@blamejs/exceptd-skills 0.20.1 → 0.21.0

package/data/framework-control-gaps.json

@@ -1,7 +1,7 @@
 {
   "_meta": {
     "schema_version": "1.0.0",
-    "last_updated": "2026-08-19",
+    "last_updated": "2026-09-22",
     "note": "status: open = gap still exists. status: closed = framework update closed the gap. Never delete entries — preserve gap history.",
     "tlp": "CLEAR",
     "source_confidence": {
@@ -15,8 +15,8 @@
       "rebuild_after_days": 365,
       "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
     },
-    "last_threat_review": "2026-05-15",
-    "entry_count": 194
+    "last_threat_review": "2026-09-22",
+    "entry_count": 199
   },
   "ALL-AI-PIPELINE-INTEGRITY": {
     "framework": "ALL",
@@ -641,7 +641,7 @@
     "atlas_refs": [
       "AML.T0010",
       "AML.T0020",
-      "AML.T0048"
+      "AML.T0031"
     ],
     "attack_refs": [],
     "theater_test": {
@@ -728,9 +728,11 @@
     "framework": "ASD Essential Eight (AU)",
     "control_id": "Patch applications; Patch operating systems",
     "control_name": "Patch applications and patch operating systems",
-    "designed_for": "Applying vendor patches to applications and operating systems within the timeframes the ISM sets for the Essential Eight. Online services, office productivity suites, web browsers and their extensions, email clients, PDF applications, security products, and the operating systems of internet-facing servers and internet-facing network devices are patched within 48 hours of release when the vendor assesses a vulnerability as critical or a working exploit exists (ISM-1876, ISM-1692, ISM-1877). Otherwise online services and internet-facing operating systems are patched within two weeks (ISM-1690, ISM-1694), as are the named application classes (ISM-1691). Other applications are patched within one month (ISM-1693). Operating systems of workstations, non-internet-facing servers and non-internet-facing network devices are patched within one month (ISM-1695), or within 48 hours for a critical vulnerability or a working exploit (ISM-1696).",
+    "designed_for": "Applying vendor patches to applications and operating systems within the timeframes the ISM sets for the Essential Eight, which differ by asset class and by maturity level. At every maturity level, online services and the operating systems of internet-facing servers and internet-facing network devices are patched within 48 hours of release when the vendor assesses a vulnerability as critical or a working exploit exists (ISM-1876, ISM-1877), and within two weeks otherwise (ISM-1690, ISM-1694). Office productivity suites, web browsers and their extensions, email clients, PDF applications and security products are patched within two weeks at Maturity Levels One and Two (ISM-1691); at Maturity Level Three they are patched within 48 hours for a critical vulnerability or a working exploit (ISM-1692) and within two weeks otherwise (ISM-1901). Other applications are covered from Maturity Level Two, within one month (ISM-1693). Operating systems of workstations, non-internet-facing servers and non-internet-facing network devices are patched within one month at Maturity Levels One and Two (ISM-1695); at Maturity Level Three they are patched within 48 hours for a critical vulnerability or a working exploit (ISM-1696) and within one month otherwise (ISM-1902). Drivers and firmware are covered only at Maturity Level Three, within 48 hours for a critical vulnerability or a working exploit (ISM-1879, ISM-1903) and within one month otherwise (ISM-1697, ISM-1904). At every level, online services, the named application classes and operating systems that their vendor no longer supports are removed or replaced (ISM-1905, ISM-1704, ISM-1501).",
     "misses": [
       "Every timeframe runs from the vendor's release, so a vulnerability exploited before a fix ships is open for the whole pre-release period at every maturity level, and the 48-hour window only starts once the fix exists",
+      "Below Maturity Level Three a browser, office suite or email client with a working exploit still has two weeks, and a workstation operating system still has one month, so the 48-hour windows that match exploitation tempo apply to those classes only at the highest level",
+      "No control requires a reversible compensating measure, such as a module blacklist, a syscall filter or a vendor-published configuration mitigation, while the patch window runs, even when the vendor offers one in the same advisory",
       "ML3 '48 hours for public exploit' is the closest framework target to KEV reality, but still assumes a reboot is acceptable within that window — live-patching deployment is not a required capability",
       "Linux kernel patching cadence differs from OS-vendor patch cadence; third-party kernel modules (OOT drivers, runtime hardening modules) are silent in scope",
       "Patch-management metrics rarely measure 'time from CISA KEV listing to patched on fleet' as the operational SLA"
@@ -795,6 +797,7 @@
       "CVE-2013-1331",
       "CVE-2013-1675",
       "CVE-2013-1690",
+      "CVE-2013-2094",
       "CVE-2013-2251",
       "CVE-2013-2423",
       "CVE-2013-2551",
@@ -851,6 +854,7 @@
       "CVE-2015-2590",
       "CVE-2015-3035",
       "CVE-2015-3043",
+      "CVE-2015-3246",
       "CVE-2015-4495",
       "CVE-2015-5287",
       "CVE-2015-5317",
@@ -938,6 +942,7 @@
       "CVE-2017-3881",
       "CVE-2017-5030",
       "CVE-2017-5070",
+      "CVE-2017-5521",
       "CVE-2017-5638",
       "CVE-2017-6077",
       "CVE-2017-6316",
@@ -973,6 +978,7 @@
       "CVE-2018-0159",
       "CVE-2018-0161",
       "CVE-2018-0167",
+      "CVE-2018-0171",
       "CVE-2018-0172",
       "CVE-2018-0173",
       "CVE-2018-0174",
@@ -1000,6 +1006,7 @@
       "CVE-2018-18325",
       "CVE-2018-18809",
       "CVE-2018-19320",
+      "CVE-2018-19322",
       "CVE-2018-19323",
       "CVE-2018-19410",
       "CVE-2018-19943",
@@ -1007,6 +1014,7 @@
       "CVE-2018-19953",
       "CVE-2018-20250",
       "CVE-2018-20753",
+      "CVE-2018-2628",
       "CVE-2018-4063",
       "CVE-2018-4344",
       "CVE-2018-4939",
@@ -1096,6 +1104,7 @@
       "CVE-2019-7194",
       "CVE-2019-7195",
       "CVE-2019-7238",
+      "CVE-2019-7256",
       "CVE-2019-7286",
       "CVE-2019-7287",
       "CVE-2019-7483",
@@ -1150,12 +1159,16 @@
       "CVE-2020-27950",
       "CVE-2020-2883",
       "CVE-2020-29557",
+      "CVE-2020-29574",
       "CVE-2020-3118",
       "CVE-2020-3259",
+      "CVE-2020-3433",
+      "CVE-2020-3452",
       "CVE-2020-3566",
       "CVE-2020-3569",
       "CVE-2020-35730",
       "CVE-2020-3580",
+      "CVE-2020-36193",
       "CVE-2020-3837",
       "CVE-2020-4427",
       "CVE-2020-4428",
@@ -1182,6 +1195,7 @@
       "CVE-2020-9819",
       "CVE-2020-9859",
       "CVE-2020-9907",
+      "CVE-2020-9934",
       "CVE-2021-0920",
       "CVE-2021-1048",
       "CVE-2021-1497",
@@ -1196,6 +1210,7 @@
       "CVE-2021-20035",
       "CVE-2021-20038",
       "CVE-2021-20090",
+      "CVE-2021-20123",
       "CVE-2021-20124",
       "CVE-2021-21166",
       "CVE-2021-21193",
@@ -1221,8 +1236,11 @@
       "CVE-2021-23758",
       "CVE-2021-23874",
       "CVE-2021-25296",
+      "CVE-2021-25297",
       "CVE-2021-25298",
+      "CVE-2021-25337",
       "CVE-2021-25369",
+      "CVE-2021-25370",
       "CVE-2021-25371",
       "CVE-2021-25372",
       "CVE-2021-25394",
@@ -1241,6 +1259,7 @@
       "CVE-2021-27860",
       "CVE-2021-27876",
       "CVE-2021-27877",
+      "CVE-2021-28663",
       "CVE-2021-28664",
       "CVE-2021-29256",
       "CVE-2021-30116",
@@ -1255,6 +1274,7 @@
       "CVE-2021-30666",
       "CVE-2021-30761",
       "CVE-2021-30762",
+      "CVE-2021-30807",
       "CVE-2021-30858",
       "CVE-2021-30860",
       "CVE-2021-30869",
@@ -1282,11 +1302,13 @@
       "CVE-2021-36260",
       "CVE-2021-36380",
       "CVE-2021-36934",
+      "CVE-2021-37415",
       "CVE-2021-37973",
       "CVE-2021-37975",
       "CVE-2021-37976",
       "CVE-2021-38003",
       "CVE-2021-38163",
+      "CVE-2021-38371",
       "CVE-2021-38406",
       "CVE-2021-38647",
       "CVE-2021-39226",
@@ -1307,17 +1329,21 @@
       "CVE-2021-42258",
       "CVE-2021-42278",
       "CVE-2021-42287",
+      "CVE-2021-42321",
       "CVE-2021-43226",
       "CVE-2021-43798",
       "CVE-2021-44026",
       "CVE-2021-44077",
       "CVE-2021-44168",
+      "CVE-2021-44207",
       "CVE-2021-44228",
       "CVE-2021-44515",
       "CVE-2021-44529",
       "CVE-2021-45046",
       "CVE-2021-45382",
+      "CVE-2022-0028",
       "CVE-2022-0185",
+      "CVE-2022-0492",
       "CVE-2022-0543",
