack vector, defense chain analysis, framework coverage, new control requirements generated, and exposure scoring. v1.1.0 (2026-05-15): every entry now carries ai_discovered_zeroday boolean + ai_discovery_source enum + ai_discovery_date + ai_assist_factor ladder, per AGENTS.md Hard Rule #7.",
     "note": "Never delete entries. Closed gaps are marked status: closed. History is data.",
@@ -2944,7 +2944,20 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "human_researcher",
-    "ai_assist_factor": "low"
+    "ai_assist_factor": "low",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-054",
+        "name": "BACKUP-TIER-NETWORK-ISOLATION",
+        "description": "Bound to this appliance: the QTS / QuTS hero web management surface on a TS-453E-class NAS answers only from an operator subnet or an authenticated VPN — not from a general user VLAN, and not from the internet via a UPnP mapping or a router port-forward, which is how small-office NAS hardware normally acquires exposure — and the appliance's outbound path is constrained so a NAS running attacker code cannot reach arbitrary destinations with the data it holds. State the precondition plainly: this bounds who can present input to the CWE-78 command-injection sink, it does not remove the sink. It does nothing for an attacker already holding a foothold on the operator subnet or on the NAS itself, nothing for the later components of the demonstrated chain once the first stage has landed, and because the packet records no live-patch path (live_patch_available false, live_patch_notes null) the appliance still has to be taken through the vendor firmware update to remediate. Where the business genuinely needs the web UI reachable from user segments, the isolation does not hold and the firmware update is the only remaining action. Distinguishing test: from a general user VLAN and from an external address, attempt to load the appliance's web management surface; anything that answers is within reach of the demonstrated chain, and 'the NAS is on the internal network' is a statement about topology, not evidence that the management surface is unreachable from untrusted segments.",
+        "evidence": "Packet records CWE-78, CVSS 9.8, RWEP 40, poc_available true, patch_available true, live_patch_available false with live_patch_notes null, cisa_kev false and active_exploitation 'unknown'. Attack vector: component 1/3 of the DEVCORE Research Team chain on the QNAP TS-453E appliance at Pwn2Own Ireland 2025 — a chained injection plus format-string bug demonstrated as part of the three-CVE chain that earned $40,000 and 4 Master of Pwn points. Citing gaps are all patch-cadence / system-security controls (AU-Essential-8-Patch, NIST-800-53-SI-2, ISO-27001-2022-A.8.8, NIS2-Art21-vulnerability-management, UK-CAF-B4) plus EU-CRA-Art13.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "NIST-800-53-SI-2",
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2025-62848": {
     "name": "QNAP QTS/QuTS hero RCE (Pwn2Own Ireland 2025, chain 2/3)",
@@ -3077,7 +3090,30 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "human_researcher",
-    "ai_assist_factor": "low"
+    "ai_assist_factor": "low",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-054",
+        "name": "BACKUP-TIER-NETWORK-ISOLATION",
+        "description": "The TS-453E is a NAS, so the box that this chain lands privileged execution on is the box holding the data. The packet places this CVE as the elevation step that converts the unauthenticated RCE foothold from the chain's earlier components into appliance-level privileged execution, which means the operator-side lever is the network position of the appliance rather than anything about the elevation primitive itself. Applied to this product the control means the QTS/QuTS hero management and service surfaces answer only from an operator subnet or an authenticated VPN — not from a general user VLAN, and not from the internet through a router port-forward or a UPnP mapping, which is how small-site and remote-worker NAS hardware normally acquires exposure — and that the appliance's outbound path is constrained so a rooted unit cannot ship the data it holds to arbitrary destinations. The precondition is exact and has to be stated rather than implied: isolation removes the chain's entry point only for callers outside the permitted segment. It does nothing once an attacker already holds the foothold this CVE elevates from, nothing against a caller inside the operator subnet or a compromised administrator host, and nothing about an implant placed before the restriction was applied. The packet records an available vendor patch with no live-patch path, so the appliance still has to be taken through the firmware update to remediate; a unit left isolated and unpatched is a deferral with an expiry date attached, not a closed finding. Distinguishing test: from a general user VLAN and from an external address, attempt to load the appliance's management surface — anything that answers is within reach of the published chain, and 'the NAS is on the internal network' is a claim about topology rather than a demonstration that the surface is unreachable from untrusted segments.",
+        "evidence": "Packet attack_vector: 'Component 3/3 of the DEVCORE Research Team chain on the QNAP TS-453E appliance at Pwn2Own Ireland 2025 — post-auth elevation (CWE-269, T1068). Used by the chain to convert the unauth RCE foothold from CVE-2025-62847/62848 into appliance-level privileged execution.' poc_available true; cisa_kev false with kev_date null and active_exploitation unknown; patch_available true, live_patch_available false, live_patch_notes null.",
+        "gap_closes": [
+          "UK-CAF-B4",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-018",
+        "name": "SCANNER-PAPER-COMPLIANCE-TEST",
+        "description": "The gaps recorded against this entry are patch-and-vulnerability-management controls, and the paper-compliance failure they permit here is specific to appliance firmware: an estate can hold a green 'patch operating systems' attestation covering its servers and workstations while the QNAP appliance's firmware build was never enumerated by the scan at all, because appliance firmware is not an OS package and the unit is not a managed host. The operational test for this CVE therefore has two halves. First, does the scan report a running firmware build read from the appliance itself, rather than treating absence of data as absence of findings? Second, does the build it reports carry the fixes for the chain's other links and not this CVE alone — the packet places this defect as component 3/3 and attributes the unauthenticated RCE foothold to CVE-2025-62847/62848, so a unit remediated only for the elevation step leaves the chain's entry point standing as an independently exploitable unauthenticated path. A verdict derived from a model name, a purchase record or a support-contract entry instead of the running build is the paper-compliance case this control exists to catch.",
+        "evidence": "Packet citing gaps: AU-Essential-8-Patch ('Patch operating systems'), ISO-27001-2022-A.8.8 ('Management of technical vulnerabilities') and NIST-800-53-SI-2 ('Flaw Remediation') are recorded as insufficient for this entry. Packet attack_vector identifies the defect as component 3/3 of the chain and names 'the unauth RCE foothold from CVE-2025-62847/62848'; the packet gives the affected product as the QNAP TS-453E appliance running QTS/QuTS hero, with patch_available true.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      }
+    ]
   },
   "CVE-2025-59389": {
     "name": "QNAP Hyper Data Protector critical RCE (Pwn2Own Ireland 2025)",
@@ -7893,7 +7929,31 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "PaperCut NG/MF is bought and audited as back-office print-management software, so it sits in the slow lane of most patch programs — but this packet makes it an authentication enforcement point that is failing open under confirmed exploitation, which is why the KEV clock and not the application-patch cadence has to govern it. Meeting the SLA on this product means the PaperCut application service is actually restarted onto the fixed build on every instance: the packet records a vendor patch but no live-patch path, and its live_patch_notes state the vendor patch typically requires a service restart or system reboot per the KEV requiredAction, so a staged package on a still-running instance has not moved the exposure at all. Until that restart lands on a given server, the bypass reachable through the SecurityRequestFilter class is still available to an unauthenticated caller, so the interim action the SLA has to record is constraining who can reach that instance's admin surface — not a scheduled maintenance window with the server left reachable in the meantime.",
+        "evidence": "Packet records cisa_kev true with kev_date 2026-04-20 and active_exploitation confirmed, RWEP 83 / CVSS 9.1, poc_available true. patch_available is true, live_patch_available is false, and live_patch_notes read: 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.' The citing framework gaps record AU-Essential-8-Patch (Patch operating systems), ISO-27001-2022-A.8.8 (Management of technical vulnerabilities), NIST-800-53-SI-2 (Flaw Remediation) and NIS2-Art21-vulnerability-handling as insufficient for this CVE.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-handling"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-129",
+        "name": "ENTERPRISE-ERP-MANAGEMENT-FUNCTION-AUTHENTICATION",
+        "description": "PaperCut's request-filter layer is where the product makes its authentication decision, and this CVE is that layer failing open: the packet places the bypass in the SecurityRequestFilter class and has a remote unauthenticated attacker reaching administrative functionality behind it. Bound to this product, the control means each administrative function on the PaperCut server authorizes its caller itself rather than inheriting a verdict from the filter that fronts it, and the admin surface is segmented so an untrusted network caller cannot present a request to that filter in the first place. The least-privilege control cited as insufficient here does not touch this path — the attacker never authenticates as any PaperCut operator, so per-account privilege scoping is never consulted, and the account model that an identity-and-access attestation examines is bypassed rather than abused. Distinguishing test: from a segment with no operational need for the print-administration console, issue unauthenticated requests to each administrative endpoint on a staging PaperCut instance and confirm each is refused before the function runs — an attestation that every PaperCut administrator authenticates at login passes cleanly while this path stays open.",
+        "evidence": "Packet vector: 'PaperCut NG/MF contains an improper authentication vulnerability that could allow remote attackers to bypass authentication on affected installations via the SecurityRequestFilter class.' cwe_refs is CWE-287; attack_vector states the flaw lets an unauthenticated attacker bypass authentication and reach administrative functionality, KEV-listed 2026-04-20 with confirmed in-the-wild exploitation and poc_available true. UK-CAF-B2 (Identity and access control) and NIST-800-53-AC-6 (Least Privilege) are both recorded among the citing gaps.",
+        "gap_closes": [
+          "UK-CAF-B2",
+          "NIST-800-53-AC-6"
+        ]
+      }
+    ]
   },
   "CVE-2025-48700": {
     "name": "Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability",
@@ -8025,7 +8085,42 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-036",
+        "name": "FLEET-CONTROL-PLANE-ADMIN-PRIVILEGE-TIER",
+        "description": "This flaw's entire precondition is a low-privileged local account on the SD-WAN Manager appliance: the packet has an authenticated, local attacker reading a credential file for the DCA user from the filesystem and thereby gaining DCA privileges. Bound here, privilege tiering means the appliance carries no general-purpose local accounts at all — every operator who can obtain shell or filesystem-level access on vManage sits in a distinct tier above application and network admins, reached only through a PAM jumphost with FIDO2 step-up, just-in-time elevation, an identity used for nothing else, and per-session attribution. State the precondition honestly rather than claiming the surface is removed: this shrinks the population that can reach the credential file, it does not make the stored password unrecoverable. Any principal that does obtain low-privileged local access on the appliance — through an operational account, a support process, or any other local-access defect on the same host — still recovers the DCA credential, and the control has no effect at all on a credential that was already read. The cited least-privilege and identity-and-access-control gaps are recorded here because the escalation runs from one local account to another via a file read, so an attestation that vManage roles are least-privileged passes cleanly while the recoverable credential file sits on disk. Distinguishing test: from a deliberately low-privileged local account on a staging appliance, attempt to read the DCA credential file and confirm the account cannot exist in the first place under the tiering policy.",
+        "evidence": "Packet fields for CVE-2026-20128: cwe_refs CWE-257; vector 'Cisco Catalyst SD-WAN Manager contains a storing passwords in a recoverable format vulnerability that allows an authenticated, local attacker to gain DCA user privileges by accessing a credential file for the DCA user on the filesystem as a low-privileged user.'; cisa_kev true with kev_date 2026-04-20; active_exploitation confirmed; rwep_score 77; cvss 8.8; poc_available true; patch_available true; live_patch_available false. NIST-800-53-AC-6 (Least Privilege), UK-CAF-B2 (Identity and access control) and NIS2-Art21-network-security are among the citing framework gaps.",
+        "gap_closes": [
+          "NIST-800-53-AC-6",
+          "UK-CAF-B2",
+          "NIS2-Art21-network-security"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-037",
+        "name": "FLEET-COMPROMISE-IR-PLAYBOOK",
+        "description": "A recoverable-format password disclosure is not closed by the code fix: the update changes how the DCA credential is stored, but a password an attacker has already read stays valid until it is changed. With the packet recording confirmed in-the-wild exploitation from the 2026-04-20 KEV listing on a controller whose own filesystem held the credential, the response half of this control is the load-bearing half — rotate the DCA credential and any other credential recoverable from the appliance filesystem as part of the update rather than as a follow-up ticket, audit what that account was used for across the exposure window, and invalidate device-trust state established through the controller where the account's use cannot be accounted for. Two preconditions decide whether the rotation is worth anything. It has to happen after the fixed build is running: rotating first simply writes a fresh password back into the recoverable format, leaving the operator with a rotation record and an unchanged exposure. And it only covers credentials the operator knows the appliance stores, so an inventory of what the controller holds on disk has to precede the rotation. This is a response control — it does not reduce the likelihood of the initial low-privileged local foothold that the flaw requires.",
+        "evidence": "Packet fields for CVE-2026-20128: vector states an 'authenticated, local attacker' can 'gain DCA user privileges by accessing a credential file for the DCA user on the filesystem as a low-privileged user'; attack_vector records 'storage of passwords in a recoverable format (CWE-257), allowing an attacker with access to recover credentials'; cisa_kev true with kev_date 2026-04-20; active_exploitation confirmed; poc_available true; rwep_score 77; patch_available true; live_patch_available false with live_patch_notes 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.' UK-CAF-B2 (Identity and access control), NIST-800-53-SI-2 (Flaw Remediation) and NIS2-Art21-network-security are among the citing framework gaps.",
+        "gap_closes": [
+          "UK-CAF-B2",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-network-security"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "The KEV listing of 2026-04-20 with confirmed in-the-wild exploitation puts this controller on the KEV clock rather than in the standard appliance patch window, and two packet details decide how the SLA is measured. There is no live-patch tool recorded for this entry, and the packet states the vendor patch typically requires a service restart or system reboot per the KEV required action — so the SLA is satisfied when each controller has restarted onto the fixed build, not when the package is staged or installed, and the restart outage has to be scheduled inside the clock rather than deferred to the next maintenance window. The limit belongs in the control statement: meeting the SLA does not close this entry on its own, because the credential file was readable for the whole pre-patch window on every affected controller. A patch-currency attestation showing the fixed build installed fleet-wide is fully consistent with an attacker still holding a valid DCA password, which is why the clock has to be paired with rotation of the exposed credential rather than recorded as the remediation.",
+        "evidence": "Packet fields for CVE-2026-20128: cisa_kev true with kev_date 2026-04-20; active_exploitation confirmed; rwep_score 77; cvss 8.8; poc_available true; patch_available true; live_patch_available false with live_patch_notes 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.'; vector describes an authenticated local attacker gaining DCA user privileges by accessing a credential file for the DCA user on the filesystem. AU-Essential-8-Patch, ISO-27001-2022-A.8.8 and NIST-800-53-SI-2 are among the citing framework gaps.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      }
+    ]
   },
   "CVE-2025-32975": {
     "name": "Quest KACE Systems Management Appliance (SMA) Improper Authentication Vulnerability",
@@ -8085,7 +8180,40 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "The KACE SMA entry is KEV-listed with confirmed exploitation and a public PoC, so the clock for this appliance runs from the listing date rather than the next appliance-maintenance window. The packet records a vendor patch with no live-patch path and notes that the patch typically requires a service restart or system reboot per the KEV requiredAction, which fixes how completion must be measured: by each appliance actually running the fixed build after that restart, not by 'update approved' or 'update staged' in a change record. An appliance that holds the update but has not been restarted is still serving the vulnerable authentication path and must be counted as exposed. Because no live-patch primitive exists for this product, any interval the operator cannot compress has to be carried as a documented compensating control (restricting which network segments may reach the appliance's authentication surface) recorded as a compensating state with a dated action, not reported as remediated.",
+        "evidence": "Packet: cisa_kev true with kev_date 2026-04-20, active_exploitation confirmed, rwep_score 77, cvss 9.1, poc_available true. patch_available true, live_patch_available false, and live_patch_notes: 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.'",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-129",
+        "name": "ENTERPRISE-ERP-MANAGEMENT-FUNCTION-AUTHENTICATION",
+        "description": "KACE SMA takes an authentication decision in front of an endpoint-management console, and this CVE is that decision failing open: the packet has an attacker impersonating legitimate users without valid credentials, reaching functionality behind the gate without ever presenting an account. Bound to this appliance the control means each administrative and API function on the SMA authorizes its own caller instead of inheriting a verdict from the front-door authentication, and the appliance's management surface is segmented so a caller with no operational need cannot present a request to that front door at all. This is precisely why the packet's cited multi-factor, identity-and-access and least-privilege gaps do not help here: the attacker never authenticates, so no second factor is demanded and no role is consulted, and an attestation that every KACE operator uses MFA passes cleanly while the path stays open. The precondition on the segmentation half must be stated rather than implied — it bounds who can reach the bypass, not whether the bypass works. A request originating from a permitted management segment, from an already-compromised administrator workstation, or from access obtained before the restriction was applied still reaches it, so segmentation buys time until the appliance is restarted onto the fixed build and never substitutes for that restart. Distinguishing test: from a segment with no operational need for the SMA console, issue unauthenticated requests to each administrative endpoint on a staging appliance and confirm each is refused before the function runs.",
+        "evidence": "Packet vector: the appliance 'contains an improper authentication vulnerability that could allow attackers to impersonate legitimate users without valid credentials'; attack_vector records an improper-authentication flaw (CWE-287) letting an unauthenticated attacker bypass authentication on the endpoint-management appliance. The entry's citing gaps name AU-Essential-8-MFA (Multi-factor authentication), UK-CAF-B2 (Identity and access control) and NIST-800-53-AC-6 (Least Privilege) as the framework controls that do not cover it.",
+        "gap_closes": [
+          "AU-Essential-8-MFA",
+          "UK-CAF-B2",
+          "NIST-800-53-AC-6"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-037",
+        "name": "FLEET-COMPROMISE-IR-PLAYBOOK",
+        "description": "The packet pairs confirmed in-the-wild exploitation and a public PoC with a fix that the vendor notes typically requires a restart or reboot, which means every affected appliance had an exposure window and the update closes the authentication path without touching anything already done through it. Because the compromised asset is an endpoint-management appliance, the playbook has to cover what that appliance can reach and not just the appliance itself: review what it was configured to distribute to managed endpoints across the window running from first plausible exposure to the restart onto the fixed build, rotate the credentials the appliance holds for reaching those endpoints along with any operator account used through it during that window, invalidate device-trust state, and set quarantine criteria for endpoints that received anything from it in that period. The precondition worth naming is that the playbook must already exist and be rehearsed before the next disclosure, because the detection an operator would reach for first will not fire: the packet's own words are that the attacker impersonates legitimate users without valid credentials, so the activity presents as a legitimate operator and authentication-failure monitoring has nothing to surface. Patching alone answers the vulnerability question and leaves the compromise question unasked.",
+        "evidence": "Packet: active_exploitation confirmed, cisa_kev true with kev_date 2026-04-20, poc_available true, against what the attack_vector describes as an endpoint-management appliance. patch_available true but live_patch_available false, with live_patch_notes stating the vendor patch 'typically requires service restart or system reboot per the KEV requiredAction'. Packet vector: attackers 'impersonate legitimate users without valid credentials'.",
+        "gap_closes": [
+          "NIS2-Art21-vulnerability-management"
+        ]
+      }
+    ]
   },
   "CVE-2024-27199": {
     "name": "JetBrains TeamCity Relative Path Traversal Vulnerability",
@@ -8449,7 +8577,29 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-120",
+        "name": "DOWNLOAD-PROVENANCE-ENFORCEMENT",
+        "description": "The sink on this entry is reached only when a user opens an attacker-controlled document that causes VBA to resolve a library from a path the attacker controls, so on any workstation not yet on the fixed and restarted build the ingress path is the surface an operator can actually enforce. Require the untrusted-origin mark on every VBA-bearing Office document arriving by mail, web download or untrusted file share, and require marked documents to open in an isolated reduced-privilege render instead of the full load path that resolves the hijacked library at the user's own privilege. The mark has to be applied at the ingress boundary and survive the container the document travels in — extraction from an archive, mount of an ISO or VHD, rename — because a search-order hijack needs the substitute library to sit in a directory the opening process searches, which is typically the same container that carried the document; a provenance scheme that tags the document but not its sibling files leaves the payload sitting where the loader will find it. Precondition: this constrains delivery only, and it holds only where the mark is applied and preserved. A document reaching the user over an internal share, a sync client or any channel that strips the tag, or a policy that lets the user click through to full editing, restores the vulnerable path in one step; and once an attacker already has write access to a searched directory on the host, provenance enforcement contributes nothing. Those cases close only with the vendor fix, and the packet records no live-patch tool for this entry with the fix typically requiring a service restart or system reboot — so hosts that have taken the update but not restarted must be counted as exposed rather than remediated.",
+        "evidence": "Packet fields for this entry: CWE-426 insecure library loading in Microsoft Visual Basic for Applications; attack_vector records an attacker-controlled document loading a malicious DLL from an unexpected path (search-order hijacking) for code execution. cisa_kev true with kev_date 2026-04-13, active_exploitation confirmed, poc_available true, cvss 9.8, rwep_score 77. patch_available true and live_patch_available false, with live_patch_notes: \"No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.\" AU-Essential-8-App-Hardening (User application hardening) and NIST-800-53-AC-6 (Least Privilege) are both recorded as citing gaps against this entry.",
+        "gap_closes": [
+          "AU-Essential-8-App-Hardening",
+          "NIST-800-53-AC-6"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-074",
+        "name": "CVE-REGRESSION-WATCHER",
+        "description": "This entry carries a 2012 CVE identifier alongside a 2026-04-13 KEV listing, confirmed in-the-wild exploitation and an available PoC — precisely the historical-identifier-resurfacing signal this control asks a threat-intake pipeline to raise. Applied here, intake must treat exploitation reports and PoC publications that name an identifier years older than the current advisory stream as a candidate re-exposure and force the affected-asset question back open for the VBA-bearing estate, because a vulnerability-management queue driven by current-year advisories will never revisit an identifier of this age on its own — the hosts get scoped only if something pushes the old ID back into the queue. Precondition: this is an intake and detection control and nothing more. It shortens time-to-notice; it does not remediate, it fires only where the pipeline covers the source that names the old identifier, and it gives no coverage on hosts compromised before the listing. The action it must hand off to is the vendor fix plus the restart or reboot the packet records as required, since no live-patch path is registered for this entry.",
+        "evidence": "Packet fields for this entry: the identifier is CVE-2012-1854, while cisa_kev is true with kev_date 2026-04-13 and active_exploitation confirmed; poc_available true, rwep_score 77, cvss 9.8. patch_available true, live_patch_available false, live_patch_notes: \"No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.\" ISO-27001-2022-A.8.8 (Management of technical vulnerabilities) and NIS2-Art21-patch-management (Vulnerability handling and disclosure) are recorded as citing gaps against this entry.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management"
+        ]
+      }
+    ]
   },
   "CVE-2025-60710": {
     "name": "Microsoft Windows Link Following Vulnerability",
@@ -8913,7 +9063,29 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-120",
+        "name": "DOWNLOAD-PROVENANCE-ENFORCEMENT",
+        "description": "Exploitation of this entry requires a user to open a crafted PDF, so until every Acrobat and Reader install in the estate is on the fixed build and has been restarted, the delivery path is the enforceable surface. Require the untrusted-origin mark on PDFs arriving by mail, web download and untrusted file share, applied at the ingress boundary rather than derived from metadata travelling with the file, and require marked PDFs to open in the reader's isolated reduced-privilege render instead of the full parsing path that carries the CWE-1321 prototype-pollution sink at the user's own privilege. The mark must survive the container, so a PDF extracted from an archive or mounted from an image still reaches the reader marked untrusted. Precondition: this narrows the path to the sink, it does not remove the sink. A PDF arriving over an internal share, a sync client or a chat client that writes the file locally reaches the parser unmarked, and a policy that permits the user to leave the protected render restores the full path in one click — neither case has compensating coverage and both need the vendor update plus the application or system restart the packet records as required. If the estate additionally disables document scripting, record that as unverified coverage for this entry rather than as a substitute for the update: the packet does not identify which component the prototype-pollution sink sits behind, so the operator cannot assert the scripting toggle covers it.",
+        "evidence": "Packet fields for this entry: CWE-1321 prototype pollution in Adobe Acrobat and Reader; vector and attack_vector both record arbitrary code execution when a crafted PDF is opened. cisa_kev true with kev_date 2026-04-13, active_exploitation confirmed, poc_available true, cvss 8.8, rwep_score 77. patch_available true and live_patch_available false, with live_patch_notes: \"No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.\" AU-Essential-8-App-Hardening (User application hardening) and NIST-800-53-AC-6 (Least Privilege) are recorded as citing gaps against this entry.",
+        "gap_closes": [
+          "AU-Essential-8-App-Hardening",
+          "NIST-800-53-AC-6"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-144",
+        "name": "EMBEDDED-MEDIA-PARSER-LIBRARY-INVENTORY-AND-PATCH-PARITY",
+        "description": "The packet names the affected product as Adobe Acrobat and Reader, which on a real estate is never one install: Reader and Acrobat ship as separate products on separate update tracks, and per-user copies land outside managed software distribution. The control here means enumerating every installed Acrobat and Reader copy across those tracks and confirming each reports the fixed build, rather than closing the flaw-remediation ticket when the single inventoried Reader package updates. Scope it to those products: the packet ties the CWE-1321 sink to Acrobat and Reader and provides no mapping from the vulnerable code into other PDF-handling software, so instructing operators to treat every PDF-capable binary in the estate as an instance of this CVE manufactures findings and removal work against renderers no evidence implicates. Widen the inventory only where a verified source identifies another product carrying the same component. The distinguishing test: after the managed update lands, enumerate the Acrobat and Reader installs on the estate and confirm none still report a pre-fix version — an estate that patches the inventoried Reader while a second Acrobat track keeps the old build still opens crafted PDFs into the sink, with a flaw-remediation attestation that reads clean. Precondition: this reaches only copies the inventory can see and the operator can update; an unmanaged per-user install is remediated by removing it, not by recording it as patched. The packet registers no live-patch path, so each copy carries the service restart or system reboot the vendor fix requires, and a copy updated but not restarted is not yet remediated.",
+        "evidence": "Packet fields for this entry: the affected product is recorded as \"Adobe Acrobat and Reader\" with a CWE-1321 prototype-pollution flaw reached by opening a crafted PDF; cisa_kev true, kev_date 2026-04-13, active_exploitation confirmed, poc_available true, cvss 8.8, rwep_score 77. patch_available true, live_patch_available false, live_patch_notes: \"No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.\" ISO-27001-2022-A.8.8 (Management of technical vulnerabilities) and NIST-800-53-SI-2 (Flaw Remediation) are recorded as citing gaps against this entry.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      }
+    ]
   },
   "CVE-2026-1340": {
     "name": "Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability",
@@ -12248,7 +12420,31 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "The remediation unit here is not an OS package but a Composer-managed component living inside every Laravel application that uses Livewire, so the KEV clock has to be run against an inventory of applications rather than an inventory of hosts. For this CVE that means: enumerate every Laravel deployment whose lockfile resolves Livewire, bump the package to the fixed release, redeploy the built artifact, and restart the PHP-FPM and queue workers so long-lived processes stop serving the old code — the packet records no live-patch path and a vendor patch that typically requires a service restart or system reboot per the KEV required action, so the restart is part of the remediation rather than a deferral point. The packet qualifies the flaw as reaching unauthenticated remote command execution in specific scenarios, which is the reason a host-level scan is not sufficient evidence of closure: an operator cannot tell from a server inventory which applications sit in the exposed configuration. With confirmed in-the-wild exploitation from the 2026-03-20 listing, the four-hour target starts at KEV listing / patch availability rather than at the next release train, and a Laravel estate whose deploys are gated on a weekly window has no way to meet it without an out-of-band path for a single dependency bump. The distinguishing test: on a production host, confirm the Livewire version actually loaded by the running PHP workers is the fixed one — not the version declared in the repository lockfile, which says what the next deploy will ship, not what is serving traffic now.",
+        "evidence": "Packet: CWE-94 code injection enabling unauthenticated remote command execution on the web server, described as reachable in specific scenarios. CISA KEV-listed 2026-03-20 with active_exploitation confirmed; CVSS 9.8, RWEP 77, poc_available true. patch_available true, live_patch_available false, and live_patch_notes records that no live-patch tool is registered and that the vendor patch typically requires a service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "Livewire's defect runs attacker-supplied code inside the PHP process that serves the request, with no credential required, and the packet records confirmed in-the-wild exploitation from the 2026-03-20 listing. Any internet-reachable Laravel application that was serving traffic during that window therefore has to be triaged as possibly compromised rather than closed out when the dependency is bumped: updating the package removes the injection sink but removes nothing the injected code already did — a PHP file written under the application's public or storage tree, a poisoned compiled view or cached container file, a queued job, an added administrative user, or a read of the application's environment file that handed over its database, cache, mail and third-party API credentials in one request. The control for this deployment: redeploy the application from the build pipeline onto a clean host image rather than patching the running one, restore the code tree from version control rather than editing in place, and rotate every secret the application process could read, since the exploit path could read all of them. The distinguishing test after remediation: diff the deployed file tree against the artifact the build pipeline produced, and treat any file the pipeline did not emit as the finding — a \"patched per SLA\" verdict recorded against the Livewire version attests to what is running now and says nothing about what ran during the exposure window.",
+        "evidence": "Packet: CWE-94 code injection giving unauthenticated remote command execution on the web server; CISA KEV-listed 2026-03-20 with active_exploitation confirmed; poc_available true; RWEP 77 against CVSS 9.8; patch_available true with live_patch_available false.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2025-43510": {
     "name": "Apple Multiple Products Improper Locking Vulnerability",
@@ -12303,7 +12499,29 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-056",
+        "name": "MOBILE-ENDPOINT-MDM-ENFORCED-KEV-SLA",
+        "description": "The packet's affected surface spans watchOS, iOS, iPadOS, macOS, visionOS and tvOS, and the fix is a full OS build with no live-patch path — so for this entry the control means the KEV clock that opened 2026-03-20 drives the update across the managed Apple estate on a declared short SLA with user deferral disallowed, not on the estate's normal OS-upgrade cadence. Completion must be measured by each device's installed build against the fixed build for its product, and because the packet records that the vendor fix typically requires a service restart or system reboot, a device that has downloaded or staged the update but not restarted is still running the vulnerable code and counts as exposed rather than remediated. Precondition: the declarative-management lever exists for enrolled iPhone, iPad and Mac. The watchOS, tvOS and visionOS units named in the same packet are commonly updated through a paired device or are not enrolled at all, so no-deferral enforcement does not reach them — those must be enumerated separately and driven manually or held outside the trust boundary until their build is confirmed. Omitting them makes the SLA report read complete while the devices nobody enrolled are the ones still carrying the flaw.",
+        "evidence": "Packet fields for this entry: the vector states that Apple watchOS, iOS, iPadOS, macOS, visionOS and tvOS contain an improper locking vulnerability (CWE-667) that could allow a malicious application to cause unexpected changes in memory shared between processes. cisa_kev true with kev_date 2026-03-20, active_exploitation confirmed, poc_available true, cvss 8.8, rwep_score 77. patch_available true and live_patch_available false, with live_patch_notes: \"No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.\" NIST-800-53-SI-2 (Flaw Remediation) and NIS2-Art21-patch-management (Vulnerability handling and disclosure) are recorded as citing gaps against this entry.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-patch-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-126",
+        "name": "MOBILE-OS-MINIMUM-PATCH-LEVEL-ENFORCEMENT",
+        "description": "The trigger the packet records is a malicious application causing unexpected changes in memory shared between processes, so for this entry the control's access-condition half is the load-bearing one: on any Apple device that cannot yet take the fixed build, the operator's remaining levers are constraining what code is allowed to run at all and withholding organizational data from the device until its build is at or above the fix. The fixed build must function as an access condition — mail, VPN and document access denied to a device below it — not as a row on a patch-compliance dashboard. The distinguishing test is to enrol a device pinned below the fixed build and confirm the policy actually denies it access to protected resources; an estate that surfaces the stale build on a report while the device keeps its access has recorded the exposure rather than removed it. Precondition: restricting untrusted or side-loaded application installation raises the bar for getting the attacker's application onto the device, but it does not evict an application already installed, and it does not cover one that arrived through the normal store channel. A device suspected of already running the malicious application belongs on the incident path, not the install-policy path. This is a holding measure for the window before the fixed build and its required restart land, not a substitute for them.",
+        "evidence": "Packet fields for this entry: CWE-667 improper locking across Apple watchOS, iOS, iPadOS, macOS, visionOS and tvOS, with the vector stating it could allow a malicious application to cause unexpected changes in memory shared between processes. cisa_kev true, kev_date 2026-03-20, active_exploitation confirmed, poc_available true, cvss 8.8, rwep_score 77. patch_available true, live_patch_available false, live_patch_notes: \"No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.\" AU-Essential-8-Patch (Patch operating systems) and ISO-27001-2022-A.8.8 (Management of technical vulnerabilities) are recorded as citing gaps against this entry.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8"
+        ]
+      }
+    ]
   },
   "CVE-2025-43520": {
     "name": "Apple Multiple Products Classic Buffer Overflow Vulnerability",
@@ -13022,7 +13240,31 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-103",
+        "name": "AI-APP-BUILDER-EXECUTION-ENDPOINT-AUTH-AND-SANDBOX",
+        "description": "n8n is the visual workflow/agent builder class this control governs, and the defect sits in exactly the sink the control names: the workflow expression evaluation system, a dynamic-evaluation path that turns workflow-supplied content into executable code. For an n8n deployment the requirement is that every surface which can reach expression evaluation authenticates the caller before the expression is evaluated — the editor API, workflow import, and any trigger whose fields are expression-evaluated — and that the n8n execution process runs confined rather than with host privileges, so a successful evaluation cannot reach filesystem, network or process operations beyond what the workflows legitimately need. Preconditions, all of which must be recorded rather than assumed: this bounds who can reach the evaluator, it does not repair the evaluator, so the vendor update remains the only fix for the flaw itself. Anyone already holding an editor-capable account is inside the authentication boundary and the control does nothing against them. Confinement added after the fact does not evict an attacker resident from an earlier execution on that host. And where a trigger must stay reachable by untrusted callers for the workflow to do its job, that path cannot be closed by authentication at all — for it, the update is the only remedy and the interim state is exposure, not mitigation.",
+        "evidence": "The packet records CWE-913, described as an improper control of dynamically managed code resources vulnerability in n8n's workflow expression evaluation system that allows for remote code execution, at CVSS 9.8 with rwep_score 77 and poc_available true. cisa_kev is true with kev_date 2026-03-11 and active_exploitation confirmed. The entry cites NIST-800-53-AC-6 (Least Privilege) and UK-CAF-B4 (System security) among the framework controls that are insufficient here, which is the privilege-and-boundary half this control addresses. patch_available is true and live_patch_available is false.",
+        "gap_closes": [
+          "NIST-800-53-AC-6",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "For this entry the clock opens at the 2026-03-11 KEV listing, and what has to be measured is the n8n build actually running, not the release pulled. The packet records no live-patch tool for this entry and notes the vendor patch typically requires a service restart or system reboot, so an instance that has fetched the fixed release but has not restarted the n8n service is still executing the vulnerable expression evaluator and must be counted as exposed rather than remediated. The second requirement follows from active_exploitation being confirmed with a public exploit available: an instance whose editor or trigger surface was reachable during the exposure window needs forensic review of the workflows present on it and rotation of any credential the n8n process could reach, because code execution on that host precedes the update and is not undone by it — patch-and-close is the wrong verdict for an instance that was reachable, and the compliance record must distinguish 'updated and restarted' from 'updated, restarted, and triaged'.",
+        "evidence": "cisa_kev true with kev_date 2026-03-11, active_exploitation confirmed, poc_available true, rwep_score 77 against cvss 9.8. patch_available is true and live_patch_available is false; live_patch_notes states that no live-patch tool is registered for this entry at bulk-import time and that the vendor patch typically requires service restart or system reboot per the KEV requiredAction. The four cited patch-and-vulnerability-handling gaps — AU-Essential-8-Patch, ISO-27001-2022-A.8.8, NIST-800-53-SI-2 and NIS2-Art21-vulnerability-management — are the risk-based-timeframe controls that carry no KEV-triggered clock.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      }
+    ]
   },
   "CVE-2021-22054": {
     "name": "Omnissa Workspace ONE Server-Side Request Forgery",
@@ -13863,7 +14105,38 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-135",
+        "name": "CONTROL-PANEL-PLUGIN-USER-SURFACE-MUST-NOT-REACH-ROOT-OPERATIONS",
+        "description": "The Cisco SD-WAN application CLI is the constrained user surface this control governs. The packet's vector describes an authenticated local attacker gaining elevated privileges via improper access controls on commands within the application CLI, with a successful exploit allowing arbitrary commands as the root user — a user-facing surface wired straight to a root operation, which is the pattern the control forbids. Applied to this device, it means the SD-WAN privileged operations sit behind their own authorization boundary that the application CLI can only request through a constrained, validated interface, so that the CLI's own command-and-path handling is not the single thing standing between a non-root operator account and root. Preconditions: the vendor update is what repairs that boundary — the control states the property to verify, it does not implement it. Until the update is applied, the only operator-side lever is limiting which accounts can open a CLI session, which bounds the population that can attempt the escalation but does not close it, because any account that legitimately reaches the CLI still reaches root. And because active_exploitation is confirmed, a device whose CLI was reachable by a non-root account during the exposure window needs forensic triage and credential rotation; an update applied to a device that already granted root does not remove what the attacker left behind.",
+        "evidence": "The packet's vector states that the Cisco SD-WAN CLI contains a path traversal vulnerability that could allow an authenticated local attacker to gain elevated privileges via improper access controls on commands within the application CLI, and that a successful exploit could allow the attacker to execute arbitrary commands as the root user. cwe_refs are CWE-25 and CWE-282. cvss 7.5, rwep_score 77, poc_available true, cisa_kev true with kev_date 2026-02-25 and active_exploitation confirmed. UK-CAF-B4 (System security) is cited as an insufficient framework control on this entry. patch_available is true, live_patch_available is false.",
+        "gap_closes": [
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-036",
+        "name": "FLEET-CONTROL-PLANE-ADMIN-PRIVILEGE-TIER",
+        "description": "An SD-WAN device CLI programs the WAN fabric that every site depends on, so the identities that can open a session on it belong in the fleet-control-plane tier this control defines rather than in a general network-operations account pool. For this CVE the tier is load-bearing on one half specifically: the packet's vector places the attacker at an authenticated CLI session, so routing every CLI path through a PAM jumphost with per-session step-up and just-in-time elevation shrinks the set of identities that can reach the vulnerable command handling at all, and makes each attempt attributable. The preconditions are where this control is usually recorded as holding when it does not. It only holds if every path to the device CLI is behind the same gate — console and out-of-band or serial access, recovery and break-glass accounts, and any automation or monitoring service account that logs into the device all bypass a jumphost by default and re-open the full path unless they are enumerated and brought under it. And the tier does not fix the escalation itself: an identity that legitimately passes the gate still reaches root through the flaw. This is a blast-radius and attribution measure that runs alongside the vendor update, never a substitute for it.",
+        "evidence": "The packet's vector places the attacker at an authenticated local session on the application CLI of a Cisco SD-WAN device, escalating to arbitrary commands as root. cisa_kev true with kev_date 2026-02-25, active_exploitation confirmed, poc_available true, rwep_score 77. NIS2-Art21-network-security (Security of network and information systems) is cited as an insufficient framework control on this entry. patch_available is true, live_patch_available is false. Note the packet is internally inconsistent on the privilege precondition: the attack_vector summary line instead describes the flaw as reachable by an unauthenticated attacker, contradicting the vector field this description relies on.",
+        "gap_closes": [
+          "NIS2-Art21-network-security"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "The clock for this entry opens at the 2026-02-25 KEV listing, and for an SD-WAN estate it has to be measured per device against the software actually running, not against the change record. The packet records no live-patch tool for this entry and notes the vendor patch typically requires a service restart or system reboot, so a device with the fixed image staged but not reloaded still runs the vulnerable CLI command handling and is counted as exposed. Because these devices are updated fleet-wide in waves, the SLA has to be evidenced by the count of devices confirmed running the fixed version rather than by the update being approved or pushed, which is the measurement that lets a partially-completed rollout be reported as within SLA. Where a site's reload window cannot be taken inside the clock, that device is recorded as an open exposure with the restriction of who can open a CLI session on it as the named interim measure — not as patched.",
+        "evidence": "cisa_kev true with kev_date 2026-02-25, active_exploitation confirmed, poc_available true, rwep_score 77 against cvss 7.5. patch_available is true and live_patch_available is false; live_patch_notes states that no live-patch tool is registered for this entry at bulk-import time and that the vendor patch typically requires service restart or system reboot per the KEV requiredAction. The cited AU-Essential-8-Patch, ISO-27001-2022-A.8.8 and NIST-800-53-SI-2 gaps are the risk-based-timeframe patching controls carrying no KEV-triggered clock.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      }
+    ]
   },
   "CVE-2026-20127": {
     "name": "Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability",
@@ -14556,7 +14829,20 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "For this entry the clock runs from the 2026-02-17 KEV listing, and completion has to be measured on the endpoint rather than in the management console: the packet records no live-patch path and a vendor patch that typically requires a service restart or system reboot per the KEV requiredAction, so a workstation that has taken the update but not restarted still hosts the vulnerable Microsoft Video ActiveX control (msvidctl) and remains exposed to a crafted web page rendered in Internet Explorer. Two things this SLA must not be allowed to substitute for on this path, and both are why the corresponding gaps are recorded against the entry: the flaw yields the same rights as the logged-on user, so running users as non-administrators narrows the blast radius but does not stop the drive-by execution; and a user-application-hardening attestation covering macro, plugin and advertisement settings does not enumerate the browser-invocable ActiveX control the bug lives in. Until the restart completes on a given host, the only remaining levers are keeping that host away from untrusted web content and recording it as exposed — neither privilege posture nor the hardening baseline closes the path, so an SLA measured on 'update approved' or 'update downloaded' records the exposure instead of removing it.",
