@blamejs/exceptd-skills 0.20.1 → 0.21.0

package/data/zeroday-lessons.json

@@ -64,10 +64,10 @@
         "adequate": false,
         "gap": "1-month critical patch window is exploitation acceptance"
       },
-      "ASD-ISM-1623": {
+      "AU-Essential-8-Patch": {
         "covered": true,
-        "adequate": "closest",
-        "gap": "48h is better but still too long for 732-byte public exploit + CISA KEV"
+        "adequate": false,
+        "gap": "The Linux kernel is an operating system, so ISM-1695 allows one month on workstations and non-internet-facing servers at Maturity Levels One and Two, ISM-1696 requires 48 hours at Maturity Level Three when the vendor rates the flaw critical or a working exploit exists, and ISM-1877 requires 48 hours at every level on internet-facing servers. With a 732-byte public exploit and a CISA KEV listing, the one-month window leaves most hosts exposed, and a kernel update protects a host only after the reboot or live patch that loads it."
       },
       "ANY-FRAMEWORK": {
         "covered": false,
@@ -780,10 +780,10 @@
         "adequate": false,
         "gap": "System security principle is silent on subsystem module disable as a compensating control for unpatched kernel LPE."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
-        "adequate": "partial",
-        "gap": "Essential 8 patch-applications maturity ladder anchors on advisory date, not on PoC availability. ML3 48h is still long for a deterministic public exploit."
+        "adequate": false,
+        "gap": "ISM-1877 gives internet-facing servers 48 hours, but ISM-1695 leaves workstations and internal servers a month below Maturity Level Three against a working local exploit, and containers share the host kernel regardless of image patch level. Every window starts at the distribution's own release, and no control requires the reboot-free esp4, esp6 and rxrpc module unload while it runs."
       },
       "FILE-INTEGRITY-CONTROLS": {
         "covered": false,
@@ -1216,10 +1216,10 @@
         "adequate": false,
         "gap": "Network-segmentation control assumes the segmentation device is trustworthy; offers no guidance for the case where the segmentation device itself is the pre-auth RCE target."
       },
-      "ASD-Essential-8-Patch-Internet-Facing": {
+      "AU-Essential-8-Patch": {
         "covered": true,
-        "adequate": "closest",
-        "gap": "Essential 8 ML3 requires 48-hour patching of internet-facing services with working exploits; closest framework match but still longer than the KEV exploitation window for vendor-confirmed in-wild attacks."
+        "adequate": false,
+        "gap": "PAN-OS is the operating system of an internet-facing network device, so ISM-1877 requires the fix within 48 hours of release at every maturity level when the vendor rates the flaw critical or a working exploit exists. The window starts at the vendor's release, so it gives no protection against exploitation before a fix exists."
       }
     },
     "new_control_requirements": [
@@ -2182,7 +2182,7 @@
         "gap_closes": [
           "NIST-AI-RMF-MEASURE-2.7",
           "OWASP-ML-Top-10-2023-ML06",
-          "AU-ISM-1546",
+          "AU-Essential-8-Patch",
           "NIS2-Art21-network-security"
         ]
       }
@@ -3305,10 +3305,10 @@
         "adequate": false,
         "gap": "System security principle is silent on the operational reality that fully patched FortiGates can carry attacker persistence (symlink-based filesystem read access) seeded before the patch was applied. Patch alone is insufficient; cleanup verification is required."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
-        "adequate": "closest",
-        "gap": "Essential 8 patch-applications ML3 (48h) is closer to the operational reality than NIST SI-2 but still misses the mass-scanning window."
+        "adequate": false,
+        "gap": "ISM-1877 gives 48 hours from release at every maturity level, but Fortinet's advisory already reported possible exploitation at disclosure and the fixed image needs a reboot. Applying the patch does not remove read-only symlinks placed before the update, and the patching controls require no compromise check."