       "CVE-2022-0847",
       "CVE-2022-0995",
@@ -1325,11 +1351,13 @@
       "CVE-2022-1096",
       "CVE-2022-1364",
       "CVE-2022-1388",
+      "CVE-2022-1471",
       "CVE-2022-20699",
       "CVE-2022-20701",
       "CVE-2022-20775",
       "CVE-2022-20821",
       "CVE-2022-21445",
+      "CVE-2022-21587",
       "CVE-2022-21882",
       "CVE-2022-21919",
       "CVE-2022-21999",
@@ -1354,6 +1382,7 @@
       "CVE-2022-24086",
       "CVE-2022-24521",
       "CVE-2022-24682",
+      "CVE-2022-24706",
       "CVE-2022-24816",
       "CVE-2022-2586",
       "CVE-2022-26134",
@@ -1367,6 +1396,7 @@
       "CVE-2022-26904",
       "CVE-2022-27924",
       "CVE-2022-27925",
+      "CVE-2022-2856",
       "CVE-2022-29303",
       "CVE-2022-29464",
       "CVE-2022-29499",
@@ -1377,16 +1407,23 @@
       "CVE-2022-31199",
       "CVE-2022-3236",
       "CVE-2022-32894",
+      "CVE-2022-33891",
       "CVE-2022-34713",
       "CVE-2022-35914",
+      "CVE-2022-36551",
+      "CVE-2022-36804",
       "CVE-2022-37042",
+      "CVE-2022-37055",
       "CVE-2022-37969",
       "CVE-2022-38028",
       "CVE-2022-38181",
       "CVE-2022-39197",
+      "CVE-2022-40684",
+      "CVE-2022-40765",
       "CVE-2022-40799",
       "CVE-2022-41033",
       "CVE-2022-41040",
+      "CVE-2022-41073",
       "CVE-2022-41125",
       "CVE-2022-41328",
       "CVE-2022-42475",
@@ -1397,6 +1434,8 @@
       "CVE-2022-43769",
       "CVE-2022-43939",
       "CVE-2022-44877",
+      "CVE-2022-46169",
+      "CVE-2022-47986",
       "CVE-2022-48503",
       "CVE-2022-48618",
       "CVE-2023-0266",
@@ -1404,7 +1443,10 @@
       "CVE-2023-0669",
       "CVE-2023-1389",
       "CVE-2023-1671",
+      "CVE-2023-20109",
       "CVE-2023-20118",
+      "CVE-2023-20198",
+      "CVE-2023-20269",
       "CVE-2023-2033",
       "CVE-2023-20867",
       "CVE-2023-20887",
@@ -1412,6 +1454,7 @@
       "CVE-2023-21529",
       "CVE-2023-21608",
       "CVE-2023-21674",
+      "CVE-2023-21823",
       "CVE-2023-21839",
       "CVE-2023-22515",
       "CVE-2023-22518",
@@ -1457,6 +1500,7 @@
       "CVE-2023-33010",
       "CVE-2023-33063",
       "CVE-2023-33106",
+      "CVE-2023-33107",
       "CVE-2023-33538",
       "CVE-2023-34048",
       "CVE-2023-34192",
@@ -1467,9 +1511,12 @@
       "CVE-2023-3519",
       "CVE-2023-35311",
       "CVE-2023-35674",
+      "CVE-2023-36033",
       "CVE-2023-36036",
       "CVE-2023-36424",
       "CVE-2023-36802",
+      "CVE-2023-36844",
+      "CVE-2023-36851",
       "CVE-2023-36874",
       "CVE-2023-37450",
       "CVE-2023-37580",
@@ -1478,10 +1525,12 @@
       "CVE-2023-38203",
       "CVE-2023-38205",
       "CVE-2023-38606",
+      "CVE-2023-38950",
       "CVE-2023-39780",
       "CVE-2023-40044",
       "CVE-2023-41061",
       "CVE-2023-41064",
+      "CVE-2023-41179",
       "CVE-2023-41265",
       "CVE-2023-41266",
       "CVE-2023-41763",
@@ -1496,16 +1545,23 @@
       "CVE-2023-43000",
       "CVE-2023-43208",
       "CVE-2023-4346",
+      "CVE-2023-43472",
+      "CVE-2023-43654",
       "CVE-2023-43770",
+      "CVE-2023-43791",
       "CVE-2023-44221",
+      "CVE-2023-44467",
       "CVE-2023-44487",
       "CVE-2023-45249",
       "CVE-2023-45727",
       "CVE-2023-46747",
+      "CVE-2023-46748",
       "CVE-2023-46805",
+      "CVE-2023-47117",
       "CVE-2023-47246",
       "CVE-2023-47565",
       "CVE-2023-4762",
+      "CVE-2023-48022",
       "CVE-2023-48365",
       "CVE-2023-4863",
       "CVE-2023-48788",
@@ -1514,35 +1570,61 @@
       "CVE-2023-4911",
       "CVE-2023-4966",
       "CVE-2023-49897",
+      "CVE-2023-50224",
       "CVE-2023-50387",
       "CVE-2023-50868",
+      "CVE-2023-51449",
       "CVE-2023-52163",
       "CVE-2023-5631",
+      "CVE-2023-6016",
+      "CVE-2023-6019",
+      "CVE-2023-6021",
+      "CVE-2023-6038",
       "CVE-2023-6549",
+      "CVE-2023-6571",
       "CVE-2023-7024",
       "CVE-2023-7028",
       "CVE-2024-0012",
+      "CVE-2024-0129",
+      "CVE-2024-0132",
       "CVE-2024-0519",
       "CVE-2024-0769",
       "CVE-2024-1086",
+      "CVE-2024-11120",
       "CVE-2024-11182",
+      "CVE-2024-11392",
+      "CVE-2024-11393",
+      "CVE-2024-11394",
       "CVE-2024-11667",
       "CVE-2024-11680",
       "CVE-2024-1212",
       "CVE-2024-12356",
+      "CVE-2024-12366",
+      "CVE-2024-12450",
       "CVE-2024-12686",
+      "CVE-2024-12776",
       "CVE-2024-12987",
+      "CVE-2024-13059",
       "CVE-2024-13159",
       "CVE-2024-13160",
       "CVE-2024-13161",
+      "CVE-2024-1561",
       "CVE-2024-1709",
+      "CVE-2024-20353",
+      "CVE-2024-20359",
       "CVE-2024-20399",
       "CVE-2024-20439",
+      "CVE-2024-20481",
       "CVE-2024-20767",
       "CVE-2024-20953",
+      "CVE-2024-21182",
       "CVE-2024-21287",
       "CVE-2024-21413",
+      "CVE-2024-21513",
+      "CVE-2024-21575",
+      "CVE-2024-21576",
       "CVE-2024-21626",
+      "CVE-2024-21762",
       "CVE-2024-21887",
       "CVE-2024-21893",
       "CVE-2024-23113",
@@ -1550,29 +1632,38 @@
       "CVE-2024-23225",
       "CVE-2024-23296",
       "CVE-2024-23897",
+      "CVE-2024-24590",
+      "CVE-2024-24591",
       "CVE-2024-24919",
       "CVE-2024-26169",
+      "CVE-2024-27132",
       "CVE-2024-27198",
       "CVE-2024-27199",
       "CVE-2024-27348",
       "CVE-2024-27443",
       "CVE-2024-28986",
       "CVE-2024-28995",
+      "CVE-2024-2912",
       "CVE-2024-29745",
       "CVE-2024-29748",
       "CVE-2024-29824",
       "CVE-2024-30051",
       "CVE-2024-30088",
       "CVE-2024-3094",
+      "CVE-2024-31462",
       "CVE-2024-32113",
       "CVE-2024-3272",
       "CVE-2024-3273",
+      "CVE-2024-32896",
       "CVE-2024-3393",
       "CVE-2024-3400",
       "CVE-2024-34102",
       "CVE-2024-35250",
       "CVE-2024-36401",
       "CVE-2024-36971",
+      "CVE-2024-37032",
+      "CVE-2024-37052",
+      "CVE-2024-37060",
       "CVE-2024-37079",
       "CVE-2024-38014",
       "CVE-2024-38080",
@@ -1585,13 +1676,19 @@
       "CVE-2024-38812",
       "CVE-2024-38813",
       "CVE-2024-38856",
+      "CVE-2024-39717",
+      "CVE-2024-39722",
       "CVE-2024-4040",
       "CVE-2024-40635",
       "CVE-2024-40711",
       "CVE-2024-40766",
       "CVE-2024-40890",
       "CVE-2024-40891",
+      "CVE-2024-41713",
+      "CVE-2024-42478",
+      "CVE-2024-42479",
       "CVE-2024-43047",
+      "CVE-2024-43093",
       "CVE-2024-43451",
       "CVE-2024-43468",
       "CVE-2024-4358",
@@ -1606,8 +1703,10 @@
       "CVE-2024-48248",
       "CVE-2024-4879",
       "CVE-2024-4885",
+      "CVE-2024-4889",
       "CVE-2024-49035",
       "CVE-2024-49138",
+      "CVE-2024-50050",
       "CVE-2024-50302",
       "CVE-2024-50603",
       "CVE-2024-50623",
@@ -1622,12 +1721,15 @@
       "CVE-2024-54085",
       "CVE-2024-55550",
       "CVE-2024-55591",
+      "CVE-2024-5565",
       "CVE-2024-57726",
       "CVE-2024-57727",
       "CVE-2024-57728",
       "CVE-2024-57968",
       "CVE-2024-58136",
       "CVE-2024-5910",
+      "CVE-2024-6047",
+      "CVE-2024-6587",
       "CVE-2024-6670",
       "CVE-2024-7399",
       "CVE-2024-7593",
@@ -1637,17 +1739,22 @@
       "CVE-2024-8069",
       "CVE-2024-8190",
       "CVE-2024-8956",
+      "CVE-2024-8963",
       "CVE-2024-9379",
       "CVE-2024-9380",
       "CVE-2024-9465",
       "CVE-2024-9474",
+      "CVE-2024-9526",
       "CVE-2024-9537",
       "CVE-2025-0108",
       "CVE-2025-0111",
       "CVE-2025-0133",
+      "CVE-2025-0282",
       "CVE-2025-0994",
       "CVE-2025-10035",
+      "CVE-2025-10164",
       "CVE-2025-10585",
+      "CVE-2025-10725",
       "CVE-2025-1094",
       "CVE-2025-11371",
       "CVE-2025-11837",
@@ -1658,7 +1765,10 @@
       "CVE-2025-14611",
       "CVE-2025-14733",
       "CVE-2025-14847",
+      "CVE-2025-1550",
       "CVE-2025-15556",
+      "CVE-2025-1753",
+      "CVE-2025-1796",
       "CVE-2025-1976",
       "CVE-2025-20281",
       "CVE-2025-20333",
@@ -1668,9 +1778,11 @@
       "CVE-2025-20393",
       "CVE-2025-21042",
       "CVE-2025-21043",
+      "CVE-2025-21085",
       "CVE-2025-21333",
       "CVE-2025-21334",
       "CVE-2025-21335",
+      "CVE-2025-21391",
       "CVE-2025-21418",
       "CVE-2025-21479",
       "CVE-2025-21480",
@@ -1678,11 +1790,15 @@
       "CVE-2025-22224",
       "CVE-2025-22225",
       "CVE-2025-22226",
+      "CVE-2025-22457",
       "CVE-2025-23006",
       "CVE-2025-23209",
+      "CVE-2025-23254",
+      "CVE-2025-23266",
       "CVE-2025-24016",
       "CVE-2025-24054",
       "CVE-2025-24085",
+      "CVE-2025-24200",
       "CVE-2025-24201",
       "CVE-2025-24472",
       "CVE-2025-24813",