+        "evidence": "Packet records CWE-94 in the Microsoft Video ActiveX control (msvidctl), CVSS 9.8, RWEP 77, cisa_kev true with kev_date 2026-02-17, active_exploitation confirmed, poc_available true, patch_available true, live_patch_available false, and live_patch_notes 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.' Vector: an attacker constructs a specially crafted Web page; when a user views it the vulnerability could allow remote code execution, giving the attacker the same user rights as the logged-on user; the attack_vector field places this in Internet Explorer for drive-by remote code execution. Citing gaps include NIST-800-53-AC-6 (Least Privilege) and AU-Essential-8-App-Hardening (User application hardening).",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      }
+    ]
   },
   "CVE-2026-2441": {
     "name": "Google Chromium CSS Use-After-Free Vulnerability",
@@ -15186,7 +15472,30 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "For this entry the KEV clock opens 2026-02-10 and the unit of completion is a restarted host, not an approved update. The packet records a vendor patch with no live-patch tool registered and a fix that typically requires a service restart or system reboot per the KEV requiredAction, so a Windows host that has installed the update but has not taken the restart is still running the pre-patch Remote Access Connection Manager image and has to be counted as exposed rather than as remediated. Scope the rollout to every host carrying the component rather than to a subset chosen from an assumed reachability model: the packet's vector describes an unauthorized attacker denying service locally, while the packet's own summary line describes the flaw conservatively as network-reachable pending Microsoft's component detail — the two framings do not agree, and narrowing the rollout to whichever one is cheaper is how a KEV-listed defect with confirmed exploitation survives the SLA on paper. The distinguishing test: query the fleet for hosts whose installed build carries the fix AND whose RasMan service has restarted since installation; a management-console report of 'update deployed' does not answer that question.",
+        "evidence": "Packet: cisa_kev true with kev_date 2026-02-10, active_exploitation confirmed, poc_available true, rwep_score 77 against cvss 8.8. patch_available true, live_patch_available false, live_patch_notes 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.' Vector: 'Microsoft Windows Remote Access Connection Manager contains a NULL pointer dereference that could allow an unauthorized attacker to deny service locally' (CWE-476). The packet's attack_vector line instead reads 'a NULL pointer dereference (CWE-476) in a network-reachable Windows component ... described conservatively as a network-reachable memory-safety flaw pending Microsoft's component detail.'",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-038",
+        "name": "MITIGATION-ACTIVE-PATCH-PENDING-VERDICT-CLASS",
+        "description": "The state this entry forces a framework to name is 'update installed, restart deferred'. Because the packet gives no live-patch tool and a fix that typically needs a service restart or system reboot, a host in that state has not eliminated the defect — it holds a time-bound compensating position, and the audit record has to surface it as one instead of as 'patched per SLA'. The deferral pressure here is structural rather than incidental: the impact the packet describes is denial of service, and the remediation itself costs a RasMan restart or a reboot, so the operators most motivated to defer are running exactly the workloads whose interruption the cited availability gap is about. Two preconditions bound the compensating state and both belong in the record. It is valid only while a dated restart is scheduled — an open-ended deferral is exposure, not mitigation. And the packet says 'service restart or system reboot' without settling which applies to a given build, so the operator has to establish that for their estate and count only hosts where the action actually completed; a host credited on the assumption that a service restart sufficed, when the build needed a reboot, is recorded as remediated while still vulnerable. Where neither has happened and no date exists, the entry is full exposure and should be scored as such.",
+        "evidence": "Packet: patch_available true, live_patch_available false, live_patch_notes 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.' Vector: Remote Access Connection Manager NULL pointer dereference (CWE-476) allowing an unauthorized attacker to deny service locally; active_exploitation confirmed, kev_date 2026-02-10, rwep_score 77. The entry's citing gaps include NIS2 Art. 21 'Availability and resilience risk-management measures' and ISO/IEC 27001:2022 A.8.8 'Management of technical vulnerabilities'.",
+        "gap_closes": [
+          "NIS2-Art21-availability",
+          "ISO-27001-2022-A.8.8"
+        ]
+      }
+    ]
   },
   "CVE-2026-21510": {
     "name": "Microsoft Windows Shell Protection Mechanism Failure Vulnerability",
@@ -15876,7 +16185,41 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "Web Help Desk is an always-on IT-operations server, so the KEV clock for this CVE runs against a small number of high-value hosts rather than a fleet — which makes the four-hour target achievable and makes missing it hard to justify. For this entry the action is to apply the vendor update to each Web Help Desk instance and restart the service: the packet records no live-patch path and a vendor patch that typically requires a service restart or system reboot per the KEV required action, so the service interruption is part of remediation rather than the reason to hold the fix for the next maintenance window. What makes the standard cadence indefensible here is the combination the packet records: the deserialization path reaches command execution on the host machine and can be exploited without authentication, and exploitation is confirmed rather than theoretical as of the 2026-02-03 listing — meaning the window between listing and restart is a window in which instances are being reached, not merely a window in which they could be. The distinguishing test: measure the elapsed time between the 2026-02-03 KEV listing and the completed restart of each Web Help Desk instance. A change-management process that routes an actively exploited unauthenticated RCE on an IT-management server through a standard weekly or monthly window has documented the exposure rather than removed it, even though every instance eventually reports the fixed build.",
+        "evidence": "Packet: SolarWinds Web Help Desk deserialization of untrusted data (CWE-502) that could lead to remote code execution allowing an attacker to run commands on the host machine, exploitable without authentication. CISA KEV-listed 2026-02-03 with active_exploitation confirmed; CVSS 9.8, RWEP 77, poc_available true. patch_available true, live_patch_available false, and live_patch_notes records that no live-patch tool is registered and that the vendor patch typically requires a service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "A help-desk server is where an IT organization's operational secrets accumulate: the service accounts wired into directory and asset-discovery integrations, the database and mail-integration credentials, and the ticket bodies in which staff paste passwords and access instructions. The packet's path hands an unauthenticated attacker command execution on that host, and exploitation is confirmed, so an instance that was reachable before the update landed has to be handled as an incident rather than as a patch record: preserve the application and configuration state for review, rebuild the server rather than updating it in place, and rotate every credential the instance held or could reach — the directory and integration service accounts first, since those are what convert a single-host compromise into access across the estate. Applying the update to a running instance closes the deserialization path but removes nothing already placed through it: a web shell in the application's served tree, a scheduled task, an added administrative account, or a modified application file all survive the upgrade and none of them are visible to a version check. The distinguishing test: after remediation, reconcile the instance's file tree, service accounts and administrative user list against a known-good baseline; if the only evidence of closure is that the version now reports fixed, the compromise question has not been asked.",
+        "evidence": "Packet: CWE-502 deserialization of untrusted data leading to remote code execution allowing an attacker to run commands on the host machine, exploitable without authentication; CISA KEV-listed 2026-02-03 with active_exploitation confirmed; poc_available true; RWEP 77 against CVSS 9.8; patch_available true with live_patch_available false.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-125",
+        "name": "SERVICE-INTERNAL-PROTOCOL-DESERIALIZATION-HARDENING",
+        "description": "For Web Help Desk this control means treating the service's own request listener as a trust boundary instead of an internal convenience: the defect is untrusted deserialization reaching command execution for a peer that never authenticates, and the deployment assumption that normally protects it — \"the help desk is an internal ticketing system\" — is not a control, it is a statement about where the box sits. The requirement for this product is that the Web Help Desk listener accepts connections only from the segments that legitimately raise and service tickets (staff networks, the management/jump network), enforced by network ACL or host firewall rather than inherited from network topology, and that no instance is published to the internet for remote-staff convenience without an authenticating gateway in front of it, since an unauthenticated request body is all the packet's path requires to reach the deserializer. Content arriving on that listener must not be permitted to construct arbitrary objects, rather than being trusted because of where it appears to come from. The distinguishing test: from a general user or guest VLAN, and from an external address, attempt to reach the Web Help Desk service port on a staging deployment and confirm the connection is refused before the application processes the request body — an instance that passes a patch-level audit while answering unauthenticated requests from any segment is exposed again the moment the next deserialization defect in this product lands.",
+        "evidence": "Packet: CWE-502 deserialization of untrusted data in SolarWinds Web Help Desk, exploitable without authentication, leading to remote code execution on the host machine; active_exploitation confirmed with CISA KEV listing 2026-02-03; CVSS 9.8, RWEP 77, poc_available true; patch_available true, live_patch_available false with a vendor patch that typically requires a service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "NIS2-Art21-vulnerability-management",
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2026-1281": {
     "name": "Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability (variant: CVE-2026-1281)",
@@ -16421,7 +16764,38 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-119",
+        "name": "ARCHIVE-CONTENT-TYPE-PROVENANCE",
+        "description": "CWE-807 on this entry is Office deciding whether content is trusted from input the attacker supplies, so the durable operator-side control is to move the origin determination off the document and onto a boundary the organization operates: the mail gateway, the managed file share and the web download path apply and preserve the untrusted-origin marking themselves, and that marking survives archives, disk-image containers and renames, so the Office host is told the file is externally sourced instead of deriving it from metadata travelling with the file. This matters more than usual here because the packet does not name which Office security feature the bypass defeats — no in-product setting can be assumed to be the intact one, which is exactly why the control that is worth attaching is the one whose input is established outside the vulnerable decision. The precondition has to be written down rather than assumed: boundary-applied marking only covers files that cross a boundary you run. A document arriving on removable media, through a personal cloud-sync client, or on any unmanaged path never passes a marking point and reaches Office unmarked, so those ingress paths must be blocked or brought under the same marking; where that is not done, this control does not cover them and the vulnerable decision is still reached with attacker-supplied input. The distinguishing test: send an externally-sourced document through each ingress path in turn and confirm it arrives at the Office host already marked untrusted, rather than confirming that a hardening policy shows as enabled in the management console.",
+        "evidence": "Packet vector: 'Microsoft Office contains a security feature bypass vulnerability in which reliance on untrusted inputs in a security decision in Microsoft Office could allow an unauthorized attacker to bypass a security feature locally' (CWE-807). cisa_kev true, kev_date 2026-01-26, active_exploitation confirmed, poc_available true, rwep_score 77 against cvss 8.8. The packet does not name the specific Office security feature that is bypassed. Citing gaps on this entry include ASD Essential Eight 'User application hardening' and UK NCSC CAF B4 'System security'.",
+        "gap_closes": [
+          "AU-Essential-8-App-Hardening",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-041",
+        "name": "PROTECTION-MECHANISM-FAILURE-CLASS-REGRESSION",
+        "description": "This entry is the case that makes a configured-and-enabled attestation worthless: the packet's flaw is the bypass of an Office security feature, so the setting is on and the check returns the wrong answer. Treat Office document handling as a protection-mechanism class and hold a regression battery of the known bypass primitives for that class, re-run on every Office patch deployment rather than once against this CVE, with the fixed build validated by detonating the battery on a representative managed image instead of by reading a version number off an inventory. The packet's own note that some impacted products may be end-of-life or end-of-service makes the recurring form of the test the load-bearing half: those installs will not receive the next fix, so the battery is the only mechanism that tells an operator whether the posture built around them still blocks. State the limit plainly instead of recording the battery as coverage — it exercises only the primitives already known to it and says nothing about the next bypass in the class, so it establishes that this fix landed and that the surrounding controls still hold, not that Office is immune to the class.",
+        "evidence": "Packet vector: Microsoft Office security feature bypass (CWE-807) that 'could allow an unauthorized attacker to bypass a security feature locally', carrying the note 'Some of the impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS).' active_exploitation confirmed, poc_available true, kev_date 2026-01-26, rwep_score 77. Citing gap on this entry: ISO/IEC 27001:2022 A.8.8 'Management of technical vulnerabilities'.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "The KEV clock on this entry opens 2026-01-26 with exploitation confirmed and a PoC available, and the packet splits the estate into two populations that need different completion criteria. For supported Office builds the mitigation is the vendor update driven across the fleet with the restart the packet says the fix typically requires, since no live-patch tool is registered — an install that has not restarted is not a closed item. For the installs the packet flags as end-of-life or end-of-service, no update is coming, and the packet's stated action is to discontinue use or transition to a supported version; for that population the 'verified mitigation' leg of this control is a dated transition or removal plan, and there is no patch task to track. Naming that split is the point of attaching this control here: a patch-compliance report that files the EoL/EoS installs under 'no update available' drops them out of the SLA permanently, and on an entry with confirmed in-the-wild exploitation that is exactly the population an attacker keeps.",
+        "evidence": "Packet: cisa_kev true, kev_date 2026-01-26, active_exploitation confirmed, poc_available true, rwep_score 77 against cvss 8.8. patch_available true, live_patch_available false, live_patch_notes 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.' Vector: 'Some of the impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.'",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      }
+    ]
   },
   "CVE-2024-37079": {
     "name": "Broadcom VMware vCenter Server Out-of-bounds Write Vulnerability",
@@ -16564,7 +16938,29 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "The KEV clock on this entry opens 2026-01-22 against a mail server, and the scoping unit that matters is the endpoint, not the host count: every ZCS instance whose /h/rest endpoint answers remote callers is in the exploited population, which is why the ordinary multi-week application-patch cadence that mail platforms are usually audited under is the gap this entry demonstrates. The packet records a vendor patch, no live-patch tool, and a fix that typically requires a service restart or system reboot, so completion is per-instance and is only real once ZCS services come back on the fixed build — an update staged on a mailbox node that has not been restarted is still serving the vulnerable dispatch path. The SLA record for this entry should also capture the exposure window it closes, per instance, from the 2026-01-22 KEV listing to the completed restart, because that window is the input to the compromise-assessment decision the rebuild runbook depends on; an SLA that records only a completion date destroys the information needed to decide whether patching was sufficient.",
+        "evidence": "Packet: cisa_kev true, kev_date 2026-01-22, active_exploitation confirmed, poc_available true, rwep_score 77 against cvss 8.8. patch_available true, live_patch_available false, live_patch_notes 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.' Vector: crafted requests to the /h/rest endpoint 'influence internal request dispatching, allowing inclusion of arbitrary files from the WebRoot directory' (CWE-98). attack_vector: 'a PHP remote file inclusion flaw (CWE-98) on ZCS, enabling remote code execution on the mail server.'",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "Zimbra ZCS sits on the internet mail boundary and the packet puts remote code execution on that server, so this entry belongs to the class this runbook exists for: the update repairs the request-dispatch defect but removes nothing that was placed on, or read from, the server through it beforehand, and patch-in-place closes the ticket over whatever is already resident. The default for an affected instance is therefore capture configuration and forensic evidence, rebuild from a known-good image onto the fixed build, and rotate the credentials and tokens the server held, rather than update-and-close. Two preconditions have to be stated or the runbook is mis-scoped. First, the trigger is exposure during the window between the 2026-01-22 KEV listing and the completed update, not the CVE in the abstract: where per-request logs covering that window exist and show no exploitation against the /h/rest path, patch-and-verify is the proportionate response — but where those logs were never collected, absence of alerts is not evidence of absence, and the instance belongs in the rebuild path rather than being cleared by default. Second, the packet does not state whether the /h/rest request path requires authentication, so exposure cannot be narrowed to unauthenticated reachability; an instance reachable only by authenticated users stays in scope until vendor detail settles that, and 'the endpoint is behind login' is not a basis for skipping the assessment.",
+        "evidence": "Packet: active_exploitation confirmed, cisa_kev true with kev_date 2026-01-22, poc_available true, rwep_score 77. Vector: 'remote attackers to craft requests to the /h/rest endpoint to influence internal request dispatching, allowing inclusion of arbitrary files from the WebRoot directory'. attack_vector: 'a PHP remote file inclusion flaw (CWE-98) on ZCS, enabling remote code execution on the mail server.' patch_available true, live_patch_available false. The packet does not state whether the /h/rest request path requires authentication. Citing gap on this entry: UK NCSC CAF B4 'System security'.",
+        "gap_closes": [
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2025-34026": {
     "name": "Versa Concerto Improper Authentication Vulnerability",
@@ -17381,7 +17777,31 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-132",
+        "name": "INDEPENDENT-INTEGRITY-VERIFICATION-OF-SIGNED-VENDOR-INSTALLERS",
+        "description": "This is the sharpest form of the control's premise: the packet does not describe a coding defect that a vendor build fixes, it describes ASUS Live Update clients that were themselves distributed with unauthorized modifications introduced through a supply chain compromise, executing on the endpoint in the trusted context of the vendor update utility. Every downstream check that resolves to 'it arrived through ASUS Live Update' therefore fails open, and so does an update-hygiene posture whose whole content is keeping the utility current. On managed ASUS hardware the in-app updater must stop being the trust decision: pull Live Update builds through managed software distribution, verify each build against an integrity reference obtained independently of the download itself — vendor-published per-release integrity values fetched over a separate channel, or a behavioural baseline of the installed binaries — and only then push it to endpoints. The packet's targeting detail makes one shortcut unusable: because only devices meeting specific conditions perform the unintended actions, a build that behaves benignly on a test bench is not evidence of a clean build, so verification has to be against a per-release integrity reference rather than against observed behaviour on one machine. The distinguishing test: take the build the endpoint's own updater would install and confirm it can be matched to an integrity value obtained over a channel other than that updater — a build whose only validation is that the updater fetched it is precisely the case this CVE describes.",
+        "evidence": "CWE-506 embedded malicious code. The packet states ASUS Live Update clients 'were distributed with unauthorized modifications introduced through a supply chain compromise' and that 'the modified builds could cause devices meeting specific targeting conditions to perform unintended actions'; the attack vector places execution on the ASUS endpoint in the trusted context of the vendor update utility. CISA KEV-listed 2025-12-17, active_exploitation confirmed, poc_available true, CVSS 8.8, RWEP 77.",
+        "gap_closes": [
+          "AU-Essential-8-App-Hardening",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "The KEV clock here does not buy a code fix, it buys removal of a tampered build. The packet records the defect as embedded malicious code introduced through a supply chain compromise rather than a flaw in the software's logic, so remediating an affected endpoint means getting the modified ASUS Live Update client off it and a known-good build — or nothing — in its place, and the packet's live-patch note puts that behind a service restart or system reboot per the KEV required action rather than anything applied in place. Scope the clock to the ASUS endpoint population rather than to a server: the packet places execution on the endpoint in the trusted context of the update utility, so the first task inside the SLA is enumerating which endpoints carry the affected Live Update client at all, and an estate that cannot answer that question has not started the clock regardless of what its patch dashboard reports. The packet also records the product statement that the impacted build could be end-of-life or end-of-service, with users directed to discontinue product utilization — so for any endpoint where no clean build applies, removing the utility is the action this SLA covers, recorded as a documented compensating control rather than as a deferral.",
+        "evidence": "CISA KEV-listed 2025-12-17 with active_exploitation confirmed and poc_available true. patch_available true; live_patch_available false, with the packet stating no live-patch tool was registered for this entry and that the vendor patch typically requires service restart or system reboot per the KEV requiredAction. The packet's product statement records that the impacted product could be end-of-life (EoL) and/or end-of-service (EoS) and that users should discontinue product utilization.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      }
+    ]
   },
   "CVE-2025-40602": {
     "name": "SonicWall SMA1000 Missing Authorization Vulnerability",
@@ -17940,7 +18360,30 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "WinRAR is a user-installed desktop archiver, not an operating-system component — which is exactly why the cited 'Patch operating systems' control does not reach this defect, and why an OS-patch-compliance dashboard can read 100% green whether or not a single WinRAR copy was updated. For this CVE the control means the KEV clock that opened 2025-12-09 is driven by a software-inventory sweep that locates every WinRAR installation across the estate — including copies users installed themselves, outside any managed-software channel — and drives each one to the vendor's fixed release. The packet records a vendor patch with no live-patch path registered, so the update itself is the remediation: there is no mitigating rule, signature or configuration toggle recorded here that can stand in for it while the sweep runs. The distinguishing test is whether the estate can answer, on demand, how many WinRAR installations currently sit below the fixed release; an organisation that can report OS patch percentages but cannot enumerate its archiver installations has no clock running on this KEV entry at all.",
+        "evidence": "Packet: CISA KEV-listed 2025-12-09, active_exploitation 'confirmed', poc_available true, CVSS 7.5, RWEP 77. Product per packet name: 'RARLAB WinRAR Path Traversal Vulnerability'. patch_available true; live_patch_available false, with live_patch_notes stating no live-patch tool is registered for this entry at bulk-import time. The citing framework gap AU-Essential-8-Patch is recorded with control text 'Patch operating systems'.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-120",
+        "name": "DOWNLOAD-PROVENANCE-ENFORCEMENT",
+        "description": "Exploitation requires a victim to receive a crafted archive and extract it, so until every WinRAR installation reaches the fixed release the delivery path is the only surface an operator can enforce against. This CVE is specifically the container case the control exists for: per the packet the crafted archive writes files outside the intended directory — for example into a Startup/autorun location — so the file that eventually executes is one the extractor created, never one the user selected or opened. The requirement for this product is that the untrusted-origin marking applied at the mail gateway and the file-share boundary survives extraction and attaches to what WinRAR writes, so a binary that lands in an autorun location out of an externally-sourced archive is still handled as externally-sourced when it runs at the user's privilege. The distinguishing test: deliver an externally-sourced archive through each ingress path, extract it, and confirm the extracted contents — not merely the archive that arrived — still carry the untrusted-origin marking. An estate that marks the received container and lets everything unpacked from it emerge unmarked has enforced provenance on the one file the traversal does not use.",
+        "evidence": "Packet: attack_vector records 'a path-traversal flaw (CWE-22) in WinRAR's archive extraction, letting a crafted archive write files outside the intended directory (e.g. into a Startup/autorun location) for code execution when the victim extracts it.' Vector: 'RARLAB WinRAR contains a path traversal vulnerability allowing an attacker to execute code in the context of the current user.' poc_available true, active_exploitation 'confirmed', CISA KEV-listed 2025-12-09; patch_available true with live_patch_available false.",
+        "gap_closes": [
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2025-62221": {
     "name": "Microsoft Windows Use After Free Vulnerability",
@@ -17995,7 +18438,31 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-145",
+        "name": "ACTIVELY-EXPLOITED-OS-LPE-REMEDIATION-WINDOW-ENFORCEMENT",
+        "description": "The packet's vector says an *authorized* attacker elevates privileges locally through a use-after-free in the Windows Cloud Files Mini Filter Driver — a kernel-mode component, so the defect executes below every account-level boundary the endpoint estate is audited on. For this CVE the control means the Windows update carrying the fix is driven across the whole affected endpoint fleet on the KEV clock that opened 2025-12-09, not folded into the next monthly rollup cycle, and that completion is measured by each host's installed build against the fixed build for its SKU rather than by 'update approved' or 'update downloaded' in the management console. The packet records a vendor patch with no live-patch path and a fix that requires a service restart or system reboot, so a host that has taken the update but not restarted still carries the vulnerable driver in memory and must be counted as exposed, not as remediated. The control's second half is the load-bearing half on this path: because the attacker is already an authorized local user, tightening account privilege does not contain the escalation to SYSTEM — a least-privilege attestation passes cleanly while the flaw remains fully exploitable, which is exactly why the cited AC-6 gap is recorded against this entry.",
+        "evidence": "Packet: CISA KEV-listed 2025-12-09, active_exploitation 'confirmed', poc_available true, CVSS 8.8, RWEP 77. Vector: 'Microsoft Windows Cloud Files Mini Filter Driver contains a use after free vulnerability that can allow an authorized attacker to elevate privileges locally.' attack_vector: 'a use-after-free (CWE-416) in a Windows kernel-mode component, exploited by a local foothold to escalate privileges to SYSTEM.' patch_available true; live_patch_available false, with live_patch_notes stating no live-patch tool is registered for this entry and that the vendor patch typically requires service restart or system reboot per the KEV requiredAction. Citing gaps include NIST-800-53-AC-6 (Least Privilege).",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management",
+          "NIST-800-53-SI-2",
+          "NIST-800-53-AC-6"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-003",
+        "name": "KERNEL-EXPLOITATION-DETECTION",
+        "description": "No live-patch path is registered for this entry and the vendor fix only takes effect after a restart, so each endpoint runs the vulnerable kernel-mode filter driver until it reboots — and with a public PoC plus confirmed in-the-wild exploitation, that window is contested rather than theoretical. For this CVE the control means the endpoint estate must carry telemetry keyed to the *outcome* of the kernel-mode use-after-free rather than to the driver's version: a process running in an ordinary user context acquiring a SYSTEM token, SYSTEM-privileged children spawned out of an interactive user session, and abnormal activity against the kernel-mode filter-driver surface — with alerting measured in seconds, not surfaced at the next log review. The packet notes that LPEs of this class are routinely paired with an initial-access flaw by ransomware operators, so this rule has to stand on its own: it is the detection that has to fire when the initial-access step was already missed, and the escalation to SYSTEM is the last observable step before the operator holds the host.",
+        "evidence": "Packet: poc_available true with active_exploitation 'confirmed'; attack_vector records 'a use-after-free (CWE-416) in a Windows kernel-mode component, exploited by a local foothold to escalate privileges to SYSTEM' and that 'LPEs of this class are routinely paired with an initial-access flaw by ransomware operators.' live_patch_available false, live_patch_notes stating no live-patch tool is registered and the vendor patch typically requires service restart or system reboot per the KEV requiredAction. CISA KEV-listed 2025-12-09.",
+        "gap_closes": [
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2022-37055": {
     "name": "D-Link Routers Buffer Overflow Vulnerability",
@@ -19573,7 +20040,30 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "An Adobe Commerce or Magento Open Source storefront is on the public internet as a condition of doing its job, and the packet's path through the Commerce REST API requires no authentication, so there is no interior network step between a published exploit and the store — the exposure window is exactly the interval between the 2025-10-24 KEV listing and the fix being live. That makes this a KEV-clock item rather than a release-train item, which matters for this product class specifically: storefront deployments are commonly scheduled around retail change-freeze windows, and a freeze is precisely the period when the store is busiest, most reluctant to deploy, and most valuable to an attacker holding an unauthenticated session-takeover primitive. The packet records a vendor patch with no live-patch path and a service restart or reboot requirement, so remediation is applying the vendor fix and taking that restart inside the KEV window, with the freeze treated as something the KEV listing overrides rather than something that defers it. Distinguishing test: read the applied patch level from the running store and confirm the restart completed, rather than accepting the deployment ticket or the change-management record as evidence — a store whose pipeline shows the patch merged but not released is unremediated in the only place that counts.",
+        "evidence": "Packet: CWE-20 improper input validation in Adobe Commerce and Magento Open Source, in the Commerce REST API (the 'SessionReaper' flaw), allowing an unauthenticated attacker to take over customer/admin sessions and reach code execution; the vector text records account takeover through the Commerce REST API. cisa_kev true with kev_date 2025-10-24; active_exploitation confirmed; poc_available true; cvss 9.8; rwep_score 77. patch_available true; live_patch_available false, with live_patch_notes recording no registered live-patch tool and that the vendor patch typically requires service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "The storefront occupies the position this control governs even though it is an application tier rather than an appliance: an unauthenticated, internet-reachable path — the Commerce REST API — that ends in code execution, under exploitation confirmed in the wild as of the 2025-10-24 KEV listing. Applied to a store, the requirement is that remediation is not 'apply the patch and close the ticket'. Any store that was reachable and unpatched during the exploitation window has to be handled as possibly holding attacker-written code and attacker-held sessions, because the packet's primitive is session takeover: the fix closes the path that produced those sessions and does nothing to sessions already issued through it. That makes forced invalidation of every session predating the fix, plus rotation of administrator credentials and integration/API keys, part of remediation rather than a follow-up, and it makes the integrity question a comparison of deployed storefront code against the release artifact rather than an inference from the absence of an alert. Distinguishing test: on a patched store, confirm a session token minted before the fix is now refused, and diff the deployed code tree against the build artifact — a store that reports the vendor patch applied while pre-fix sessions still authenticate has closed the entry path and left the access it produced in place.",
+        "evidence": "Packet: the flaw lets an unauthenticated attacker take over customer/admin sessions and reach code execution through the Commerce REST API; cisa_kev true with kev_date 2025-10-24 and active_exploitation confirmed, so the exploitation window predates any operator's remediation. poc_available true; cvss 9.8; rwep_score 77. The packet's citing framework gaps include UK-CAF-B2 (Identity and access control). patch_available true; live_patch_available false, with the vendor patch requiring service restart or reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "UK-CAF-B2"
+        ]
+      }
+    ]
   },
   "CVE-2025-59287": {
     "name": "Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data Vulnerability",
@@ -19633,7 +20123,39 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "WSUS is the host the rest of the estate takes its updates from, so this entry inverts the usual remediation ordering: the clock that opened with the 2025-10-24 KEV listing has to be run on the update server itself ahead of the endpoints it serves, because an unauthenticated deserialization path to remote code execution on WSUS sits upstream of every patch decision those endpoints make. The packet records no live-patch path and a vendor patch that typically requires a service restart or system reboot per the KEV requiredAction, so completion is measured by the WSUS host's state after that restart — a server that has installed the update and not restarted is still running the vulnerable service and must be counted as exposed, not as remediated. Because active exploitation is confirmed and a public PoC exists, an instance that stayed reachable through the window before that restart needs triage rather than a 'patched per SLA' verdict.",
+        "evidence": "Packet records CWE-502 deserialization of untrusted data in Windows Server Update Service (WSUS), reachable by an unauthenticated attacker for remote code execution; CVSS 9.8, RWEP 77, cisa_kev true with kev_date 2025-10-24, active_exploitation confirmed, poc_available true, patch_available true, live_patch_available false, and live_patch_notes 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.'",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "ISO-27001-2022-A.8.8",
+          "AU-Essential-8-Patch"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-125",
+        "name": "SERVICE-INTERNAL-PROTOCOL-DESERIALIZATION-HARDENING",
+        "description": "The WSUS listener accepts content from a peer that never authenticates and hands it to a deserializer — the packet puts remote code execution ahead of any authentication decision — so that listener has to be treated as a trust boundary rather than as an internal convenience. For this deployment the requirement is that the WSUS service endpoints accept connections only from the managed clients and administrative hosts that legitimately speak to them, enforced by host firewall or network ACL rather than inherited from the assumption that WSUS sits on a trusted network, and that content arriving there is constrained to what the update protocol legitimately conveys instead of being permitted to construct arbitrary objects. The precondition has to be stated rather than implied: WSUS must remain reachable by every endpoint it services, so this narrows the caller set and cannot close the path for anything inside it — a compromised managed client, or any host that can place itself in that set, still reaches the deserializer. It bounds exposure during the remediation window and is not a substitute for taking the server through the update and its restart. This is also why the cited least-privilege gap is recorded here: the attacker never authenticates, so no account-privilege scoping is consulted on this path and an access-control attestation passes cleanly while it stays open.",
+        "evidence": "Packet records CWE-502, vector 'Microsoft Windows Server Update Service (WSUS) contains a deserialization of untrusted data vulnerability that allows for remote code execution', and an attack_vector stating the flaw is 'reachable by an unauthenticated attacker for remote code execution'. CVSS 9.8, RWEP 77, active_exploitation confirmed, poc_available true. Citing gaps include NIST-800-53-AC-6 (Least Privilege) and UK-CAF-B4 (System security).",
+        "gap_closes": [
+          "NIST-800-53-AC-6",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-078",
+        "name": "ENDPOINT-MGMT-DEPLOYMENT-CHANNEL-INTEGRITY",
+        "description": "Code execution on WSUS lands inside the software-distribution channel every managed endpoint already trusts, so the WSUS installation and the content it serves have to be governed as a privileged distribution channel rather than as application data: file-integrity-monitor the installation and the directories it serves artifacts from, alert on writes that do not correspond to a sanctioned administrator action or a vendor synchronization, and hold the server to KEV-priority patching as a management-plane asset in its own right rather than as one more Windows server in the general fleet. This is the half of the response that still has value after the vendor update lands, because the fix closes the deserialization sink but removes nothing an attacker wrote through it — and with exploitation confirmed from the 2025-10-24 listing, an instance that was reachable before remediation needs forensic triage rather than patch-and-close. The precondition: integrity monitoring detects, it does not prevent, and it is only meaningful where the baseline predates the exposure window. Where no pre-exposure baseline exists, the content the server distributes has to be re-established from vendor-sourced material instead of being trusted from the server's present state.",
+        "evidence": "Packet records active_exploitation confirmed with cisa_kev true and kev_date 2025-10-24, poc_available true, and an unauthenticated deserialization path (CWE-502) to remote code execution on the WSUS server. patch_available is true with live_patch_available false, so the deserialization sink is closed only once the vendor update and its restart are taken. NIS2-Art21-supply-chain (Supply chain security measures) is recorded as a citing gap for this entry.",
+        "gap_closes": [
+          "NIS2-Art21-supply-chain"
+        ]
+      }
+    ]
   },
   "CVE-2025-61932": {
     "name": "Motex LANSCOPE Endpoint Manager Improper Verification of Source of a Communication Channel Vulnerability",
@@ -19890,7 +20412,30 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "Kentico Xperience instances are public-facing content-delivery surfaces, and this defect hands an unauthenticated caller control of administrative objects — so the exposure window for a KEV-listed bypass is measured from the 2025-10-20 listing to the moment the last instance has actually restarted on the fixed build, not to the moment the update was staged. The packet's live-patch note makes that second half load-bearing: there is no live-patch path, and the vendor fix typically requires a service restart or system reboot per the KEV requiredAction, so an SLA that stops at package deployment leaves the bypass reachable on a running site. The estate side of this is the enumeration: every Kentico instance, including sites that are not on the primary application's patch cadence, has to be on the same clock, because a single unrestarted internet-reachable instance is a full administrative-object compromise and the CMS is where the organization's public content and its administrative credential material meet. The distinguishing test: after the due date, list instances by running build and restart timestamp — a patch-compliance dashboard reporting the fixed version as available or downloaded, rather than running, records the exposure instead of ending it.",
+        "evidence": "CISA KEV-listed 2025-10-20 with active_exploitation confirmed and poc_available true; CVSS 9.1, RWEP 77. The vector states the authentication bypass could allow an attacker to control administrative objects, and the attack_vector characterises it as CWE-288 authentication bypass using an alternate path or channel reaching administrative functionality without credentials. patch_available is true but live_patch_available is false, and live_patch_notes record that the vendor patch typically requires a service restart or system reboot per the KEV requiredAction. The citing gaps AU-Essential-8-Patch, ISO-27001-2022-A.8.8, NIS2-Art21-patch-management and NIST-800-53-SI-2 are all patch-cadence controls; none of them defines a listing-triggered clock of its own.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "The packet says this bypass lets an attacker control administrative objects, and that it has been exploited in the wild with a public PoC — which means on an instance that was internet-reachable before the fix landed, the update removes the alternate-path bypass but leaves behind whatever administrative objects were created or altered through it. Those objects are indistinguishable from legitimate ones after the fact, because they were created through the CMS's own administrative interfaces rather than by writing to disk. A Kentico instance exposed during the window therefore needs an administrative-object and account audit against a known-good baseline, rotation of administrative credentials and of any API or connection secrets the CMS holds, and invalidation of existing administrative sessions — treated as an incident with the update as one step in it, not as a patch-and-close. The distinguishing test: on an already-updated instance, diff the administrative object and account inventory against the pre-exposure baseline; 'the fixed build is running' is not evidence that the administrative state is the one the operator intended.",
+        "evidence": "The packet's vector states the flaw could allow an attacker to control administrative objects, and the attack_vector records an unauthenticated attacker reaching administrative functionality. active_exploitation is confirmed, CISA KEV-listed 2025-10-20, poc_available true, CVSS 9.1, RWEP 77. patch_available is true with live_patch_available false and live_patch_notes recording a service restart or system reboot requirement, so the remediation on offer is an in-place vendor update that carries the instance's existing administrative state forward. UK-CAF-B2 (identity and access control) is cited as a gap: an attestation that administrator accounts are governed and periodically reviewed does not surface principals or administrative objects introduced through an authentication bypass rather than through the account-provisioning path it governs.",
+        "gap_closes": [
+          "UK-CAF-B2"
+        ]
+      }
+    ]
   },
   "CVE-2025-33073": {
     "name": "Microsoft Windows SMB Client Improper Access Control Vulnerability",
@@ -20018,7 +20563,30 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "Oracle E-Business Suite is the class of system whose changes normally queue behind an ERP change window and a regression cycle, and this control's demand is that a KEV listing with confirmed exploitation preempts that queue for the affected component. For this deployment 'verified mitigation' has a specific end state the packet defines: the fix applied to the Configurator component and the service restarted, because live_patch_available is false and the packet's live-patch note records that the vendor patch typically requires a service restart or system reboot per the KEV required action -- an EBS instance that has taken the patch into its staging environment, or applied it without the restart, has not mitigated. Where the change window genuinely cannot be pulled forward, this control's third option is the one that must be exercised explicitly rather than assumed: a written, time-bound compensating control -- the Configurator Runtime endpoints removed from untrusted-network reachability until the restart happens -- recorded as an active compensating state with an owner and an expiry, not as an informal decision to wait for the next window. Distinguishing test: for each EBS instance, produce the timestamp at which the fixed Configurator component was actually running post-restart and compare it against the 2025-10-20 KEV listing date; an instance whose only evidence is a change ticket scheduled into a future quarterly window has not met the SLA no matter how cleanly it passes a patch-management audit.",
+        "evidence": "Packet facts only: CISA KEV-listed 2025-10-20 with active_exploitation 'confirmed' and poc_available true. CWE-918 server-side request forgery in the Runtime component of Oracle Configurator, which the vector records as remotely exploitable without authentication. RWEP 83 against CVSS 7.5 -- real-world exploit priority far above the base score, driven by the KEV listing and confirmed exploitation rather than by base severity. patch_available true, live_patch_available false, with the live-patch note stating that no live-patch tool is registered for this entry and that the vendor patch typically requires service restart or system reboot per the KEV required action. The citing gaps are AU Essential Eight patch operating systems, ISO/IEC 27001:2022 A.8.8, NIST SP 800-53 SI-2 and NIS2 Art. 21 vulnerability handling -- every one of them cadence-based, none tied to a KEV clock.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-handling"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-129",
+        "name": "ENTERPRISE-ERP-MANAGEMENT-FUNCTION-AUTHENTICATION",
+        "description": "The precondition the packet records is that the Runtime component of Oracle Configurator can be reached and driven over the network with no credential at all, so the control has to bind at the function and at reachability rather than at the EBS sign-on page. For this deployment that means two things. The Configurator Runtime paths must require an authenticated, authorized caller before the component acts on the request -- an unauthenticated caller must be refused before the server-side fetch the SSRF depends on is ever issued. And the EBS surface must be segmented so that an untrusted network caller cannot reach those paths at all: an internet-facing EBS front end should publish only the modules it has a business reason to publish, with Configurator Runtime off that list unless external self-service configuration is a deliberate requirement. On this entry the segmentation half is also the only lever that exists between the KEV listing and the restart the vendor patch needs, since the packet records no live-patch path. Least-privilege posture on EBS accounts is beside the point on this path and should not be offered as a compensating control: the attacker never holds an account. Distinguishing test: from an untrusted network segment against a staging instance, request each Configurator Runtime path unauthenticated and confirm the request is refused before the component processes it -- an attestation that 'all E-Business Suite users authenticate' passes cleanly while this path remains open.",
+        "evidence": "Packet facts only: the vector states the SSRF exists 'in the Runtime component of Oracle Configurator' and that the vulnerability 'is remotely exploitable without authentication'; attack_vector describes an unauthenticated attacker coercing server-side requests to internal resources. CWE-918. CISA KEV-listed 2025-10-20, active_exploitation 'confirmed', poc_available true, RWEP 83, CVSS 7.5. patch_available true with live_patch_available false and a note recording that the vendor patch typically requires service restart or system reboot, so reachability control is the only interim lever. UK NCSC CAF B4 system security is cited as an insufficient control on this entry.",
+        "gap_closes": [
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2025-54253": {
     "name": "Adobe Experience Manager Forms Code Execution Vulnerability",
@@ -20410,7 +20978,32 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "This flaw lets an unauthenticated attacker read arbitrary local files on the Grafana host, including its own configuration and secrets, so time on the vulnerable build is continuing disclosure rather than only continuing risk — which is what distinguishes it from the ordinary patch-cadence item the cited controls treat it as. Run the clock from the 2025-10-09 KEV listing rather than the next maintenance window, and define 'mitigated' for this product as the Grafana service restarted onto the fixed build: the packet records a vendor patch with no live-patch path and a restart-or-reboot requirement, so an instance whose package was replaced but whose process was never restarted has not met the SLA no matter what the change record says. Where the restart genuinely cannot be taken inside the window, the documented compensating control this SLA permits is removing untrusted reachability to the instance for the duration — and that substitution carries two conditions that must be stated rather than assumed. It holds only where the instance's exposure is actually controllable at the network boundary, which is not true of a Grafana deployment published for external users; and it does nothing about files already read, so any credential, datasource secret or key material readable through this flaw during the exposure window must be treated as disclosed and rotated, since patching closes the read path but does not revoke what the path already returned.",
+        "evidence": "Packet records a path-traversal flaw (CWE-22) letting an unauthenticated attacker read arbitrary files including configuration and secrets; product described as Grafana with a path traversal vulnerability allowing access to local files. CISA KEV-listed 2025-10-09 with active_exploitation 'confirmed'; poc_available true; RWEP 77, CVSS 7.5. patch_available true, live_patch_available false, and the live-patch note states the vendor patch typically requires service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-vulnerability-management",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-018",
+        "name": "SCANNER-PAPER-COMPLIANCE-TEST",
+        "description": "The paper-compliance failure for this CVE is specific and mechanical: the packet records a fix with no live-patch path that requires a service restart, so a scanner reading the installed Grafana package version reports the instance remediated while the process still listening continues to serve the vulnerable traversal handler from the code it loaded at start. The distinguishing test is to exercise the flaw against the running instance rather than compare version strings — issue a traversal request that attempts to reach a local file outside the served root and confirm the listening process refuses it — and to cross-check that the process start time is later than the update. This matters more than usual on Grafana because the asset being read is the instance's own configuration and secrets: a version-only inventory cannot separate an instance that restarted from one that did not, so the vulnerability-management attestation passes for hosts that are still disclosing credentials to any unauthenticated caller.",
+        "evidence": "Packet records patch_available true, live_patch_available false, and a live-patch note stating the vendor patch typically requires service restart or system reboot per the KEV requiredAction; the flaw is a CWE-22 path traversal permitting an unauthenticated attacker to read arbitrary local files including configuration and secrets. CISA KEV-listed 2025-10-09, active_exploitation 'confirmed', poc_available true, RWEP 77, CVSS 7.5.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2025-27915": {
     "name": "Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability (variant: CVE-2025-27915)",
@@ -20470,7 +21063,29 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "For a ZCS estate the KEV clock has to be started by the KEV listing itself rather than by severity, because this entry is the case where severity actively argues against acting: CVSS 6.1 falls below the critical-only trigger most mail-platform patch policies fire on, while the packet's RWEP of 77 reflects what is actually true of it — confirmed in-the-wild exploitation and a public PoC. The surface on the clock is the Classic Web Client, not the mail transport that vulnerability programs usually track for a mail server, since the packet's execution path is a user opening a message whose ICS entry carries the ontoggle payload. The packet records a vendor patch with no live-patch path and notes that the vendor patch typically requires a service restart or reboot per the KEV required action, so remediation means taking that restart on the KEV clock instead of holding it for the next mail-system maintenance window. Distinguishing test: confirm the running Classic Web Client is serving the fixed build rather than reading a package-level 'patched' status off the mail host — and treat closing the SLA ticket as separate from closing the incident, because applying the fix stops new ICS payloads from executing and does nothing to a redirect filter the packet's payload already created.",
+        "evidence": "Packet: CWE-79 in the Synacor Zimbra Collaboration Suite (ZCS) Classic Web Client caused by insufficient sanitization of HTML content in ICS files; when a user views an e-mail message containing a malicious ICS entry, embedded JavaScript executes via an ontoggle event inside a tag, running arbitrary JavaScript within the victim's session and enabling unauthorized actions such as setting e-mail filters that redirect messages to an attacker-controlled address, leading to e-mail redirection and data exfiltration. cisa_kev true with kev_date 2025-10-07; active_exploitation confirmed; poc_available true; cvss 6.1; rwep_score 77. patch_available true; live_patch_available false, with live_patch_notes recording no registered live-patch tool and that the vendor patch typically requires service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-040",
+        "name": "OWA-PER-REQUEST-SIEM-INGESTION",
+        "description": "Zimbra's Classic Web Client presents this control's exact telemetry problem, and the packet's own impact description is why: the script runs inside a session the victim already authenticated, so the attacker never authenticates and every authentication event a ZCS deployment forwards stays clean through the whole exploitation path. The only trace is the request stream the victim's own browser produces after the ICS entry renders, including the mailbox-configuration call that installs the filter redirecting mail to the attacker's address. Forward ZCS per-request web-client access logs and mailbox filter/forwarding-configuration changes to a SIEM held outside the mail server, retained far enough back to cover the period before the 2025-10-07 KEV listing, and alert on filter or forwarding-address changes not originating from an interactive settings session. This is the half of the response that still has value after the patch lands: the fix closes the ICS execution path but leaves any filter already created quietly forwarding mail, and nothing in an authentication or MTA delivery log will surface it. Distinguishing test: create a filter through the web client on a staging ZCS and confirm the SIEM records the change with actor and timestamp — a deployment whose mail-server logging consists of authentication events and MTA delivery records passes a security-monitoring attestation while the entire exploitation and persistence path is invisible to it.",
+        "evidence": "Packet: the ICS-borne JavaScript runs within the victim's session and allows unauthorized actions on the victim's account, specifically named as setting e-mail filters to redirect messages to an attacker-controlled address, producing e-mail redirection and data exfiltration. active_exploitation confirmed; cisa_kev true with kev_date 2025-10-07; poc_available true; rwep_score 77. The packet's citing framework gaps include UK-CAF-C1 (Security monitoring) and NIS2-Art21-incident-handling. patch_available true; live_patch_available false, with the vendor patch requiring service restart or reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "UK-CAF-C1",
+          "NIS2-Art21-incident-handling"
+        ]
+      }
+    ]
   },
   "CVE-2021-22555": {
     "name": "Linux Kernel Heap Out-of-Bounds Write Vulnerability",
@@ -20525,7 +21140,39 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-130",
+        "name": "CONTAINER-HOST-NAMESPACE-ESCAPE-HARDENING",
+        "description": "The packet states the precondition rather than leaving it implicit: the flaw is reached through user namespaces, by a local user with user-namespace access, and the outcome is root. On a container host that is the escape case exactly — a confined workload able to create a user namespace drives a heap out-of-bounds write in the kernel's netfilter x_tables code and lands as host root, so the namespace boundary the deployment is designed around is not a boundary at all and the kernel is the only thing left. For this CVE the control means unprivileged user-namespace creation is disabled on every host whose workloads do not genuinely require it, and each container is confined with an AppArmor or SELinux profile plus a seccomp profile with CAP_SYS_ADMIN dropped — because those measures remove the exploit precondition on hosts that cannot yet absorb the reboot the vendor kernel update needs. The distinguishing test: from inside a representative unprivileged container on a staging host, attempt to create a user namespace and reach the x_tables path, and confirm it is refused before the write occurs. A fleet that passes image-scanning and RBAC audits while permitting unprivileged user-namespace creation is still handing every confined workload this primitive.",
+        "evidence": "Packet: vector states the flaw 'could allow an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space'; attack_vector records 'a heap out-of-bounds write (CWE-787) in the Linux kernel netfilter x_tables, exploited by a local user (with user-namespace access) to gain root.' CISA KEV-listed 2025-10-06, active_exploitation 'confirmed', poc_available true, CVSS 8.8, RWEP 77. patch_available true; live_patch_available false, with live_patch_notes stating no live-patch tool is registered and the vendor patch typically requires service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-002",
+        "name": "LIVE-PATCH-CAPABILITY",
+        "description": "The packet pairs an available vendor kernel fix with no registered live-patch path and a remediation that requires a service restart or system reboot — which, on a Linux fleet carrying production workloads, converts an actively-exploited local-root flaw into a scheduling negotiation measured in maintenance windows rather than in the hours the KEV listing implies. For this CVE the control means live kernel patching (kpatch, livepatch, kGraft or equivalent) must already be a deployed and quarterly-tested capability on every host that cannot absorb an unplanned reboot, provisioned ahead of the next kernel KEV listing rather than stood up in response to one: a capability that did not exist on 2025-10-06 could not shorten this exposure by a single day. To be explicit about what is actionable here — the remediation for this entry remains the vendor kernel update taken with the reboot, since the packet records no live-patch tool for it; the control's value is that the next kernel out-of-bounds write does not have to queue behind the same negotiation. The distinguishing test: pick a production host and confirm a live-patch agent is installed and has successfully applied a kernel patch within the last quarter. A fleet whose compliance report is green because kernel updates are staged-but-not-rebooted is still running the vulnerable kernel in memory.",
+        "evidence": "Packet: patch_available true, live_patch_available false, live_patch_notes 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.' CISA KEV-listed 2025-10-06 with active_exploitation 'confirmed' and poc_available true; CVSS 8.8, RWEP 77. Affected product per packet name: 'Linux Kernel Heap Out-of-Bounds Write Vulnerability'.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "NIS2-Art21-patch-management",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-003",
+        "name": "KERNEL-EXPLOITATION-DETECTION",
+        "description": "With a public PoC, confirmed in-the-wild exploitation, no registered live-patch path, and a fix that only takes effect on reboot, every host still waiting in the maintenance queue is running the vulnerable netfilter x_tables code with a working exploit in circulation. For this CVE the control means auditd or eBPF rules written against the exploitation sequence the packet describes rather than against the kernel package version: unprivileged user-namespace creation by a process that then issues netfilter/x_tables socket-option calls, and any transition to uid 0 by a process that did not start privileged — alerting within 60 seconds, because a local-root primitive is used and moved on from in far less time than a daily log review. The packet records that LPEs of this class are routinely paired with an initial-access primitive, so the rule has to stand alone rather than assume an earlier alert: this is the detection that has to fire when the initial-access step went unseen. It is also the control that distinguishes a fleet that knows its unrebooted hosts are exposed from one that reports them as patched because the package version is current.",
+        "evidence": "Packet: poc_available true with active_exploitation 'confirmed'; attack_vector records 'a heap out-of-bounds write (CWE-787) in the Linux kernel netfilter x_tables, exploited by a local user (with user-namespace access) to gain root' and that 'LPEs of this class are routinely paired with an initial-access primitive.' Vector notes the path is 'through user name space'. live_patch_available false, with live_patch_notes stating no live-patch tool is registered and the vendor patch typically requires service restart or system reboot per the KEV requiredAction. CISA KEV-listed 2025-10-06.",
+        "gap_closes": [
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2010-3962": {
     "name": "Microsoft Internet Explorer Uninitialized Memory Corruption Vulnerability",
@@ -21095,7 +21742,33 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-121",
+        "name": "MOBILE-ZERO-CLICK-HARDENING",
+        "description": "The packet places this out-of-bounds write inside Samsung's image-parsing library libimagecodec.quram.so and describes zero-click code execution from a malicious image forming the initial-access half of a mobile-spyware chain, so no user decision and no application-privilege boundary stands between delivery and the vulnerable parser — the reboot-gated firmware update is the only real fix and it is not fast enough on its own for the population this class targets. For the plausibly targeted cohort — executives, journalists, legal and security staff — place devices in a reduced-attack-surface posture that stops untrusted images, message attachments and link previews from being fetched and rendered automatically, narrowing the delivery path into the CWE-787 write during the window between the 2025-10-02 KEV listing and completed fleet restart. This is also the only substitute available for the least-privilege control cited against this entry, which never engages on this path: the write happens inside the platform codec before any account or app privilege decision is consulted, so scoping privilege leaves the flaw fully reachable and constraining what content reaches the codec is the remaining lever. Three preconditions must be stated rather than assumed. The posture only helps if it was already standing for that cohort before the disclosure, since it does nothing if switched on after the image arrived. It narrows the messaging delivery path but does not remove the parser surface — any application that fetches and renders an image still reaches the same codec — so it is a narrowing measure, not elimination. And it does not evict an attacker already resident: a cohort device that was reachable during the exposure window needs forensic triage and credential revocation, not a settings change.",
+        "evidence": "Packet records an out-of-bounds write (CWE-787) in libimagecodec.quram.so on Samsung mobile devices, allowing remote attackers to execute arbitrary code, exploitable by a malicious image for zero-click code execution on the device, and characterizes the class as the initial-access half of a mobile-spyware chain. CISA KEV-listed 2025-10-02 with active_exploitation 'confirmed'; poc_available true; RWEP 77, CVSS 9.8. patch_available true, live_patch_available false, and the live-patch note states the vendor patch typically requires service restart or system reboot per the KEV requiredAction. NIST-800-53-AC-6 (Least Privilege) is recorded among the framework controls citing this entry.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management",
+          "NIST-800-53-AC-6",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-126",
+        "name": "MOBILE-OS-MINIMUM-PATCH-LEVEL-ENFORCEMENT",
+        "description": "Treat the Samsung firmware build that carries this codec fix as a condition of access to organizational data rather than a figure on a patch-compliance report: a handset below it is denied or quarantined from mail, VPN and documents. The packet gives no live-patch path and a fix requiring a restart or reboot, which makes the restart the completion criterion — a handset that has downloaded the firmware but not restarted still loads the vulnerable libimagecodec.quram.so and must be counted exposed rather than remediated. One half of this control's usual shape does not carry on this path and should not be recorded as though it does: because the trigger is a zero-click malicious image rather than a malicious installed application, restricting side-loaded or untrusted app installs does not reduce reachability here, so the levers are the build and the content path only. Preconditions: the gate is meaningful only where Samsung has published a build carrying the fix for that exact model and the device is enrolled in management; until such a build exists the correct state is quarantine, and any unenrolled or BYOD population is outside the control entirely and has to be denied access to organizational data rather than assumed compliant. Distinguishing test: enrol a handset pinned below the fixed build and confirm access to protected resources is actually refused — an estate that surfaces the stale build on a dashboard while the device keeps its mail and VPN has recorded the exposure, not removed it.",
+        "evidence": "Packet records an out-of-bounds write (CWE-787) in libimagecodec.quram.so on Samsung mobile devices allowing remote attackers to execute arbitrary code, exploitable by a malicious image for zero-click code execution. CISA KEV-listed 2025-10-02, active_exploitation 'confirmed', poc_available true, RWEP 77, CVSS 9.8. patch_available true, live_patch_available false, and the live-patch note states the vendor patch typically requires service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management",
+          "NIST-800-53-SI-2"
+        ]
+      }
+    ]
   },
   "CVE-2025-4008": {
     "name": "Smartbedded Meteobridge Command Injection Vulnerability",
@@ -21155,7 +21828,31 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "A Meteobridge is a small weather-station data-logger appliance that no endpoint-management console enrols and no software-inventory agent reports, so the KEV clock this control imposes lands on a device class that typically has no owner inside the patch program at all — the first work the SLA forces is enumerating where these units are before any of them can be counted as remediated. Meeting it means each unit is taken through the vendor update and the restart the packet's live_patch_notes describe, with no live-patch path available to avoid that interruption. The SLA is unusually load-bearing on this product because the flaw needs no credential and yields root: there is no partial state where an unpatched unit is merely degraded, and there is no account lockout, session expiry or credential rotation that buys time while the update is scheduled — an enumerated-but-unpatched Meteobridge past the clock is fully exposed to a publicly available exploit.",
+        "evidence": "Packet records cisa_kev true with kev_date 2025-10-02 and active_exploitation confirmed, RWEP 77 / CVSS 9.8, poc_available true. patch_available is true, live_patch_available is false, and live_patch_notes read: 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.' AU-Essential-8-Patch, ISO-27001-2022-A.8.8 and NIST-800-53-SI-2 are recorded among the citing gaps.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-134",
+        "name": "DEVICE-MANAGEMENT-GATEWAY-CONFIG-ENDPOINT-AUTH-INPUT-NEUTRALIZATION",
+        "description": "The packet's CWE pair is the entire defect: CWE-306 means the Meteobridge's network-facing configuration surface performs a critical function without ever demanding a credential, and CWE-77 means what arrives at that surface reaches an OS command sink — which is why the packet's own wording is that a remote unauthenticated attacker gains arbitrary command execution with elevated privileges (root) on affected devices. Bound to this appliance, the control requires each of those configuration endpoints to authenticate its caller before processing, to neutralize what it passes to the command interpreter rather than filtering the request string, and to be unreachable from untrusted networks — the last clause is the practical one, because a weather station's data-publishing role is precisely what puts its interface on a reachable address, and reachability is the only remaining exploit precondition once a public exploit exists. The least-privilege gap cited for this CVE is not on this path: the attacker holds no account to constrain, and the injected command already executes as root, so account-privilege scoping is never consulted. Because exploitation is confirmed rather than theoretical, a unit whose configuration surface was reachable before the firmware update needs forensic triage rather than a patch-and-close, since the update closes the injection path but removes nothing an attacker already ran as root. Distinguishing test: from an untrusted segment, send each configuration endpoint on a staging Meteobridge a payload that attempts command execution and confirm it is refused before any interpreter runs.",
+        "evidence": "Packet vector: 'Smartbedded Meteobridge contains a command injection vulnerability that could allow remote unauthenticated attackers to gain arbitrary command execution with elevated privileges (root) on affected devices.' cwe_refs are CWE-306 and CWE-77; attack_vector describes an OS command-injection flaw on the Smartbedded Meteobridge weather-station device letting an unauthenticated attacker execute commands on the device, CISA KEV-listed 2025-10-02 with confirmed in-the-wild exploitation, poc_available true. NIST-800-53-AC-6 (Least Privilege), UK-CAF-B4 (System security) and NIS2-Art21-network-security are recorded among the citing gaps.",
+        "gap_closes": [
+          "NIST-800-53-AC-6",
+          "UK-CAF-B4",
+          "NIS2-Art21-network-security"
+        ]
+      }
+    ]
   },
   "CVE-2025-32463": {
     "name": "Sudo Inclusion of Functionality from Untrusted Control Sphere Vulnerability",
@@ -21518,7 +22215,29 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "Adminer is a database-administration front end and the packet's path needs no credential at all: an unauthenticated caller coerces the instance into issuing requests to internal resources, so the exposed asset is the whole set of destinations the hosting web server can reach from where it sits, including the database hosts the tool exists to talk to. The KEV listing here dates from 2025-09-29 for a defect published years earlier, so the work item never arrives through new-CVE inflow — it arrives only if the vulnerability-management program re-scans the deployed estate against the KEV catalogue on a schedule. Applied to this product the SLA needs an explicit completion definition, because the packet records patch_available true, live_patch_available false, and a fix that typically requires a service restart or reboot per the KEV requiredAction: remediation is the replaced Adminer build plus the restart of the process serving it, not an entry in a package inventory. The enumeration step is what a generic patch SLA misses on this product class — every deployed copy has to be located, including copies dropped under a web root by hand and copies baked into an application or container image, because a copy no package manager owns is a copy no patch cycle will ever update, and one forgotten instance is sufficient to keep the primitive live.",
+        "evidence": "Packet vector: 'Adminer contains a server-side request forgery vulnerability that, when exploited, allows a remote attacker to obtain potentially sensitive information.' attack_vector: a server-side request forgery flaw (CWE-918) 'letting an unauthenticated attacker coerce the server into making requests to internal resources'. CVSS 7.5, RWEP 77, poc_available true, CISA KEV-listed 2025-09-29 with active_exploitation confirmed. patch_available true, live_patch_available false, live_patch_notes: 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.'",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-038",
+        "name": "MITIGATION-ACTIVE-PATCH-PENDING-VERDICT-CLASS",
+        "description": "The lever operators actually reach for first on this flaw is not the build — it is reachability and egress, because the packet's primitive is the server issuing requests on the attacker's behalf, so restricting who can reach the instance or what the web host may connect outbound to blunts the impact immediately. That response puts the entry in this control's state (b): a compensating control is active while the vulnerable code is still deployed, and it must be recorded as that distinct state with a dated action item to take the vendor build and the service restart the packet says it needs, not rolled into a patched-per-SLA count. The precondition is the whole point and has to be written down next to the mitigation: a network or egress restriction bounds the SSRF only for as long as the specific route it blocks stays blocked, so a new internal service, a security-group or routing change, a move of the host into a segment with broader reach, or simply a valuable destination inside the still-permitted set reopens the identical primitive with no change to the application and no alert. It also does nothing for an attacker who can still reach the instance and probe whatever remains permitted, and nothing about information already retrieved before the restriction went in — so an instance that was reachable while the PoC the packet records was public warrants a review of what it could have reached during that window, not only a forward-looking block. Where the restriction cannot be verified route by route, the entry stays in state (c) and should be reported as full exposure.",
+        "evidence": "Packet: CWE-918 server-side request forgery in Adminer; attack_vector states an unauthenticated attacker coerces the server into making requests to internal resources, and the vector states the result is disclosure of potentially sensitive information. poc_available true, CISA KEV-listed 2025-09-29, active_exploitation confirmed, RWEP 77, CVSS 7.5. patch_available true with live_patch_available false, and live_patch_notes recording that the vendor patch typically requires a service restart or system reboot per the KEV requiredAction — so the interval between mitigation and remediation is real and has to be tracked.",
+        "gap_closes": [
+          "UK-CAF-B4",
+          "NIS2-Art21-network-security"
+        ]
+      }
+    ]
   },
   "CVE-2025-20362": {
     "name": "Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization Vulnerability",
@@ -21638,7 +22357,40 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-030",
+        "name": "PERIMETER-DEVICE-ZERODAY-SLA-TIER",
+        "description": "The vulnerable component is the VPN web server on Cisco Secure Firewall ASA and FTD — the device that terminates remote access and is itself the trust boundary — and the packet gives a CWE-120 buffer overflow reachable without authentication for remote code execution at CVSS 9.8. A standard 14- or 30-day appliance patch SLA measures the wrong thing on this class: from the KEV listing there is a public PoC and confirmed in-the-wild exploitation against the box whose whole job is deciding who gets inside, so the exposure is not proportional to the number of days remaining in the window. The requirement for this deployment is a distinct tier — the vendor fix deployed within hours of the KEV listing, taking the service restart or reboot the packet's requiredAction calls for, or the VPN web server's listener removed from untrusted networks until that reboot completes. The distinguishing test: enumerate every ASA and FTD unit with the VPN web server enabled and confirm each is on the fixed build past the KEV due date; a fleet report showing those units scheduled into the next quarterly maintenance window has recorded the exposure rather than removed it, and the restart requirement is exactly why they get scheduled there.",
+        "evidence": "Packet: CWE-120 buffer overflow in the Cisco Secure Firewall ASA and Secure Firewall Threat Defense (FTD) VPN Web Server, allowing unauthenticated remote code execution; cvss 9.8, rwep_score 77, poc_available true. CISA KEV-listed 2025-09-25 with active_exploitation confirmed. patch_available true, live_patch_available false; live_patch_notes: 'No live-patch tool registered for this entry at bulk-import time. Vendor patch typically requires service restart or system reboot per the KEV requiredAction.'",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "Because this is pre-authentication code execution on the ASA/FTD appliance itself and the packet records confirmed in-the-wild exploitation alongside a public PoC, the vendor update remediates the defect but not the device: anything an attacker wrote to a unit during the exposure window survives the upgrade. Any appliance whose VPN web server was reachable before the fix landed has to be treated as compromised until shown otherwise — configuration and image captured for forensics first, the device rebuilt from a known-good image, and every credential it held or terminated rotated, including local administrative accounts, VPN user credentials and active session material, and the key material on the tunnels it fronted. The packet also states this flaw can be chained with CVE-2025-20362, so the triage question is not whether the overflow ran in isolation but what the chained access reached afterwards and which interior credentials passed through the box during the window. Distinguishing test: an IR runbook that answers a KEV-listed pre-auth RCE on a VPN concentrator with patch-and-monitor fails this control — the default has to be rebuild plus rotation, decided before the next disclosure rather than during it.",
+        "evidence": "Packet: unauthenticated remote code execution on the ASA/FTD VPN Web Server via a CWE-120 buffer overflow; the vector notes 'This vulnerability could be chained with CVE-2025-20362.' active_exploitation confirmed, CISA KEV-listed 2025-09-25, poc_available true, rwep_score 77. patch_available true with no live-patch path recorded.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-031",
+        "name": "FIREWALL-EGRESS-TELEMETRY-SEPARATE-TRUST-ZONE",
+        "description": "Code execution on the ASA/FTD unit puts the attacker inside the same system that produces the device's own record, so syslog, VPN authentication events and threat logs held on the compromised appliance are attacker-controlled evidence from the moment the overflow lands. This deployment therefore has to be forwarding those streams continuously to a collector in a separate trust zone — different management plane, different credentials, different authentication path from the firewall administrators' — so that the record of pre-exploitation probing of the VPN web server, and of what the chain with CVE-2025-20362 reached afterwards, exists somewhere the appliance cannot reach or erase. With exploitation already confirmed at KEV listing and a restart-requiring vendor update, the interval between exposure and completed reboot is precisely when the off-device copy is the only surviving source. Distinguishing test: on a staging unit, clear the local log store and confirm the separate-zone collector still holds that period's VPN authentication and connection events.",
+        "evidence": "Packet: the flaw yields remote code execution on the Cisco ASA/FTD appliance's VPN Web Server itself; active_exploitation confirmed, CISA KEV-listed 2025-09-25, poc_available true. Remediation requires the vendor patch with a service restart or system reboot per the KEV requiredAction (live_patch_available false), and the vector notes the flaw can be chained with CVE-2025-20362.",
+        "gap_closes": [
+          "NIS2-Art21-network-security"
+        ]
+      }
+    ]
   },
   "CVE-2025-5086": {
     "name": "Dassault Systèmes DELMIA Apriso Deserialization of Untrusted Data Vulnerability",
@@ -23507,7 +24259,31 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-057",
+        "name": "BROWSER-MANAGED-UPDATE-NO-DEFERRAL",
+        "description": "The packet states this ANGLE/GPU flaw affects multiple browsers that use Chromium — Chrome, Edge and Opera are named and the list is explicitly not exhaustive — so the ring that matters is the union of every Chromium-derived browser on the estate, not the single browser the organization treats as standard. Holding the security channel for a validation week here means holding a fix for a bug being exploited in the wild through a crafted web page: the delivery is a page visit, so there is no attachment to strip, no macro to block and no user action to police between the page and the GPU process. Applied here the control also has to count remediation at the right moment — the packet records no live-patch path and a fix that takes effect only after a restart, so a device that has downloaded the update but has not relaunched the browser is still running the vulnerable ANGLE and GPU-process code, and an update dashboard that counts 'version downloaded' overstates coverage. Precondition and limit: fast updating closes the entry path, it does not evict an attacker who already landed. Because exploitation is confirmed, a device that browsed while unpatched needs triage on its own merits — updating a compromised host removes the bug, not the implant. Second-string Chromium builds that no enterprise update policy governs (kiosk browsers, embedded webviews, developer channels, bundled runtimes) have to be enumerated and either brought under the same ring or removed; where such a build has no managed update channel at all, the no-deferral rule cannot be applied to it and removal is the only honest disposition.",
+        "evidence": "Packet vector, verbatim: 'Google Chromium contains an improper input validation vulnerability in ANGLE and GPU. This vulnerability could allow a remote attacker to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.' CISA KEV-listed 2025-07-22 (kev_date) with active_exploitation confirmed, poc_available true, cvss 8.8, rwep_score 77. patch_available true, live_patch_available false, and live_patch_notes records no registered live-patch tool with the vendor patch typically requiring a service restart or system reboot per the KEV requiredAction — the basis for counting remediation at relaunch rather than at download. Citing gaps include ASD Essential Eight 'User application hardening' and NIST 800-53 SI-2, both of which an estate can attest to while its update ring still defers the security channel and while non-standard Chromium builds sit outside the policy.",
+        "gap_closes": [
+          "AU-Essential-8-App-Hardening",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-018",
+        "name": "SCANNER-PAPER-COMPLIANCE-TEST",
+        "description": "For this CVE the paper-compliance failure takes two distinct shapes and a version-based scan catches neither. Coverage first: the packet says the defect affects browsers that utilize Chromium including but not limited to Chrome, Edge and Opera, so a scan scoped to the organization's standard browser reports the estate clean while Edge and Opera installs, embedded Chromium webviews and bundled runtimes still carry the vulnerable ANGLE/GPU code. State second: the packet records no live-patch path and a fix that takes effect after a restart, so the version on disk can be the fixed one while the still-running browser process — the one hosting the GPU process a crafted page reaches — is the old build. The operational test: on a sample of workstations, enumerate every Chromium-derived binary present rather than only the managed browser, and compare the version of the running process against the version installed on disk; a scanner that declares the estate remediated without answering both questions has produced a compliance artifact, not a statement about whether a crafted page can still reach the sandbox-escape path. Precondition: where the scanner cannot read running-process versions, the substitute is a forced relaunch or reboot campaign with per-device confirmation, and until that confirmation exists the estate's status is unknown rather than remediated — treating 'update deployed' as the completion signal is the exact assumption this test exists to break.",
+        "evidence": "Packet vector states the improper input validation is in ANGLE and GPU and that it 'could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera'; attack_vector describes an attacker-controlled web page escaping the browser sandbox (CWE-20). CISA KEV-listed 2025-07-22, active_exploitation confirmed, poc_available true, rwep_score 77. live_patch_available false with live_patch_notes recording that the vendor patch typically requires a service restart or system reboot per the KEV requiredAction — the basis for distinguishing the installed build from the running one. ISO 27001 A.8.8, NIST 800-53 SI-2 and UK CAF B4 are the cited gaps; each is routinely evidenced with precisely the version-based scan report this test invalidates.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2025-54309": {
     "name": " CrushFTP Unprotected Alternate Channel Vulnerability",
@@ -24196,7 +24972,29 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "The interval is what makes this a KEV-clock case: the packet carries a 2016 identifier year and a KEV listing dated 2025-07-07 with confirmed exploitation. Nine years of CVSS 9.8 sitting in the record did not get this fixed, which is the direct evidence that severity-ordered, recency-fed remediation does not reach it — a queue built from current-year advisories and this month's vendor bulletins never surfaces a 2016 library flaw at all, no matter how the severity threshold is set. The KEV listing is the event that has to override that ordering and put every PHP application sending mail through PHPMailer on the clock. The packet records a vendor patch with no live-patch path and a restart or reboot requirement, so remediation is shipping the fixed library into each affected application and taking that restart, rather than assuming that replacing files on disk is the end of it. Distinguishing test: ask the KEV-response process to produce the remediation date for a CVE whose identifier year is 2016 — a program reporting full KEV coverage while its intake is driven by current-year advisory feeds has not looked at this entry, and the gap is in what feeds the queue rather than in the SLA written above it.",
+        "evidence": "Packet: CWE-77/CWE-88 command injection in PHPMailer because it fails to sanitize user-supplied input, affecting the 'mail()' function of the 'class.phpmailer.php' script; an attacker can execute arbitrary code within the context of the application, and failed exploit attempts result in a denial-of-service condition. The packet places the flaw in PHPMailer's sender-address handling, enabling remote code execution in PHP applications that pass attacker-controlled input to the From address. cisa_kev true with kev_date 2025-07-07 against a CVE identifier year of 2016; active_exploitation confirmed; poc_available true; cvss 9.8; rwep_score 77. patch_available true; live_patch_available false, with live_patch_notes recording no registered live-patch tool and that the vendor patch typically requires service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-021",
+        "name": "TIER-3-DEPENDENCY-INVENTORY",
+        "description": "PHPMailer is almost never something an organization decides to install. It arrives inside a CMS, a plugin, a theme, a vendored composer tree, or a third-party web application, which means estate exposure here is a property of dependencies-of-dependencies rather than of anything that appears on a software inventory or in an OS package database — and an operating-system patch cycle will never touch a copy of class.phpmailer.php sitting inside an application directory. The packet's path needs exactly one such copy: any PHP application that passes attacker-controlled input into the From address supplies the flaw its input, and code then executes in that application's context, so a single unenumerated copy behind a contact form is the whole exposure. Inventory therefore has to resolve to the library level and follow transitive and vendored copies — every place the file exists on disk and in every container image — because a copy nobody has enumerated cannot be assessed as vulnerable, cannot be put in a patch queue, and cannot be confirmed as fixed afterwards. Distinguishing test: search filesystems and built images for PHPMailer copies and reconcile the result against the software inventory; every copy the search returns that the inventory does not list was never in the patch queue, and a clean patch-compliance report covering only the products the organization believes it runs is measuring the wrong set.",
+        "evidence": "Packet: the flaw is in the 'mail()' function of the 'class.phpmailer.php' script and enables remote code execution in PHP applications that pass attacker-controlled input to the From address, with code executing within the context of the application. cisa_kev true with kev_date 2025-07-07; active_exploitation confirmed; poc_available true; cvss 9.8; rwep_score 77. The packet's citing framework gaps include AU-Essential-8-Patch (Patch operating systems) and NIS2-Art21-vulnerability-management (Vulnerability handling). patch_available true; live_patch_available false.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      }
+    ]
   },
   "CVE-2014-3931": {
     "name": "Multi-Router Looking Glass (MRLG) Buffer Overflow Vulnerability",
@@ -24553,7 +25351,29 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-030",
+        "name": "PERIMETER-DEVICE-ZERODAY-SLA-TIER",
+        "description": "NetScaler ADC/Gateway carries this defect only when it is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or an AAA virtual server — which is to say, only when it is acting as the organization's remote-access trust boundary, exactly the deployment class this SLA tier exists for. Two consequences for this product: units in those roles cannot be folded into a 14- or 30-day appliance-maintenance cadence, and the clock does not stop at the staged image, because the packet records no live-patch path and a restart-or-reboot requirement — so it runs from the 2025-06-30 KEV listing through the completed restart of every unit in a Gateway or AAA role. The control's alternative, isolating the vulnerable interface, has a specific meaning here: the vulnerable parser is what answers on the Gateway or AAA virtual server itself, so interim exposure is bounded by restricting reachability of those virtual servers, not by filtering somewhere upstream of an appliance that is itself the filter. Inventorying which units hold those roles is the first action, since it is also what lets the rest of the fleet be triaged down. The distinguishing test: enumerate every NetScaler by configured role and running build against the fixed build past the due date — a severity-driven patch queue that sorts by CVSS 7.5 leaves an actively-exploited boundary device sitting behind higher-scored internal findings.",
+        "evidence": "The packet's vector states that NetScaler must be configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server for the flaw to apply, placing the vulnerable role on the remote-access trust boundary. The attack_vector describes a CWE-119 buffer overflow exploitable for memory corruption yielding both DoS and code execution. CISA KEV-listed 2025-06-30, active_exploitation confirmed, poc_available true, CVSS 7.5 against RWEP 77. patch_available is true, live_patch_available is false, and live_patch_notes record that the vendor patch typically requires a service restart or system reboot per the KEV requiredAction. The citing gaps AU-Essential-8-Patch, ISO-27001-2022-A.8.8 and NIST-800-53-SI-2 are general patch-and-flaw-remediation controls that apply one cadence to the estate and draw no distinction for a device that is itself the trust boundary.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "A NetScaler in the Gateway or AAA role that was reachable while this was being exploited cannot be treated as clean once the update lands. The packet's primitive is a buffer overflow producing unintended control flow, and its attack_vector records code execution alongside denial of service — so a successful run means attacker-controlled execution on the appliance that terminates the organization's remote-access sessions and performs its authentication. The default response for an affected unit is therefore configuration extraction, rebuild from vendor media, and rotation of the credential and key material the appliance holds or could observe — administrative credentials, certificate private keys, and any credentials that traversed the Gateway or AAA virtual server — with existing sessions invalidated rather than carried across the upgrade. The reason this is the default rather than the escalation is mechanical: the packet offers no live-patch path, so remediation is an in-place vendor update plus restart, and an in-place update preserves the appliance's configuration and filesystem, which is precisely what an implant needs to survive the fix. The distinguishing test: on an already-upgraded unit, ask what evidence exists that no code ran before the upgrade — if the answer is the build number, the unit has been patched but not cleared.",
+        "evidence": "The packet describes a CWE-119 buffer overflow leading to unintended control flow, with the attack_vector recording exploitation for memory corruption yielding DoS and code execution, on a NetScaler configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server. active_exploitation is confirmed, CISA KEV-listed 2025-06-30, poc_available true, CVSS 7.5, RWEP 77. patch_available is true with live_patch_available false and live_patch_notes recording a service restart or system reboot requirement — an in-place update that carries the appliance's existing configuration forward. UK-CAF-B4 (system security) is cited as a gap: a system-security attestation satisfied by the appliance running a supported, patched build says nothing about whether that build was applied over a unit that had already executed attacker code.",
+        "gap_closes": [
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2019-6693": {
     "name": "Fortinet FortiOS Use of Hard-Coded Credentials Vulnerability",
@@ -25169,7 +25989,30 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-040",
+        "name": "OWA-PER-REQUEST-SIEM-INGESTION",
+        "description": "Roundcube's mailbox surface has to be logged at the per-request level, shipped off the webmail host, because the theft this flaw enables never produces a failed or unusual authentication event — the same webmail per-request telemetry requirement the inventory entry states for Exchange OWA, applied to a Roundcube estate. The packet's path is a crafted email that hits a desanitization issue in message_body() in program/actions/mail/show.php, so the injected script runs when the victim opens the message, inside a session the victim authenticated normally, and the attacker's mail reads and outbound sends are issued by the victim's own browser over the victim's own session. Applied here: forward the Roundcube HTTP access log and the mailbox-side (IMAP/webmail application) request log for every mailbox operation — not just the login events — to a collector the webmail host cannot write to, retain it long enough to cover the span between the KEV listing of 2025-06-09 and the day each instance was actually restarted onto the fixed code, and review it for read/send patterns rather than authentication failures. The distinguishing test: ask the SIEM to reconstruct every message a chosen account opened and sent on a chosen day; a source that can only answer 'the user logged in at 09:14' cannot see this attack at all. Precondition and limit: this is detection, not prevention — it does not stop the script from executing, and it only yields evidence if per-request logging was already shipping before the crafted message arrived. If the deployment sits behind a reverse proxy that logs only at the proxy, mailbox-side actions over the authenticated session will not appear, and the webmail application/IMAP log must be added as its own source. Where per-request logging was absent during the exposure window, retrospective review cannot answer the question and the mailboxes have to be treated as potentially read and their stored credentials as potentially taken.",
+        "evidence": "Packet: cisa_kev true, kev_date 2025-06-09, active_exploitation confirmed, poc_available true, RWEP 77 against CVSS 6.1 — the in-the-wild status rather than the base score is what makes the pre-restart window worth reconstructing. The vector records that the flaw 'could allow a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php'; the attack_vector records script running 'in a victim's authenticated session via a crafted email (exploited in espionage credential-theft campaigns)'. patch_available true but live_patch_available false, and live_patch_notes records that no live-patch tool is registered for this entry and that the vendor patch typically requires a service restart or system reboot per the KEV requiredAction — so every deployment carried a window between listing and restart. The citing gaps NIST 800-53 SI-2 (Flaw Remediation) and NIS2 Art. 21 vulnerability handling are both remediation-side and close at 'patched', leaving session-borne theft that already happened unrecorded.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "For this entry the clock starts at the KEV listing of 2025-06-09 with a public PoC already available and exploitation confirmed, and what decides whether an operator can meet it is not the package — it is the restart. The packet records a vendor patch but no registered live-patch tool, and states the fix typically requires a service restart or system reboot, so a Roundcube instance is not remediated when the upgrade lands on disk; it is remediated when the webmail service and the PHP worker serving program/actions/mail/show.php have been recycled and a request actually executes the fixed message_body(). Applied here: schedule that recycle inside the response window rather than at the next maintenance weekend, and where a shared-hosting or multi-tenant webmail platform genuinely cannot be recycled that fast, book the delay as a dated, named exception with the compensating measure written down — not as 'patch scheduled', which reads as compliant on a report while every mailbox on the instance stays reachable through a single crafted message. Precondition: the compressed clock only covers instances the operator knows about. A KEV-triggered SLA applied over an inventory that omits departmental, hosted or legacy Roundcube instances silently exempts exactly the instances nobody restarts, so the enumeration of webmail instances is part of the control rather than a prerequisite assumed to hold.",
+        "evidence": "Packet: cisa_kev true with kev_date 2025-06-09, active_exploitation confirmed, poc_available true, rwep_score 77, cvss 6.1. patch_available true, live_patch_available false, and live_patch_notes states that no live-patch tool is registered for this entry at bulk-import time and that the vendor patch typically requires a service restart or system reboot per the KEV requiredAction — the restart, not the package upgrade, is the step that ends the exposure. The vector places the defect in message_body() in program/actions/mail/show.php, reached by a crafted email. The citing gaps NIST 800-53 SI-2, ISO 27001 A.8.8 and NIS2 Art. 21 vulnerability handling all impose an obligation to remediate but none carries a KEV-triggered deadline, which is the gap this control fills.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      }
+    ]
   },
   "CVE-2025-32433": {
     "name": "Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function Vulnerability",
@@ -26200,67 +27043,101 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
-  },
-  "CVE-2025-4427": {
-    "name": "Ivanti Endpoint Manager Mobile (EPMM) Authentication Bypass Vulnerability",
-    "lesson_date": "2026-05-29",
-    "attack_vector": {
-      "description": "an authentication bypass (CWE-288) on EPMM that, chained with the code-injection flaw, yields unauthenticated remote code execution. CISA KEV-listed 2025-05-19 with confirmed in-the-wild exploitation.",
-      "privileges_required": "none (unauthenticated network reach to the device/service)",
-      "complexity": "low — KEV-listed, actively exploited; treat as weaponized",
-      "ai_factor": "No AI involvement documented in discovery or weaponization."