@@ -1697,32 +1813,46 @@
       "CVE-2025-25181",
       "CVE-2025-25249",
       "CVE-2025-25257",
+      "CVE-2025-25297",
       "CVE-2025-26399",
       "CVE-2025-26633",
       "CVE-2025-27038",
+      "CVE-2025-27363",
       "CVE-2025-2746",
       "CVE-2025-2747",
       "CVE-2025-2749",
+      "CVE-2025-27520",
       "CVE-2025-2775",
       "CVE-2025-2776",
       "CVE-2025-2783",
       "CVE-2025-27920",
       "CVE-2025-29635",
       "CVE-2025-29824",
+      "CVE-2025-30165",
+      "CVE-2025-30202",
+      "CVE-2025-30400",
       "CVE-2025-30406",
+      "CVE-2025-31161",
       "CVE-2025-31200",
       "CVE-2025-31201",
       "CVE-2025-31277",
+      "CVE-2025-31324",
       "CVE-2025-32432",
       "CVE-2025-32433",
+      "CVE-2025-32434",
+      "CVE-2025-32444",
       "CVE-2025-32463",
+      "CVE-2025-3248",
       "CVE-2025-32701",
       "CVE-2025-32706",
       "CVE-2025-32709",
       "CVE-2025-32756",
       "CVE-2025-33073",
+      "CVE-2025-33236",
       "CVE-2025-34026",
       "CVE-2025-34028",
+      "CVE-2025-34291",
+      "CVE-2025-3466",
       "CVE-2025-35939",
       "CVE-2025-37164",
       "CVE-2025-38352",
@@ -1743,22 +1873,28 @@
       "CVE-2025-4427",
       "CVE-2025-4428",
       "CVE-2025-4632",
+      "CVE-2025-47729",
       "CVE-2025-47812",
       "CVE-2025-47813",
       "CVE-2025-47827",
       "CVE-2025-48384",
       "CVE-2025-48543",
       "CVE-2025-48572",
+      "CVE-2025-48595",
       "CVE-2025-48633",
       "CVE-2025-48703",
       "CVE-2025-49113",
+      "CVE-2025-49596",
       "CVE-2025-49704",
       "CVE-2025-49706",
       "CVE-2025-5086",
+      "CVE-2025-51480",
       "CVE-2025-52691",
       "CVE-2025-53521",
+      "CVE-2025-53767",
       "CVE-2025-53770",
       "CVE-2025-54068",
+      "CVE-2025-54136",
       "CVE-2025-5419",
       "CVE-2025-54236",
       "CVE-2025-54253",
@@ -1766,6 +1902,7 @@
       "CVE-2025-54948",
       "CVE-2025-55177",
       "CVE-2025-55182",
+      "CVE-2025-56520",
       "CVE-2025-57819",
       "CVE-2025-58034",
       "CVE-2025-58360",
@@ -1775,6 +1912,7 @@
       "CVE-2025-59529",
       "CVE-2025-59689",
       "CVE-2025-59718",
+      "CVE-2025-60455",
       "CVE-2025-60710",
       "CVE-2025-61757",
       "CVE-2025-61882",
@@ -1790,24 +1928,35 @@
       "CVE-2025-62849",
       "CVE-2025-64328",
       "CVE-2025-64446",
+      "CVE-2025-64496",
       "CVE-2025-6543",
       "CVE-2025-6554",
       "CVE-2025-66644",
       "CVE-2025-67038",
+      "CVE-2025-67818",
       "CVE-2025-68613",
       "CVE-2025-68645",
+      "CVE-2025-68668",
       "CVE-2025-68686",
+      "CVE-2025-69286",
       "CVE-2025-6965",
       "CVE-2025-7775",
       "CVE-2025-8110",
+      "CVE-2025-8671",
+      "CVE-2025-8747",
       "CVE-2025-8875",
       "CVE-2025-8876",
       "CVE-2025-9242",
       "CVE-2025-9377",
+      "CVE-2026-0257",
       "CVE-2026-0300",
+      "CVE-2026-0766",
+      "CVE-2026-10520",
+      "CVE-2026-11645",
       "CVE-2026-12569",
       "CVE-2026-1281",
       "CVE-2026-1340",
+      "CVE-2026-15409",
       "CVE-2026-15410",
       "CVE-2026-1603",
       "CVE-2026-16812",
@@ -1822,8 +1971,10 @@
       "CVE-2026-20131",
       "CVE-2026-20133",
       "CVE-2026-20230",
+      "CVE-2026-20245",
       "CVE-2026-20253",
       "CVE-2026-20262",
+      "CVE-2026-20316",
       "CVE-2026-20349",
       "CVE-2026-20700",
       "CVE-2026-20805",
@@ -1834,44 +1985,84 @@
       "CVE-2026-21525",
       "CVE-2026-21533",
       "CVE-2026-21643",
+      "CVE-2026-21858",
+      "CVE-2026-21877",
       "CVE-2026-21962",
+      "CVE-2026-22218",
+      "CVE-2026-22219",
+      "CVE-2026-22252",
+      "CVE-2026-22688",
       "CVE-2026-22719",
       "CVE-2026-22769",
       "CVE-2026-23760",
+      "CVE-2026-24206",
+      "CVE-2026-24207",
+      "CVE-2026-24213",
+      "CVE-2026-24214",
+      "CVE-2026-24215",
       "CVE-2026-2441",
       "CVE-2026-24423",
       "CVE-2026-24858",
       "CVE-2026-25089",
       "CVE-2026-25108",
+      "CVE-2026-25592",
+      "CVE-2026-26015",
+      "CVE-2026-26190",
+      "CVE-2026-28318",
       "CVE-2026-3055",
+      "CVE-2026-3059",
+      "CVE-2026-3060",
+      "CVE-2026-30616",
+      "CVE-2026-30617",
+      "CVE-2026-30624",
+      "CVE-2026-30625",
+      "CVE-2026-31229",
+      "CVE-2026-31230",
       "CVE-2026-31431",
       "CVE-2026-31635",
+      "CVE-2026-33017",
       "CVE-2026-33634",
       "CVE-2026-33824",
       "CVE-2026-33825",
+      "CVE-2026-34159",
       "CVE-2026-34197",
       "CVE-2026-34908",
       "CVE-2026-34909",
       "CVE-2026-34910",
+      "CVE-2026-34926",
       "CVE-2026-3502",
+      "CVE-2026-35273",
       "CVE-2026-35616",
       "CVE-2026-3909",
       "CVE-2026-39808",
+      "CVE-2026-40933",
+      "CVE-2026-41091",
       "CVE-2026-41940",
+      "CVE-2026-41947",
+      "CVE-2026-41950",
       "CVE-2026-42016",
       "CVE-2026-42018",
       "CVE-2026-42208",
+      "CVE-2026-42271",
       "CVE-2026-42945",
       "CVE-2026-43284",
       "CVE-2026-43500",
+      "CVE-2026-45247",
       "CVE-2026-45321",
+      "CVE-2026-45498",
       "CVE-2026-45659",
+      "CVE-2026-45829",
+      "CVE-2026-46300",
+      "CVE-2026-46333",
       "CVE-2026-46817",
+      "CVE-2026-48172",
       "CVE-2026-48282",
       "CVE-2026-48558",
       "CVE-2026-48710",
       "CVE-2026-48907",
+      "CVE-2026-48908",
       "CVE-2026-50522",
+      "CVE-2026-50751",
       "CVE-2026-53362",
       "CVE-2026-54420",
       "CVE-2026-55040",
@@ -1880,6 +2071,7 @@
       "CVE-2026-56164",
       "CVE-2026-56290",
       "CVE-2026-56291",
+      "CVE-2026-5760",
       "CVE-2026-58644",
       "CVE-2026-58704",
       "CVE-2026-59310",
@@ -1897,6 +2089,7 @@
       "CVE-2026-72530",
       "CVE-2026-72898",
       "CVE-2026-73570",
+      "CVE-2026-7473",
       "CVE-2026-75650",
       "CVE-2026-76460",
       "CVE-2026-76461",
@@ -1907,6 +2100,7 @@
       "CVE-2026-82329",
       "CVE-2026-83548",
       "CVE-2026-83549",
+      "CVE-2026-8398",
       "CVE-2026-8452",
       "CVE-2026-85046",
       "CVE-2026-85706",
@@ -1915,6 +2109,7 @@
       "CVE-2026-86218",
       "CVE-2026-87491",
       "CVE-2026-87886",
+      "CVE-2026-9082",
       "CVE-2026-9586",
       "MAL-2025-AI-FOUND-FFMPEG-BIGSLEEP"
     ],
@@ -6248,7 +6443,7 @@
     ],
     "atlas_refs": [
       "AML.T0096",
-      "AML.T0017"
+      "AML.T0016"
     ],
     "attack_refs": [
       "T1071",
@@ -7907,7 +8102,7 @@
       "CVE-2026-8398"
     ],
     "atlas_refs": [
-      "AML.T0017"
+      "AML.T0016"
     ],
     "attack_refs": [
       "T1059"
@@ -8096,7 +8291,7 @@
       "CVE-2026-42945"
     ],
     "atlas_refs": [
-      "AML.T0040"
+      "AML.T0017"
     ],
     "attack_refs": [
       "T1190"
@@ -8164,7 +8359,7 @@
     "evidence_cves": [],
     "atlas_refs": [
       "AML.T0010",
-      "AML.T0016"
+      "AML.T0081"
     ],
     "attack_refs": [
       "T1195.001"
@@ -8272,7 +8467,7 @@
     "evidence_cves": [],
     "atlas_refs": [
       "AML.T0010",
-      "AML.T0016",
+      "AML.T0053",
       "AML.T0051"
     ],
     "attack_refs": [
@@ -8395,7 +8590,7 @@
       "CVE-2026-42945"
     ],
     "atlas_refs": [
-      "AML.T0040"
+      "AML.T0017"
     ],
     "attack_refs": [
       "T1190"
@@ -8806,7 +9001,7 @@
     ],
     "atlas_refs": [
       "AML.T0096",
-      "AML.T0017"
+      "AML.T0016"
     ],
     "attack_refs": [
       "T1071",
@@ -9522,7 +9717,7 @@
     "opened_date": "2026-05-15",
     "evidence_cves": [],
     "atlas_refs": [
-      "AML.T0040"
+      "AML.T0010"
     ],
     "attack_refs": [
       "T1078",
@@ -9593,7 +9788,7 @@
       "CVE-2007-3010"
     ],
     "atlas_refs": [
-      "AML.T0040"
+      "AML.T0010"
     ],
     "attack_refs": [
       "T1199",
@@ -9706,38 +9901,39 @@
     "forward_looking": true,
     "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
   },
-  "AU-ISM-1556": {
-    "framework": "au-ism",
-    "control_id": "ISM-1556",
-    "control_name": "Multi-factor authentication for privileged users (telecom NMS application)",
-    "designed_for": "Australian Government ISM control ISM-1556 — phishing-resistant MFA for privileged users + remote access.",
+  "AU-ISM-1173-Telecom-NMS": {
+    "framework": "Australian Government Information Security Manual (ISM)",
+    "control_id": "ISM-1173",
+    "control_name": "Multi-factor authentication is used to authenticate privileged human users of systems (telecom network management)",
+    "designed_for": "ISM-1173 requires multi-factor authentication for privileged human users of systems, and is in the Essential Eight profile from Maturity Level Two. Applied to a telecom operator, it covers the human administrators of the network management system, element managers and operations support systems.",