-    },
-    "defense_chain": {
-      "prevention": {
-        "what_would_have_worked": "Apply the Ivanti EPMM patch from the advisory; the two flaws are chained for full preauth compromise, so restrict the management surface and review for unauthorized access.",
-        "was_this_required": true,
-        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation)",
-        "adequacy": "Patch/replace is definitive; the gap is that the affected class is internet-exposed by function and (for consumer/EoL devices) often unpatchable, so network isolation is the load-bearing control."
-      },
-      "detection": {
-        "what_would_have_worked": "Monitoring for the EPMM management surface: exploit-shaped requests, device crashes/reboots, malicious firmware, and outbound botnet/C2 traffic from the device.",
-        "was_this_required": false,
-        "framework_requiring_it": null,
-        "adequacy": "Necessary to catch exploitation of devices not yet patched/replaced; edge devices are frequently recruited into botnets."
-      },
-      "response": {
-        "what_would_have_worked": "Patch or replace the device, isolate it from untrusted networks, and rotate any credentials reachable from it; reflash firmware on indicators of a malicious-update compromise.",
-        "was_this_required": true,
-        "framework_requiring_it": "NIST 800-53 IR-4",
-        "adequacy": "Mandatory for a KEV-listed unauthenticated device flaw; firmware implants survive a reboot without a reflash."
-      }
-    },
-    "framework_coverage": {
-      "NIST-800-53-SI-2": {
-        "covered": true,
-        "adequate": false,
-        "gap": "The 30-day flaw-remediation SLA is far longer than the observed exploitation window for a KEV-listed unauthenticated network-device/service flaw; CISA KEV due dates are days."
-      },
-      "ISO-27001-2022-A.8.8": {
-        "covered": true,
-        "adequate": false,
-        "gap": "'Appropriate timescales' is undefined; the standard 30-day reading is unsafe for an unauthenticated, actively-exploited flaw on an internet-facing device — and end-of-life consumer devices have no patch at all, so the only control is replacement/isolation."
+    "ai_assist_factor": "none"
+  },
+  "CVE-2025-4427": {
+    "name": "Ivanti Endpoint Manager Mobile (EPMM) Authentication Bypass Vulnerability",
+    "lesson_date": "2026-05-29",
+    "attack_vector": {
+      "description": "an authentication bypass (CWE-288) on EPMM that, chained with the code-injection flaw, yields unauthenticated remote code execution. CISA KEV-listed 2025-05-19 with confirmed in-the-wild exploitation.",
+      "privileges_required": "none (unauthenticated network reach to the device/service)",
+      "complexity": "low — KEV-listed, actively exploited; treat as weaponized",
+      "ai_factor": "No AI involvement documented in discovery or weaponization."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Apply the Ivanti EPMM patch from the advisory; the two flaws are chained for full preauth compromise, so restrict the management surface and review for unauthorized access.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 22-01 (KEV remediation)",
+        "adequacy": "Patch/replace is definitive; the gap is that the affected class is internet-exposed by function and (for consumer/EoL devices) often unpatchable, so network isolation is the load-bearing control."
+      },
+      "detection": {
+        "what_would_have_worked": "Monitoring for the EPMM management surface: exploit-shaped requests, device crashes/reboots, malicious firmware, and outbound botnet/C2 traffic from the device.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Necessary to catch exploitation of devices not yet patched/replaced; edge devices are frequently recruited into botnets."
+      },
+      "response": {
+        "what_would_have_worked": "Patch or replace the device, isolate it from untrusted networks, and rotate any credentials reachable from it; reflash firmware on indicators of a malicious-update compromise.",
+        "was_this_required": true,
+        "framework_requiring_it": "NIST 800-53 IR-4",
+        "adequacy": "Mandatory for a KEV-listed unauthenticated device flaw; firmware implants survive a reboot without a reflash."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "The 30-day flaw-remediation SLA is far longer than the observed exploitation window for a KEV-listed unauthenticated network-device/service flaw; CISA KEV due dates are days."
+      },
+      "ISO-27001-2022-A.8.8": {
+        "covered": true,
+        "adequate": false,
+        "gap": "'Appropriate timescales' is undefined; the standard 30-day reading is unsafe for an unauthenticated, actively-exploited flaw on an internet-facing device — and end-of-life consumer devices have no patch at all, so the only control is replacement/isolation."
+      },
+      "NIS2-Art21-network-security": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Treats the class as essential-function infrastructure but lacks a compressed remediation SLA; consumer/edge devices in particular are routinely internet-exposed and unpatched."
+      },
+      "PCI-DSS-4.0-6.3.3": {
+        "covered": true,
+        "adequate": false,
+        "gap": "The 30-day critical-patch window is exploitation acceptance for an unauthenticated flaw on an internet-facing device in or adjacent to the CDE."
+      }
+    },
+    "compliance_exposure_score": {
+      "percent_audit_passing_orgs_still_exposed": 72,
+      "basis": "Internet-facing Ivanti Endpoint Manager Mobile (EPMM) is routinely run on a standard patch SLA — or, for consumer/EoL devices, not patched at all — which was active exposure for this KEV-listed, actively-exploited flaw.",
+      "theater_pattern": "patch_management"
+    },
+    "ai_discovered_zeroday": false,
+    "ai_discovery_source": "vendor_research",
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-134",
+        "name": "DEVICE-MANAGEMENT-GATEWAY-CONFIG-ENDPOINT-AUTH-INPUT-NEUTRALIZATION",
+        "description": "This is the authentication half of the EPMM chain. The packet places the flaw in EPMM's API component, where crafted API requests reach protected resources without proper credentials because of an insecure implementation of the Spring Framework open-source library, and states that chained with the code-injection flaw it yields unauthenticated remote code execution on the device-management gateway itself. Bound to this product, the control means every EPMM API endpoint authorizes its own caller before it processes the request rather than inheriting a verdict from the framework layer that fronts it, and that no EPMM instance is left with those endpoints reachable from an untrusted network. The two identity gaps cited against this entry are cited precisely because they never engage: the attacker presents no credentials at all, so per-account privilege scoping (AC-6) is never consulted, and the account and credential model a UK-CAF-B2 identity-and-access attestation examines is bypassed rather than abused — an estate where every EPMM operator authenticates with strong MFA passes that attestation cleanly while this path stays wide open. The precondition on the network half: restricting reachability bounds who can present the crafted request, but it cannot be complete for an instance that has to answer devices enrolling from outside the corporate network, which is a deployment fact the operator must establish per instance rather than one the packet supplies. Reachability limits are therefore a bound on exposure, not a substitute for endpoint-level authorization. Distinguishing test: from an unauthenticated client on a staging EPMM, request each protected API resource and confirm each is refused before the resource is served.",
+        "evidence": "The packet states that Ivanti Endpoint Manager Mobile (EPMM) contains an authentication bypass vulnerability in the API component that allows an attacker to access protected resources without proper credentials via crafted API requests, and that this results from an insecure implementation of the Spring Framework open-source library. Its attack vector records an authentication bypass (CWE-288) that, chained with the code-injection flaw, yields unauthenticated remote code execution. Entry facts: CVSS 9.8, RWEP 77, poc_available true, CISA KEV-listed 2025-05-19 with active_exploitation confirmed. UK-CAF-B2 (Identity and access control) and NIST-800-53-AC-6 (Least Privilege) are both among the framework control gaps citing this CVE.",
+        "gap_closes": [
+          "UK-CAF-B2",
+          "NIST-800-53-AC-6"
+        ]
       },
-      "NIS2-Art21-network-security": {
-        "covered": true,
-        "adequate": false,
-        "gap": "Treats the class as essential-function infrastructure but lacks a compressed remediation SLA; consumer/edge devices in particular are routinely internet-exposed and unpatched."
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "For this entry the KEV clock opens at the 2025-05-19 listing, and what makes the clock specific to EPMM is where it has to stop. The packet records no live-patch tool registered for this entry and notes that the vendor patch typically requires a service restart or system reboot per the KEV requiredAction — so an EPMM instance whose update is installed but whose service has not been restarted is still running the vulnerable API component and must be counted as exposed, not as remediated. Completion is therefore measured by restarted instances, not by patch-applied counts in a deployment console. The compensating-control branch of the SLA has to name its precondition rather than imply coverage: the only interim lever is restricting who can reach the EPMM API surface, and for any instance that must answer devices enrolling from outside the corporate network that restriction cannot be complete — it narrows the caller population but does not remove the crafted-request path, and it does not stop the clock. Nothing in the interim branch reduces the exposure to a caller already inside the permitted segment, because the flaw needs no credentials at all.",
+        "evidence": "The packet records CISA KEV listing 2025-05-19 with active_exploitation confirmed and poc_available true, CVSS 9.8 and RWEP 77 for an authentication bypass (CWE-288) in the EPMM API component that, chained with the code-injection flaw, yields unauthenticated remote code execution. patch_available is true; live_patch_available is false, and the live-patch notes state that no live-patch tool is registered for this entry at bulk-import time and that the vendor patch typically requires a service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "NIST-800-53-SI-2",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-vulnerability-management"
+        ]
       },
-      "PCI-DSS-4.0-6.3.3": {
-        "covered": true,
-        "adequate": false,
-        "gap": "The 30-day critical-patch window is exploitation acceptance for an unauthenticated flaw on an internet-facing device in or adjacent to the CDE."
+      {
+        "id": "NEW-CTRL-037",
+        "name": "FLEET-COMPROMISE-IR-PLAYBOOK",
+        "description": "EPMM is the gateway that manages an enrolled device population, so an instance that was reachable while this bypass was live is a fleet-control-plane exposure rather than a single-server one, and patch-and-close does not address it. The playbook this CVE demands covers: certificate revocation pushed to enrolled devices, device-trust-state invalidation, an audit of configuration profiles pushed during the exposure window, quarantine criteria for downstream devices, and rotation of credentials for any account that authenticated through the EPMM instance during that window. The reason it is needed here specifically is that the packet's chain ends in unauthenticated remote code execution on the management gateway — an attacker at that position acts as the fleet's own control plane, and every profile, certificate and credential it handled during the window is suspect, none of which the vendor patch reverses. Two preconditions, both stated rather than assumed. The playbook is only actionable if the exposure window can be bounded from EPMM logs that predate the suspected compromise; where it cannot be bounded, the whole enrolled population is in scope rather than out. And the packet establishes confirmed in-the-wild exploitation of this CVE, not that any particular instance was compromised — the trigger for invoking the playbook is evidence that the instance's API was reachable during the window, not the existence of the CVE.",
+        "evidence": "The packet identifies the product as Ivanti Endpoint Manager Mobile (EPMM) and places the flaw in its API component: crafted API requests reach protected resources without proper credentials (CWE-288), and chained with the code-injection flaw this yields unauthenticated remote code execution. It records CISA KEV listing 2025-05-19, active_exploitation confirmed, poc_available true, CVSS 9.8, RWEP 77. patch_available is true; live_patch_available is false, with notes that no live-patch tool is registered and the vendor patch typically requires a service restart or system reboot per the KEV requiredAction.",
+        "gap_closes": [
+          "NIS2-Art21-vulnerability-management",
+          "UK-CAF-B2"
+        ]
       }
-    },
-    "compliance_exposure_score": {
-      "percent_audit_passing_orgs_still_exposed": 72,
-      "basis": "Internet-facing Ivanti Endpoint Manager Mobile (EPMM) is routinely run on a standard patch SLA — or, for consumer/EoL devices, not patched at all — which was active exposure for this KEV-listed, actively-exploited flaw.",
-      "theater_pattern": "patch_management"
-    },
-    "ai_discovered_zeroday": false,
-    "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    ]
   },
   "CVE-2025-42999": {
     "name": "SAP NetWeaver Deserialization Vulnerability",
@@ -26550,7 +27427,20 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "The vulnerable component here is a Windows OS component driven by attacker-controlled web/script content delivered as a crafted URL, so exposure is estate-wide across every Windows endpoint that renders one — there is no single service to isolate and no interface to restrict as an interim measure, which removes the compensating-control branch this SLA normally allows. The packet records no registered live-patch tool and a vendor fix that requires a service restart or system reboot per the KEV requiredAction, and that makes the load-bearing detail the terminus of the clock rather than its length: the KEV-tied remediation window must end at reboot-completed on each endpoint, because until the restart happens the scripting engine resident in memory is still the vulnerable one. The distinguishing test: sample endpoints the patch console reports as compliant and confirm each has actually restarted since the update was staged — a fleet reporting full deployment while carrying pending-reboot endpoints past the KEV due date has recorded compliance, not removed the exposure.",
+        "evidence": "Packet records cisa_kev true with kev_date 2025-05-13, active_exploitation confirmed, poc_available true, CVSS 8.8 and RWEP 77. patch_available is true, live_patch_available is false, and live_patch_notes state that no live-patch tool is registered for this entry and that the vendor patch typically requires service restart or system reboot per the KEV requiredAction. The vector records a type confusion (CWE-843) in the Windows Scripting Engine allowing an unauthorized attacker to execute code over a network via a specially crafted URL, exploitable by attacker-controlled web/script content for code execution in the client.",
+        "gap_closes": [
+          "NIS2-Art21-patch-management",
+          "NIST-800-53-SI-2",
+          "ISO-27001-2022-A.8.8"
+        ]
+      }
+    ]
   },
   "CVE-2025-32706": {
     "name": "Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow Vulnerability",
@@ -27895,7 +28785,32 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-129",
+        "name": "ENTERPRISE-ERP-MANAGEMENT-FUNCTION-AUTHENTICATION",
+        "description": "The Visual Composer Metadata Uploader is a development/management function of the NetWeaver application server, and the packet shows it accepting an unauthenticated POST to /developmentserver/metadatauploader with no authorization check at all — so the control has to bind at the endpoint, not at the SAP logon. Every development-server and Visual Composer function on the NetWeaver stack must authorize the caller before the upload handler runs, and the /developmentserver/* surface must be segmented so an untrusted network caller cannot reach it in the first place. Role and authorization-object review over SAP user accounts is beside the point on this path: the attacker never holds an SAP account, and the uploaded JSP executes with the SAP service account's privileges rather than any user's, so the blast radius is the service identity and everything it can reach, not the rights of some compromised dialog user. The distinguishing test for this product: from an untrusted network segment, POST a file to /developmentserver/metadatauploader on a staging NetWeaver instance and confirm it is refused before anything is written into a directory the application server serves — an estate that passes SAP role-and-authorization audits while leaving that endpoint network-reachable is still exposed to the unauthenticated upload path.",
+        "evidence": "The packet's vector records an unauthenticated POST to /developmentserver/metadatauploader that uploads an executable binary / JSP webshell which the application server then serves and executes, yielding RCE as the SAP service account; the attack_vector states the endpoint lacks an authorization check. CVSS 10, RWEP 78, CISA KEV-listed 2025-04-29, active_exploitation confirmed, poc_available true. The citing gaps include DORA-Art-9 (ICT risk management framework), UK-CAF-B4 (system security) and NIS2-Art21-network-security (security of network and information systems) — protection-and-prevention controls that carry no requirement for an application server's development or upload endpoints to authenticate the caller before the function runs.",
+        "gap_closes": [
+          "DORA-Art-9",
+          "UK-CAF-B4",
+          "NIS2-Art21-network-security"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "For this SAP flaw the artifact left behind is a JSP webshell already written into a directory the NetWeaver application server serves and executes, so applying the Visual Composer fix closes the upload path and removes nothing that came through it. Any instance that was reachable at /developmentserver/metadatauploader during the mass-exploitation window has to be triaged as compromised rather than patched and closed: hunt the served and deployment directories for files that do not correspond to a sanctioned deployment, rotate the SAP service account and every credential recoverable from the host, and rebuild rather than clean where a webshell is found. The packet records hands-on-keyboard follow-on including ransomware staging behind this access and frequent chaining with the NetWeaver deserialization flaw CVE-2025-42999, which means an operator whose entire response is the vendor update may be closing the door behind an actor already inside, and may leave the second flaw's path open as well. The distinguishing test: on an instance already updated, enumerate the served directory tree against a known-good deployment manifest — a patch-compliance record showing the fix applied is not evidence that nothing was written before it landed.",
+        "evidence": "The packet's vector states the uploaded executable binary / JSP webshell is served and executed by the application server itself. Its attack_vector records mass exploitation from April 2025, webshell access leading to hands-on-keyboard follow-on including ransomware staging, and frequent chaining with CVE-2025-42999. patch_available is true and live_patch_available is false with no live-patch notes recorded, so the remediation on offer is a vendor update — an action that cannot remove a webshell already written to disk. CISA KEV-listed 2025-04-29, active_exploitation confirmed, poc_available true, CVSS 10, RWEP 78. The citing gaps ISO-27001-2022-A.8.8, NIST-800-53-SI-2, PCI-DSS-4.0-6.3.3 and AU-ISM-1546 are all patch-installation controls whose satisfied state is 'update applied'.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "PCI-DSS-4.0-6.3.3",
+          "AU-ISM-1546"
+        ]
+      }
+    ]
   },
   "CVE-2025-31161": {
     "name": "CrushFTP HTTP authorization-header authentication bypass (crushadmin takeover)",
@@ -28268,7 +29183,30 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "The KEV listing on this entry lands nearly two decades after the vendor fix the packet names, so the clock that matters here is the listing date, not patch availability, and a vulnerability-management program keyed to newly published CVE inflow never generates a work item for it at all. The population still exploitable is by definition the hosts the original update never reached, which is exactly the population a patch-management console cannot report on because it does not manage them. Applied to this flaw the SLA therefore has two non-standard requirements: enumeration must start from what actually answers Server Service RPC on the network rather than from the console's asset list, and completion must be measured as installed build plus a completed reboot, because the packet records live_patch_available false and a fix that requires a reboot, so a host that has taken the update but not restarted is still running the vulnerable service and counts as exposed rather than remediated. The distinguishing test: sweep each segment for hosts answering Server Service RPC and compare each responder's build against the fixed build; a KEV-SLA attestation driven off the management console's patch inventory reports full compliance while the unmanaged responders that carry this CVE are never in the denominator.",
+        "evidence": "Packet: CISA KEV-listed 2026-05-20, active_exploitation confirmed, CVSS 9.3, RWEP 70, poc_available true. patch_available true and live_patch_available false, with live_patch_notes recording 'Microsoft patch MS08-067 (2008); requires reboot. No live-patch primitive.' — a KEV listing dated many years after the vendor patch. The vector records a crafted RPC request to the Windows Server service triggering a buffer overflow (CWE-119) allowing unauthenticated remote code execution, described as wormable.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-128",
+        "name": "APPSERVER-REMOTING-PROTOCOL-RESTRICTION",
+        "description": "This is the remoting-protocol class exactly: a non-HTTP RPC listener that parses an attacker's request before any credential is presented, where the parser is itself the vulnerable code, so web-tier hardening and the perimeter firewall never touch the path. For this flaw the requirement is that the Windows Server service's RPC listener accept connections only from the management and file/print peers that legitimately need it, enforced per segment by host firewall rule and network ACL rather than inherited from an assumption that the host sits on an internal network — which is the assumption a wormable defect defeats, since a worm's requests originate inside the trusted segment and not at the edge. The limit has to be stated rather than left implied: this bounds which hosts can present the crafted request, it does not remove the defect from any host that must keep answering Server Service RPC to its own segment, and it does nothing once a host inside the permitted segment is already compromised or once an infected laptop, contractor machine or removable-media host is introduced behind the ACL. Where the listener cannot be restricted because the host's function depends on it, the only remaining lever is the update and the reboot it requires, since the packet records no live-patch primitive. The distinguishing test: from a general user VLAN on a staging network, send Server Service RPC traffic at a representative host and confirm it is dropped before reaching the service; an estate that blocks this protocol at the perimeter while every internal segment can reach every host still carries the propagation path intact.",
+        "evidence": "Packet vector: 'A crafted RPC request to the Windows Server service triggers a buffer overflow allowing unauthenticated remote code execution — wormable.' attack_vector names it as the MS08-067 flaw exploited by Conficker, CISA KEV-listed 2026-05-20 with active_exploitation confirmed and poc_available true. live_patch_available false; live_patch_notes state the patch requires reboot and that there is no live-patch primitive.",
+        "gap_closes": [
+          "NIS2-Art21-network-security",
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2022-23812": {
     "name": "node-ipc geo-targeted file-wiper protestware (RU/BY heart-emoji overwrite; peacenotwar dropper in 11.0.0+)",
@@ -30544,7 +31482,41 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "human_researcher",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-134",
+        "name": "DEVICE-MANAGEMENT-GATEWAY-CONFIG-ENDPOINT-AUTH-INPUT-NEUTRALIZATION",
+        "description": "UniFi OS is the management gateway for the estate it fronts, and on this path the authentication decision itself is what fails: an nginx allowlist matches the raw, percent-encoded request URI while the backend routes on a separately decoded URI, so a caller with no credential reaches an authenticated backend route. Applied to this product the control has two halves. The vendor's half is that the route-authorization decision and the routing decision must be taken from the same normalized form of the URI, so a request the gateway believes matches the auth-exempt /api/auth/validate-sso/ entry cannot resolve to a different handler — that is why the packet's remediation is the vendor update. The operator's half is reachability and the sink: the package-update path the chain reaches passes an unsanitized package name to sh -c, so the UniFi OS management surface must answer only from an operator/management segment or an authenticated VPN, never from a general user VLAN and never published to the internet through a port forward or remote-access mapping. The distinguishing test: from a general user VLAN and from an external address, request the allowlisted /api/auth/validate-sso/ path in percent-encoded form and confirm the console does not answer at all — reachability is the entire precondition for an unauthenticated bypass, and 'the console is behind our firewall' is a claim about topology, not a demonstration that the surface is unreachable from untrusted segments. Because exploitation is confirmed, a console that was reachable before the update lands needs forensic review of what is installed on it rather than a patch-and-close.",
+        "evidence": "Packet vector: the UniFi OS nginx gateway compares a raw, percent-encoded request URI against its public-routes allowlist while the backend routing decision uses a separately decoded/normalized URI, so a request whose raw form matches the allowlisted, auth-exempt /api/auth/validate-sso/ entry normalizes to an authenticated backend route — an unauthenticated, network-reachable attacker defeats the access-control gate (CWE-284, CVSS 10, RWEP 79). The packet records the chain with CVE-2026-34909 (path traversal) and CVE-2026-34910 (an unsanitized package name passed to sh -c) yielding remote code execution; cisa_kev true with kev_date 2026-06-23, active_exploitation confirmed, poc_available true. live_patch_available is false and live_patch_notes state remediation is the vendor update plus the named compensating controls until it lands.",
+        "gap_closes": [
+          "NIST-800-53-SC-7",
+          "NIS2-Art21-network-security",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-030",
+        "name": "PERIMETER-DEVICE-ZERODAY-SLA-TIER",
+        "description": "What this flaw defeats is the console's own access-control gate — the allowlist that decides which routes answer without a credential — so the device is not an application sitting behind a trust boundary, it is the boundary. The packet gives a CVSS 10 unauthenticated path with a public PoC and confirmed exploitation, and records no live-patch path for this product class, which leaves an operator exactly the two branches this control names: take the UniFi OS update, accepting the service restart that the absence of a live-patch path implies, on a clock measured from the 2026-06-23 KEV listing; or isolate the management interface from every untrusted segment until the update lands. A 14- or 30-day operating-system patch SLA applied to a console whose bypass chains to full root through passwordless sudo to /usr/bin/dpkg is a cadence, not a remediation plan. The distinguishing test: enumerate every UniFi OS console in the estate against the fixed release and confirm none remains below it past the KEV due date, with any that do carrying an explicit interface-isolation record rather than a dashboard row.",
+        "evidence": "Packet records CVSS 10 with RWEP 79, cisa_kev true with kev_date 2026-06-23, active_exploitation confirmed, poc_available true, patch_available true, live_patch_available false, and live_patch_notes stating there is no live-patch path for this product class and that remediation is the vendor update plus the named compensating controls until it lands. The vector places the failure in the gateway's own access-control gate (raw percent-encoded URI matched against the public-routes allowlist versus a separately decoded/normalized backend URI) and records escalation to full root via the service's passwordless sudo to /usr/bin/dpkg.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "The last step of this chain installs attacker-chosen content through the console's own package-update path: an unsanitized package name reaching sh -c, then passwordless sudo to /usr/bin/dpkg running a malicious package maintainer script as root. A package installed that way — and anything its maintainer script wrote — is simply part of the console's filesystem afterward, and the UniFi OS update that fixes the URI-normalization mismatch removes none of it. So for any console that was reachable by an unauthenticated caller during the exposure window, with exploitation confirmed in the wild, the default disposition has to be configuration export, rebuild from a vendor image, and rotation of every credential the console held or brokered — not update-in-place followed by a green patch report. The distinguishing test: on a console suspected of exposure, compare the installed package set and dpkg maintainer scripts against a known-good build before the update is applied; an estate holding no such baseline cannot distinguish a patched console from a patched-and-still-owned one.",
+        "evidence": "Packet vector: chained with CVE-2026-34909 and CVE-2026-34910 (an unsanitized package name passed to sh -c) the access-control bypass yields remote code execution, and the service's passwordless sudo to /usr/bin/dpkg escalates to full root via a malicious package maintainer script. active_exploitation is confirmed, cisa_kev true with kev_date 2026-06-23, poc_available true. patch_available is true but live_patch_available is false, with live_patch_notes stating there is no live-patch path for this product class.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "ISO-27001-2022-A.8.8"
+        ]
+      }
+    ]
   },
   "CVE-2026-20253": {
     "name": "Splunk Enterprise Missing Authentication for Critical Function Vulnerability",
@@ -30654,7 +31626,31 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "human_researcher",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "The unit of remediation for this flaw is the JCE extension, not the Joomla platform, so the clock that opened with the 2026-06-16 KEV listing has to be measured against the installed JCE build on every site in the estate. A site whose Joomla core is current still answers index.php?option=com_jce&task=profiles.import if the extension itself was not updated, and estates whose sites are operated by an agency or reseller need the count taken there rather than inferred. The packet records a vendor update with no live-patch path, so there is no way to close the endpoint short of taking each site through the extension update. Nothing about a site's configuration buys time: the path needs no account and no user interaction, only a CSRF token scrapable from any public page, so every publicly reachable install is exposed for exactly the interval between the listing and the update landing on the last site. The distinguishing test is to query each site for its installed JCE version instead of accepting a platform-level 'Joomla is up to date' attestation, and to re-check after any restore from a pre-update backup, which silently reinstates the vulnerable extension on a site that was already remediated.",
+        "evidence": "Packet: CWE-284 improper access control; CISA KEV-listed 2026-06-16 with active_exploitation confirmed; CVSS 9.8, RWEP 70, poc_available true. patch_available true with live_patch_available false and live_patch_notes 'No live-patch path for this product class; remediation is the vendor update plus the named compensating controls until it lands.' The packet's vector names index.php?option=com_jce&task=profiles.import as reachable by any unauthenticated visitor, requiring only a CSRF token scrapable from any public page. The citing gaps AU-Essential-8-Patch, ISO-27001-2022-A.8.8, NIST-800-53-SI-2 and NIS2-Art21-vulnerability-management are the patch-timing controls the packet's own remediation note points back at.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-025",
+        "name": "CONFIGURATION-SIDE-LIVE-PATCH-INVENTORY",
+        "description": "The packet's remediation note says the vendor update 'plus the named compensating controls' is the remediation, and for this product the compensating path lives in the web-server configuration rather than in the application. Two rules are deployable without waiting on the extension update: refuse to hand any file under the JCE upload root to the PHP handler, so the write the attacker obtains through File::upload(..., false, true) cannot become execution, and reject requests carrying task=profiles.import at the reverse proxy so the crafted profile that whitelists executable uploads is never imported. Both have to be inventoried and rehearsed before the next disclosure, because authoring a deny-execute rule for the first time during an active exploitation window is where sites get broken or missed. The preconditions have to be recorded alongside the rules rather than left implicit: the deny-execute rule covers only the directories it names — the packet places the shell in the web root's default images/ folder, so an install whose upload root has been relocated, or that permits writes to any other docroot path, is untouched by it — and the request filter holds only for the request shapes it matches, so an alternate encoding or an alias reaching the same task goes around it. Neither rule evicts a shell already written, so a site that was publicly reachable before the rules went in needs its docroot audited against a known-good source tree, not merely the rules applied. This is also why the cited least-privilege gap does not close on its own: the attacker never authenticates, so per-account privilege scoping is never consulted, and the code runs as the web-server user — constraining what that account's writable directories are permitted to execute is the half that actually bites.",
+        "evidence": "Packet vector: 'File::makeSafe() sanitizes the filename but never restricts the extension, and File::upload(..., false, true) is called with unsafe handling enabled, bypassing Joomla's extension blacklist,' letting the attacker 'write a .php web shell into the web root (default images/ folder), yielding unauthenticated remote code execution and a persistent backdoor running as the web-server user.' patch_available true, live_patch_available false, live_patch_notes: 'No live-patch path for this product class; remediation is the vendor update plus the named compensating controls until it lands.' NIST-800-53-AC-6 and UK-CAF-B4 are recorded as citing gaps on this entry.",
+        "gap_closes": [
+          "NIST-800-53-AC-6",
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2026-54420": {
     "name": "LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following Vulnerability",
@@ -31132,7 +32128,31 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "Active! Mail's web front end is internet-facing and parses incoming HTTP requests prior to authentication, and the packet records the successful outcome as arbitrary code execution in the context of the web service on the mail server. It also records what attackers did with that foothold: reached hosted mailboxes and harvested stored credentials, including cloud-admin credentials at affected providers. Both facts point the same way — installing the vendor update on an instance that was reachable during the exploitation window closes the overflow and does nothing about credentials already taken or anything left running on the host. So for this product the default response to a confirmed-exploited instance is to preserve and export the configuration, rebuild the mail host rather than patch it in place, and rotate every credential the server stored or could reach: mailbox credentials first, then the provider and cloud-admin credentials the packet names, because those are the ones whose blast radius extends past the mail server into the hosting environment. Service crashes deserve the same treatment as a signal: the packet ties the denial-of-service outcome to a failed-control attempt at the same overflow, so a crash on an internet-facing Active! Mail instance is a reason to hunt, not a stability ticket to close.",
+        "evidence": "CWE-121 stack-based buffer overflow reachable pre-authentication on an internet-facing webmail front end; the packet describes an over-length field overflowing a fixed-size stack buffer and overwriting the saved return address, yielding arbitrary code execution in the context of the web service on the mail server, or a service crash for denial of service on failed control. The packet further states that 'in observed incidents the foothold was used to reach hosted mailboxes and harvest stored credentials (including cloud-admin credentials at affected providers)'. CISA KEV-listed 2025-04-28, active_exploitation confirmed, poc_available true, CVSS 9.8, RWEP 68.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "The packet gives a vendor update and no live-patch path for this product class, stating that remediation is the vendor update plus the named compensating controls until it lands — so on Active! Mail there is nothing to apply without taking the webmail service down, and the compensating controls are the whole of the coverage in between. That interval is also the whole of the exposure, because there is no access-control lever to pull meanwhile: the front end must stay internet-reachable to serve users, it parses the attacker's request before authentication, and no user interaction is involved in reaching the vulnerable parser. Run the clock from the 2025-04-28 KEV listing through the restart of every affected instance, and count instances rather than hosts — the packet's own incident detail is about hosted mailboxes at providers, so an operator running the product for multiple tenants owes one completed clock per instance. The service interruption the update requires belongs inside the SLA, not as the reason to defer it into the next maintenance window.",
+        "evidence": "CISA KEV-listed 2025-04-28 with active_exploitation confirmed and poc_available true. patch_available true; live_patch_available false, with the packet stating there is no live-patch path for this product class and that remediation is the vendor update plus the named compensating controls until it lands. The packet describes the front end as internet-facing and parsing incoming HTTP requests prior to authentication, exploitable by a remote unauthenticated attacker. CVSS 9.8, RWEP 68.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      }
+    ]
   },
   "CVE-2025-3928": {
     "name": "Commvault Web Server Unspecified Vulnerability",
@@ -31187,7 +32207,29 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-054",
+        "name": "BACKUP-TIER-NETWORK-ISOLATION",
+        "description": "The packet's opening fact about this deployment is that the Commvault Web Server is internet-reachable, and reachability is what makes the rest of the path available: an attacker holding any valid low-privilege Commvault account sends crafted requests to that web surface to create and execute a webshell. Applied to this product, the control means the Commvault Web Server's HTTP surface answers only from an operator subnet or an authenticated VPN rather than from the open internet, and that the host's outbound path is constrained so a webshell running in the web-application context cannot freely reach arbitrary destinations with what the same host holds. Two preconditions have to be stated rather than assumed. First, restricting reachability bounds who can present the crafted request; it does not repair the upload primitive, and it gives nothing against a caller who already has a foothold on a permitted host or against a webshell planted before the restriction was applied. Second, the egress constraint only limits what the webshell itself can reach — the packet records that the stored Azure/M365 application client secrets were read, and once those secrets are off the host they are replayable from any address, so egress filtering does not contain the cross-tenant half at all. The distinguishing test: from an external address and from a general user VLAN, attempt to load the Commvault Web Server's HTTP surface; anything that answers is within reach of a caller holding any valid low-privilege account, and 'the server is behind our firewall' is a claim about topology, not a demonstration that the surface is unreachable from untrusted networks.",
+        "evidence": "The packet states the Commvault Web Server is internet-reachable and that an attacker holding valid (low-privilege) authenticated user credentials can send crafted requests that create and execute a webshell, yielding remote code execution within the web-application context; it states unauthenticated access is not exploitable, so the primitive requires a prior valid-account foothold. It records that in the observed Metallic SaaS breach this foothold was used to read Commvault-stored Azure/M365 application credentials (client secrets), allowing impersonation of customer service principals and lateral movement into downstream M365 tenants. Entry facts: CWE-434, CVSS 8.8, RWEP 72, poc_available true, CISA KEV-listed 2025-04-28 with active exploitation confirmed. patch_available is true; live_patch_available is false, with live-patch notes stating there is no live-patch path for this product class and that remediation is the vendor update plus the named compensating controls until it lands.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "For an internet-reachable Commvault Web Server under confirmed exploitation, the IR default has to be configuration capture, rebuild and credential rotation rather than patch-in-place, because the packet's outcome is a webshell running on the host and the vendor update does not evict it. The rotation scope is the part that is specific to this product and larger than the host: the packet records the observed Metallic SaaS breach reading Commvault-stored Azure/M365 application credentials (client secrets) and impersonating customer service principals into downstream M365 tenants, so every application credential the server held must be rotated in the tenants that trust it and the sessions those secrets minted revoked — rebuilding the Commvault host alone leaves the attacker holding credentials that work from anywhere, with no dependency on the rebuilt server. Two preconditions, stated rather than implied. This control's usual trigger is a pre-auth RCE, and this path is not pre-auth — the packet is explicit that unauthenticated access is not exploitable and a prior valid low-privilege account is required — so the runbook trigger for this CVE is evidence that any account could have reached the web server during the exposure window, and an instance whose access logs cannot establish that is treated as in scope rather than out. And the packet establishes confirmed in-the-wild exploitation of the CVE, not that a given instance was compromised; the rebuild decision is driven by unbounded exposure, not by the CVE alone.",
+        "evidence": "The packet states the Commvault Web Server is internet-reachable, that exploitation requires an attacker holding valid low-privilege authenticated credentials (unauthenticated access is not exploitable), and that crafted requests let the attacker create and execute a webshell for remote code execution in the web-application context, providing persistent code execution. It records that in the observed Metallic SaaS breach the foothold was used to read Commvault-stored Azure/M365 application credentials (client secrets), allowing impersonation of customer service principals and lateral movement into downstream M365 tenants — turning a single web-server compromise into cross-tenant cloud access. CISA KEV-listed 2025-04-28, active_exploitation confirmed, poc_available true, CVSS 8.8, RWEP 72, CWE-434. patch_available true; live_patch_available false, with notes recording no live-patch path for this product class and remediation as the vendor update plus the named compensating controls until it lands.",
+        "gap_closes": [
+          "NIS2-Art21-vulnerability-management",
+          "NIST-800-53-SI-2"
+        ]
+      }
+    ]
   },
   "CVE-2025-24054": {
     "name": "Microsoft Windows NTLM Hash Disclosure Spoofing Vulnerability",
@@ -31511,7 +32553,41 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "human_researcher",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-009",
+        "name": "KERNEL-MODULE-INVENTORY-AND-DISABLE",
+        "description": "The packet states the snd-usb-audio driver is bound by the kernel automatically when a USB audio device enumerates, which means the vulnerable descriptor-parsing code runs on any host with a physically reachable USB port whether or not that host has any audio-peripheral role. For this CVE the control means enumerating which systems actually need USB audio-class support and removing the driver from the reachable surface on the ones that do not — kiosks, servers, rack-mounted and unattended endpoints, and any device whose threat model includes an attacker with physical access to the port. The mechanism depends on how the kernel was built, and getting that wrong is how this control gets recorded as a mitigation while the parse path stays reachable: a modprobe blacklist only stops an autoload, so it applies where snd-usb-audio is a module, and does nothing on a kernel compiled with CONFIG_SND_USB_AUDIO=y, where the driver is built in and binds regardless. Determine which build a host is running before claiming the control — the driver is built in if it appears in /lib/modules/<release>/modules.builtin, and modular if modinfo resolves it. Where it is built in, the equivalent controls are USB device authorization (deny-by-default on the USB bus, allowlisting the peripherals a host is meant to accept) or a kernel built without the driver; a blacklist entry on such a host is not a compensating control and the host stays unremediated until it reboots onto the fixed kernel. The distinguishing test is to attach a USB audio-class device to a supposedly remediated host and confirm the driver does not bind, rather than confirming the module is absent from the currently loaded set — a host whose loaded-module list looks clean at audit time will still bind the driver the moment a device is plugged in, and a built-in driver will bind no matter what the blacklist says.",
+        "evidence": "Packet vector: the ALSA USB-audio driver (snd-usb-audio) traverses clock-source, clock-multiplier and clock-selector descriptors of an attached USB audio device without validating each descriptor's bLength field, and reachability requires physical USB access plus 'the (low) privilege of the kernel auto-binding the audio driver on enumeration'. CWE-125, CVSS 7.1, RWEP 59, AV:L. patch_available true; live_patch_available false with live_patch_notes 'No live-patch path for this product class; remediation is the vendor update plus the named compensating controls until it lands.'",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "NIST-800-53-SI-2",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-017",
+        "name": "BUG-FAMILY-MITIGATION-PERSISTENCE",
+        "description": "The packet does not describe one unchecked descriptor read; it describes the same missing bLength validation across three separate descriptor traversals in the same driver, which makes this a parse-site class rather than a point defect. For this CVE the control means whichever USB-audio surface removal the host required — modprobe blacklist on a modular build, USB device authorization on a built-in one — and any USB-peripheral restriction deployed alongside it, stays in force after the fixed kernel is installed and rebooted, for a stated soak period, instead of being reverted the moment the vulnerability scanner reports the host on a fixed build. A fix that hardens the three named traversals says nothing about the remaining descriptor-parsing paths the same driver walks on enumeration, and the packet's own primitive — reading past the end of an allocated descriptor buffer using an attacker-declared length — is a pattern, not a location. The distinguishing test is whether the change record for this CVE has a scheduled review date on removing the compensating control, or whether the blacklist was rolled back in the same maintenance action that applied the kernel; the second is the failure mode this control exists to prevent.",
+        "evidence": "Packet vector names three distinct descriptor types traversed without bLength validation in the same driver: clock-source, clock-multiplier and clock-selector descriptors of an attached USB audio device, where 'a malicious or bogus USB device can present a descriptor whose declared length is shorter than the structure the driver dereferences'. CWE-125 out-of-bounds read. live_patch_available false; remediation per live_patch_notes is 'the vendor update plus the named compensating controls until it lands'.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "This entry is KEV-listed with confirmed exploitation, but the packet records no live-patch path for the product class, so the mitigation the SLA clock demands cannot be a hot fix — it is either the vendor kernel update with a reboot, or the documented compensating control, and on a fleet that cannot reboot inside the window it is the compensating control by default. For this CVE the SLA therefore has to be written so that a verified USB-audio surface removal counts as the mitigation for hosts still awaiting a reboot — a modprobe blacklist where the driver is modular, or USB device authorization where it is built into the kernel and a blacklist would do nothing, with the reboot tracked as a separate open item rather than the clock being paused until a maintenance window appears. The distinguishing test is whether the KEV response record for this CVE names a mitigation state for every affected host at the deadline — updated-and-rebooted, or compensating-control-verified — or whether hosts pending reboot are simply absent from the record; an SLA that only counts completed kernel updates will report a clean deadline while the descriptor-parse path stays reachable on every host that has not yet restarted.",
+        "evidence": "cisa_kev true, kev_date 2025-04-09, active_exploitation 'confirmed'. RWEP 59, CVSS 7.1. patch_available true, live_patch_available false, live_patch_notes 'No live-patch path for this product class; remediation is the vendor update plus the named compensating controls until it lands.' poc_available is false, so the confirmed-exploitation signal here comes from the KEV listing rather than from published exploit code.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "AU-Essential-8-Patch",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      }
+    ]
   },
   "CVE-2024-53197": {
     "name": "Linux Kernel Out-of-Bounds Access Vulnerability",
@@ -31786,7 +32862,41 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-124",
+        "name": "FRAMEWORK-DEFAULT-SECRET-DETECTION",
+        "description": "Cisco Smart Licensing Utility ships an undocumented static administrative account whose credential is compiled into the binary, so the secret an attacker needs is a property of the product, identical on every install, and not something the operator provisioned or can rotate. That inverts the usual form of this control: there is no per-instance key to make unique, so the deployment gate has to be presence-of-the-shipped-credential rather than uniqueness-of-the-operator's. For CSLU that means treating any host carrying an affected 2.0.0-2.2.0 build as holding a published administrative credential until the vendor update is applied, and verifying after the update that presenting the shipped Basic-auth credential to the CSLU REST API on TCP/8182 is refused rather than accepted. Re-run that check after any workstation or server rebuild, image restore or CSLU reinstall, since those are the operations that silently put an affected build back on a host that was previously remediated, and the utility carries no operator-visible account listing that would make the regression obvious. The distinguishing test is to authenticate against a staging instance with the shipped credential and confirm refusal — an estate that passes a password-policy and privileged-account-review audit still hands full administrative control of the CSLU API to any unauthenticated caller who can reach the port, because the account was never in the directory the audit examined.",
+        "evidence": "Packet vector: 'Cisco Smart Licensing Utility ships an undocumented static administrative account (CWE-798 / CWE-912) whose credentials (cslu-windows-client:Library4C$LU) are hardcoded in the binary', its REST API 'listens on TCP/8182' when running, and 'an unauthenticated, remote attacker who reaches the host over the network can present the static Basic-auth credentials to authenticate as administrator with no prior access', yielding 'full administrative control over the CSLU application API'. Affected range given as 2.0.0-2.2.0. CVSS 9.8, RWEP 70, poc_available true.",
+        "gap_closes": [
+          "UK-CAF-B4",
+          "ISO-27001-2022-A.8.8"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-018",
+        "name": "SCANNER-PAPER-COMPLIANCE-TEST",
+        "description": "The packet records that CSLU only listens while actively invoked, which makes this vulnerability structurally invisible to the two techniques most estates rely on for evidence: a network scan of TCP/8182 finds the port closed whenever the utility happens not to be running, and a service inventory finds nothing listening to attribute a version to. For this CVE the operational test has to be installed-software inventory across the Windows estate — does any host carry a Smart Licensing Utility build in the 2.0.0-2.2.0 range, regardless of whether the service answered at scan time — because that, not port reachability, is the condition the packet ties exposure to. The distinguishing test is to scan a staging host with an affected CSLU installed but not currently invoked, and confirm the tooling still reports it as affected; a scanner that returns clean because nothing answered on 8182 has measured the sampling moment rather than the exposure, and every subsequent invocation of the utility reopens an unauthenticated administrative API with a credential published in the advisory.",
+        "evidence": "Packet vector: 'Because CSLU only listens while actively invoked, exposure is intermittent, but any reachable, running 2.0.0-2.2.0 instance is trivially compromisable', with the REST API on TCP/8182 reachable by an unauthenticated remote attacker while the service runs. cisa_kev true, kev_date 2025-03-31, active_exploitation 'confirmed'.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-vulnerability-management",
+          "AU-Essential-8-Patch"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "KEV listing on 2025-03-31 with confirmed exploitation, a public PoC and unauthenticated administrative access at CVSS 9.8 puts this above any routine patch cadence, and the packet gives no live-patch path, so the mitigation that satisfies the clock is either upgrading past the affected 2.0.0-2.2.0 range or removing/stopping the utility on hosts that do not need it. For this CVE the SLA should treat 'CSLU not installed' as a first-class satisfying outcome rather than only counting upgrades, because Smart Licensing Utility is a support tool rather than a production dependency on most of the hosts that carry it, and uninstalling is faster than scheduling a software update across a Windows estate. The distinguishing test is whether the KEV record for this CVE resolves every affected host to upgraded, uninstalled, or explicitly risk-accepted at the deadline; an SLA measured only on upgrade completion will show hosts as pending indefinitely while an unauthenticated caller with the published credential can take administrative control of the API the next time the utility runs.",
+        "evidence": "cisa_kev true, kev_date 2025-03-31, active_exploitation 'confirmed'. CVSS 9.8, RWEP 70, poc_available true. patch_available true; live_patch_available false with live_patch_notes 'No live-patch path for this product class; remediation is the vendor update plus the named compensating controls until it lands.' Packet vector states the attacker gains 'full administrative control over the CSLU application API', which is chained with CVE-2024-20440 to harvest further credentials and tokens.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "AU-Essential-8-Patch",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      }
+    ]
   },
   "CVE-2025-2783": {
     "name": "Google Chromium Mojo Sandbox Escape Vulnerability",
@@ -32392,7 +33502,30 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "This entry has the profile a severity-threshold patch policy defers: CVSS 5.5, no public PoC, and the packet's own statement that there is no direct privilege escalation from the bug alone. The control's requirement for this CVE is that the clock is driven by the 2025-03-11 KEV listing and the confirmed exploitation, not by the score — and that the co-patched NTFS/FAT flaws the packet names (CVE-2025-24993 RCE and CVE-2025-24985) are remediated as one unit with it, because the value of this out-of-bounds read is what it hands those memory-corruption bugs: heap contents including cached credentials, cryptographic key material, and addresses useful for defeating ASLR. Treating an information-disclosure primitive as a lower tier than the RCE it is chained with is what leaves the chain viable after a partial rollout. The packet records no live-patch path for this product class, so there is no way to shorten the window other than the fleet's own update cadence, and remediation state must be read per host rather than from an update-approval record. Until the update lands, the only exploit precondition the packet actually names is user interaction — the victim must mount a specially crafted VHD/VHDX, delivered by phishing or inside a bundled archive — so refusing untrusted disk images at the mail and file-share boundary, plus user guidance not to mount them, is the interim lever. State its limit: that lever holds only where mounting disk images is not part of a routine workflow and where the image is recognizable as externally sourced; an image nested inside an archive or dropped on an internal share does not present as untrusted, and it does nothing on a host where a malicious image has already been mounted and the memory contents already read.",
+        "evidence": "Packet: CWE-125; attack_vector — reachability \"requires local presence plus user interaction (CVSS UI:R): an attacker must get a victim to mount a specially crafted VHD/VHDX, typically delivered through phishing or a bundled archive\"; the primitive \"discloses small portions of heap memory, which can leak secrets such as cached credentials, cryptographic key material, or addresses useful for defeating ASLR\"; \"There is no direct privilege escalation from this bug alone, but the leaked data is commonly chained with the co-patched NTFS/FAT memory-corruption flaws (CVE-2025-24993 RCE, CVE-2025-24985) to harden an exploit chain into code execution.\" CISA KEV-listed 2025-03-11, active_exploitation confirmed; CVSS 5.5, RWEP 59, poc_available false; patch_available true, live_patch_available false, live_patch_notes \"No live-patch path for this product class; remediation is the vendor update plus the named compensating controls until it lands.\" citing_gaps: AU-Essential-8-Patch, NIST-800-53-SI-2, NIS2-Art21-vulnerability-management.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-018",
+        "name": "SCANNER-PAPER-COMPLIANCE-TEST",
+        "description": "The paper-compliance shape on this entry is the vulnerability report itself. A scan that grades endpoints by their highest-severity finding shows a Windows host as clean of criticals while this KEV-listed CVSS 5.5 out-of-bounds read in the NTFS driver stays unremediated, and a management-console row reading \"update approved\" or \"update downloaded\" is not evidence that a given host's NTFS driver carries the fix. The operational test for this CVE: query each endpoint's installed Windows build against the build that fixes this entry and its co-patched siblings (CVE-2025-24993, CVE-2025-24985) treated as one remediation unit, and close the finding against that build check rather than against the scanner's severity ranking or the absence of a critical on the host. The verification must also cover the estate's real shape — hosts held back by a deferred update ring, and re-imaged or restored hosts that were rebuilt from a pre-fix image, are where a build check finds exposure that a fleet-level compliance percentage hides. Precondition and limit: this control proves remediation state, it does not reduce exposure on a host that is still unpatched; and because the packet records no public PoC, the absence of exploitation signal in scanner or endpoint telemetry is not evidence a host is unaffected — the leak is a read, so a successful exploitation of this primitive leaves little for a scanner to find.",
+        "evidence": "Packet: CVSS 5.5, RWEP 59, poc_available false, CISA KEV-listed 2025-03-11 with active_exploitation confirmed; patch_available true, live_patch_available false; attack_vector names the co-patched NTFS/FAT flaws CVE-2025-24993 (RCE) and CVE-2025-24985 as the bugs this leak is chained with, and states the primitive is an out-of-bounds read disclosing heap memory rather than a privilege escalation. citing_gaps record ISO-27001-2022-A.8.8 (Management of technical vulnerabilities) and AU-Essential-8-Patch (Patch operating systems) as insufficient for this entry.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "AU-Essential-8-Patch"
+        ]
+      }
+    ]
   },
   "CVE-2025-24985": {
     "name": "Microsoft Windows Fast FAT File System Driver Integer Overflow Vulnerability",
@@ -32762,7 +33895,30 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_disclosure",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "Microsoft Management Console is a built-in Windows component, so the affected population is the entire managed Windows endpoint estate rather than a single service that can be stopped or firewalled while a fix is scheduled. The packet records a vendor update with live_patch_available false and no live-patch path for this product class, which means remediation is the update landing on each host, and the interval before it lands is carried by the compensating controls the packet's live_patch_notes points to. This control binds that deployment clock to the 2025-03-11 KEV listing rather than to the next scheduled endpoint-patch ring, so the estate must reach the fixed state (or run documented, expiring compensating controls) inside the window the packet records as closing 2025-04-01. The distinguishing test is to enumerate the fleet against the fixed state on the due date: a patch programme that ships this update on a monthly ring passes a process audit while every unremediated host carries an actively-exploited security-feature bypass for the remainder of that month, and the packet's RWEP of 82 against a CVSS of 7.0 is exactly the case a CVSS-ranked queue defers.",
+        "evidence": "Packet: cisa_kev true, kev_date 2025-03-11, attack_vector records the KEV due date as 2025-04-01, active_exploitation confirmed, poc_available true, rwep_score 82 against cvss 7.0, patch_available true, live_patch_available false, live_patch_notes 'No live-patch path for this product class; remediation is the vendor update (or, for end-of-life products, decommissioning) plus the named compensating controls until it lands.'",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-041",
+        "name": "PROTECTION-MECHANISM-FAILURE-CLASS-REGRESSION",
+        "description": "What fails in this CVE is not a code-execution sink but a Windows security feature refusing to hold: the packet's vector is improper neutralization in Microsoft Management Console that lets an unauthorized attacker bypass a security feature locally (CWE-707). That makes build-number verification structurally unable to answer the operator's real question, because a host reports the same patch state whether the protection enforces or has been bypassed. The requirement here is to carry the MMC bypass primitive in the standing protection-mechanism regression battery alongside the MOTW/SmartScreen/AMSI-class primitives the control already governs, and to re-run that battery after each Windows update deployment on a representative build rather than once at remediation of this CVE. The distinguishing test for this product: on a host the scanner reports as fixed, exercise the bypass against the MMC surface and confirm the security feature blocks it. With a PoC available and exploitation confirmed, an estate that verifies patch level but never verifies enforcement cannot distinguish a re-enforced protection from a re-broken one.",
+        "evidence": "Packet: cwe_refs CWE-707, vector 'Improper neutralization in Microsoft Management Console allows an unauthorized attacker to bypass a security feature locally.', poc_available true, active_exploitation confirmed, cisa_kev true (2025-03-11), patch_available true, live_patch_available false.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2024-13161": {
     "name": "Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability (GetHashForSingleFile)",
@@ -32817,7 +33973,39 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "human_researcher",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-134",
+        "name": "DEVICE-MANAGEMENT-GATEWAY-CONFIG-ENDPOINT-AUTH-INPUT-NEUTRALIZATION",
+        "description": "Ivanti EPM is the endpoint-management server for the estate, and this flaw reaches sensitive information on it with no credential at all: the GetHashForSingleFile handler consumes a caller-supplied absolute path and returns what it finds, so the read completes before any authentication decision is made. Two requirements follow for this deployment. Every EPM handler that takes a caller-supplied path must authenticate the caller before it acts, and must resolve the supplied path to a canonical absolute form and verify the result still sits under the directory that handler is entitled to read — rejecting absolute paths and traversal segments before a file handle is opened, rather than filtering the request string on the way in. And no EPM instance may present those handlers to an untrusted network, because a remote unauthenticated attacker is the packet's threat model and reachability is the entire exploit precondition. The distinguishing test for this product: from an unauthenticated client against a staging EPM, call the file-hash handler with an absolute path outside its intended directory and confirm the request is refused before any file is read — an estate that passes EPM role-and-permission audits still exposes this path, since the attacker never reaches the role model. Because exploitation is confirmed and a public PoC exists, an instance that presented these handlers to an untrusted network before the January-2025 security updates needs forensic triage rather than a patch-and-close.",
+        "evidence": "CWE-36 absolute path traversal, named in the packet against the GetHashForSingleFile handler; the packet states the flaw 'allows a remote unauthenticated attacker to leak sensitive information' in Ivanti EPM before the 2024 January-2025 Security Update and the 2022 SU6 January-2025 Security Update. CISA KEV-listed 2025-03-10 (due 2025-03-31), active_exploitation confirmed, poc_available true, CVSS 9.8, RWEP 73.",
+        "gap_closes": [
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "For this CVE the compressed clock runs on the EPM server itself, not on the endpoints it manages, and that inverts the usual patch-cadence assumption: one server-side update closes the exposure for the whole estate, so there is no fleet-rollout tail to justify a monthly or quarterly maintenance window. The packet records a vendor fix — the 2024 January-2025 Security Update and the 2022 SU6 January-2025 Security Update — and no live-patch path for this product class, so remediation means taking the EPM server through the update rather than applying anything in place, and the named compensating controls hold only until it lands. The flaw was already exploited in the wild with a public PoC when CISA listed it on 2025-03-10, which makes the 2025-03-31 due date the outer bound rather than the target. Inside the interval the only available lever is reachability: restrict which networks can reach the EPM management surface, since the attack requires no credential and no user interaction.",
+        "evidence": "CISA KEV-listed 2025-03-10 with a stated due date of 2025-03-31 and active_exploitation confirmed; poc_available true; patch_available true, with the packet naming the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update as the fixing releases; live_patch_available false, and the packet's live-patch note stating there is no live-patch path for this product class and that remediation is the vendor update plus the named compensating controls until it lands. CVSS 9.8, RWEP 73.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-037",
+        "name": "FLEET-COMPROMISE-IR-PLAYBOOK",
+        "description": "The primitive here is a read, and a read is not reversed by an update: whatever an unauthenticated attacker pulled off an exposed EPM server before the January-2025 security updates remains in their hands afterwards. Because EPM is a fleet-control-plane asset rather than an ordinary application server, the response has to be scoped to the estate it serves and not to the one host — establish the exposure window from the instance's first untrusted-network-reachable day through the day the update landed, rotate credentials for every account that authenticated through the EPM server inside that window, and treat material the server held during it as disclosed rather than still-confidential. This playbook has to be written before the disclosure, because reconstructing which accounts transited a management server months after the fact is the step that fails under time pressure. It is also the half of the response no patch-status dashboard surfaces: a flaw-remediation control closes at 'update installed', and for a confirmed-exploited disclosure primitive that is not closure.",
+        "evidence": "CWE-36 absolute path traversal allowing, per the packet, a remote unauthenticated attacker to leak sensitive information from Ivanti EPM; active_exploitation confirmed and CISA KEV-listed 2025-03-10 (due 2025-03-31); poc_available true; live_patch_available false, with remediation recorded as the vendor update plus named compensating controls until it lands.",
+        "gap_closes": [
+          "NIST-800-53-SI-2"
+        ]
+      }
+    ]
   },
   "CVE-2024-13160": {
     "name": "Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability (GetHashForWildcard)",
@@ -33316,7 +34504,38 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "human_researcher",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "The KEV clock means different work depending on where a Pentaho deployment sits, because this entry names fixed builds on two branches only — 9.4.0.1 and 9.3.0.2 — while explicitly including 8.3.x among the affected releases. A 9.3.x or 9.4.x server takes a point upgrade and can meet a short window; an 8.3.x server has no in-branch fix named here and has to be carried onto a fixed branch, which is a migration with report, schedule and plugin compatibility work behind it, not a maintenance-window task. Programmes that measure this SLA as days-to-apply-the-vendor-patch will show the 8.3.x estate as perpetually pending while it is in fact fully exposed against a public exploit, so those instances need a dated migration commitment plus a documented interim restriction running from the KEV listing (2025-03-03), not an open counter. No live-patch path exists for this product class, so the analytics outage the upgrade requires belongs inside the KEV window rather than in the next quarterly release train.",
+        "evidence": "KEV-listed 2025-03-03 (due 2025-03-24), active_exploitation \"confirmed\", poc_available true; CVSS 8.8, RWEP 65; patch_available true with the vector naming the fixed versions as 9.4.0.1 and 9.3.0.2 and listing 8.3.x among the affected releases; live_patch_available false — \"No live-patch path for this product class; remediation is the vendor update (or, for end-of-life products, decommissioning) plus the named compensating controls until it lands.\"",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-018",
+        "name": "SCANNER-PAPER-COMPLIANCE-TEST",
+        "description": "A version-string verdict is unusually unsafe on this CVE because the affected set is not one ordered range: the fixes land at 9.4.0.1 and 9.3.0.2 while 8.3.x is separately called out as affected. Any scanner rule shaped as \"below 9.4.0.1 is vulnerable\" or \"only the current branch is in scope\" mis-verdicts the 8.3.x and 9.3.x estates in opposite directions — the first marks a patched 9.3.0.2 server as vulnerable, the second quietly drops the 8.3.x servers that are exposed. The operational test for a Pentaho estate: stand up a staging server on each branch actually in production use and confirm the scanner marks the 9.3.x server clean only at or above 9.3.0.2 (not merely above 9.3.0.0), and never marks an 8.3.x server clean; then confirm the check reaches every Pentaho instance, including analytics servers stood up by business units outside the platform team's inventory. This control changes exploitability not at all — it exists so the remediation percentage a compliance report shows corresponds to servers that were actually upgraded, which matters here precisely because the entry carries confirmed exploitation and a public PoC.",
+        "evidence": "The vector names the fixed versions as 9.4.0.1 and 9.3.0.2 and states the flaw affects releases \"prior to\" those \"including 8.3.x\"; patch_available true; KEV-listed 2025-03-03 with active_exploitation \"confirmed\" and poc_available true.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-129",
+        "name": "ENTERPRISE-ERP-MANAGEMENT-FUNCTION-AUTHENTICATION",
+        "description": "The defect sits in the gap between two components that trust each other: web services accept a property value, and something downstream interprets that stored value as a Spring template — so the write side never treats the value as code, and the interpreting side never re-checks who supplied it. Bound to a Pentaho BA Server deployment the control means each web service that can set a server property authorises the caller for that specific action before storing the value, rather than accepting the write from any caller that can reach the endpoint, and that the property-setting surface is routable only from the administrative segment rather than from wherever analytics consumers and embedded dashboards sit. The limit has to be stated plainly: this narrows who can plant the template, it does not stop the template from being interpreted. Any caller with a legitimate route to those services, and any integration account wired into them, still lands on the same sink — so the 9.4.0.1 / 9.3.0.2 upgrade remains the only closure, and this control only bounds exposure until that upgrade is scheduled. Distinguishing test: on a staging BA Server, call each property-setting web service as an unauthenticated client and again as an ordinary report consumer, and confirm the write is refused before the value is stored.",
+        "evidence": "The vector states the server allows \"certain web services to set property values which contain Spring templates that are interpreted downstream\"; cwe_refs CWE-74 and CWE-94; CVSS 8.8, RWEP 65; KEV-listed 2025-03-03 with active_exploitation \"confirmed\".",
+        "gap_closes": [
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2022-43939": {
     "name": "Hitachi Vantara Pentaho BA Server Authorization Bypass Vulnerability",
@@ -33756,7 +34975,38 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_disclosure",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-030",
+        "name": "PERIMETER-DEVICE-ZERODAY-SLA-TIER",
+        "description": "PAN-OS is the trust boundary itself, and the exposed surface in this CVE is its management web interface — the plane that administers the boundary — which is why placing this appliance in the same patch population as a general server or workstation gives it the wrong clock. The control's alternative branch is precisely the action the packet's own vector names: isolate the vulnerable interface by restricting management-web-interface access to trusted internal IP addresses per the vendor's deployment guidance, which removes network reach for callers outside the operator network while the appliance update is scheduled. The packet also bounds the tier's scope — it states the issue does not affect Cloud NGFW or Prisma Access — so the accelerated tier applies to the PAN-OS appliance estate specifically rather than to every Palo Alto product in the inventory. The distinguishing test: from a general user segment, attempt to load the PAN-OS management web interface; anything that answers is inside the reachable population for an authenticated file read whose exploitation the packet records as confirmed, and 'the firewall is on the internal network' is a topology assertion, not a demonstration that the management plane is unreachable.",
+        "evidence": "Packet: name 'Palo Alto Networks PAN-OS File Read Vulnerability', vector states an authenticated attacker with network access to the management web interface can read files readable by the 'nobody' user and that risk is greatly reduced by restricting management web interface access to trusted internal IP addresses per the vendor's linked best-practices deployment guidelines; vector also states the issue does not affect Cloud NGFW or Prisma Access. cisa_kev true, kev_date 2025-02-20, active_exploitation confirmed, patch_available true, live_patch_available false.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "On this CVE the packet supplies the compensating-control branch of the SLA directly: the vendor's stated risk-reduction step is restricting management-web-interface access to trusted internal IP addresses, a configuration change on the firewall itself rather than a code deployment. That leaves no defensible interval between the 2025-02-20 KEV listing and a mitigated state, even where the PAN-OS update must wait for a change window — the packet records patch_available true with live_patch_available false and no live-patch path, so the update has to be taken on the appliance and the access restriction is what covers the wait. The clock the control imposes runs to the due date the packet records as 2025-03-13, and it applies per appliance: the deliverable is every PAN-OS unit either updated or demonstrably answering its management interface only from the operator network, dated against the KEV listing rather than against the next firmware maintenance cycle.",
+        "evidence": "Packet: cisa_kev true, kev_date 2025-02-20, attack_vector records the KEV due date as 2025-03-13, active_exploitation confirmed, poc_available true, rwep_score 77 against cvss 6.5, patch_available true, live_patch_available false, live_patch_notes 'No live-patch path for this product class; remediation is the vendor update (or, for end-of-life products, decommissioning) plus the named compensating controls until it lands.', and the vector names the management-web-interface IP restriction as the risk-reduction measure.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-038",
+        "name": "MITIGATION-ACTIVE-PATCH-PENDING-VERDICT-CLASS",
+        "description": "This entry is unusually prone to the conflation the control exists to prevent, because the vendor's own text offers the access restriction as risk reduction in the same breath as the flaw description. The two states are materially different on this appliance: restricting the management web interface to trusted internal IP addresses narrows who can reach the endpoint, but the file read still succeeds for any caller who reaches it with credentials — which on a firewall means every administrator account and anything that has taken one — so the primitive is contained, not removed. Compliance evidence must therefore carry 'management interface restricted to trusted internal IPs, PAN-OS update pending' as its own time-bound state rather than folding it into a patched-per-SLA line. The residual to record with it: with exploitation confirmed and a PoC available, any appliance whose management interface was reachable before the restriction was applied may already have disclosed every file the 'nobody' user can open, so closing the state also means treating that pre-restriction window as an exposure to triage rather than a patch-and-close.",
+        "evidence": "Packet: vector states an authenticated attacker with network access to the management web interface reads files readable by the 'nobody' user, and that restricting management web interface access to trusted internal IP addresses greatly reduces the risk; cwe_refs CWE-73 and CWE-610; active_exploitation confirmed; poc_available true; patch_available true; live_patch_available false with live_patch_notes recording no live-patch path for this product class.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8"
+        ]
+      }
+    ]
   },
   "CVE-2026-56291": {
     "name": "Balbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability",
@@ -34354,7 +35604,19 @@
         "adequate": false,
         "gap": "Protection-of-audit-information control is directly undermined — the observed exploitation pattern deletes security logs via link-following, defeating log-integrity assumptions."