     "misses": [
-      "Telecom NMS service accounts (which hold gNB / EMS / OSS access) often bypass human MFA",
-      "Service-account credential management policy is ISM-1559 (covered separately); ISM-1556 alone is insufficient for telecom OEM-vendor support tunnels",
-      "Lawful-intercept gateway operator credentials specifically uncovered — these are not always classified as privileged in telecom RBAC models",
-      "OEM remote-support inbound tunnels (Cisco TAC, Ericsson ENS) often pass credentials via shared mailbox — defeats MFA intent"
+      "The control names human users, so telecom network management service accounts, which hold radio-network, element-manager and operations-support access, sit outside it and are often left on static credentials",
+      "Service-account credentials fall under ISM-1685 instead, and ISM-1173 alone says nothing about the OEM vendor support tunnels that carry privileged access into the network",
+      "Lawful-intercept gateway operator accounts are not always classified as privileged in telecom role models, so they can fall outside the control's scope entirely",
+      "OEM remote-support tunnels often pass credentials through a shared mailbox, which defeats the purpose of multi-factor authentication even where the control is met on paper"
     ],
-    "real_requirement": "ISM-1556 + telecom-NMS service-account FIDO2 enforcement + LI-gateway-specific MFA + OEM remote-support-tunnel federated-MFA mandate.",
+    "real_requirement": "Multi-factor authentication for privileged network-management users must extend to phishing-resistant factors on every administrative path, including lawful-intercept gateways and OEM remote-support tunnels, with network-management service accounts brought under ISM-1685 credential management.",
     "status": "open",
     "opened_date": "2026-05-15",
     "evidence_cves": [],
     "atlas_refs": [],
     "attack_refs": [
       "T1078",
-      "T1098"
+      "T1098",
+      "T1111"
     ],
     "theater_test": {
-      "claim": "Our telecom posture satisfies AU ISM control 1556 for signaling-protocol abuse.",
-      "test": "Confirm signaling-anomaly baselines per PLMN-pair, gNB firmware hash attestation, and LI-gateway audit. Pull the past 90 days of signaling alerts; confirm triage records. Theater verdict if any of those streams is missing, or if signaling anomalies are unmonitored.",
+      "claim": "Privileged users of our telecom network management systems authenticate with multi-factor authentication, which satisfies ISM-1173.",
+      "test": "List every administrative path into the network management system, element managers, operations support systems and lawful-intercept gateways, including OEM remote-support tunnels. For each, confirm the factor in use and whether it is phishing-resistant, and confirm no credential for it is shared through a mailbox or ticket. Theater verdict if any path accepts a password alone, if lawful-intercept operator accounts are not classified as privileged, or if a support tunnel's credential is shared.",
       "evidence_required": [
-        "signaling baseline document with PLMN-pair coverage",
-        "gNB attestation telemetry",
-        "alert-triage records"
+        "inventory of administrative paths with the authentication factor used on each",
+        "privileged-role classification covering lawful-intercept gateway operators",
+        "OEM remote-support credential handling record"
       ],
       "verdict_when_failed": "compliance-theater"
     },
     "forward_looking": true,
-    "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
+    "forward_looking_reason": "No CVE in the catalog anchors this gap yet; it records the control class without binding it to a single incident."
   },
   "GSMA-NESAS-Deployment": {
     "framework": "GSMA-NESAS",
@@ -9972,39 +10168,37 @@
     "forward_looking": true,
     "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
   },
-  "AU-ISM-1559-IdP": {
-    "framework": "AU ISM",
-    "control_id": "ISM-1559",
-    "control_name": "Privileged Account Credential Management — IdP-tenant control-plane extension",
-    "designed_for": "ISM-1559 covers privileged-account credential management — storage, rotation, monitoring of privileged credentials.",
+  "AU-ISM-1685-IdP": {
+    "framework": "Australian Government Information Security Manual (ISM)",
+    "control_id": "ISM-1685",
+    "control_name": "Credentials for break glass accounts, local administrator accounts and service accounts are long, unique, unpredictable and managed (identity provider tenant)",
+    "designed_for": "ISM-1685 requires that credentials for break glass accounts, local administrator accounts and service accounts are long, unique, unpredictable and managed, and is in the Essential Eight profile from Maturity Level Two. Applied to an identity provider, it covers the tenant's break-glass administrators and the service credentials that operate its management API.",
     "misses": [
-      "ISM-1559 reaches privileged credentials at the system layer (admin password vault, server-side admin accounts)",
-      "IdP-tenant control-plane operations (modifying federated trust, granting tenant-wide application permissions, rotating the token-signing certificate) are outside the ISM-1559 evidence path",
-      "The IdP tenant is the privileged-credential source-of-truth for every downstream system; ISM-1559 audits the downstream systems and treats the IdP tenant as oracle"
+      "The control reaches credentials on the systems an organization runs, such as an administrator password vault or server-side service accounts, and not the identity provider tenant's own control plane",
+      "Control-plane operations in the tenant (changing a federated trust, granting tenant-wide application permissions, rotating the token-signing certificate) are not credential events, so they sit outside the evidence this control collects",
+      "The identity provider tenant is the source of truth for privileged access to every downstream system, and credential management audited on those downstream systems treats the tenant as trustworthy"
     ],
-    "real_requirement": "Extend ISM-1559 scope to the IdP tenant's own control plane: management-API-token inventory, consent-grant inventory, federated-trust integrity, with continuous alerting and quarterly attestation.",
+    "real_requirement": "Credential management must extend to the identity provider tenant's own control plane: an inventory of management-API tokens and consent grants, integrity monitoring of federated trusts and the token-signing certificate, continuous alerting on changes, and quarterly attestation.",
     "status": "open",
     "opened_date": "2026-05-15",
-    "evidence_cves": [
-      "CVE-2020-2021"
-    ],
+    "evidence_cves": [],
     "atlas_refs": [],
     "attack_refs": [
       "T1078.004",
       "T1098.001"
     ],
     "theater_test": {
-      "claim": "Our IdP posture satisfies AU ISM 1559 for identity provider security.",
-      "test": "Confirm IdP token-signing certificate rotation alerting, claim-transformation change-control, management-API token TTL/scope/source-IP enforcement. Confirm the IdP is treated as critical-infrastructure-tier in the asset inventory. Theater verdict if IdP is in 'IT vendor' tier rather than critical-infrastructure tier.",
+      "claim": "Our identity provider's privileged and service credentials are managed, which satisfies ISM-1685.",
+      "test": "Confirm alerting on token-signing certificate rotation, change control on claim transformations, and enforced lifetime, scope and source-address limits on management-API tokens. Confirm the identity provider is classified in the critical-infrastructure tier of the asset inventory. Theater verdict if it is classified as an ordinary IT vendor, or if management-API tokens have no lifetime or scope limit.",
       "evidence_required": [
-        "IdP control-plane monitoring rule export",
+        "identity provider control-plane monitoring rule export",
         "asset-tier classification record",
-        "management-API token inventory"
+        "management-API token inventory with lifetime and scope"
       ],
       "verdict_when_failed": "compliance-theater"
     },
     "forward_looking": true,
-    "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
+    "forward_looking_reason": "No CVE in the catalog anchors this gap yet; it records the control class without binding it to a single incident."