       }
-    }
+    },
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-145",
+        "name": "ACTIVELY-EXPLOITED-OS-LPE-REMEDIATION-WINDOW-ENFORCEMENT",
+        "description": "Windows Storage is an OS component rather than an optional server role, so the exposed population is the whole Windows fleet and there is no subset an operator can enumerate and isolate instead of updating. The exploitation precondition the packet names is standard user access — the local attacker plants a symbolic link that redirects a privileged Windows Storage file-management operation to a target of their choosing — so account-privilege policy is not a containment story here: the flaw is the thing that converts a standard user into a privileged one, which is precisely why this control says privilege policy must not be relied on to hold the line. Applied to this entry, the Windows update carrying the fix has to be driven across every affected endpoint on the clock that started with the 2025-02-11 KEV listing rather than folded into the normal monthly ring, and the packet's live_patch_available: false with no live_patch_notes has to be treated as a hard planning fact — nothing can be applied to a running endpoint, so the rollout needs restart windows for the fleet and not just a deployment ring. One scheduling signal is actively misleading on this entry: poc_available is false while active_exploitation is confirmed, so a program that gates urgency on public proof-of-concept availability will hold this at routine severity indefinitely. The distinguishing test: enumerate installed build numbers across the fleet against the fixed build for each Windows SKU in the estate and confirm zero endpoints remain below it past the KEV due date — an attestation that 'standard users are not local administrators' passes cleanly while this path stays wide open.",
+        "evidence": "Packet: CISA KEV-listed 2025-02-11, active_exploitation confirmed, CVSS 7.1, RWEP 61, CWE-59. Attack path as recorded: 'A local attacker with standard user access creates a symbolic link that redirects a privileged Windows Storage file-management operation to an unintended target, allowing them to delete arbitrary files — including security event logs — and escalate privileges.' Remediation fields: patch_available true; live_patch_available false with live_patch_notes null. poc_available false, i.e. confirmed in-the-wild exploitation with no public PoC recorded.",
+        "gap_closes": [
+          "AU-ISM-1546",
+          "ISO-27001-2022-A.8.8"
+        ]
+      }
+    ]
   },
   "CVE-2024-40891": {
     "name": "Zyxel DSL CPE OS Command Injection Vulnerability",
@@ -34645,7 +35907,30 @@
         "adequate": false,
         "gap": "Unauthenticated SQL injection against the WebAdmin login endpoint bypasses access enforcement entirely at the authentication layer itself, before any access-control policy is evaluated."
       }
-    }
+    },
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "The packet does not stop at 'unauthenticated SQL injection' — it records the observed outcome as the creation of unauthorized administrative accounts on the appliance, which is an implant built out of the product's own account model rather than a file dropped on disk. Applying the December 2020 hotfix closes the injection point at the WebAdmin authentication endpoint and removes nothing an attacker already created through it, so for any CyberoamOS unit that was reachable before the hotfix landed the default disposition is export-config, rebuild or replace, and rotate every credential the appliance holds or terminates — not hotfix-in-place followed by closing the ticket. The audit that decides this cannot be run against the appliance's own account list on its own terms: an attacker-created administrator is indistinguishable from a legitimate one by privilege alone, so the list has to be reconciled against an authoritative roster of who is supposed to hold WebAdmin access, and any account that cannot be attributed to a person is the finding. State the limit rather than recording this as remediation: it is a detection-and-recovery control, not a fix. It tells the operator whether the box is trustworthy today, and on a platform that will receive no further updates a clean answer has a short shelf life.",
+        "evidence": "Packet: CWE-89; CISA KEV-listed 2025-02-06 with active_exploitation confirmed; CVSS 9.8, RWEP 73, poc_available true. attack_vector: 'An unauthenticated remote attacker submits crafted SQL injection payloads to the CyberoamOS WebAdmin login/authentication endpoint, executing arbitrary SQL statements against the backend database — in observed cases used to create unauthorized administrative accounts on the appliance.' live_patch_available false; live_patch_notes record a hotfix distributed December 4, 2020 (including to EOL versions 10.6.2+). NIST-800-53-SI-2 and NIS2-Art21-vulnerability-management are recorded as citing gaps.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-127",
+        "name": "UNSUPPORTED-NETWORK-DEVICE-ENUMERATION-AND-RETIREMENT",
+        "description": "The packet's live_patch_notes carry the whole decision: a hotfix was distributed December 4, 2020, including to EOL versions 10.6.2+, but CyberoamOS is now fully end-of-life/end-of-service per CISA's required action and no further updates will be issued for remaining deployments. That makes the hotfix worth applying to any unit that never took it, and worthless as a posture — it settles this defect and leaves the next WebAdmin defect with no fix path at all. Applied to this product, the control means every surviving CyberoamOS unit carries an end-of-support date in the asset inventory together with a dated replacement decision, because the packet's exploitation path is an unauthenticated remote request to the appliance's web management surface, so reachability is the entire precondition and the inventory is what tells the operator where reachability exists. Until replacement lands, the WebAdmin surface comes off every untrusted segment. Name the precondition instead of claiming the surface is gone: that restriction holds only while it is enforced from every segment an attacker can occupy; it does not cover a unit whose WebAdmin must stay reachable for remote administration, which has to be moved behind an authenticated gateway performing its own enforcement, since the appliance's own authentication is precisely what the injection bypasses; and it does nothing for a unit that already carries an attacker-created administrator. The distinguishing test: from each untrusted segment, attempt to load WebAdmin on every inventoried unit — anything that answers is reachable by the exact request the packet describes, and a risk-acceptance record with no replacement date leaves a KEV-listed device on a retired platform in service indefinitely.",
+        "evidence": "Packet live_patch_notes, verbatim: 'A hotfix was distributed December 4, 2020 (including to EOL versions 10.6.2+), but CyberoamOS is now fully end-of-life/end-of-service per CISA's required action — no further updates will be issued for remaining deployments.' live_patch_available false. Vector: 'An SQL injection vulnerability in the WebAdmin of Cyberoam OS through 2020-12-04 allows unauthenticated attackers to execute arbitrary SQL statements remotely.' CISA KEV-listed 2025-02-06, active_exploitation confirmed, CVSS 9.8, RWEP 73. NIST-800-53-AC-3, AU-ISM-1546 and UK-CAF-B4 are recorded as citing gaps.",
+        "gap_closes": [
+          "NIST-800-53-AC-3",
+          "AU-ISM-1546",
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2020-15069": {
     "name": "Sophos XG Firewall Buffer Overflow Vulnerability",
@@ -34687,7 +35972,31 @@
         "adequate": false,
         "gap": "Essential Eight patch-applications timelines (days, not years) were not met for a large population of still-exploited XG units."
       }
-    }
+    },
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-030",
+        "name": "PERIMETER-DEVICE-ZERODAY-SLA-TIER",
+        "description": "The XG Firewall is the trust boundary, and the packet's path reaches code execution on the appliance itself from an unauthenticated crafted HTTP/S request to the User Portal's clientless-access Bookmarks feature — no credential is presented at any point. For this product the control means the v17.x estate is driven onto Hotfix HF062020.1 on a perimeter clock measured in hours from the 2025-02-06 KEV listing, not on the operating-system patch cadence the cited Essential Eight and ISO A.8.8 attestations are measured against: a 14- or 30-day window applied to the device that terminates remote access is a window with the boundary open. The cited NIST SC-7 Boundary Protection gap is the reason this needs its own tier — the boundary-protection control an operator would point at is the firewall, and here the firewall is the vulnerable asset, so SC-7 evidence cannot serve as the compensating control for its own defect. The isolation alternative this tier permits carries a precondition that must be stated rather than assumed: the User Portal clientless-access surface is a remote-access feature, so withdrawing it is available only where remote users do not depend on it. Where they do, restricting the portal to known source ranges narrows the caller set but does not remove the unauthenticated overflow path — HF062020.1 is the only thing that closes it, and the packet records no live-patch path, so the hotfix has to be taken on the unit rather than deferred. Distinguishing test: from an address outside any administrative or VPN range, request the User Portal on each v17.x unit; anything that answers is reachable by the unauthenticated overflow, and a patch-compliance report listing the firewall as 'within the current cycle' has recorded the exposure rather than removed it.",
+        "evidence": "Packet: CWE-120 buffer overflow; attack_vector states an unauthenticated attacker sends a crafted HTTP/S request to the XG Firewall's clientless-access User Portal Bookmarks feature, triggering a buffer overflow that yields remote code execution on the firewall appliance itself. Vector: 'Sophos XG Firewall 17.x through v17.5 MR12 allows a Buffer Overflow and remote code execution via the HTTP/S Bookmarks feature for clientless access. Hotfix HF062020.1 was published for all firewalls running v17.x.' CVSS 9.8, RWEP 58, CISA KEV-listed 2025-02-06, active_exploitation 'confirmed', poc_available false. patch_available true; live_patch_available false with live_patch_notes null. Citing gaps include NIST-800-53-SC-7 (Boundary Protection), AU-Essential-8-Patch, ISO-27001-2022-A.8.8 and NIS2-Art21-vulnerability-management.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SC-7",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "The packet pairs a pre-auth RCE on the appliance with confirmed in-the-wild exploitation, which makes 'hotfix applied' an incomplete disposition for this device class: HF062020.1 closes the Bookmarks overflow and removes nothing an attacker wrote to the firewall before it landed. Applied to this product, any v17.x unit whose User Portal was reachable from untrusted networks during the exposure window is triaged as potentially compromised rather than closed out — preserve and review the appliance configuration, rebuild the unit from vendor media, and rotate every credential the firewall held or brokered (administrator accounts, User Portal and VPN user credentials, and any authentication secrets carried in its configuration), because code execution on the appliance reaches all of them. The precondition bounds the scope honestly: this escalation is warranted for units whose clientless-access surface was exposed during the window, and a unit that can be shown never to have presented that surface to an untrusted network is remediated by the hotfix alone — the two cases must be separated by evidence, not by assumption. Distinguishing test: on a unit that has taken HF062020.1, compare the running configuration against the last known-good administrative baseline and enumerate administrative accounts and portal users created or modified before the hotfix date; a firewall closed out on version evidence alone has verified the flaw is gone without verifying the attacker is.",
+        "evidence": "Packet: active_exploitation 'confirmed' and CISA KEV listing 2025-02-06 on a flaw whose attack_vector yields remote code execution on the firewall appliance itself from an unauthenticated HTTP/S request. Remediation recorded is the vendor hotfix — 'Hotfix HF062020.1 was published for all firewalls running v17.x' — with live_patch_available false and live_patch_notes null. Cited gaps NIS2-Art21-vulnerability-management (Vulnerability handling) and UK-CAF-B4 (System security) are the handling/assurance controls this entry records as insufficient.",
+        "gap_closes": [
+          "NIS2-Art21-vulnerability-management",
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2024-53104": {
     "name": "Linux Kernel Out-of-Bounds Write Vulnerability",
@@ -35161,7 +36470,32 @@
         "adequate": false,
         "gap": "A public PoC (Exploit-DB 52436) exists for this confirmed-exploited kernel flaw, meaning routine patch-cycle SLAs left an exposure window during which attackers had both an exploit and evidence of active use."
       }
-    }
+    },
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-145",
+        "name": "ACTIVELY-EXPLOITED-OS-LPE-REMEDIATION-WINDOW-ENFORCEMENT",
+        "description": "The packet puts a local low-privilege attacker at a heap-based buffer overflow in the Hyper-V NT Kernel Integration VSP, reached by supplying malformed or oversized data through the integration-service path and corrupting kernel heap memory to reach SYSTEM. That is a kernel-mode component, so the defect executes below every account-level boundary the Windows estate is audited on. For this CVE the control means the Windows update carrying the fix is driven across every affected host on the clock that opened with the 2025-01-14 KEV listing rather than folded into the next monthly rollup cycle, and that completion is measured per host by the installed build against the fixed build for its SKU — not by 'update approved' or 'update downloaded' in the management console. The packet records a vendor patch with no live-patch path registered for this entry, so there is no in-memory remediation to fall back on: a host that cannot take the update inside the window is exposed, not mitigated, and must be tracked and named as such rather than counted compliant. The second half of the control is the load-bearing half on this path. Because the attacker already holds a local low-privilege account, tightening account privilege does not contain the escalation to SYSTEM — a least-privilege attestation passes cleanly while the flaw remains fully exploitable, which is exactly why the AC-6 gap is recorded against this entry.",
+        "evidence": "The packet's attack vector states that a local low-privilege attacker triggers a heap-based buffer overflow in the Hyper-V NT Kernel Integration VSP component by supplying malformed/oversized data through the integration-service path, corrupting kernel heap memory to escalate to SYSTEM; the entry's vector line is 'Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability'. Entry facts: CWE-122, CVSS 7.8, RWEP 74, poc_available true, CISA KEV-listed 2025-01-14, active_exploitation confirmed. patch_available is true; live_patch_available is false and the packet records no live-patch notes for this entry. NIST-800-53-AC-6 (Least Privilege) is among the framework control gaps citing this CVE.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "NIST-800-53-SI-2",
+          "NIST-800-53-AC-6",
+          "ISO-27001-2022-A.8.8"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-068",
+        "name": "HYPERVISOR-VM-ESCAPE-TENANCY-ASSUMPTION",
+        "description": "The affected component sits in the Hyper-V virtualization stack, and the packet's path is a local low-privilege user reaching SYSTEM through the integration-service path. State the limit precisely rather than blurring it: the packet describes local privilege escalation, not a guest-to-host escape, and the risk write-up should say so. What the packet does defeat is the tenancy assumption operators use to exempt virtualization hosts from expedited patching — 'only trusted administrators have local access to this host' is an assumption, not a control, and the packet's precondition is any local low-privilege account, which on a virtualization host includes service accounts, management agents and any identity permitted to run code there. Applied to this CVE, the control means a KEV-listed defect in a Hyper-V component runs on a compressed clock from the 2025-01-14 listing regardless of whether the host is single-tenant or multi-tenant and regardless of what guests it carries, which is precisely the exemption a quarterly virtualization maintenance window encodes. The precondition that must be stated: the compressed clock only helps where the host can actually absorb the update inside it, and the packet records no live-patch path for this entry, so hosts whose guests cannot be moved inside the window are named individually as accepted exposure with a dated completion — they are not compliant, and the compressed SLA does not make them so.",
+        "evidence": "The packet names the entry 'Microsoft Windows Hyper-V NT Kernel Integration VSP Heap-based Buffer Overflow Vulnerability' and describes the attack as a local low-privilege attacker corrupting kernel heap memory via the integration-service path to escalate to SYSTEM; it does not describe a guest-to-host escape. CISA KEV-listed 2025-01-14 with active_exploitation confirmed and poc_available true; CWE-122, CVSS 7.8, RWEP 74. patch_available is true, live_patch_available is false, and no live-patch notes are recorded for this entry.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "NIS2-Art21-vulnerability-management",
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2024-55591": {
     "name": "Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability",
@@ -35282,7 +36616,38 @@
         "adequate": false,
         "gap": "EU operators running Qlik Sense as BI infrastructure face ransomware-grade impact from an incomplete vendor fix; vulnerability handling must include bypass verification, not just patch application."
       }
-    }
+    },
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-042",
+        "name": "INCOMPLETE-PATCH-SEQUENCE-SEVERITY-MULTIPLIER",
+        "description": "This entry states outright that the flaw exists because the fix for CVE-2023-41265 was incomplete, which makes it the second defect on the same Qlik Sense header-validation primitive rather than an independent finding — and vulnerability programmes that score each CVE discretely miss exactly that. Two consequences for a Qlik estate. First, an operator who applied the CVE-2023-41265 fix and recorded the header-tunneling risk as remediated is still exposed, so that earlier remediation evidence cannot be carried forward against this CVE and any attestation that reuses it is false. Second, because the same primitive has now failed twice, a third bypass of the Proxy's header validation should be treated as likely rather than hypothetical: the Proxy warrants standing detection for repository-service requests that did not originate from an authenticated front-end session, kept in place beyond the patch rather than retired with the ticket. Prioritisation should follow the sequence position, not the CVE in isolation — this is an unauthenticated remote code execution path at RWEP 72 with confirmed exploitation and a public PoC.",
+        "evidence": "The vector states \"NOTE: this issue exists because of an incomplete fix for CVE-2023-41265\", and describes unauthenticated remote code execution arising from improper validation of HTTP headers (cwe_refs CWE-444); CVSS 9.6, RWEP 72; KEV-listed 2025-01-13 with active_exploitation \"confirmed\" and poc_available true.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-vulnerability-handling"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-129",
+        "name": "ENTERPRISE-ERP-MANAGEMENT-FUNCTION-AUTHENTICATION",
+        "description": "The Qlik Sense Proxy is where this product makes its authentication decision, and the repository application behind it acts on what the Proxy forwards. This CVE is a caller reaching those internal-only repository endpoints by crafting headers the Proxy mis-parses, so the repository never learns the request arrived unauthenticated. Bound to this deployment the control means the repository application authorises each administrative operation on its own evidence rather than inheriting the Proxy's verdict, and that the two highest-consequence operations the entry names — registering a new administrative user, and scheduling an external task — are not reachable by a request whose only claim to identity is a forwarded header. Distinguishing test: on a staging Qlik Sense node, issue a request directly at a repository-service endpoint carrying forged forwarding headers and confirm it is refused before the operation runs. The precondition matters: this bounds the tunneling route only while the repository service is reachable from the Proxy alone. If it also answers on an interface other hosts can route to, the Proxy's header validation is not on that path at all, and neither this control nor the patch to the Proxy addresses that second route — reachability of the repository service has to be verified, not assumed from the deployment being internal.",
+        "evidence": "The attack path in the entry: \"An unauthenticated attacker sends a specially-crafted HTTP request with manipulated headers to the Qlik Sense Proxy, tunneling the request through to internal-only repository service endpoints; the elevated internal session is then used to register a new admin user or schedule an external task, achieving remote code execution.\" cwe_refs CWE-444; CVSS 9.6; KEV-listed 2025-01-13 with active_exploitation \"confirmed\".",
+        "gap_closes": [
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "This entry names eight distinct fixed patch levels — August 2023 Patch 2, May 2023 Patch 6, February 2023 Patch 10, November 2022 Patch 12, August 2022 Patch 14, May 2022 Patch 16, February 2022 Patch 15 and November 2021 Patch 17 — one per release train, so \"Qlik Sense is patched\" is not a statement an estate can make centrally. Each node has to be measured against the fixed patch level of the train it actually runs, and a node on an older train gains nothing from a fix existing on a newer one. Because exploitation is confirmed and the path needs no credentials, the interval that counts runs from the KEV listing (2025-01-13) to the moment each node reaches its train's fixed patch level, not to the moment a change record is raised. No live-patch path is recorded for this entry, so reaching that patch level is the remediation. Where a node cannot get there inside the window, the compensating position is to remove untrusted-network reachability of that node's Proxy and to hunt for the artefacts the entry names — an administrative user nobody provisioned, or a scheduled external task — because those persist through the upgrade and the patch removes neither.",
+        "evidence": "The vector lists the fixed versions as August 2023 Patch 2, May 2023 Patch 6, February 2023 Patch 10, November 2022 Patch 12, August 2022 Patch 14, May 2022 Patch 16, February 2022 Patch 15, and November 2021 Patch 17, and describes the outcome as registering a new admin user or scheduling an external task; patch_available true, live_patch_available false with live_patch_notes null; KEV-listed 2025-01-13 with active_exploitation \"confirmed\" and poc_available true; CVSS 9.6, RWEP 72.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "NIST-800-53-SI-2"
+        ]
+      }
+    ]
   },
   "CVE-2024-55550": {
     "name": "Mitel MiCollab Path Traversal Vulnerability (CVE-2024-55550)",
@@ -35525,7 +36890,32 @@
         "adequate": false,
         "gap": "EU-equivalent public-sector operators of niche vertical software need vendor attestation that cryptographic key material is unique per deployment, which standard vulnerability management processes rarely verify."
       }
-    }
+    },
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-124",
+        "name": "FRAMEWORK-DEFAULT-SECRET-DETECTION",
+        "description": "USAHERDS ships the same ASP.NET MachineKey (ValidationKey/DecryptionKey) in every install, so the secret an attacker needs to forge material the server will trust comes from the product rather than from the target — and the packet records that APT41 already holds the value. That inverts the usual remediation order: no amount of account hygiene, password policy or session management on the operator's side reduces this exposure, because the forged __VIEWSTATE passes MAC validation before any account is consulted, which is exactly why the cited ISO A.5.15 access-control and NIST IA-2 user-authentication attestations pass cleanly while the path stays open. Gate the deployment on key uniqueness instead: after moving the instance off the affected build (the packet places the flaw in USAHERDS through 7.4.0.1), verify that the instance's machineKey validation and decryption values are unique to that instance and match neither the product-shipped constant nor any other instance you operate, and hold the server out of service until they do. Re-run the check after every restore-from-image, VM template clone or server rebuild, since those are the operations that quietly reintroduce the shipped key onto a host that was previously remediated. The precondition that must be stated: rotating the key closes the forgery path forward only — it does not evict an attacker who already achieved code execution through a forged __VIEWSTATE before rotation, so an instance exposed while carrying the shipped key needs forensic triage of the web application's process and content in addition to the key change. Distinguishing test: read the machineKey values from two independently deployed instances and from a freshly restored image; identical values on any pair means the deserialization path is still forgeable by anyone holding the constant.",
+        "evidence": "Packet: CWE-798 use of hard-coded credentials; vector 'Acclaim USAHERDS through 7.4.0.1 uses hard-coded credentials.' attack_vector states USAHERDS ships with a static, product-wide ASP.NET MachineKey (ValidationKey/DecryptionKey), that an attacker who obtains the key value — 'APT41 acquired it through undisclosed means' — can forge a __VIEWSTATE payload that passes MAC validation, and that the server deserializes it, executing attacker code. CVSS 8.1, RWEP 42, CISA KEV-listed 2024-12-23, active_exploitation 'confirmed', poc_available false. patch_available true; live_patch_available false with live_patch_notes null. Cited gaps include ISO-27001-2022-A.5.15 (Access control), NIST-800-53-IA-2 (Identification and Authentication, Organizational Users) and NIST-800-53-SI-2 (Flaw Remediation).",
+        "gap_closes": [
+          "ISO-27001-2022-A.5.15",
+          "NIST-800-53-IA-2",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "The clock on this entry opened with the 2024-12-23 KEV listing against confirmed in-the-wild exploitation, and the remediation shape leaves no shortcut: the packet records a vendor patch with no live-patch path, so the only way the fix reaches a USAHERDS instance is by taking it off the affected build (through 7.4.0.1) and through the vendor update, with the service interruption that implies. For this application the control means that upgrade is scheduled against the KEV clock rather than against the general application-patching cadence the cited AU ISM 1546 and NIST SI-2 attestations are measured on — a line-of-business web application inside a periodic patch cycle is precisely the population that carried this flaw into a KEV listing years after the affected build was identified. The condition to state plainly: meeting the SLA on version alone is not sufficient remediation here, because the vulnerable primitive is a shipped secret rather than a code defect the update independently guarantees to re-key; the version move is the SLA-bearing action and the key-uniqueness verification recorded alongside it is what makes the instance actually non-forgeable. Distinguishing test: for each USAHERDS instance, compare the deployed build against the affected range and the completion date against the 2024-12-23 listing; an instance recorded as 'scheduled in the next maintenance cycle' is an accepted exposure on an actively exploited path, not a remediation.",
+        "evidence": "Packet: CISA KEV-listed 2024-12-23, active_exploitation 'confirmed', RWEP 42, CVSS 8.1. Vector places the flaw in 'Acclaim USAHERDS through 7.4.0.1'. patch_available true; live_patch_available false with live_patch_notes null, so no live-patch path is recorded for this entry. Cited gaps include NIST-800-53-SI-2 (Flaw Remediation), AU-ISM-1546 (Patch operating systems and applications), NIS2-Art21-vulnerability-management (Vulnerability handling) and UK-CAF-B4 (System security).",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "AU-ISM-1546",
+          "NIS2-Art21-vulnerability-management",
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2024-12356": {
     "name": "BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) Command Injection Vulnerability",
@@ -36111,7 +37501,20 @@
         "adequate": false,
         "gap": "Vulnerability management processes did not surface XXE-capable unauthenticated endpoints as high-priority exposure."
       }
-    }
+    },
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "Proself ships as three separately versioned editions and the packet gives each its own affected ceiling — Enterprise/Standard Ver5.62 and earlier, Gateway Edition Ver1.65 and earlier, Mail Sanitize Edition Ver1.08 and earlier — so 'verified mitigation' on this entry means confirming every deployed edition individually against its own fixed version. A single 'Proself is updated' attestation is the specific failure mode here, because the version numbers are not comparable across editions and an estate that moved its Enterprise/Standard servers while leaving a Gateway or Mail Sanitize instance in place is still answering the unauthenticated XXE path. The clock this control sets runs from the 2024-12-03 KEV listing, and because live_patch_available is false with no live-patch notes recorded, meeting it means taking each Proself instance through the vendor update — there is nothing to apply to a running service as an interim. Two properties of this entry make the compressed clock matter more than its 7.5 base score suggests. First, exploitation is confirmed in the wild while no public proof-of-concept is recorded, so a program that schedules on PoC availability will never receive the signal it is waiting for. Second, what the flaw returns is arbitrary files on the server 'containing account information', which means updating does not end the incident: every credential readable through the pre-update window has to be treated as disclosed and rotated, and the control's 'verified mitigation' bar is not met by the update alone on an instance that was internet-reachable before it landed.",
+        "evidence": "Packet: CWE-611, CVSS 7.5, RWEP 42, CISA KEV-listed 2024-12-03, active_exploitation confirmed, poc_available false. Attack path as recorded: 'An unauthenticated attacker submits a specially crafted XML request containing external entity declarations to a Proself endpoint, causing the server to disclose arbitrary local files including account information.' Packet vector text names the affected ceilings — 'Proself Enterprise/Standard Edition Ver5.62 and earlier, Proself Gateway Edition Ver1.65 and earlier, and Proself Mail Sanitize Edition Ver1.08 and earlier' — and states that 'arbitrary files on the server containing account information may be read by the attacker.' Remediation fields: patch_available true; live_patch_available false with live_patch_notes null.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      }
+    ]
   },
   "CVE-2023-28461": {
     "name": "Array Networks AG and vxAG ArrayOS Missing Authentication for Critical Function Vulnerability",
@@ -36259,7 +37662,31 @@
         "adequate": false,
         "gap": "Access enforcement failed because the Process Extension SDK component did not correctly authorize requests, allowing unauthenticated access to data that should require a session."
       }
-    }
+    },
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-129",
+        "name": "ENTERPRISE-ERP-MANAGEMENT-FUNCTION-AUTHENTICATION",
+        "description": "Agile PLM is the system of record for product designs and supplier data, and this flaw shows the Agile PLM Framework's Process Extension SDK component answering a crafted HTTP request from a caller holding no credential at all — the authorization decision is taken incorrectly inside the function rather than at the console login. Applied to this deployment the control means every Process Extension / SDK entry point on the Framework authorizes the caller before it returns any PLM content, and the Framework's HTTP surface is segmented so an untrusted network caller cannot reach that component in the first place. Least-privilege review of Agile PLM user roles does not touch this path: the attacker never holds an account, and the packet scores impact as unauthorized access to critical data or complete access to all Agile PLM Framework accessible data (C:H) rather than the privileges of some compromised user. Distinguishing test: from an untrusted network segment, send an unauthenticated HTTP request to each Process Extension SDK endpoint on a staging 9.3.6 instance and confirm it is refused before any PLM data is returned — an attestation that 'all PLM users authenticate at login' passes cleanly while this path stays open.",
+        "evidence": "Packet: CWE-863 incorrect authorization in the Oracle Agile PLM Framework's Software Development Kit / Process Extension component; an unauthenticated attacker with network access via HTTP sends a crafted request and obtains unauthorized access to critical data or complete access to all Agile PLM Framework accessible data. CVSS 3.1 base 7.5, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N; affected supported version 9.3.6. CISA KEV-listed 2024-11-21, active_exploitation confirmed.",
+        "gap_closes": [
+          "NIST-800-53-AC-3",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "Agile PLM sits in the supply-chain application tier that most estates patch on a quarterly application cadence, and the packet's own numbers are what make that cadence wrong here: a 7.5 base score with confidentiality-only impact and poc_available false will sort below every 9.x item in a score-ordered or exploit-availability-ordered queue, while the entry is KEV-listed with exploitation already confirmed. The control binds the clock to the KEV listing instead of to the score: the affected 9.3.6 Framework instance is taken through the vendor update inside the KEV-tier window. The packet records a vendor patch and no live-patch path, so there is no in-place mitigation to buy time with — where the update cannot land in that window the remaining lever is removing HTTP reachability of the Process Extension SDK surface from untrusted networks, recorded as a time-bound exception rather than as patched-per-SLA.",
+        "evidence": "Packet: cisa_kev true, kev_date 2024-11-21, active_exploitation confirmed, poc_available false, rwep_score 42, cvss 7.5. patch_available true, live_patch_available false, live_patch_notes null. Attack path is an unauthenticated crafted HTTP request to the Agile PLM Framework Process Extension SDK component (version 9.3.6).",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      }
+    ]
   },
   "CVE-2024-38813": {
     "name": "VMware vCenter Server Privilege Escalation Vulnerability",
@@ -38248,7 +39675,39 @@
         "adequate": false,
         "gap": "Least-functionality is the real fix here: the IOS HTTP admin server should be disabled, but CM-7 baselining rarely reaches retired edge routers still exposing /level/15/exec, so the CSRF surface persists."
       }
-    }
+    },
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-127",
+        "name": "UNSUPPORTED-NETWORK-DEVICE-ENUMERATION-AND-RETIREMENT",
+        "description": "A 2008-vintage flaw in the Cisco IOS 12.4 HTTP administration component on the 871 Integrated Services Router is reachable in 2026 only because the router is still racked and still answering. The control means the asset inventory has to carry an end-of-support date for every network-attached embedded device including routers, so a unit whose vendor has stopped issuing fixes but whose HTTP admin surface is still remotely reachable is discoverable before an advisory names it, not after. The distinguishing test for this device class: query the inventory for routers past end-of-support whose management interface answers from a segment with no operational need to reach it; any non-empty result without a replace-or-formally-risk-accept decision is the finding. A patch-management policy that assumes a fix always exists produces no record at all for this router, because there is no version to compare it against.",
+        "evidence": "Packet: affected product is the HTTP Administration component in Cisco IOS 12.4 on the 871 Integrated Services Router; patch_available is false and live_patch_available is false; live_patch_notes reads 'End-of-life or unpatched product with no vendor fix and no live-patch path; isolate or decommission affected systems.' CISA KEV-listed 2026-07-13 with active_exploitation confirmed (RWEP 70, CVSS 4.3). Citing gaps include ISO/IEC 27001:2022 A.8.8 (Management of technical vulnerabilities) and the NIS2 Art.21 network-security measures.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-network-security"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-122",
+        "name": "EOL-ASSET-DECOMMISSION",
+        "description": "There is no build of IOS an operator can move this router to, so for CVE-2008-4128 'remediation' means removal and nothing else. Applied to this device: any surviving unit must be segmented so that its HTTP admin server cannot be reached from any network an administrator browses the web from, and carried to decommission on a bounded, dated schedule rather than an open-ended risk acceptance. Segmentation is the compensating control, not the fix, because the exploit needs only an already-authenticated administrator's browser to be able to issue requests to /level/15/exec/- and /level/15/exec/-/configure/http on the device — the attacker never authenticates. The distinguishing test: from every segment an administrator's workstation can browse from, attempt to load the router's HTTP admin surface; anything that answers is within reach of the lure path, and a risk-acceptance memo with no removal date leaves a KEV-listed no-fix device in service indefinitely.",
+        "evidence": "Packet: patch_available false, live_patch_available false, live_patch_notes 'End-of-life or unpatched product with no vendor fix and no live-patch path; isolate or decommission affected systems.' Attack vector per packet: an attacker lures an already-authenticated IOS administrator to a crafted page that forces requests to /level/15/exec/- and /level/15/exec/-/configure/http, executing privilege-15 and configuration commands through the router HTTP admin server. CWE-352; CISA KEV-listed 2026-07-13, active_exploitation confirmed. Citing gaps name NIST SP 800-53 Rev 5 SC-7 (Boundary Protection) and UK CAF B4 (System security) as insufficient.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SC-7",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-038",
+        "name": "MITIGATION-ACTIVE-PATCH-PENDING-VERDICT-CLASS",
+        "description": "This router can never reach a 'patched' verdict — the packet records no vendor fix and no live-patch path — so vulnerability-management reporting has to represent it as its own state rather than as an overdue patch item that rolls forward every cycle. For CVE-2008-4128 the register entry must read: full exposure, contained by segmentation of the HTTP admin surface, with a dated decommission action attached; not 'patch pending'. The distinguishing test: pull the register entry for this CVE and confirm the recorded state names the compensating control and the removal date; an estate whose report shows only an aging patch-SLA breach has recorded the exposure without ever forcing the only decision that ends it.",
+        "evidence": "Packet: patch_available false and live_patch_available false, with live_patch_notes stating no vendor fix and no live-patch path exists; CISA KEV-listed 2026-07-13 with active_exploitation confirmed and poc_available false. The citing gap ISO/IEC 27001:2022 A.8.8 (Management of technical vulnerabilities) is patch-closure-shaped and has no verdict for a product with no fix.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8"
+        ]
+      }
+    ]
   },
   "CVE-2020-14644": {
     "name": "Oracle WebLogic Server Remote Code Execution Vulnerability",
@@ -38618,7 +40077,30 @@
         "adequate": false,
         "gap": "Malicious-code protection keyed on file extension/type is defeated precisely because the vulnerability misrepresents the extension to both the user and naive filters."
       }
-    }
+    },
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-120",
+        "name": "DOWNLOAD-PROVENANCE-ENFORCEMENT",
+        "description": "The victim in this chain ran the file because of what it was called, not what it was: the packet records the downloaded HTA being presented with a filename that read as a PDF. That makes the untrusted-origin marking, applied at the ingress boundary and independent of anything the file carries, the control that still functions when the displayed name lies. For this CVE it means the .URL lure arriving by mail or web download is tagged as externally sourced at the gateway, and the tag survives the transformation the packet describes — a file that is renamed, or fetched onward through the handler the lure opens, must inherit the untrusted marking rather than lose it, so the artifact the user is invited to double-click still triggers an untrusted-content decision. The distinguishing test: deliver a file whose presented name and actual handler disagree through each ingress path onto a managed workstation and confirm it still reaches the user marked as untrusted; a user-application-hardening attestation that covers macro and ActiveX settings, and user training to 'check the extension', are exactly what a filename-spoofing flaw defeats.",
+        "evidence": "Packet attack_vector: 'Void Banshee lured victims with a .URL that used CVE-2024-38112 to open attacker content in MSHTML/IE, then used CVE-2024-43461 to spoof the downloaded HTA's filename as a PDF so the victim ran it, dropping Atlantida stealer.' CWE-451; CISA KEV-listed 2024-09-16 with active_exploitation confirmed; RWEP 79, CVSS 8.8, poc_available true. Citing gaps name ASD Essential Eight user application hardening, NIST SP 800-53 SI-3 (Malicious Code Protection) and ISO/IEC 27001:2022 A.8.7 (Protection against malware) as insufficient.",
+        "gap_closes": [
+          "AU-Essential-8-App-Hardening",
+          "NIST-800-53-SI-3",
+          "ISO-27001-2022-A.8.7"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "For this MSHTML flaw the packet gives a vendor update and no live-patch path, and states the update requires a reboot to take effect — so the KEV clock has to run from the 2024-09-16 listing through completed reboot of every affected endpoint, not to the moment the update is staged or downloaded. Until that reboot lands, the endpoint still renders the attacker-chosen filename to the user, which is the whole exploitation step this CVE contributes to the chain. Where the reboot cannot be taken inside the window, the compensating position has to be documented explicitly for those hosts rather than assumed from the deployment report. The distinguishing test: measure elapsed time from the KEV listing to the last endpoint's post-update reboot; a fleet reported as compliant on update-deployment counts while endpoints await restart has not closed the window.",
+        "evidence": "Packet: CISA KEV-listed 2024-09-16, active_exploitation confirmed, RWEP 79, CVSS 8.8. patch_available true, live_patch_available false, live_patch_notes 'No live-patching primitive for this product; the vendor update requires a reboot and is the remediation.' The packet places this CVE as the victim-deception step of a chain that also uses CVE-2024-38112 and ends in the Atlantida stealer. Citing gaps name NIST SP 800-53 SI-2 (Flaw Remediation) and NIS2 Art.21 vulnerability handling as insufficient.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      }
+    ]
   },
   "CVE-2024-8190": {
     "name": "Ivanti Cloud Services Appliance OS Command Injection Vulnerability",
@@ -38692,7 +40174,40 @@
         "adequate": false,
         "gap": "Malicious-code protection that keys off MOTW/Protected View is directly undermined when the mark is stripped, so signature/behavioral gating never triggers on the downloaded payload."