   },
   "NIS2-Art-21-Federated-Identity": {
     "framework": "EU NIS2 Directive",
@@ -10351,19 +10545,19 @@
     "forward_looking": true,
     "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
   },
-  "AU-ISM-1546-Cloud-Service-Account": {
-    "framework": "ACSC ISM (Australian Government Information Security Manual)",
-    "control_id": "ISM-1546",
-    "control_name": "Multi-factor authentication for privileged users and remote access",
-    "designed_for": "MFA for AU-government privileged users and remote-access scenarios",
+  "AU-ISM-1685-Cloud-Service-Account": {
+    "framework": "Australian Government Information Security Manual (ISM)",
+    "control_id": "ISM-1685",
+    "control_name": "Credentials for break glass accounts, local administrator accounts and service accounts are long, unique, unpredictable and managed (cloud service accounts)",
+    "designed_for": "ISM-1685 requires that credentials for break glass accounts, local administrator accounts and service accounts are long, unique, unpredictable and managed, and is in the Essential Eight profile from Maturity Level Two. Applied to cloud platforms, it covers the access keys, tokens and federated credentials that service accounts and workloads use.",
     "misses": [
-      "Cloud service-account access keys are bearer credentials that bypass human MFA entirely",
-      "IAM-role assume-role chains initiated by service principals never cross the human-MFA gate",
-      "Managed-identity tokens (Azure managed identity, AWS instance profile, GCP service-account default) are scoped to non-human principals",
-      "OIDC federation tokens for CI (GitHub Actions / GitLab / CircleCI) bypass human-MFA - MFA was evaluated at the IdP, not at the cloud",
-      "SAML assertions held by SaaS integrations bypass cloud-IAM MFA"
+      "Cloud service-account access keys are bearer credentials: a long, unique key satisfies the control and still works from anywhere once it leaks, with no human authentication step to stop it",
+      "Role-assumption chains started by service principals never pass a human multi-factor gate, and the control sets no limit on how far such a chain can reach",
+      "Managed-identity tokens (Azure managed identity, AWS instance profiles, the GCP default service account) are issued to non-human principals by the platform, so there is no credential for the organization to make long or unique",
+      "OIDC federation tokens for CI systems (GitHub Actions, GitLab, CircleCI) inherit whatever authentication the identity provider performed, not any check at the cloud",
+      "SAML assertions held by SaaS integrations reach cloud resources without passing the cloud platform's own multi-factor controls"
     ],
-    "real_requirement": "ISM-1546 extension enumerating cloud non-human-principal credential hygiene: (1) bearer-token TTL ceilings (<= 1h non-CAE, <= 24h with Continuous Access Evaluation), (2) audience binding on every federated trust, (3) per-action audit logging on every non-human principal, (4) periodic rotation cadence with documented owner, (5) detection of token replay across source-IP boundaries.",
+    "real_requirement": "Service-account credential management must extend to cloud non-human principals: (1) bearer-token lifetime ceilings (one hour without continuous access evaluation, 24 hours with it), (2) audience binding on every federated trust, (3) per-action audit logging for every non-human principal, (4) a rotation cadence with a documented owner, (5) detection of token replay across source-address boundaries.",
     "status": "open",
     "opened_date": "2026-05-15",
     "evidence_cves": [],
@@ -10373,7 +10567,7 @@
       "T1552.005"
     ],
     "theater_test": {
-      "claim": "Our cloud service-account posture satisfies AU ISM 1546.",
+      "claim": "Our cloud service-account credentials are managed, which satisfies ISM-1685.",
       "test": "Inventory cloud service accounts. Confirm short-lived OIDC tokens (workload identity federation) are used in preference to static keys; for any remaining static keys, confirm rotation policy ≤90 days and source-IP allowlisting. Theater verdict if static keys exist without rotation/IP-allowlisting, or if workload identity federation is available but not adopted.",
       "evidence_required": [
         "cloud service-account inventory by auth method",
@@ -13297,236 +13491,43 @@
   "AU-ISM-1546": {
     "framework": "Australian Government Information Security Manual (ISM)",
     "control_id": "ISM-1546",
-    "control_name": "Patch operating systems and applications",
-    "designed_for": "Patching operating systems and applications within timeframes set by the Essential Eight Maturity Model — ML1: 1 month for non-critical, 2 weeks for internet-facing; ML2: 2 weeks for non-critical, 48 hours for internet-facing or exploited; ML3: 48 hours for non-critical, 48 hours for internet-facing or exploited.",
+    "control_name": "Users are authenticated before they are granted access to a system and its resources",
+    "designed_for": "ISM-1546 requires that users are authenticated before they are granted access to a system and its resources. It governs the organization's own access decisions and sits in the ISM's identity and access management guidelines, outside the Essential Eight maturity profiles.",
     "misses": [
-      "Patch-application timeframes anchor on advisory date, not on public-PoC availability — a deterministic LPE with a public PoC is exploitable from disclosure-minus-zero regardless of the 48h ML3 window",
-      "The maturity ladder does not differentiate between exploitable-from-disclosure (public PoC + deterministic primitive) and theoretically-exploitable, so the highest-tempo bucket is still slower than the threat",
-      "No requirement to deploy reversible compensating controls (kernel-module blacklist, syscall filter) while the patch cycle proceeds, even when the vendor offers them in the same advisory window"
+      "The control is met by configuring authentication in front of a system, so it does not reach a flaw in the vendor's own authentication code: an authentication bypass in an internet-facing appliance grants access to an unauthenticated request on a configuration that satisfies the control",
+      "Evidence for the control records that an authentication mechanism exists on each system; it does not test management interfaces, secondary ports or APIs that reach the same resources without passing through that mechanism",
+      "It sets no response when a vendor discloses that its authentication can be bypassed, so how quickly that exposure closes is governed by the patching controls rather than by this one"
     ],
-    "real_requirement": "ISM-1546 implementation must add: (1) a PoC-availability-aware tempo overlay where deterministic LPEs with public PoCs trigger a same-day-mitigation requirement separate from patch SLA, (2) a named compensating-control posture per maturity level (module blacklist at ML1, seccomp at ML2, live-patch at ML3), (3) explicit evidence that the operator inspected the advisory for non-binary mitigation paths before defaulting to the patch-only response.",
+    "real_requirement": "Authentication evidence must cover every path to a system's resources, including management interfaces and APIs, and must be re-tested for unauthenticated access whenever a vendor discloses an authentication bypass in a product the organization runs, rather than resting on the configuration record.",
     "status": "open",
     "opened_date": "2026-05-17",
     "evidence_cves": [
       "BUG-2026-NIGHTMARE-ECLIPSE-YELLOWKEY",
       "CVE-2013-0625",
       "CVE-2013-0632",
-      "CVE-2013-2094",
-      "CVE-2015-3246",
-      "CVE-2017-5521",
-      "CVE-2018-0171",
-      "CVE-2018-19322",
-      "CVE-2018-2628",
       "CVE-2019-17558",
-      "CVE-2019-7256",
-      "CVE-2020-29574",
-      "CVE-2020-3433",
-      "CVE-2020-3452",
-      "CVE-2020-36193",
-      "CVE-2020-9934",
-      "CVE-2021-20123",
-      "CVE-2021-25297",
-      "CVE-2021-25370",
-      "CVE-2021-28663",
-      "CVE-2021-30807",
+      "CVE-2020-2021",
       "CVE-2021-33044",
       "CVE-2021-33045",
-      "CVE-2021-37415",
-      "CVE-2021-38371",
-      "CVE-2021-42321",
-      "CVE-2021-44207",
-      "CVE-2022-0028",
-      "CVE-2022-0492",
-      "CVE-2022-1471",
       "CVE-2022-20700",
-      "CVE-2022-21587",
-      "CVE-2022-23176",
-      "CVE-2022-24706",
       "CVE-2022-26925",
-      "CVE-2022-2856",
-      "CVE-2022-33891",
-      "CVE-2022-36551",
-      "CVE-2022-36804",
-      "CVE-2022-37055",
-      "CVE-2022-40684",
-      "CVE-2022-40765",
-      "CVE-2022-41073",
-      "CVE-2022-46169",
-      "CVE-2022-47986",
-      "CVE-2023-20109",
-      "CVE-2023-20198",
-      "CVE-2023-20269",
-      "CVE-2023-21823",
-      "CVE-2023-33107",
       "CVE-2023-33246",
-      "CVE-2023-36033",
-      "CVE-2023-36844",
-      "CVE-2023-36851",
-      "CVE-2023-38950",
-      "CVE-2023-41179",
-      "CVE-2023-43472",
-      "CVE-2023-43654",
-      "CVE-2023-43791",
-      "CVE-2023-44467",
-      "CVE-2023-46748",
-      "CVE-2023-47117",
-      "CVE-2023-48022",
-      "CVE-2023-50224",
-      "CVE-2023-51449",
-      "CVE-2023-6016",
-      "CVE-2023-6019",
-      "CVE-2023-6021",
-      "CVE-2023-6038",
       "CVE-2023-6448",
-      "CVE-2023-6571",
-      "CVE-2024-0129",
-      "CVE-2024-0132",
-      "CVE-2024-11120",
-      "CVE-2024-11392",
-      "CVE-2024-11393",
-      "CVE-2024-11394",
-      "CVE-2024-12366",
-      "CVE-2024-12450",
-      "CVE-2024-12776",
-      "CVE-2024-13059",
-      "CVE-2024-1561",
-      "CVE-2024-20353",
-      "CVE-2024-20359",
-      "CVE-2024-20481",
-      "CVE-2024-21182",
-      "CVE-2024-21513",
-      "CVE-2024-21575",
-      "CVE-2024-21576",
-      "CVE-2024-21762",
-      "CVE-2024-24590",
-      "CVE-2024-24591",
-      "CVE-2024-27132",
       "CVE-2024-28987",
-      "CVE-2024-2912",
-      "CVE-2024-31462",
-      "CVE-2024-32896",
-      "CVE-2024-37032",
-      "CVE-2024-37052",
-      "CVE-2024-37060",
-      "CVE-2024-39717",
-      "CVE-2024-39722",
-      "CVE-2024-41713",
-      "CVE-2024-42478",
-      "CVE-2024-42479",
-      "CVE-2024-43093",
-      "CVE-2024-4889",
-      "CVE-2024-4978",
-      "CVE-2024-50050",
-      "CVE-2024-5565",
-      "CVE-2024-6047",
-      "CVE-2024-6587",
-      "CVE-2024-8963",
-      "CVE-2024-9526",
-      "CVE-2025-0282",
-      "CVE-2025-10164",
-      "CVE-2025-10725",
-      "CVE-2025-1550",
-      "CVE-2025-1753",
-      "CVE-2025-1796",
-      "CVE-2025-21085",
-      "CVE-2025-21391",
-      "CVE-2025-22457",
-      "CVE-2025-23254",
-      "CVE-2025-23266",
-      "CVE-2025-24200",
-      "CVE-2025-25297",
-      "CVE-2025-27363",
-      "CVE-2025-27520",
-      "CVE-2025-30165",
-      "CVE-2025-30202",
-      "CVE-2025-30400",
-      "CVE-2025-31161",
-      "CVE-2025-31324",
-      "CVE-2025-32434",
-      "CVE-2025-32444",
-      "CVE-2025-3248",
-      "CVE-2025-33236",
-      "CVE-2025-34291",
-      "CVE-2025-3466",
-      "CVE-2025-47729",
-      "CVE-2025-48595",
-      "CVE-2025-49596",
-      "CVE-2025-51480",
-      "CVE-2025-53767",
-      "CVE-2025-54136",
-      "CVE-2025-56520",
-      "CVE-2025-60455",
-      "CVE-2025-64496",
-      "CVE-2025-64513",
-      "CVE-2025-67818",
-      "CVE-2025-68668",
-      "CVE-2025-69286",
-      "CVE-2025-8671",
-      "CVE-2025-8747",
-      "CVE-2026-0257",
-      "CVE-2026-0766",
-      "CVE-2026-10520",
-      "CVE-2026-11645",
-      "CVE-2026-15409",
-      "CVE-2026-20245",
-      "CVE-2026-20316",
-      "CVE-2026-21858",
-      "CVE-2026-21877",
-      "CVE-2026-22218",
-      "CVE-2026-22219",
-      "CVE-2026-22252",
-      "CVE-2026-22688",
-      "CVE-2026-24206",
-      "CVE-2026-24207",
-      "CVE-2026-24213",
-      "CVE-2026-24214",
-      "CVE-2026-24215",
-      "CVE-2026-25592",
-      "CVE-2026-26015",
-      "CVE-2026-26190",
-      "CVE-2026-28318",
-      "CVE-2026-3059",
-      "CVE-2026-3060",
-      "CVE-2026-30616",
-      "CVE-2026-30617",
-      "CVE-2026-30624",
-      "CVE-2026-30625",
-      "CVE-2026-31229",
-      "CVE-2026-31230",
-      "CVE-2026-33017",
-      "CVE-2026-34159",
-      "CVE-2026-34926",
-      "CVE-2026-35273",
-      "CVE-2026-40933",
-      "CVE-2026-41091",
-      "CVE-2026-41947",
-      "CVE-2026-41950",
-      "CVE-2026-42271",
-      "CVE-2026-45247",
-      "CVE-2026-45498",
-      "CVE-2026-45829",
-      "CVE-2026-46300",
-      "CVE-2026-46333",
-      "CVE-2026-48172",
-      "CVE-2026-48908",
-      "CVE-2026-50751",
-      "CVE-2026-5760",
-      "CVE-2026-7473",
-      "CVE-2026-8398",
-      "CVE-2026-9082",
-      "MAL-2024-PYPI-ULTRALYTICS-XMRIG"
+      "CVE-2025-64513"
     ],
     "atlas_refs": [],
     "attack_refs": [
-      "T1068"
+      "T1190",
+      "T1556"
     ],
     "theater_test": {
-      "claim": "Our AU ISM-1546 patch programme meets Essential Eight Maturity Level 3 for kernel-class vulnerabilities.",
-      "test": "Pull the patch-management evidence pack and select the most recent deterministic kernel LPE with public PoC (CVE-2026-46300 / Fragnesia is the reference case). Confirm whether the evidence shows (a) same-day deployment of a named compensating control (module blacklist, seccomp profile, live-patch) distinct from the binary patch, and (b) the operator documented inspection of the advisory for non-binary mitigation before defaulting to the patch SLA. Theater verdict if the evidence collapses to 'patch within 48h' without a named same-day compensating control, or if the compensating control was deployed without advisory-side evidence of evaluation.",
+      "claim": "Every system requires authentication before access, which satisfies ISM-1546.",
+      "test": "Select the most recent authentication-bypass advisory for a product the organization runs. Confirm the evidence shows that the affected interface was re-tested for unauthenticated access after the advisory, and that management interfaces, secondary ports and APIs reaching the same resources are listed and were tested, not only the primary login. Theater verdict if the evidence is the authentication configuration record alone, or if the re-test after the advisory is missing.",
       "evidence_required": [
-        "patch-management evidence pack for the reference deterministic LPE",
-        "same-day compensating-control deployment record",
-        "advisory inspection notes documenting non-binary mitigation evaluation"
+        "list of every interface and API reaching the system's resources",
+        "unauthenticated-access test results for each, dated after the most recent bypass advisory",
+        "the advisory and the remediation record it triggered"
       ],
       "verdict_when_failed": "compliance-theater"
     }
@@ -14098,8 +14099,8 @@
     ],
     "atlas_refs": [
       "AML.T0010",
-      "AML.T0016",
-      "AML.T0040",
+      "AML.T0035",
+      "AML.T0110",
       "AML.T0051"
     ],
     "attack_refs": [
@@ -14135,7 +14136,7 @@
     ],
     "atlas_refs": [
       "AML.T0010",
-      "AML.T0016"
+      "AML.T0035"
     ],
     "attack_refs": [
       "T1190",
@@ -14578,21 +14579,53 @@
   "AU-ISM-1808": {
     "framework": "Australian Government Information Security Manual (ISM)",
     "control_id": "ISM-1808",
-    "control_name": "Software supply chain risk management",
-    "designed_for": "ISM control 1808 — managing the risks associated with the software supply chain, including assessing the trustworthiness of software vendors, validating software integrity, and monitoring for supply-chain compromise indicators. Anchored on the assumption that vendor-side SBOM disclosures and maintainer identity are trustworthy inputs to the operator's supply-chain risk model.",
+    "control_name": "A vulnerability scanner with an up-to-date vulnerability database is used for vulnerability scanning activities",
+    "designed_for": "ISM-1808 requires a vulnerability scanner with an up-to-date vulnerability database for vulnerability scanning. It is in the profile of every Essential Eight maturity level, alongside the scanning-frequency controls ISM-1698 (online services, daily), ISM-1699 (office suites, browsers, email clients, PDF applications and security products, weekly), ISM-1700 (other applications, fortnightly, from Maturity Level Two), ISM-1701 (internet-facing operating systems, daily), ISM-1702 (other operating systems, fortnightly) and ISM-1703 (drivers, fortnightly, at Maturity Level Three).",
     "misses": [
-      "ISM-1808 presumes maintainer identity is a reliable trust anchor; worm-class npm-registry compromises (Shai-Hulud MAL-2026-SHAI-HULUD-OSS reference case) publish malicious payloads under legitimate maintainer identity via credential theft + token replay, invalidating the maintainer-identity-as-trust-signal model that ISM-1808 evidence collection relies on",
-      "Vendor-side SBOM truth is treated as authoritative; ISM-1808 does not require independent operator-side SBOM-against-installed-artefact reconciliation, so a worm-injected dependency appears in installed-package telemetry while being absent from the vendor's published SBOM for the canonical version",
-      "ISM-1808 does not enumerate post-publish cooldown periods, maintainer-account-integrity monitoring (MFA enforcement, email-domain expiry tracking), or lockfile audit against known-malicious version sets during active exposure windows as standard controls — leaving operators without a baseline response posture when a worm-class incident is in progress"
+      "An up-to-date database holds only the checks scanner vendors have written, so a flaw CISA adds to the Known Exploited Vulnerabilities catalog before a check exists is invisible to a scanner that satisfies the control",
+      "Appliances, embedded devices and network equipment often cannot be scanned with credentials, so the scanner reports only the version string it can see or nothing at all, and a compliant scan shows no finding for a vulnerable build",
+      "The control measures that a scanner runs with a current database, not that its findings reach the patching queue inside the patching timeframes"
     ],
-    "real_requirement": "ISM-1808 implementations must add ecosystem-specific supply-chain controls: (1) operator-side SBOM-against-installed-artefact reconciliation independent of vendor-published SBOM, (2) maintainer-account-integrity monitoring on critical-path upstream packages (registry-side MFA enforcement evidence, maintainer-email-domain expiry tracking, anomalous-publish detection), (3) post-publish cooldown periods on consumption of fresh releases from systemically-important upstream maintainers, (4) lockfile audit against the known-malicious version set during the active exposure window of any worm-class incident, (5) documented response posture for the worm-class incident category distinct from the generic 'vulnerable dependency' response.",
+    "real_requirement": "Scanning evidence must show coverage of the KEV-listed vulnerabilities relevant to the estate, with a named alternative check (a version query, a vendor script, a manual inspection) wherever no scanner signature exists, and must link each finding to the patching deadline it falls under.",
+    "status": "open",
+    "opened_date": "2026-05-18",
+    "evidence_cves": [],
+    "forward_looking": true,
+    "forward_looking_reason": "No CVE in the catalog anchors this gap yet; it records the control class without binding it to a single incident.",
+    "atlas_refs": [],
+    "attack_refs": [
+      "T1190"
+    ],
+    "theater_test": {
+      "claim": "Our vulnerability scanning satisfies ISM-1808.",
+      "test": "Take the KEV entries added in the last 30 days that apply to products the organization runs. For each, confirm the scanner either has a check that reports it or the evidence names an alternative check that was run, and confirm each finding is linked to a patching deadline. Theater verdict if the evidence is the scanner's database update log alone, or if any applicable KEV entry has neither a scanner check nor a documented alternative.",
+      "evidence_required": [
+        "scanner database version and update log",
+        "per-KEV-entry coverage record naming the scanner check or the alternative check",
+        "finding-to-patch-deadline linkage for the sampled entries"
+      ],
+      "verdict_when_failed": "compliance-theater"
+    }
+  },
+  "AU-ISM-1452": {
+    "framework": "Australian Government Information Security Manual (ISM)",
+    "control_id": "ISM-1452",
+    "control_name": "A supply chain risk assessment is performed for suppliers of operating systems, applications, IT equipment, OT equipment and services to assess the impact to a system’s security risk profile",