       }
-    }
+    },
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-041",
+        "name": "PROTECTION-MECHANISM-FAILURE-CLASS-REGRESSION",
+        "description": "What fails here is a defense, not a parser: a crafted .lnk whose target path forces Windows to rewrite and canonicalize the shortcut drops the Zone.Identifier alternate data stream, so files opened afterwards skip Protected View and SmartScreen. An estate can hold every MOTW, SmartScreen and Protected View policy in the enforced state and still detonate the payload, which is why this product needs a standing class-level regression battery rather than a one-off check that this shortcut is now tagged — the known Zone.Identifier-stripping primitives replayed against detonation chambers, EDR rules and application-hardening policy on every patch deployment, since the packet's CWE-693 classification says the mechanism itself failed and mechanisms that fail once tend to fail again on the same primitive. The distinguishing test: deliver a shortcut-borne file through a managed workstation's normal path after the update lands and confirm the opened file still carries its zone marking and still opens in Protected View. Confirming that SmartScreen and Protected View are 'enabled' is a statement about policy state, not evidence that the marking survives an attacker-chosen delivery container.",
+        "evidence": "Packet: CWE-693 protection-mechanism failure, Windows Mark of the Web (MOTW). Attack path is a crafted .lnk file whose target path forces Windows to rewrite/canonicalize the shortcut, dropping the Zone.Identifier ADS and removing the Mark-of-the-Web so subsequently opened files skip Protected View and SmartScreen prompts. CISA KEV-listed 2024-09-10, active_exploitation confirmed, poc_available true, cvss 5.4, rwep_score 75.",
+        "gap_closes": [
+          "AU-Essential-8-App-Hardening",
+          "NIST-800-53-SI-3",
+          "ISO-27001-2022-A.8.7"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-119",
+        "name": "ARCHIVE-CONTENT-TYPE-PROVENANCE",
+        "description": "On this CVE the endpoint's own provenance marking is the thing that breaks — the Zone.Identifier ADS is dropped when Windows canonicalizes the attacker's shortcut — so the untrusted-origin decision cannot be left to metadata that rides along with the delivered file and that the attacker's .lnk controls. The operator-side expression is that the mail gateway and file-share boundary establish and hold the origin decision themselves: externally-sourced shortcut files and the archives carrying them are blocked, detonated or quarantined at ingress, so a file whose zone marking has been stripped on the workstation is never treated as locally-sourced content on the strength of the missing ADS. The distinguishing test: deliver a .lnk-bearing item through each ingress path and confirm the boundary acts on it, instead of confirming only that Protected View and SmartScreen are enabled on the endpoint — the packet's path is specifically the removal of the tag those two features key off, so an endpoint-only attestation says nothing about this delivery.",
+        "evidence": "Packet: the delivered artifact is a crafted .lnk file; Windows rewriting the shortcut's target path drops the Zone.Identifier ADS, removing the Mark-of-the-Web, so subsequently opened files skip Protected View and SmartScreen. poc_available true and active_exploitation confirmed (CISA KEV 2024-09-10), so the delivery path is in live use.",
+        "gap_closes": [
+          "AU-Essential-8-App-Hardening",
+          "NIST-800-53-SI-3",
+          "ISO-27001-2022-A.8.7"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "At CVSS 5.4 this is the shape of finding a score-ordered queue puts below every critical in the same month's rollup, yet the packet has it KEV-listed with confirmed in-the-wild exploitation and a public PoC — its value to an attacker is that it silences the prompt the user would otherwise see, not that it scores high. The control replaces the score-ordered queue with a KEV-triggered clock: the Windows update that fixes the shortcut-rewrite path is deployed and the reboot taken across the affected fleet inside the KEV window, because the packet records no live-patching primitive for this product and names the reboot-requiring vendor update as the remediation. There is no configuration toggle that holds the line in the meantime — MOTW is itself the control being bypassed — so an estate that defers the reboot into its normal cadence is relying entirely on gateway-side delivery blocking, and should record that as its actual posture.",
+        "evidence": "Packet: cisa_kev true, kev_date 2024-09-10, active_exploitation confirmed, poc_available true, cvss 5.4, rwep_score 75. patch_available true, live_patch_available false; live_patch_notes: 'No live-patching primitive for this product; the vendor update requires a reboot and is the remediation.'",
+        "gap_closes": [
+          "NIST-800-53-SI-2"
+        ]
+      }
+    ]
   },
   "CVE-2024-38014": {
     "name": "Microsoft Windows Installer Improper Privilege Management Vulnerability",
@@ -38766,7 +40281,28 @@
         "adequate": false,
         "gap": "Essential Eight application hardening relies on macro-execution restrictions in Office, exactly the enforcement this flaw defeats, so the mitigation is silently bypassed."
       }
-    }
+    },
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-041",
+        "name": "PROTECTION-MECHANISM-FAILURE-CLASS-REGRESSION",
+        "description": "The mechanism that fails on this entry is Office's macro-blocking of untrusted content: the packet has a user lured into opening a malicious Publisher file and the security-feature bypass causing embedded macros to run even though policy would normally stop them. That is why a user-application-hardening attestation passes cleanly while the estate is exposed — the attestation is read off the policy setting, and the policy setting is not what failed; the handler enforcing it is. For this CVE the control means the macro-blocking policy is regression-tested by detonating a Publisher document on a managed image, not only Word and Excel samples, and that the Publisher case stays in the battery permanently instead of being retired once this CVE is patched, because CWE-693 bypasses recur against the same primitive and each Office handler enforces the policy separately. The same specificity applies to the endpoint side: application-control and EDR policies written around Office-borne execution must name the Publisher handler explicitly rather than assuming the Word/Excel process images cover the suite. Precondition, stated plainly: this is a verification and detection control, not containment. It proves whether the enforcement path holds for the cases tested and produces telemetry when it does not; it does nothing for a host that has not yet taken the vendor update, and because the packet puts execution in the user's own context, nothing here stops the code from running once the document is opened on an unpatched host.",
+        "evidence": "Packet: CWE-693, entry name \"Microsoft Publisher Protection Mechanism Failure Vulnerability\"; attack_vector — \"A user is lured into opening a malicious Publisher file; the security-feature bypass causes Office to run embedded macros even though macro-blocking policy would normally stop untrusted content, giving the attacker code execution in the user's context.\" CISA KEV-listed 2024-09-10 with active_exploitation confirmed; CVSS 7.3, RWEP 46, poc_available false. citing_gaps record AU-Essential-8-App-Hardening (User application hardening) and ISO-27001-2022-A.8.7 (Protection against malware) as insufficient for this entry.",
+        "gap_closes": [
+          "AU-Essential-8-App-Hardening",
+          "ISO-27001-2022-A.8.7"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "Remediation on this entry is the vendor update, and the packet removes the standard reason for deferring it — there is no live-patching primitive for the product and the update requires no reboot, so the fix reaches an endpoint without an outage and the KEV clock that opened 2024-09-10 is the governing deadline. The measurement problem is specific to this CVE: the packet's own vector places the bypass in Office's macro-blocking, so the vulnerable component is an application inside the productivity suite rather than the OS, and an estate that tracks OS patch compliance while treating the suite as self-updating cannot say which endpoints still carry the vulnerable Publisher handler. Completion has to be measured per host against the installed suite build on every endpoint where Publisher is present, which first requires knowing where it is installed — Publisher is routinely absent from application inventories because it is rarely used deliberately, and an endpoint nobody counts is an endpoint nobody patches. Hosts held on a deferred update channel remain exposed for the full deferral length after the fix has shipped, so that deferral is the exposure window and should be recorded as one. Precondition on the closure claim: this control governs how fast the fix lands and how completion is proven; it does not reduce risk on a host still awaiting the update, where the only remaining lever is the delivery path and the detonation-tested enforcement covered by the regression control above. The packet records no public PoC, which lowers commodity-exploitation likelihood but does not move the clock — exploitation is already confirmed.",
+        "evidence": "Packet: patch_available true, live_patch_available false, live_patch_notes \"No live-patching primitive for this product; the vendor update (no reboot required) is the remediation.\" CISA KEV-listed 2024-09-10 with active_exploitation confirmed; poc_available false; CVSS 7.3, RWEP 46. attack_vector places the bypass in Office's macro-blocking of untrusted content. citing_gaps record NIST-800-53-SI-2 (Flaw Remediation) as insufficient for this entry.",
+        "gap_closes": [
+          "NIST-800-53-SI-2"
+        ]
+      }
+    ]
   },
   "CVE-2024-40766": {
     "name": "SonicWall SonicOS Improper Access Control Vulnerability",
@@ -39062,7 +40598,31 @@
         "adequate": false,
         "gap": "Access enforcement is bypassed because authorization is checked on requestUri while rendering follows overrideViewUri — the control assumes a single consistent decision point, which this split defeats."
       }
-    }
+    },
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-129",
+        "name": "ENTERPRISE-ERP-MANAGEMENT-FUNCTION-AUTHENTICATION",
+        "description": "OFBiz takes its authorization decision against the requestUri but renders the screen named by overrideViewUri, so the function that actually runs — ProgramExport, which evaluates a Base64-encoded Groovy program as the OFBiz process user — never authorizes its own caller. Bound to this product, the control means every OFBiz screen and export/scripting endpoint authorizes the caller at the point of execution rather than inheriting a verdict taken on the routing key, and the views that can reach a code-evaluation path are refused for any request whose entry point was an unauthenticated public endpoint. The cited access-enforcement control is precisely what fails here: the attacker prefixes a public endpoint (the packet names forgotPassword) so the request never reaches OFBiz's user/role permission model at all — a deployment can pass an access-enforcement review of its permission matrix while this path stays fully open, which is why AC-3 is recorded against this entry rather than credited. The second half of the control, keeping the OFBiz admin/scripting surface off untrusted networks, carries a precondition that must be stated: it bounds exposure only for instances that have no business serving untrusted users, so an internet-facing OFBiz storefront or partner portal cannot rely on it and must take the vendor update; and neither measure evicts a Groovy payload already executed as the process user on an instance that was reachable during the exposure window. Distinguishing test: on a staging instance, request a public endpoint with the view overridden to ProgramExport and confirm the request is refused before the screen renders.",
+        "evidence": "Packet: CWE-863; attack_vector — \"OFBiz checks authorization against the requestUri but renders the screen named by overrideViewUri. An unauthenticated attacker prefixes a public endpoint (e.g. forgotPassword) and overrides the view to ProgramExport, then posts a Base64-encoded Groovy program that executes as the OFBiz process user.\" CVSS 9.8, RWEP 67, poc_available true; CISA KEV-listed 2024-08-27 with active_exploitation confirmed. citing_gaps record NIST-800-53-AC-3 (Access Enforcement) and UK-CAF-B4 (System security) as insufficient for this entry.",
+        "gap_closes": [
+          "NIST-800-53-AC-3",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "The packet records a vendor fix, a public PoC and confirmed in-the-wild exploitation on an unauthenticated code-execution path, so the OFBiz upgrade off the affected 18.12.14-and-earlier line to 18.12.15 runs on the clock that opened with the 2024-08-27 KEV listing, not in the next ERP change window. The usual deferral argument does not exist on this entry: the packet states there is no live-patching primitive for this product and that the vendor update requires no reboot, so the only remaining constraint is the application's own restart/change process — an ERP change-freeze is a scheduling preference here, not a technical blocker, and recording one as a compensating control leaves an unauthenticated Groovy-execution path open. Measure completion from the deployed webapp's reported version rather than from a patch-management row saying \"OFBiz updated\": these deployments are commonly customized builds where the inventory record and the running instance diverge. Precondition on the closure claim: applying the update ends new exploitation of this path but does nothing about an instance that was reachable while unpatched — anything already executed as the OFBiz process user survives the upgrade, so an instance exposed during the window needs forensic triage rather than a patch-and-close.",
+        "evidence": "Packet: patch_available true; vector — \"This issue affects Apache OFBiz: through 18.12.14. Users are recommended to upgrade to version 18.12.15, which fixes the issue.\" live_patch_available false, live_patch_notes \"No live-patching primitive for this product; the vendor update (no reboot required) is the remediation.\" CISA KEV-listed 2024-08-27, active_exploitation confirmed, poc_available true, RWEP 67, CVSS 9.8. citing_gaps: AU-Essential-8-Patch, ISO-27001-2022-A.8.8, NIST-800-53-SI-2, NIS2-Art21-vulnerability-handling.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-handling"
+        ]
+      }
+    ]
   },
   "CVE-2024-7971": {
     "name": "Google Chromium V8 Type Confusion Vulnerability (CVE-2024-7971)",
@@ -39099,7 +40659,30 @@
         "adequate": false,
         "gap": "Malicious-code protection at the endpoint did not stop a memory-corruption chain that escaped the browser sandbox and loaded a kernel rootkit (FudModule)."
       }
-    }
+    },
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-057",
+        "name": "BROWSER-MANAGED-UPDATE-NO-DEFERRAL",
+        "description": "The packet gives a clean remediation and a precise boundary: the vendor update, no reboot required, no live-patching primitive, with builds prior to 128.0.6613.84 affected. The control for this CVE is therefore that the browser's security channel is not held behind an enterprise update ring's validation cycle, and that completion is measured per host against the installed browser build rather than against 'auto-update is enabled in policy' — the latter is the state a managed fleet is usually attested on, and it is satisfied while version-pinned, kiosk, and long-uptime roaming hosts sit behind the fixed build. The urgency here is not carried by exploit availability, which is the second half of why this needs enforcing: the packet records poc_available false alongside a 2024-08-26 KEV listing with confirmed in-the-wild exploitation, so a prioritization pipeline that ranks on public-PoC presence will under-rank a bug a named actor was already running in a full chain. The precondition to state is a measurement one: the fleet number has to be the build each host is actually running, not the build the management console reports as approved or downloaded, because an approved-but-not-running update leaves the host exposed on the same terms as one that never received it.",
+        "evidence": "Packet vector: 'Type confusion in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to exploit heap corruption via a crafted HTML page. (Chromium security severity: High)'. CWE-843; CISA KEV-listed 2024-08-26 with active_exploitation confirmed; CVSS 9.6, RWEP 56; poc_available false. patch_available true, live_patch_available false, live_patch_notes: 'No live-patching primitive for this product; the vendor update (no reboot required) is the remediation.' Citing gaps AU-Essential-8-App-Hardening, ISO-27001-2022-A.8.8, NIST-800-53-SI-2 and UK-CAF-B4.",
+        "gap_closes": [
+          "AU-Essential-8-App-Hardening",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-043",
+        "name": "NATION-STATE-INITIAL-ACCESS-IR-ESCALATION",
+        "description": "The packet describes this bug as the opening stage of a chain rather than as a standalone browser fault: a victim visits an attacker-controlled page, crafted JavaScript triggers the V8 type confusion, the resulting heap corruption yields renderer code execution, and Citrine Sleet chained that with a Windows sandbox escape to deploy the FudModule rootkit. Commodity incident response handles only the visible half — a browser anomaly on a user's workstation — and resolves it with a browser reset or a decision scoped to the browser, which is exactly the under-escalation this control exists to stop, because the terminal state of the chain is kernel-level persistence that outlives anything done to the browser. For this CVE the runbook needs a trigger a responder can act on in the moment: renderer-level compromise indicators on a host that browsed externally during the exposure window escalate to full host triage and to the explicit question of whether the second-stage escape ran, rather than being closed out by confirming the browser has since been updated — the update closes the entry point and says nothing about a host already through it. The precondition worth naming is that the actor attribution in this packet was available only after the fact, so the escalation criterion has to be the chain shape (browser renderer execution followed by evidence of privilege escalation or kernel-level persistence), not an actor name the responder will not hold on day one.",
+        "evidence": "Packet attack_vector: 'A victim visits an attacker-controlled page that runs crafted JavaScript triggering a V8 type confusion; the resulting heap corruption yields renderer RCE, which Citrine Sleet chained with a Windows sandbox escape to deploy the FudModule rootkit.' CISA KEV-listed 2024-08-26 with active_exploitation confirmed; poc_available false. NIS2-Art21-incident-handling is recorded as a citing gap on this entry.",
+        "gap_closes": [
+          "NIS2-Art21-incident-handling"
+        ]
+      }
+    ]
   },
   "CVE-2024-39717": {
     "name": "Versa Director Dangerous File Type Upload Vulnerability",
@@ -39466,7 +41049,30 @@
         "adequate": false,
         "gap": "Standard endpoint monitoring rarely flags a race-condition kernel EoP; without behavioral SYSTEM-token-theft detection the escalation step is invisible, and no patch existed to remediate during the zero-day window."
       }
-    }
+    },
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-145",
+        "name": "ACTIVELY-EXPLOITED-OS-LPE-REMEDIATION-WINDOW-ENFORCEMENT",
+        "description": "The defect is in the Windows kernel itself, so it executes below every account-level boundary the endpoint estate is audited on, and the packet's path — low-privilege code execution first (its example is a Chromium renderer sandbox escape), then a kernel race corrupting kernel state to reach SYSTEM — means the attacker is already an ordinary user when the escalation begins. For this CVE the control means the Windows update carrying the fix is driven across the whole affected endpoint fleet on the KEV clock that opened 2024-08-13 rather than folded into the next monthly rollup, and that completion is measured per host as installed build against the fixed build for its SKU, not as 'update approved' or 'update downloaded' in the management console. The packet records no live-patching primitive and an update that requires a reboot, so a host that has taken the update but not restarted is still running the vulnerable kernel and must be counted as exposed rather than remediated — the pending-reboot population is the real residual, and it is exactly the population a patch-compliance dashboard reports as green. Tightening account privilege does not contain this path: the escalation begins in whatever context the initial low-privilege execution landed in and terminates at SYSTEM, so a least-privilege attestation passes cleanly while the flaw stays fully exploitable. Distinguishing test: query the fleet for hosts whose installed build carries the fix but whose uptime predates that installation, and confirm those hosts are still counted against the KEV clock rather than reported as patched.",
+        "evidence": "Packet: CISA KEV-listed 2024-08-13, active_exploitation 'confirmed', RWEP 59, CVSS 7.0. patch_available true, live_patch_available false, live_patch_notes 'No live-patching primitive for this product; the vendor update requires a reboot and is the remediation.' Attack vector: 'After gaining initial low-privilege code execution (e.g. via a Chromium renderer sandbox escape), the attacker triggers a Windows Kernel race condition to corrupt kernel state and elevate to SYSTEM.' CWE-591.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-vulnerability-handling",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-003",
+        "name": "KERNEL-EXPLOITATION-DETECTION",
+        "description": "Between the 2024-08-13 KEV listing and the completed reboot of every affected host, detection is the only thing standing between a low-privilege foothold and SYSTEM on this path. Anchor it on what the packet actually documents: the attacker already holds low-privilege code execution, repeatedly attempts a kernel race to corrupt kernel state, and ends holding a SYSTEM token. The durable observable is therefore the privilege transition itself — a sandboxed or low-integrity process acquiring a SYSTEM token or having its integrity level raised — together with the repeated kernel-object access the race requires from a process that has no reason to make it. Do not build the rule on process crashes or respawns: an exploit that retries the race in a tight loop inside one process never crashes, so a crash-correlated rule reports clean through the real attempt, and the packet establishes no crash signal to key on. Do not build it on tool signatures either — the packet records no public PoC, so there is no stable IoC set and a signature-shaped rule reports clean while the behaviour is present. Alert on the transition within 60 seconds. Two preconditions bound this control and must be stated rather than assumed. It detects, it does not prevent: the kernel race stays reachable until the rebooted fixed build lands, so it never substitutes for the update window. And it holds only where telemetry leaves the host continuously — once the race is won the attacker holds SYSTEM and can stop or blind a local agent, so on hosts with no reporting agent, or where telemetry is merely pulled on a schedule, this contributes nothing and the reboot window is the entire defence. Distinguishing test: on a staging host, have a low-integrity process acquire a SYSTEM token and confirm the alert reaches the off-host collector inside 60 seconds — validate the privilege transition, not a synthetic crash.",
+        "evidence": "Packet: attack vector states 'Exploitation depends on repeatedly winning the race' and that escalation follows initial low-privilege code execution, ending at SYSTEM. poc_available false. CISA KEV-listed 2024-08-13, active_exploitation 'confirmed'. live_patch_available false with the vendor update requiring a reboot. NIST-800-53-SI-4 (System Monitoring) is recorded as a citing framework gap on this entry.",
+        "gap_closes": [
+          "NIST-800-53-SI-4"
+        ]
+      }
+    ]
   },
   "CVE-2024-38193": {
     "name": "Microsoft Windows Ancillary Function Driver for WinSock Privilege Escalation Vulnerability",
@@ -40095,7 +41701,42 @@
         "adequate": false,
         "gap": "The 2024-08-05 KEV due date lagged the near-immediate mass exploitation of a preauth RCE affecting every default GeoServer install; SI-2 remediation windows are too slow for this exposure."
       }
-    }
+    },
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-025",
+        "name": "CONFIGURATION-SIDE-LIVE-PATCH-INVENTORY",
+        "description": "The GeoServer advisory in this packet ships a deployment-side mitigation that removes the vulnerable code without waiting for the upgrade: deleting the gt-complex-x.y.jar matching the running GeoTools version (the packet's own example is gt-complex-31.1.jar on GeoServer 2.25.1) strips the JXPath evaluation path that the OGC request handlers reach. For this product the control means knowing, per instance, whether the gt-complex module is load-bearing before the next disclosure — because the same advisory states that removing the jar may break GeoServer functionality or prevent GeoServer from deploying where that module is needed. An operator who discovers that during an incident has neither a mitigation nor a tested rollback. Hold a rehearsed jar-removal-and-restart procedure for the instances where gt-complex is not required, keep it deployable independently of the upgrade to 2.22.6 / 2.23.6 / 2.24.4 / 2.25.2, and record which instances cannot take it so their exposure is managed by reachability instead. The packet records no live-patching primitive for this product, so between the KEV listing and a completed upgrade this configuration path is the only lever that removes the unauthenticated code-execution sink rather than merely narrowing who can reach it.",
+        "evidence": "Packet vector: \"multiple OGC request parameters allow Remote Code Execution (RCE) by unauthenticated users through specially crafted input against a default GeoServer installation due to unsafely evaluating property names as XPath expressions\"; \"Versions 2.22.6, 2.23.6, 2.24.4, and 2.25.2 contain a patch for the issue. A workaround exists by removing the `gt-complex-x.y.jar` file from the GeoServer where `x.y` is the GeoTools version (e.g., `gt-complex-31.1.jar` if running GeoServer 2.25.1). This will remove the vulnerable code from GeoServer but may break some GeoServer functionality or prevent GeoServer from deploying if the gt-complex module is needed.\" patch_available: true; live_patch_available: false; live_patch_notes: \"No live-patching primitive for this product; the vendor update (no reboot required) is the remediation.\" CISA KEV 2024-07-15, active_exploitation confirmed, CVSS 9.8, RWEP 70.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-038",
+        "name": "MITIGATION-ACTIVE-PATCH-PENDING-VERDICT-CLASS",
+        "description": "A GeoServer instance with gt-complex removed and a GeoServer instance upgraded to 2.22.6 / 2.23.6 / 2.24.4 / 2.25.2 are not the same compliance state, and this CVE makes the difference operationally sharp rather than academic. The mitigated instance still runs an affected release and still reports an affected version, so nothing in its self-description distinguishes it from an unremediated one; and because the mitigation is the absence of a file rather than a change to the code, any operation that rebuilds the deployment from its original artifact — redeploying the WAR, rebuilding the container image, installing an extension that pulls the module back — silently restores unauthenticated remote code execution with no new CVE, no version change, and no failed control test. The audit verdict for such an instance must therefore be recorded as a compensating-control state carrying a time-bound action item to reach a fixed release, never as \"patched per SLA\". The distinguishing test for this deployment: redeploy a mitigated instance through its normal build-and-release pipeline, then confirm the gt-complex jar is still absent afterwards — an estate that verified the removal once, by hand, has verified nothing about the state its pipeline will produce tomorrow.",
+        "evidence": "Packet vector: workaround is \"removing the `gt-complex-x.y.jar` file from the GeoServer\", which \"will remove the vulnerable code from GeoServer but may break some GeoServer functionality or prevent GeoServer from deploying if the gt-complex module is needed\", while the fix is \"Versions 2.22.6, 2.23.6, 2.24.4, and 2.25.2\". patch_available: true; live_patch_available: false. CISA KEV 2024-07-15 with active_exploitation confirmed; attack_vector: \"An unauthenticated attacker sends an OGC request (WFS/WMS/WPS) whose property name is a JXPath expression; GeoServer evaluates it via the GeoTools/commons-jxpath path and executes arbitrary code.\"",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-018",
+        "name": "SCANNER-PAPER-COMPLIANCE-TEST",
+        "description": "This CVE carries two distinct false-clean traps, and the packet names both. The first is scoping: the XPath evaluation was intended only for complex feature types (Application Schema data stores) but is applied to simple feature types as well, which is why the advisory states the vulnerability applies to ALL GeoServer instances including a default installation — so an assessment that excluded the estate's simple-feature deployments as \"not the affected configuration\" excluded nothing real. The second is version reading: the vulnerable code is in the GeoTools library GeoServer calls, whose jar version numbering differs from the GeoServer release it ships with (gt-complex-31.1.jar on GeoServer 2.25.1), and a jar-removal-mitigated host still advertises an affected GeoServer version. Version-string scanning therefore misreports in both directions on this product. The operational test that separates paper compliance from a demonstrated result: submit a property name containing a benign JXPath expression through each of the six request types the advisory confirms as exploitable — WFS GetFeature, WFS GetPropertyValue, WMS GetMap, WMS GetFeatureInfo, WMS GetLegendGraphic and WPS Execute — against a staging instance and confirm none of them evaluates it. A scan report keyed on the GeoServer banner alone has not tested any of those paths.",
+        "evidence": "Packet vector: \"This XPath evaluation is intended to be used only by complex feature types (i.e., Application Schema data stores) but is incorrectly being applied to simple feature types as well which makes this vulnerability apply to **ALL** GeoServer instances\"; \"this vulnerability has been confirmed to be exploitable through WFS GetFeature, WFS GetPropertyValue, WMS GetMap, WMS GetFeatureInfo, WMS GetLegendGraphic and WPS Execute requests\"; \"The GeoTools library API that GeoServer calls evaluates property/attribute names for feature types in a way that unsafely passes them to the commons-jxpath library\"; workaround jar named as `gt-complex-31.1.jar` for GeoServer 2.25.1. CISA KEV 2024-07-15, active_exploitation confirmed, CVSS 9.8.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2024-23692": {
     "name": "Rejetto HTTP File Server Template Engine Injection Vulnerability",
@@ -40132,7 +41773,30 @@
         "adequate": false,
         "gap": "SI-2 flaw remediation has no vendor patch to apply for EoL HFS 2.3m; only decommission/migration mitigates."
       }
-    }
+    },
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-122",
+        "name": "EOL-ASSET-DECOMMISSION",
+        "description": "For Rejetto HFS there is no remediation to schedule. The packet records no vendor fix, no live-patch path, and the product unsupported at and below 2.3m as of the CVE assignment date, so exposure that persists is exposure no future maintenance window will ever close — the usual vulnerability-management response of assigning a patch due date produces a register entry that can never be satisfied. What this control means for this product: enumerate every HFS instance at 2.3m or earlier, including the ones nobody registered as a service, because HFS is characteristically stood up ad hoc to hand a file to somebody and then left running; take its HTTP listener off every untrusted network immediately, which for these hosts usually means withdrawing a router port-forward or firewall publish rather than reconfiguring the application; and set a dated commitment to replace it with a supported file-transfer product and remove the binary. Reachability is the whole exploit precondition here — the request that runs commands carries its payload in the search parameter with an empty Host header to defeat filtering and needs no credential at all, so any instance that answers an HTTP request from an untrusted network is exploitable by anyone who can reach it. Segmentation is the mandatory interim state, not a substitute for removal; leaving a confirmed-exploited unpatchable service behind a firewall indefinitely converts a temporary compensating control into a permanent accepted breach path.",
+        "evidence": "Packet: patch_available false; live_patch_available false; live_patch_notes \"End-of-life or unpatched product with no vendor fix and no live-patch path; isolate or decommission affected systems.\" vector: \"Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection vulnerability. This vulnerability allows a remote, unauthenticated attacker to execute arbitrary commands on the affected system by sending a specially crafted HTTP request. As of the CVE assignment date, Rejetto HFS 2.3m is no longer supported.\" attack_vector: \"An unauthenticated attacker sends an HTTP request whose 'search' parameter contains HFS template macros with an empty Host header to bypass filtering; the server evaluates the injected {.exec.}/{.chr.} macros and runs arbitrary OS commands.\" CISA KEV 2024-07-09, active_exploitation confirmed, CVSS 9.8, RWEP 81, poc_available true.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "NIST-800-53-SC-7",
+          "NIS2-Art21-network-security"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-038",
+        "name": "MITIGATION-ACTIVE-PATCH-PENDING-VERDICT-CLASS",
+        "description": "This CVE is the case the three-state verdict exists for, because the state every framework treats as the destination — binary patch deployed — is permanently unavailable. The packet gives no vendor fix and an unsupported product, so an HFS instance can only ever occupy the compensating-control state (network isolation holding the unauthenticated macro-injection path out of reach) or the full-exposure state, and the compliance record has to say which, with a decommission date attached. The failure this control prevents is procedural rather than technical: a register that records \"remediation blocked pending vendor patch\" for an unsupported product produces an entry that renews quietly at every review, reads as diligence, and never escalates, while the service stays reachable and confirmed-exploited. The distinguishing test: query the vulnerability register for every entry whose remediation is blocked on a vendor fix, and check each against the product's support status — any entry for an unsupported product that carries a patch due date instead of a decommission date is a finding, because the due date describes an event that will not occur.",
+        "evidence": "Packet: patch_available false; live_patch_available false; live_patch_notes \"End-of-life or unpatched product with no vendor fix and no live-patch path; isolate or decommission affected systems.\" vector: \"As of the CVE assignment date, Rejetto HFS 2.3m is no longer supported.\" CISA KEV 2024-07-09 with active_exploitation confirmed and poc_available true; RWEP 81, CVSS 9.8.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2024-38080": {
     "name": "Microsoft Windows Hyper-V Privilege Escalation Vulnerability",
@@ -40674,7 +42338,39 @@
         "adequate": false,
         "gap": "Boundary protection is undermined because the vulnerable component IS the boundary device; SC-7 assumes the gateway is trustworthy, but the traversal turns the VPN concentrator into an unauthenticated file-read oracle."
       }
-    }
+    },
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-030",
+        "name": "PERIMETER-DEVICE-ZERODAY-SLA-TIER",
+        "description": "A Check Point Quantum Security Gateway is not a server behind the boundary, it is the boundary, and the packet places the vulnerable MyCRL endpoint on the internet-facing surface of gateways running the Remote Access VPN or Mobile Access blades. This control's tier therefore governs: vendor fix deployed within hours of the KEV listing, or isolation of the vulnerable interface -- meaning the remote-access and mobile-access portal taken out of service -- as the interim, rather than the standard multi-week appliance-patch window that would otherwise apply. Two packet facts shape how the tier runs on this product. First, the vendor update requires a reboot and there is no live-patching primitive for this product, so the tier's clock cannot stop at 'hotfix installed'; it stops at 'gateway restarted', because until then the vulnerable endpoint is still being served. Second, the exposure is conditioned on which blades are enabled, so the tier's opening action is enumerating which gateways are internet-connected with Remote Access VPN or Mobile Access enabled -- that list bounds the interim exposure and tells the operator which units must be isolated if the reboot cannot happen immediately. Distinguishing test: ask the operator to produce, within the tier's own window, the list of internet-facing gateways with those blades enabled and the restart timestamp for each; an appliance-patching programme that can only report a change-ticket queue has no tier for the device that terminates every remote-access session.",
+        "evidence": "Packet facts only: CISA KEV-listed 2024-05-30 with active_exploitation 'confirmed', poc_available true, CVSS 8.6 and RWEP 81. The vector records the exposure as affecting Check Point Security Gateways 'once connected to the internet and enabled with remote Access VPN or Mobile Access Software Blades', and states that a security fix mitigating the vulnerability is available. attack_vector: an unauthenticated attacker sends a path-traversal request to the gateway's MyCRL endpoint and reads arbitrary appliance files. patch_available is true; live_patch_available is false, with the live-patch note recording 'No live-patching primitive for this product; the vendor update requires a reboot and is the remediation.' The citing gaps include NIST SP 800-53 SC-7 boundary protection and NIS2 Art. 21 security of network and information systems -- controls that presume the boundary device itself is sound -- alongside AU Essential Eight patch operating systems.",
+        "gap_closes": [
+          "NIST-800-53-SC-7",
+          "NIS2-Art21-network-security",
+          "AU-Essential-8-Patch"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "This control normally fires on pre-auth RCE; here the primitive is a pre-auth arbitrary file read, and that difference makes the control more necessary rather than less, because the entire product of the exploit is secret material. Per the packet the attacker reads arbitrary appliance files and harvests credentials and configuration that enable follow-on VPN and lateral access -- so applying the vendor fix and rebooting closes the read path while leaving every secret already taken fully valid. For a gateway that sat internet-connected with Remote Access VPN or Mobile Access enabled before the fix landed, the runbook default must therefore be assume-exfiltrated: rotate the local account and administrative credential material the gateway holds, re-issue the certificate and key material it stores, treat the stored VPN configuration as known to the attacker, and reset any directory or authentication-service credentials the gateway was configured with -- ahead of, or alongside, the reboot rather than after a subsequent incident. Follow-on access on this path arrives as a successful remote-access authentication using real credentials, which is why closing the vulnerability does not close the incident. Distinguishing test: choose one gateway that was exposed before remediation and ask which specific secrets it held and when each was last rotated; if the answer is 'we installed the fix and rebooted', the disclosure has been stopped without being remediated, and the framework's flaw-remediation control has recorded a closure the attacker's stolen credentials do not honour.",
+        "evidence": "Packet facts only: attack_vector states the unauthenticated path-traversal request against the MyCRL endpoint lets the attacker read arbitrary appliance files, 'harvesting credentials and configuration that enable follow-on VPN/lateral access'. CWE-200 information disclosure -- not remote code execution. CISA KEV-listed 2024-05-30 with active_exploitation 'confirmed' and poc_available true, RWEP 81 against CVSS 8.6. patch_available true; live_patch_available false, with the note that the vendor update requires a reboot and is the remediation -- i.e. the packet records remediation of the flaw, not of the disclosure it already produced. Citing gaps NIST SP 800-53 SI-2 flaw remediation and ISO/IEC 27001:2022 A.8.8 technical-vulnerability management both treat the fix as the terminal state.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "ISO-27001-2022-A.8.8"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-031",
+        "name": "FIREWALL-EGRESS-TELEMETRY-SEPARATE-TRUST-ZONE",
+        "description": "On this CVE the only record that a given gateway's MyCRL endpoint was requested -- and which appliance files came back -- is generated by the gateway itself, the same device the unauthenticated attacker is reading arbitrary files from. Once the harvested credentials are replayed, the follow-on step the packet describes surfaces as an ordinary successful remote-access VPN authentication, which is invisible unless the authentication record is held and queried somewhere the gateway's own state cannot influence. Applied to this product, the control means the gateway's request-level logs and its remote-access authentication logs are forwarded continuously to a SIEM in a separate trust zone -- different management plane, different credentials, different authentication path -- so that after a KEV listing the operator can retrospectively answer two questions across the whole fleet: was this endpoint requested on any gateway before the reboot completed, and which accounts authenticated through remote access afterwards from new locations or at anomalous times. That retrospective window is the whole value here, because the KEV listing arrives after exploitation, and the packet's citing gap is precisely that security monitoring is not carrying this. Distinguishing test: take a gateway's local log store out of the picture entirely and confirm both questions can still be answered from the off-box collector, for the period preceding the reboot -- a monitoring attestation resting on the gateway's own log retention cannot scope an incident whose first act was reading that gateway's files.",
+        "evidence": "Packet facts only: the vulnerable surface is the gateway's MyCRL endpoint, reachable unauthenticated, and the recorded outcome is reading arbitrary appliance files to harvest credentials and configuration enabling follow-on VPN/lateral access. CISA KEV-listed 2024-05-30, active_exploitation 'confirmed', poc_available true -- exploitation preceded the listing, so the operator's question is retrospective. live_patch_available false with the note that the vendor update requires a reboot, so a detection window exists between the KEV listing and the completed restart of every affected gateway. UK NCSC CAF C1 security monitoring is cited as an insufficient control on this entry.",
+        "gap_closes": [
+          "UK-CAF-C1"
+        ]
+      }
+    ]
   },
   "CVE-2024-4978": {
     "name": "JAVS Viewer Installer Embedded Malicious Code Vulnerability",
@@ -41864,7 +43560,30 @@
         "adequate": false,
         "gap": "Application-hardening guidance is desktop-browser-centric and does not address Android app-permission/foreground-service abuse that this notification-hiding flaw enables."