+    "designed_for": "ISM-1452 requires a supply chain risk assessment for suppliers of operating systems, applications, IT equipment, OT equipment and services, to assess their impact on a system's security risk profile; ISM-1567 then excludes suppliers the assessment rates high risk. Both sit in the ISM's cyber supply chain risk management guidelines, outside the Essential Eight profiles, and treat vendor-side SBOM disclosures and maintainer identity as trustworthy inputs to the assessment.",
+    "misses": [
+      "The assessment treats maintainer identity as a reliable trust anchor; worm-class package-registry compromises (the Shai-Hulud case, MAL-2026-SHAI-HULUD-OSS) publish malicious payloads under a legitimate maintainer's identity through credential theft and token replay, so an assessment of that maintainer still rates the package trustworthy",
+      "Vendor-side SBOM data is treated as authoritative; the control does not require operator-side reconciliation of the SBOM against the installed artifact, so a worm-injected dependency appears in installed-package telemetry while being absent from the vendor's published SBOM for that version",
+      "It names no post-publish cooldown, no maintainer-account integrity monitoring (registry MFA enforcement, maintainer email-domain expiry) and no lockfile audit against a known-malicious version set, so an operator has no baseline response while a worm-class incident is in progress"
+    ],
+    "real_requirement": "Supply chain risk assessment must add ecosystem-specific controls: (1) operator-side SBOM-against-installed-artifact reconciliation independent of the vendor's SBOM, (2) maintainer-account integrity monitoring on critical-path upstream packages (registry MFA enforcement evidence, maintainer email-domain expiry tracking, anomalous-publish detection), (3) a cooldown before consuming fresh releases from systemically important maintainers, (4) lockfile audit against the known-malicious version set during the exposure window of any worm-class incident, (5) a documented response for worm-class incidents distinct from the generic vulnerable-dependency response.",
     "status": "open",
     "opened_date": "2026-05-18",
     "evidence_cves": [
       "CVE-2013-2597",
       "CVE-2018-1000861",
-      "CVE-2021-25337",
       "CVE-2022-40139",
+      "CVE-2024-4978",
+      "MAL-2024-PYPI-ULTRALYTICS-XMRIG",
       "MAL-2026-SHAI-HULUD-OSS"
     ],
     "atlas_refs": [
@@ -14604,16 +14637,144 @@
       "T1567"
     ],
     "theater_test": {
-      "claim": "Our software supply-chain risk management satisfies AU ISM control 1808.",
-      "test": "Pull the ISM-1808 evidence pack. Confirm operator-side SBOM-against-installed-artefact reconciliation runs on a defined cadence independent of vendor-published SBOM. Confirm maintainer-account-integrity monitoring is in place for critical-path upstream packages (registry MFA, email-domain expiry, anomalous-publish detection). Confirm a documented worm-class incident-response posture exists distinct from the generic vulnerable-dependency response. Sample the most recent worm-class incident in the past 12 months; verify the response included lockfile audit against the known-malicious version set within the exposure window. Theater verdict if SBOM evidence relies solely on vendor-side data, if maintainer-account-integrity monitoring is undocumented, or if the sampled incident response did not include lockfile audit within the exposure window.",
+      "claim": "Our supplier risk assessments satisfy ISM-1452.",
+      "test": "Confirm operator-side SBOM-against-installed-artifact reconciliation runs on a defined cadence independent of the vendor's SBOM. Confirm maintainer-account integrity monitoring is in place for critical-path upstream packages (registry MFA, email-domain expiry, anomalous-publish detection). Confirm a documented worm-class incident response exists distinct from the generic vulnerable-dependency response. Sample the most recent worm-class incident in the past 12 months and verify the response included a lockfile audit against the known-malicious version set within the exposure window. Theater verdict if SBOM evidence relies solely on vendor-side data, if maintainer-account monitoring is undocumented, or if the sampled response did not include the lockfile audit within the exposure window.",
       "evidence_required": [
         "operator-side SBOM reconciliation cadence document",
-        "maintainer-account-integrity monitoring records for critical-path packages",
-        "worm-class incident-response playbook + execution record for sampled incident"
+        "maintainer-account integrity monitoring records for critical-path packages",
+        "worm-class incident-response playbook and the execution record for the sampled incident"
       ],
       "verdict_when_failed": "compliance-theater"
     }
   },
+  "AU-ISM-0298": {
+    "framework": "Australian Government Information Security Manual (ISM)",
+    "control_id": "ISM-0298",
+    "control_name": "A centralised and managed approach that maintains the integrity of patches or updates, and confirms that they have been applied successfully, is used to patch or update applications, operating systems, drivers and firmware",
+    "designed_for": "ISM-0298 requires a centralised, managed patching approach that maintains the integrity of each patch or update and confirms it was applied. It sits in the ISM's patch management guidelines, outside the Essential Eight profiles, and assumes the organization's own patching system is what delivers the update.",
+    "misses": [
+      "Software that updates itself (browsers, agents, desktop applications, device firmware) fetches and applies updates outside any centralised system, so the integrity check the control requires never runs on those updates",
+      "Integrity is usually taken to mean the vendor's signature verified, which does not detect a signed update from a compromised build system or a rollback to an older signed build",
+      "Confirmation that an update applied records the installed version, not that the binary running matches what the vendor published"
+    ],
+    "real_requirement": "Update integrity evidence must cover self-updating software as well as centrally patched software: signature verification before apply, pinning of the update signing key out of band, rejection of rollbacks to older signed builds, and a post-install check that the running binary matches the published artifact.",
+    "status": "open",
+    "opened_date": "2026-09-22",
+    "evidence_cves": [],
+    "atlas_refs": [],
+    "attack_refs": [
+      "T1195.002",
+      "T1554"
+    ],
+    "theater_test": {
+      "claim": "Our patches and updates keep their integrity and are confirmed applied, which satisfies ISM-0298.",
+      "test": "List the software on a sample host that updates itself outside the central patching system. For each, confirm the update client verifies a signature before applying, rejects a rollback to an older signed build, and that someone can show the installed binary matches the vendor's published artifact. Theater verdict if the evidence covers only centrally deployed patches, or if any self-updating product has no documented integrity check.",
+      "evidence_required": [
+        "inventory of self-updating software on a sampled host",
+        "per-product record of signature verification and rollback protection",
+        "post-install artifact comparison for one sampled update"
+      ],
+      "verdict_when_failed": "compliance-theater"
+    },
+    "forward_looking": true,
+    "forward_looking_reason": "No CVE in the catalog anchors this gap yet; it records the control class without binding it to a single incident."
+  },
+  "AU-ISM-1240": {
+    "framework": "Australian Government Information Security Manual (ISM)",
+    "control_id": "ISM-1240",
+    "control_name": "Validation and sanitisation are performed on all input received over the internet by software",
+    "designed_for": "ISM-1240 requires software to validate and sanitise all input it receives over the internet; ISM-2016 extends the same requirement to input received over a local network. Both sit in the ISM's software development guidelines, outside the Essential Eight profiles.",
+    "misses": [
+      "Validation is usually read as checking the declared size and type of an input, which does not bound what a compressed input expands to, so a decompression bomb passes validation and exhausts memory or disk afterwards",
+      "Sanitisation of file paths inside archives is not named, so an archive entry such as ../../etc/cron.d/job passes input validation and writes outside the extraction directory",
+      "Regular-expression validators can themselves be the denial of service when a pattern backtracks catastrophically on crafted input, and the control does not distinguish a validator that is safe to run from one that is not",
+      "Normalization of confusable characters before comparison is not named, so input that looks identical to a screened value passes a string comparison"
+    ],
+    "real_requirement": "Input handling evidence must show limits on decompressed size and ratio, confinement of archive entry paths to the extraction directory, entity-expansion limits in XML parsers, regular expressions that run in linear time or under a timeout, and Unicode normalization before any comparison used for screening or authorization.",
+    "status": "open",
+    "opened_date": "2026-09-22",
+    "evidence_cves": [],
+    "atlas_refs": [],
+    "attack_refs": [
+      "T1190",
+      "T1499.003"
+    ],
+    "theater_test": {
+      "claim": "Our software validates and sanitises all input received over the internet, which satisfies ISM-1240.",
+      "test": "Submit a small compressed file that expands to many gigabytes, an archive containing an entry with a ../ path, an XML document with nested entity expansion, and a string built to make one of the application's validation regexes backtrack. Confirm each is rejected within a bounded time and resource budget. Theater verdict if any is accepted, or if the evidence is a validation policy with no such test results.",
+      "evidence_required": [
+        "test results for the four crafted inputs",
+        "configured decompression and entity-expansion limits",
+        "regex engine or timeout configuration for input validators"
+      ],
+      "verdict_when_failed": "compliance-theater"
+    },
+    "forward_looking": true,
+    "forward_looking_reason": "No CVE in the catalog anchors this gap yet; it records the control class without binding it to a single incident."