       }
-    }
+    },
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-126",
+        "name": "MOBILE-OS-MINIMUM-PATCH-LEVEL-ENFORCEMENT",
+        "description": "The packet pins this to Android-13 and to a Framework rendering path, and the trigger is an application already running on the device, so both halves of this control bind. First: the Android build carrying the fix is an access condition for organizational data — a device below it is quarantined from mail, VPN and document access rather than surfaced as a row on a patch-compliance dashboard — and because the packet says remediation requires applying the fixed release and rebooting with no vendor live-patch mechanism, a device that has downloaded the update but not restarted sits below the line and must be treated as exposed. Second, and load-bearing for the interval where a device is waiting on an OEM or carrier build it cannot obtain, the exploit needs a malicious app to be running at all, so the remaining lever is constraining what code gets installed: restrict installation to vetted sources and disallow unknown-source and side-loaded installs on any device holding organizational data. The precondition to state is that neither half is retroactive. Enforcing the build stops future suppression of the notification; it does not evict an app already present, does not revoke the background access that app already holds, and does not reconstruct what ran while the indicator was hidden — so a device suspected of carrying such an app needs an installed-app and permission review, not a build check alone. The distinguishing test: enrol a device pinned below the fixed build and confirm the policy actually denies it protected resources; an estate that lists the stale build on a report while the device keeps its mail and VPN access has recorded the exposure rather than removed it.",
+        "evidence": "Packet vector: 'In applyRemoteView of NotificationContentInflater.java, there is a possible way to hide foreground service notification due to misleading or insufficient UI. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-13 Android ID: A-251586912.' attack_vector: a malicious app hides the foreground-service notification Android normally forces, so background sensor/data access runs without the persistent status-bar indicator. CWE-200, CVSS 5.5, RWEP 47, poc_available false, CISA KEV-listed 2024-03-05 with active_exploitation confirmed. patch_available true, live_patch_available false, live_patch_notes: 'No vendor live-patch mechanism; remediation requires applying the fixed release and rebooting.'",
+        "gap_closes": [
+          "AU-Essential-8-App-Hardening",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-041",
+        "name": "PROTECTION-MECHANISM-FAILURE-CLASS-REGRESSION",
+        "description": "Android's forced foreground-service notification is a protection mechanism in the sense this control governs: the platform mandates a persistent visible indicator precisely so background service execution cannot be silent, and the packet describes a Framework path that defeats it through misleading or insufficient UI. That makes the mechanism, not the individual CVE, the thing that needs testing — any detection or user-transparency posture that keys off the presence of the status-bar indicator is only as good as the mechanism producing it, and this entry is proof the mechanism can fail without the monitoring above it noticing anything at all. Applied to a managed mobile estate, the requirement is that every accepted OS build be validated against the known indicator-suppression primitives for this class before it is treated as the fixed build, and that mobile-threat-defense detections which infer background activity from the visible notification be regression-tested on the same schedule rather than assumed to carry forward. State the limits: class regression only covers primitives already known, so it does not detect a novel way of hiding the notification, and passing the battery on a build is not evidence that no app already on the estate used this one — it validates the mechanism going forward, it does not produce history. Because of that, this control complements an app-inventory and permission review rather than substituting for it, and where an operator cannot run the battery at all, the honest position is that indicator-derived monitoring on that build is unvalidated rather than sound.",
+        "evidence": "Packet vector: the flaw is 'a possible way to hide foreground service notification due to misleading or insufficient UI', with 'no additional execution privileges needed' and 'User interaction is not needed for exploitation'. attack_vector: the malicious app's background sensor/data access runs 'without the persistent status-bar indicator that would alert the user'. CISA KEV-listed 2024-03-05, active_exploitation confirmed, poc_available false. The entry cites NIST-800-53-SI-4 (System Monitoring) among the framework controls that were insufficient.",
+        "gap_closes": [
+          "NIST-800-53-SI-4"
+        ]
+      }
+    ]
   },
   "CVE-2021-36380": {
     "name": "Sunhillo SureLine OS Command Injection Vulnerability",
@@ -42047,7 +43766,31 @@
         "adequate": false,
         "gap": "Application-hardening baselines do not disable or restrict the Microsoft Streaming Service driver, leaving the vulnerable IOCTL/KS path reachable by any local user."
       }
-    }
+    },
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-145",
+        "name": "ACTIVELY-EXPLOITED-OS-LPE-REMEDIATION-WINDOW-ENFORCEMENT",
+        "description": "The packet's path for this flaw starts from an ordinary local process and ends at SYSTEM: a user-mode caller drives the mskssrv.sys streaming driver into dereferencing an attacker-controlled pointer, which yields a kernel write primitive. That makes the account-privilege posture most estates are audited on — standard users, no local administrators, least privilege attested — a boundary this flaw does not have to cross, so it cannot be the containment story while the fix is outstanding. The second half matters more for scheduling: the packet states there is no vendor live-patch mechanism and that remediation requires applying the fixed release and rebooting, which means exposure does not end when the update is pushed, it ends when each host restarts. A fleet reporting successful deployment while machines sit unrestarted is still exploitable on every one of them. Run the clock from the KEV listing date to completed reboot per host rather than to deployment-tool success, enumerate the fleet's actual installed builds against the fixed build for each SKU, and treat any host that has taken the update but not the restart as unremediated in the compliance record rather than as compliant-pending-reboot.",
+        "evidence": "Packet: attack_vector \"A local process drives the mskssrv.sys streaming driver to dereference an attacker-controlled pointer, converting a user-mode foothold into a kernel write primitive and SYSTEM privileges.\"; vector \"Microsoft Streaming Service Elevation of Privilege Vulnerability\"; CWE-822. patch_available true; live_patch_available false; live_patch_notes \"No vendor live-patch mechanism; remediation requires applying the fixed release and rebooting.\" CISA KEV 2024-02-29, active_exploitation confirmed, CVSS 8.4, RWEP 77, poc_available true.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-patch-management",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-AC-6",
+          "AU-Essential-8-App-Hardening"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-003",
+        "name": "KERNEL-EXPLOITATION-DETECTION",
+        "description": "Because the packet ties remediation to a reboot of every affected endpoint and records confirmed in-the-wild exploitation with a PoC available, this estate has a detection-only window whose length is set by its restart schedule rather than by how fast the update is pushed — and monitoring is the citing gap the packet names. On a Windows fleet the telemetry source is the EDR/ETW equivalent of the auditd or eBPF rules this control is usually expressed in: alert on a local, unprivileged process obtaining a handle to the Microsoft Streaming Service device, and on a subsequent token or integrity-level change to SYSTEM within the same process lineage. That pairing is what the packet's path actually produces — the user-mode foothold reaching the driver, then the kernel write cashing out as SYSTEM — and detecting only the second half means detecting the escalation after it has already succeeded, at whatever point the follow-on payload becomes noisy enough for signature-based tooling to notice. The rule has to be live for the whole reboot window and its coverage checked against the same host list used for the build enumeration, so unrestarted hosts are the ones being watched most closely rather than the ones nobody has instrumented.",
+        "evidence": "Packet: attack_vector \"A local process drives the mskssrv.sys streaming driver to dereference an attacker-controlled pointer, converting a user-mode foothold into a kernel write primitive and SYSTEM privileges.\"; live_patch_notes \"No vendor live-patch mechanism; remediation requires applying the fixed release and rebooting.\"; live_patch_available false. CISA KEV 2024-02-29 with active_exploitation confirmed and poc_available true; RWEP 77, CVSS 8.4. Citing gap in the packet: UK-CAF-C1 \"Security monitoring\" (UK NCSC Cyber Assessment Framework v3.2).",
+        "gap_closes": [
+          "UK-CAF-C1"
+        ]
+      }
+    ]
   },
   "CVE-2020-3259": {
     "name": "Cisco ASA and FTD Information Disclosure Vulnerability",
@@ -42470,7 +44213,41 @@
         "adequate": false,
         "gap": "System-security assurance credits hardware mitigations like PAC; this flaw defeats that mitigation, so control coverage over-relies on the bypassed protection."
       }
-    }
+    },
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-056",
+        "name": "MOBILE-ENDPOINT-MDM-ENFORCED-KEV-SLA",
+        "description": "Apple shipped this fix as an OS release across five product families at once — macOS Ventura 13.1, watchOS 9.2, iOS 16.2, iPadOS 16.2 and tvOS 16.2 — and the packet records no live-patch mechanism, so every affected device has to be carried through the update and rebooted before the defect is gone. Enforce the fixed build from the device-management channel with user deferral disallowed rather than by prompting the user, and make the enrolment scope cover the watchOS and tvOS members of the estate, which patch-compliance programs built around laptops and phones routinely leave out while the same defect sits on them. The clock runs from the KEV listing, not from the next device-refresh window, because the remediation the packet describes is a reboot the operator has to schedule rather than a silent background fix.",
+        "evidence": "Packet vector: \"This issue is fixed in macOS Ventura 13.1, watchOS 9.2, iOS 16.2 and iPadOS 16.2, tvOS 16.2.\" patch_available true; live_patch_available false with live_patch_notes \"No vendor live-patch mechanism; remediation requires applying the fixed release and rebooting.\" cisa_kev true, kev_date 2024-01-31, active_exploitation confirmed.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "NIS2-Art21-patch-management",
+          "NIST-800-53-SI-2",
+          "ISO-27001-2022-A.8.8"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-126",
+        "name": "MOBILE-OS-MINIMUM-PATCH-LEVEL-ENFORCEMENT",
+        "description": "Treat the fixed build as an access condition for organizational data rather than a reporting metric: a Mac, iPhone, iPad, Watch or Apple TV still below macOS Ventura 13.1 / watchOS 9.2 / iOS 16.2 / iPadOS 16.2 / tvOS 16.2 is denied or quarantined from mail, VPN and document access until it takes the update. The distinction matters more than usual for this defect because what it removes is Pointer Authentication — a mitigation whose entire job is to stop an attacker who already holds arbitrary kernel read/write from converting that into reliable control. A device left below the fixed build is therefore not simply unpatched; it has lost the mitigation that would otherwise blunt the rest of the chain, and no downstream detection replaces it. Distinguishing test: enrol a device pinned below the fixed build and confirm the policy actually refuses it protected resources, rather than listing the stale build on a dashboard while the device keeps its access.",
+        "evidence": "Packet vector: \"An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication.\" attack_vector: \"Within an exploit chain, code that already holds arbitrary kernel read/write wins a time-of-check/time-of-use race to defeat Pointer Authentication, removing a key mitigation and enabling reliable kernel-level control on the device.\" CWE-367; RWEP 57 with CVSS 7.0; active_exploitation confirmed; fixed releases named in the packet vector.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-121",
+        "name": "MOBILE-ZERO-CLICK-HARDENING",
+        "description": "The packet does not describe a standalone bug reachable on its own — it is a step inside a chain whose precondition is arbitrary kernel read/write already held, and the exploitation signal is Apple's own report against iOS releases predating iOS 15.7.1 with no public PoC, which is the targeted-implant profile rather than commodity malware. For the population plausibly inside that targeting set — executives, journalists, legal and security staff — place devices in the platform's reduced-attack-surface mode where the OS version supports it, so untrusted web content, message attachments, fonts and link previews are not processed automatically. That narrows the delivery path for the earlier chain stages that must land before this PAC bypass is reachable at all, which is the only lever available while devices wait on a reboot-gated update. It has to be a standing assignment made before the next disclosure, not a reaction to this CVE — the mode only helps if it was already on when the chain arrived.",
+        "evidence": "Packet vector: \"Apple is aware of a report that this issue may have been exploited against versions of iOS released before iOS 15.7.1.\" attack_vector places the flaw \"[w]ithin an exploit chain\". poc_available false while active_exploitation is confirmed. live_patch_available false; remediation per live_patch_notes requires applying the fixed release and rebooting.",
+        "gap_closes": [
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2024-21893": {
     "name": "Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability",
@@ -44022,7 +45799,31 @@
         "adequate": false,
         "gap": "Mobile-device hardening controls rarely account for a GPU-driver LPE that undoes app-sandbox isolation once a malicious app is already present."
       }
-    }
+    },
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-145",
+        "name": "ACTIVELY-EXPLOITED-OS-LPE-REMEDIATION-WINDOW-ENFORCEMENT",
+        "description": "This is a confirmed-exploited local privilege escalation reached from an ordinary unprivileged application through a GPU driver IOCTL, and the packet records no vendor live-patch mechanism — remediation is applying the fixed release and rebooting. For this CVE that means the fixed release is driven across the affected estate on the KEV clock rather than folded into the next routine device-update cycle, and the reboot is treated as part of remediation rather than as a follow-up, since an installed-but-not-restarted device is still running the vulnerable kgsl code. Because the packet scopes the defect to multiple Qualcomm chipsets rather than one product, the enforcement has to enumerate the fixed build per affected device model and confirm zero devices remain below it past the due date; a single fleet-wide 'up to date' figure hides the models whose fixed release has not been taken. The control's second clause is the one that matters most here: account-privilege policy is not containment, because the packet's attacker is already an unprivileged local application, so restricting administrative rights changes nothing about the escalation path. The distinguishing test is a per-model build enumeration against the fixed release with a hard deadline, not a patch-compliance percentage.",
+        "evidence": "Packet attack_vector: 'A local, already-present unprivileged application issues a crafted IOCTL to the Adreno GPU (kgsl) driver; an integer overflow during shared-virtual-memory assignment corrupts kernel memory and escalates privileges, typically as one stage of a mobile exploit chain.' Entry name 'Qualcomm Multiple Chipsets Integer Overflow Vulnerability'; CWE-190; CVSS 7.8; RWEP 53. cisa_kev true, kev_date 2023-12-05, active_exploitation 'confirmed'. patch_available true; live_patch_available false with live_patch_notes 'No vendor live-patch mechanism; remediation requires applying the fixed release and rebooting.'",
+        "gap_closes": [
+          "NIS2-Art21-patch-management",
+          "NIST-800-53-SI-2",
+          "AU-ISM-1546"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-126",
+        "name": "MOBILE-OS-MINIMUM-PATCH-LEVEL-ENFORCEMENT",
+        "description": "The packet's trigger is a locally installed unprivileged application issuing a crafted IOCTL, so on any device that has not yet taken the fixed release the operator's only remaining lever is constraining what code gets to run at all — restricting installation of untrusted or side-loaded applications, and denying the device access to organizational data rather than listing it on a patch-compliance report. For this CVE the fixed release for each affected chipset must be an access condition: a device below it is quarantined from mail, VPN and document access instead of being flagged for later. That is what the citing least-functionality gap actually demands on this vector, and it is the half of the control that does the work here, because the escalation path does not need network reachability or elevated rights — it needs an app on the device. The distinguishing test is to enrol a device pinned below the fixed release for its chipset and confirm the policy denies it access to protected resources; an estate that surfaces the stale build on a dashboard while the device keeps its access has recorded the exposure rather than removed it, and the packet describes this flaw as one stage of a chain, which means the device that keeps its access is the one that carries the rest of the chain inside the trust boundary.",
+        "evidence": "Packet attack_vector: 'A local, already-present unprivileged application issues a crafted IOCTL to the Adreno GPU (kgsl) driver ... corrupts kernel memory and escalates privileges, typically as one stage of a mobile exploit chain.' Packet vector: 'Memory corruption in Graphics Linux while assigning shared virtual memory region during IOCTL call.' Citing gap NIST-800-53-CM-7 (Least Functionality) is recorded as insufficient for this entry. patch_available true, live_patch_available false, live_patch_notes 'No vendor live-patch mechanism; remediation requires applying the fixed release and rebooting.' poc_available false.",
+        "gap_closes": [
+          "NIST-800-53-CM-7",
+          "UK-CAF-B4",
+          "ISO-27001-2022-A.8.8"
+        ]
+      }
+    ]
   },
   "CVE-2023-33106": {
     "name": "Qualcomm Multiple Chipsets Use of Out-of-Range Pointer Offset Vulnerability",
@@ -44364,7 +46165,31 @@
         "adequate": false,
         "gap": "Advisory-driven vulnerability management cannot pre-empt an unknown browser zero-day used specifically to break out of the renderer sandbox."
       }
-    }
+    },
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-057",
+        "name": "BROWSER-MANAGED-UPDATE-NO-DEFERRAL",
+        "description": "For this CVE the update ring must place Chrome/Chromium on 119.0.6045.199 or later within the 24-hour bound rather than holding it for a validation window, because the packet pairs a 2023-11-30 KEV listing with confirmed exploitation on a sandbox escape — the component that is supposed to contain a compromised renderer is the component that fails. The precondition that decides whether this control actually works is in the packet's own remediation note: the fix requires updating and relaunching the browser. A managed fleet that reports the update as delivered while long-lived browser sessions keep running still has the vulnerable Skia mapped in those processes, so compliance has to be measured on the build the process is actually executing — enforced with a restart deadline or forced relaunch policy — not on the version staged on disk. State the other limit too: this control reaches only software that takes the browser vendor's update channel, so Chromium embedded inside other applications is outside it entirely and is handled by the inventory control rather than counted as covered here. Distinguishing test: query managed-browser reporting for the running build on each host after the ring completes; any host reporting a pre-119.0.6045.199 running build, or a stale process start time against a completed update, is still exposed to the escape.",
+        "evidence": "Packet: CWE-190 integer overflow in Skia; vector 'Integer overflow in Skia in Google Chrome prior to 119.0.6045.199 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a malicious file.' live_patch_notes: 'No live patch; requires updating Chrome/Chromium to 119.0.6045.199+ and relaunching the browser (downstream products must rebuild against the fixed Skia).' CVSS 9.6, RWEP 55, CISA KEV-listed 2023-11-30, active_exploitation 'confirmed', poc_available false. patch_available true; live_patch_available false. Cited gaps include NIS2-Art21-patch-management, NIST-800-53-SI-2 and UK-CAF-B4.",
+        "gap_closes": [
+          "NIS2-Art21-patch-management",
+          "NIST-800-53-SI-2",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-144",
+        "name": "EMBEDDED-MEDIA-PARSER-LIBRARY-INVENTORY-AND-PATCH-PARITY",
+        "description": "Skia is a graphics library that ships inside far more than the browser the advisory names, and the packet makes the consequence explicit — downstream products must rebuild against the fixed Skia. So the estate has to be inventoried for every binary that bundles its own Chromium/Skia copy (Chromium-derived browsers, Electron applications, embedded webviews and desktop apps with in-process browser components) and each one held to a build rebuilt against fixed Skia, rather than treating the Chrome fleet reaching 119.0.6045.199+ as closing the CWE-190 primitive across the estate. This is also why the cited Essential Eight user-application-hardening gap is recorded here: that control describes the browser's configuration, while the packet's path begins from an already-compromised renderer, so no content-blocking setting is consulted, and a hardened browser configuration on a host running an application with an unpatched vendored Skia still carries the escape. The precondition has to be stated rather than glossed: an inventory produces a fix only where the embedding vendor has shipped a rebuild — where it has not, there is no build to move to, and the remaining levers are constraining what untrusted content that application is allowed to render and scheduling its withdrawal, not recording it as covered by the browser update. Distinguishing test: after the Chrome/Chromium fleet reports 119.0.6045.199+, enumerate installed applications that ship their own Chromium/Skia and confirm each reports a version its vendor rebuilt against fixed Skia; any that cannot is an open instance of the same overflow, and any that has no such build is an exposure needing a dated decision rather than a passing patch report.",
+        "evidence": "Packet live_patch_notes states verbatim: 'No live patch; requires updating Chrome/Chromium to 119.0.6045.199+ and relaunching the browser (downstream products must rebuild against the fixed Skia).' attack_vector: 'From an already-compromised renderer, an attacker feeds a malicious graphics primitive that overflows an integer in Skia's size calculation, producing an undersized buffer whose subsequent writes corrupt adjacent memory to escape the sandbox.' CWE-190, CVSS 9.6, RWEP 55, CISA KEV-listed 2023-11-30, active_exploitation 'confirmed', patch_available true, live_patch_available false. Cited gaps include AU-Essential-8-App-Hardening (User application hardening), ISO-27001-2022-A.8.8 and NIST-800-53-SI-2.",
+        "gap_closes": [
+          "AU-Essential-8-App-Hardening",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      }
+    ]
   },
   "CVE-2023-49103": {
     "name": "ownCloud graphapi Information Disclosure Vulnerability",
@@ -44946,7 +46771,33 @@
         "adequate": false,
         "gap": "Patching within the ISM window helps, but the control does not mandate restricting the J-Web management interface that is the actual attack surface."
       }
-    }
+    },
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-025",
+        "name": "CONFIGURATION-SIDE-LIVE-PATCH-INVENTORY",
+        "description": "The vulnerable surface here is J-Web, the optional web management front end on EX Series switches — the device forwards traffic without it — and the packet's only remediation is applying a fixed Junos release and rebooting, which on an access-layer switch is a service outage the operator has to schedule. That gap between disclosure and reboot window is precisely when an unauthenticated, network-reachable request path stays open. Inventory and pre-test the configuration-side path so it is deployable independently of the Junos upgrade schedule: the J-Web HTTP/HTTPS management service turned off on units that do not need it, and restricted to a management network on the units that do. Exposure then ends at a config commit instead of at the next maintenance window. Track which units are running on the configuration-side mitigation versus which are on the fixed release — those are two different states, and a fleet report that merges them hides how many devices still carry the reachable code path.",
+        "evidence": "Packet vector: \"A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to control certain, important environment variables.\" patch_available true; live_patch_available false with live_patch_notes \"No vendor live-patch mechanism; remediation requires applying the fixed release and rebooting.\" The entry's own citing framework gaps name NIST 800-53 CM-7 Least Functionality and SC-7 Boundary Protection.",
+        "gap_closes": [
+          "NIST-800-53-CM-7",
+          "NIST-800-53-SC-7",
+          "NIST-800-53-SI-2",
+          "ISO-27001-2022-A.8.8",
+          "AU-ISM-1546"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "This flaw is not the end state the operator is defending against — the packet describes it being chained with other J-Web flaws toward pre-auth remote code execution, carrying a public PoC and confirmed in-the-wild exploitation. Any EX Series unit whose J-Web interface was reachable during the exposure window has to be handled as potentially implanted, not merely unpatched: capture the running and candidate configuration for comparison against a known-good baseline, rebuild from a vendor image rather than upgrading in place, and rotate every credential the device held or authenticated — local administrative accounts, shared secrets, and any key material sitting in the configuration. Upgrading in place closes the request path and leaves untouched whatever was written through it beforehand, which is exactly the outcome a vulnerability-management attestation records as remediated. The gap is that the frameworks cited here are satisfied by the version bump alone.",
+        "evidence": "Packet attack_vector: \"An unauthenticated attacker sends crafted J-Web requests that modify PHP environment variables, causing partial integrity loss that is chained with other J-Web flaws toward pre-auth remote code execution.\" cisa_kev true, kev_date 2023-11-13, active_exploitation confirmed, poc_available true. RWEP 76 against CVSS 5.3 — the base score reflects the packet's \"partial loss of integrity\" wording while the real-world priority reflects the chain, so CVSS-driven triage under-ranks this entry.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "ISO-27001-2022-A.8.8",
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2023-36845": {
     "name": "Juniper Junos OS EX/SRX J-Web PHPRC Modification RCE",
@@ -46465,7 +48316,32 @@
         "adequate": false,
         "gap": "System security expects a trustworthy code-integrity anchor, but this flaw defeats the code-signature trust anchor itself, so the control's assumption is invalid until patched."
       }
-    }
+    },
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-126",
+        "name": "MOBILE-OS-MINIMUM-PATCH-LEVEL-ENFORCEMENT",
+        "description": "Both halves of this control are load-bearing here, because the trigger the packet names is a malicious application defeating code-signature validation. First, make macOS Ventura 13.6 / iOS 16.7 / iPadOS 16.7 an access condition: a device below it is denied or quarantined from organizational mail, VPN and documents rather than listed on a patch-compliance report. Second, on any device that cannot yet take the fixed build, constrain what code is permitted to run at all — installation restricted to the managed application catalogue, no side-loading, and no enterprise or developer provisioning profiles beyond the ones the estate itself issues. Signature validation is the platform mechanism that normally makes \"only approved code runs\" true, and this defect is that mechanism failing, so while devices sit below the fixed build the enforcement has to come from the management layer instead. Distinguishing test: enrol a device pinned below the fixed build and confirm it is actually refused protected resources.",
+        "evidence": "Packet vector: \"A malicious app may be able to bypass signature validation. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.\" Fixed releases named in the packet: macOS Ventura 13.6, iOS 16.7 and iPadOS 16.7. CWE-295 improper certificate validation; attack_vector describes bypassing code-signature checks so unsigned code runs as part of a chained exploit. patch_available true; live_patch_available false.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-056",
+        "name": "MOBILE-ENDPOINT-MDM-ENFORCED-KEV-SLA",
+        "description": "The fix ships only as an OS release — macOS Ventura 13.6, iOS 16.7, iPadOS 16.7 — with no live-patch path, so remediation across the Apple estate is a reboot on every device and nothing lands silently in the background. Drive it from the device-management channel on the KEV clock with user deferral disallowed, because this is the update class users postpone longest: a certificate-validation fix produces no symptom the user can perceive, so the reboot is the only part of it they experience. Hold the macOS half of the estate to the same clock as the phones — a Ventura Mac below 13.6 carries the same signature-validation bypass as an iPhone below iOS 16.7, and it is typically the population left on a user-driven update cadence while the mobile fleet is centrally enforced.",
+        "evidence": "Packet vector: \"This issue is fixed in macOS Ventura 13.6, iOS 16.7 and iPadOS 16.7.\" cisa_kev true, kev_date 2023-09-25, active_exploitation confirmed. live_patch_available false with live_patch_notes \"No vendor live-patch mechanism; remediation requires applying the fixed release and rebooting.\" poc_available false — the exploitation signal is Apple's own report, not a published exploit.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "NIS2-Art21-vulnerability-management",
+          "NIST-800-53-SI-2",
+          "ISO-27001-2022-A.8.8"
+        ]
+      }
+    ]
   },
   "CVE-2023-41992": {
     "name": "Apple Multiple Products Kernel Privilege Escalation Vulnerability",
@@ -46522,7 +48398,41 @@
         "adequate": false,
         "gap": "System security relies on kernel integrity that this improper-check flaw directly violates, invalidating the control until patched."
       }
-    }
+    },
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-056",
+        "name": "MOBILE-ENDPOINT-MDM-ENFORCED-KEV-SLA",
+        "description": "The packet names the exact builds carrying the fix — macOS Monterey 12.7, iOS 16.7 and iPadOS 16.7, macOS Ventura 13.6 — so the SLA has a concrete per-platform target rather than a vague 'current' state, and the entry is KEV-listed 2023-09-25 with confirmed exploitation. Apple estates fail this differently from server estates: the update is offered and the user defers it indefinitely, so the requirement here is that declarative device management installs and enforces the fixed build on a KEV clock with user deferral disallowed, across iPhone, iPad and Mac alike since all three platforms appear in the packet's fix list. Because the packet records no vendor live-patch mechanism and a remediation that requires applying the fixed release and rebooting, the SLA must be measured to completed restart on the fixed build — a device that has downloaded and staged the update is still running the vulnerable kernel and cannot be counted as remediated. The precondition is enrolment: this reaches only supervised or MDM-enrolled devices and does nothing for unenrolled personal devices holding organizational data, which is why it has to be paired with an access condition that quarantines any device below the fixed build rather than left as the whole answer. Distinguishing test: set a deferral on a managed test device, confirm the platform installs regardless inside the window, and confirm the compliance record only flips to remediated once the device reports the fixed build after restart.",
+        "evidence": "Packet vector: 'This issue is fixed in macOS Monterey 12.7, iOS 16.7 and iPadOS 16.7, macOS Ventura 13.6. A local attacker may be able to elevate their privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.' CISA KEV-listed 2023-09-25, active_exploitation 'confirmed', RWEP 59, CVSS 7.8. patch_available true, live_patch_available false, live_patch_notes 'No vendor live-patch mechanism; remediation requires applying the fixed release and rebooting.'",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-126",
+        "name": "MOBILE-OS-MINIMUM-PATCH-LEVEL-ENFORCEMENT",
+        "description": "Treat the builds the packet names — macOS Monterey 12.7, iOS 16.7 and iPadOS 16.7, macOS Ventura 13.6 — as an access condition rather than a dashboard metric: a device below its platform's fixed build is denied or quarantined from organizational mail, VPN and documents rather than listed as non-compliant while retaining all of it. That distinction is what matters for this flaw because the outcome the packet records is kernel privileges and full device control by spyware; once the chain completes, every credential and data set that device can reach belongs to the attacker, so leaving access in place while the build catches up grants precisely the reach a quarantine would have removed. Unlike other Apple kernel-memory cases, restricting untrusted or side-loaded application installation is not the covering lever here — the packet places the local process as arriving via a chained WebKit stage, so an app-install restriction leaves the delivery path open and must not be recorded as the mitigation for this entry. The precondition is that the build assertion is enforced at the resource rather than on the device: a device-side self-report is not a control against an attacker who, per the packet, already holds kernel privileges, so the gate has to sit on the identity or management attestation the service trusts before it releases data. Distinguishing test: enrol a device pinned below the fixed build for its platform and confirm it is actually refused organizational data rather than merely flagged on a report.",
+        "evidence": "Packet vector names the fixed releases: macOS Monterey 12.7, iOS 16.7 and iPadOS 16.7, macOS Ventura 13.6, with exploitation reported against versions of iOS before iOS 16.7. Attack vector: 'A local process (delivered via the chained WebKit stage) abuses a kernel improper-check flaw to elevate to kernel privileges, giving the spyware full device control.' CWE-754. CISA KEV-listed 2023-09-25, active_exploitation 'confirmed'. patch_available true; live_patch_available false with remediation requiring the fixed release and a reboot.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-121",
+        "name": "MOBILE-ZERO-CLICK-HARDENING",
+        "description": "The packet places this kernel flaw as the escalation step of a chain whose delivery stage is WebKit, with the end state being spyware holding full device control — which is the targeting profile this control's cohort exists for: executives, journalists, legal and security staff. For that cohort, place devices in Apple's reduced-attack-surface mode so untrusted web content and message-borne content (attachments, fonts, link previews) is not processed automatically, narrowing the WebKit stage that delivers the local process into this CWE-754 kernel check during the window between the 2023-09-25 KEV listing and completed fleet restart. Two preconditions bound the claim and neither may be softened. The mode narrows a delivery path; it does not remove the kernel flaw, so the fixed build plus reboot the packet requires remains the remediation and this cannot be recorded as closing the exposure. And it only helps if it was already enabled when the chain arrived — a device compromised before the mode was turned on stays compromised, and must be handled as an incident (restore to the fixed build, rotate every credential that device held) rather than as a hardening item. It follows that the cohort roster is a standing posture assigned ahead of the next disclosure; switching the mode on in reaction to a KEV listing protects nobody already inside the targeting set. Distinguishing test: on a cohort device, confirm untrusted web and message content is refused automatic processing, and separately confirm the roster was assigned before the disclosure date rather than after it.",
+        "evidence": "Packet attack vector: 'A local process (delivered via the chained WebKit stage) abuses a kernel improper-check flaw to elevate to kernel privileges, giving the spyware full device control.' CWE-754. CISA KEV-listed 2023-09-25, active_exploitation 'confirmed', RWEP 59, CVSS 7.8, poc_available false. live_patch_available false; live_patch_notes 'No vendor live-patch mechanism; remediation requires applying the fixed release and rebooting.'",
+        "gap_closes": [
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2023-41993": {
     "name": "Apple Multiple Products WebKit Code Execution Vulnerability",
@@ -48357,7 +50267,21 @@
         "adequate": false,
         "gap": "A.8.8 technical-vulnerability management typically triages by CVSS confidentiality/integrity impact, but this is availability-only (C:N/I:N/A:H) and can be de-prioritised, leaving the exploitable .NET runtime unpatched despite confirmed in-the-wild DoS."
       }
-    }
+    },
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "This entry is KEV-listed 2023-08-09 with confirmed exploitation and an available vendor fix, and none of the frameworks cited against it carries a KEV-tied clock — so the control supplies the missing deadline: verified mitigation within 4 hours of the KEV listing or patch availability, whichever is later. What 'verified' has to mean here is fixed by the packet's own remediation note — installing the August 2023 .NET 6.0/7.0 runtime and Visual Studio updates and restarting the affected applications, with no live-patch mechanism available — so a long-running Kestrel worker that has taken the runtime package but has not restarted is still executing the vulnerable code and the clock runs to process restart, not to package installation. Package-inventory evidence on its own will report this remediated while the unauthenticated crafted-traffic path still exhausts CPU and memory. The clock also has to span two estates normally on separate patch programs, both named by the packet's remediation: internet-reachable ASP.NET Core services and the Visual Studio installs on developer workstations. The 'documented compensating controls' branch of this SLA is usable only where the service has an enumerable client population whose reachability can be restricted for the window; a publicly reachable endpoint has no such population, and for those the restart is the only lever — restricting reachability narrows who can send the crafted traffic, it does not remove the resource-consumption defect, and it must be recorded as a bounded interim state with the restart still owed. This matters more than the RWEP of 38 suggests, because an availability-only impact is exactly the shape that slips a patch queue despite confirmed in-the-wild exploitation. Distinguishing test: on a staging service, apply the runtime update without restarting the worker and confirm the compliance record does not read remediated until the process itself reports the fixed runtime.",
+        "evidence": "Packet: CISA KEV-listed 2023-08-09, active_exploitation 'confirmed', RWEP 38, CVSS 7.5, poc_available false, CWE-400. patch_available true, live_patch_available false, live_patch_notes 'No vendor live-patch mechanism exists; remediation is installing the August 2023 .NET 6.0/7.0 runtime and Visual Studio updates and restarting the affected applications.' Attack vector: 'An unauthenticated remote attacker sends crafted traffic to an ASP.NET Core / Kestrel or .NET application that triggers uncontrolled resource consumption (CWE-400), exhausting CPU/memory and denying service.'",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2017-18368": {
     "name": "Zyxel P660HN-T1A Routers Command Injection Vulnerability",
@@ -49732,7 +51656,34 @@
         "adequate": false,
         "gap": "A.8.8 technical-vulnerability management struggles to track this on BYOD/managed handsets where firmware version visibility is limited, so the SMR May-2021 fix may not be verifiable as applied across the fleet."
       }
-    }
+    },
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-145",
+        "name": "ACTIVELY-EXPLOITED-OS-LPE-REMEDIATION-WINDOW-ENFORCEMENT",
+        "description": "The defect sits in the Samsung MFC charger driver — kernel-mode code, so it executes below every account boundary a mobile estate is audited on. For this CVE the control means the SMR May-2021 Release 1 firmware build is driven across every affected handset on the KEV clock that opened 2023-06-29, not folded into whatever OEM update cadence the fleet happens to follow, and completion is measured per handset by the installed SMR build level rather than by 'update pushed' or 'update available' in the management console. The packet records no live-patch mechanism for this driver and an update that reboots the device, so a handset that has downloaded the firmware but not restarted still runs the vulnerable driver and must be counted as exposed rather than remediated. Two limits belong in the control statement rather than being assumed away. First, the operator can only reach the fixed level where Samsung and the carrier still ship SMR releases for that model; where the model no longer receives them, this control cannot be satisfied at all and the remaining lever is holding the device outside the trust boundary. Second, the packet's precondition is an attacker who already holds compromised radio privileges, so tightening the app-level or user-level privilege model does not contain the escalation — a least-privilege attestation over the handset's user and app accounts passes cleanly while the race to a kernel write and signature-check bypass stays reachable, which is exactly why the AC-6 gap is recorded against this entry.",
+        "evidence": "Packet fields for CVE-2021-25395: cwe_refs CWE-362; cisa_kev true with kev_date 2023-06-29; active_exploitation confirmed; rwep_score 46; cvss 6.4; poc_available false; patch_available true; live_patch_available false with live_patch_notes 'No live-patch mechanism for the mobile kernel driver; remediation requires installing Samsung's SMR May-2021 Release 1 firmware update, which reboots the device.' Vector: 'A race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows local attackers to bypass signature check given a radio privilege is compromised.' Attack vector adds that the race produces a use-after-free and the attacker 'wins the race to obtain a kernel write and bypass the signature check, escalating to kernel-level control.' NIST-800-53-AC-6 (Least Privilege) is among the citing framework gaps.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-vulnerability-management",
+          "NIST-800-53-AC-6",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-126",
+        "name": "MOBILE-OS-MINIMUM-PATCH-LEVEL-ENFORCEMENT",
+        "description": "Bound to this flaw, minimum-patch-level enforcement means SMR May-2021 Release 1 is an access condition for the handset rather than a line on a patch-compliance report: a device below that SMR level is denied or quarantined from organizational mail, VPN and document access until it has taken the firmware update and rebooted. This is the control that still has an answer where the remediation-window control cannot be met — a model for which the fixed SMR build is not offered can never reach the required level, and holding it outside the trust boundary is then the only remaining lever. Two preconditions have to be stated rather than assumed. First, the gate must be enforced at the resource by conditional access; a console that surfaces the stale SMR level while the handset keeps its live mail and VPN sessions has recorded the exposure, not removed it. Second, this is containment for a handset that is still clean — it does not evict an attacker who already won the race on that device, because the packet puts the outcome at kernel-level control, beneath the management agent that would enforce the policy; a handset with any indication of compromise needs a wipe and re-provision, not a policy flag. Distinguishing test: enrol a handset pinned below SMR May-2021 Release 1 and confirm the policy actually refuses it access to protected resources.",
+        "evidence": "Packet fields for CVE-2021-25395: vector states the race condition exists in the MFC charger driver 'prior to SMR MAY-2021 Release 1' and that local attackers can bypass the signature check 'given a radio privilege is compromised'; attack_vector records escalation 'to kernel-level control'; cisa_kev true with kev_date 2023-06-29 and active_exploitation confirmed; patch_available true; live_patch_available false with live_patch_notes stating remediation 'requires installing Samsung's SMR May-2021 Release 1 firmware update, which reboots the device.'",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-vulnerability-management",
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2021-25371": {
     "name": "Samsung Mobile Devices Unspecified Vulnerability",