+  },
+  "AU-ISM-1815": {
+    "framework": "Australian Government Information Security Manual (ISM)",
+    "control_id": "ISM-1815",
+    "control_name": "Event logs are protected from unauthorised modification and deletion",
+    "designed_for": "ISM-1815 requires event logs to be protected from unauthorised modification and deletion, and is in the Essential Eight profile from Maturity Level Two. It is met by access controls on the log store and the centralised event logging facility.",
+    "misses": [
+      "Access control on the log store stops an attacker editing stored logs but not writing false entries through the application: an unneutralized carriage return or line feed in logged input creates a forged log line that arrives through the authorized path",
+      "Secrets and personal information written into logs are protected from modification but still exposed to everyone who can read the logs, and the control does not require redaction before shipping",
+      "Structured log fields built by string concatenation can be broken by injected delimiters, so a downstream parser attributes an event to the wrong user or drops it, without any stored record being modified"
+    ],
+    "real_requirement": "Log integrity evidence must cover the write path as well as the store: neutralization of CR, LF and field delimiters in every logged value, structured encoding of log records, and redaction of secrets and personal information before the record leaves the host.",
+    "status": "open",
+    "opened_date": "2026-09-22",
+    "evidence_cves": [],
+    "atlas_refs": [],
+    "attack_refs": [
+      "T1070",
+      "T1565.001"
+    ],
+    "theater_test": {
+      "claim": "Our event logs are protected from unauthorised modification, which satisfies ISM-1815.",
+      "test": "Send a request whose logged field contains a CR/LF pair followed by a line imitating a successful administrator login, and one containing an API key. Confirm the log store shows one neutralized record for the first and a redacted value for the second. Theater verdict if the forged line appears as its own record, or if the key is stored in clear.",
+      "evidence_required": [
+        "log output for the crafted CR/LF request",
+        "log output showing redaction of the test secret",
+        "log store access-control configuration"
+      ],
+      "verdict_when_failed": "compliance-theater"
+    },
+    "forward_looking": true,
+    "forward_looking_reason": "No CVE in the catalog anchors this gap yet; it records the control class without binding it to a single incident."
+  },
+  "AU-ISM-1268": {
+    "framework": "Australian Government Information Security Manual (ISM)",
+    "control_id": "ISM-1268",
+    "control_name": "The need-to-know principle is enforced for database contents through the application of minimum privileges, database views, database roles and data tokenisation",
+    "designed_for": "ISM-1268 requires the need-to-know principle to be enforced on database contents through minimum privileges, database views, database roles and data tokenisation. It sits in the ISM's database systems guidelines, outside the Essential Eight profiles.",
+    "misses": [
+      "In a multitenant application every tenant is served by the same database role, so minimum privileges and roles at the database layer cannot separate one tenant from another; the separation lives in application queries the control does not examine",
+      "Row-level isolation that depends on the application adding a tenant filter to each query fails open on the one query that omits it, and nothing in the control tests for that omission",
+      "Caches, search indexes and background jobs that copy database contents are outside the database, so need-to-know enforced in the database does not follow the data into them"
+    ],
+    "real_requirement": "Tenant isolation evidence must show enforcement below the application query (database row-level security policies or per-tenant schemas bound to the authenticated principal), a test that a query without a tenant filter returns nothing, and the same isolation applied to caches, search indexes and background jobs.",
+    "status": "open",
+    "opened_date": "2026-09-22",
+    "evidence_cves": [],
+    "atlas_refs": [],
+    "attack_refs": [
+      "T1530",
+      "T1213"
+    ],
+    "theater_test": {
+      "claim": "Need-to-know is enforced on our database contents, which satisfies ISM-1268.",
+      "test": "Authenticate as a user of one tenant and issue a request that reaches a query path without an explicit tenant filter, then read a record belonging to another tenant through the cache and the search index. Confirm all three return nothing from the other tenant. Theater verdict if isolation depends only on application-level filters, or if either derived store returns another tenant's data.",
+      "evidence_required": [
+        "database row-level security policy or per-tenant schema configuration",
+        "cross-tenant test results for the query path, the cache and the search index"
+      ],
+      "verdict_when_failed": "compliance-theater"
+    },
+    "forward_looking": true,
+    "forward_looking_reason": "No CVE in the catalog anchors this gap yet; it records the control class without binding it to a single incident."
+  },
   "CIS-Controls-v8-7.4": {
     "framework": "CIS Controls v8",
     "control_id": "7.4",
@@ -15309,26 +15470,26 @@
       "verdict_when_failed": "compliance-theater"
     }
   },
-  "ATLAS-AML.T0048": {
+  "ATLAS-AML.T0010": {
     "framework": "MITRE ATLAS v2026.09",
-    "control_id": "AML.T0048",
-    "control_name": "External Harms — ML Supply Chain Compromise (bundled-codec / inference-server class)",
-    "designed_for": "ATLAS AML.T0048 catalogues external harms from ML supply-chain compromise, including malicious model weights, poisoned training data, and compromised ML libraries. The technique-level guidance covers detection and mitigation at the model-artifact and library-consumption layer.",
+    "control_id": "AML.T0010",
+    "control_name": "AI Supply Chain Compromise (bundled-codec / inference-server class)",
+    "designed_for": "ATLAS AML.T0010 catalogs compromise of the AI supply chain, including hardware, AI software, data, models, container registries and AI agent tools. The technique-level mitigations cover model provenance, hash pinning and weight integrity at the model-artifact and library-consumption layer.",
     "misses": [
-      "AML.T0048 enumerates supply-chain compromise at the model and ML-library granularity; bundled-codec attack surfaces inside inference servers (vLLM multimodal heap overflow via JPEG2000 / FFmpeg / OpenCV CVE-2026-22778) sit a layer below — the codec is not 'an ML library' in the classical taxonomy sense",
-      "Multimodal inference servers bundle decoder libraries with very different security maturity than core ML frameworks; the supply-chain risk is concentrated in the codec dependency chain, which AML.T0048 mitigations do not specifically address",
-      "Operator-side defences enumerated for AML.T0048 (model provenance, hash-pinning, weight integrity) do not transfer to bundled-codec currency — a hash-pinned model running on a vulnerable JPEG2000 decoder is still exploitable",
-      "Detection guidance focuses on model-behaviour anomalies; host-side RCE from a malformed multimodal input bypasses model-behaviour observability entirely"
+      "AML.T0010 names AI software as a supply-chain component, but bundled-codec attack surfaces inside inference servers (vLLM multimodal heap overflow via JPEG2000 / FFmpeg / OpenCV, CVE-2026-22778) sit a layer below: the codec is not an ML library in the usual sense of the taxonomy",
+      "Multimodal inference servers bundle decoder libraries whose security maturity differs sharply from core ML frameworks. The supply-chain risk concentrates in the codec dependency chain, which AML.T0010 mitigations do not address specifically",
+      "The operator-side defenses listed for AML.T0010 (model provenance, hash pinning, weight integrity) do not cover codec currency: a hash-pinned model running on a vulnerable JPEG2000 decoder is still exploitable",
+      "Detection guidance focuses on model-behavior anomalies, and host-side RCE from a malformed multimodal input does not show up in model-behavior monitoring"
     ],
-    "real_requirement": "AML.T0048 mitigations must enumerate bundled-codec / decoder libraries inside inference servers as an in-scope supply-chain surface with its own currency posture: KEV-grade patch SLA for multimodal-decoder CVEs, an SBOM-level inventory of every decoder bundled into the inference server, and runtime detection for inference-process crashes / unexpected child-process spawns as the host-RCE telemetry that model-behaviour monitoring lacks.",
+    "real_requirement": "AML.T0010 mitigations must list bundled codec and decoder libraries inside inference servers as an in-scope supply-chain surface with its own currency posture: a KEV-grade patch SLA for multimodal-decoder CVEs, an SBOM-level inventory of every decoder bundled into the inference server, and runtime detection of inference-process crashes and unexpected child processes, which is the host-RCE telemetry that model-behavior monitoring lacks.",
     "status": "open",
     "opened_at": "2026-05-18",
     "evidence_cves": [
       "CVE-2026-22778"
     ],
     "theater_test": {
-      "claim": "We are compliant with AML.T0048 (External Harms — ML Supply Chain Compromise (bundled-codec / inference-server class)) because we follow the documented requirement: ATLAS AML.T0048 catalogues external harms from ML supply-chain compromise, including malicious model weights, poisoned training data, and compromised ML libraries. The technique-level guidance covers",
-      "test": "Pull the operational evidence supporting AML.T0048 for the last audit cycle. Confirm the program addresses the gap proven by CVE-2026-22778: AML.T0048 enumerates supply-chain compromise at the model and ML-library granularity; bundled-codec attack surfaces inside inference servers (vLLM multimodal heap overflow via JPEG2000 / FFmpeg / OpenCV CVE-2026-22778) sit a layer below — the codec is not 'an ML library' in the classical taxonomy sense. Theater verdict if the operator cannot produce evidence-of-execution for the real requirement (AML.T0048 mitigations must enumerate bundled-codec / decoder libraries inside inference servers as an in-scope supply-chain surface with its own currency posture: KEV-grade patch SLA for multimodal-decoder CVEs, an SBOM-), or if the only artifact is a written policy with no execution log.",
+      "claim": "We are compliant with AML.T0010 (AI Supply Chain Compromise) because our AI supply-chain program covers model provenance, hash pinning and weight integrity.",
+      "test": "Pull the operational evidence supporting AML.T0010 for the last audit cycle. Confirm the program addresses the gap proven by CVE-2026-22778, where a heap overflow in a decoder bundled into the vLLM inference server (JPEG2000 / FFmpeg / OpenCV) sits below the model and ML-library layer. Theater verdict if the operator cannot produce evidence that bundled decoders are inventoried in the SBOM and patched on a KEV-grade SLA, or if the only artifact is a written policy with no execution log.",
       "evidence_required": [
         "operational execution log demonstrating the gap is closed in practice, not just on paper",
         "date-stamped artifact corresponding to the CVE-evidence findings (CVE-2026-22778)",