       }
     },
     "compliance_exposure_score": {
@@ -3328,7 +3328,7 @@
         "gap_closes": [
           "ISO-27001-2022-A.8.8",
           "NIST-800-53-SI-2",
-          "AU-ISM-1546"
+          "AU-Essential-8-Patch"
         ]
       },
       {
@@ -8445,10 +8445,10 @@
         "adequate": false,
         "gap": "'Appropriate timescales' is undefined; the standard reading is unsafe for an actively-exploited client RCE, and the legacy KEV re-listing exists because organizations still run vulnerable Office/IE/Windows builds."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
-        "adequate": false,
-        "gap": "Essential 8 patch-applications (48h at ML3) is closer to the reality for a client RCE than 30 days, but legacy KEV re-listings show that long-tail unpatched estates persist; centralized update management and Office hardening are the load-bearing controls."
+        "adequate": true,
+        "gap": "Excel is an office productivity suite, so the fix for the malformed-object flaw is due within two weeks of release at Maturity Levels One and Two (ISM-1691) and within 48 hours at Maturity Level Three because a working exploit exists (ISM-1692), and ISM-1704 requires an unsupported Office version to be removed. The flaw triggers when a user opens the crafted file, so a host that has not installed the update and rebooted stays exposed, and the 2026 KEV listing for a CVE from 2009 means such hosts are being exploited."
       }
     },
     "compliance_exposure_score": {
@@ -8596,10 +8596,10 @@
         "adequate": false,
         "gap": "'Appropriate timescales' is undefined; the standard reading is unsafe for an actively-exploited client flaw, and security-feature-bypass flaws mean a single layered control (Protected View, SmartScreen, Mark-of-the-Web) cannot be relied on alone."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "Essential 8 names application patching, application hardening, and macro/Office controls separately, but does not require defence-in-depth for the case where the protection mechanism itself is bypassed — ASR rules, application control, and mail/web content filtering are the load-bearing layers when SmartScreen/Protected View fail."
+        "gap": "VBA is a component of the office productivity suite, which ISM-1691 requires patched within two weeks of release at Maturity Levels One and Two even with a working exploit; only ISM-1692 at Maturity Level Three requires 48 hours. The window runs from Microsoft's release, so the 2026-04-13 KEV listing sets no new deadline for an estate that missed the fix, and neither window plans for the reboot the update requires."
       }
     },
     "compliance_exposure_score": {
@@ -8673,10 +8673,10 @@
         "adequate": false,
         "gap": "'Appropriate timescales' is undefined; the standard reading is unsafe for an actively-exploited kernel/driver LPE that is part of every modern ransomware kit."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "Essential 8 patch-applications (48h at ML3) is the right tier for a Windows LPE, but the load-bearing endpoint controls are hypervisor-protected code integrity (HVCI/VBS) and the Microsoft Vulnerable Driver Blocklist — neither of which the framework demands explicitly."
+        "gap": "This exploited link-following privilege escalation, listed in KEV on 2026-04-13 with a proof of concept available, gets 48 hours only at Maturity Level Three (ISM-1696) on workstations and internal servers; at Maturity Levels One and Two, ISM-1695 allows one month from release. The fix also needs a reboot that the window does not plan for."
       }
     },
     "compliance_exposure_score": {
@@ -8826,10 +8826,10 @@
         "adequate": false,
         "gap": "'Appropriate timescales' is undefined; the standard reading is unsafe for an actively-exploited kernel/driver LPE that is part of every modern ransomware kit."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "Essential 8 patch-applications (48h at ML3) is the right tier for a Windows LPE, but the load-bearing endpoint controls are hypervisor-protected code integrity (HVCI/VBS) and the Microsoft Vulnerable Driver Blocklist — neither of which the framework demands explicitly."
+        "gap": "ISM-1695 allows one month from release to fix the CLFS driver on workstations and internal servers at Maturity Levels One and Two, and ISM-1696 requires 48 hours only at Maturity Level Three, where the public proof of concept meets the working-exploit condition. The fix needs a reboot, and no Essential Eight control requires a compensating measure on hosts that stay unpatched while the window runs."
       }
     },
     "compliance_exposure_score": {
@@ -8912,10 +8912,10 @@
         "adequate": false,
         "gap": "'Appropriate timescales' is undefined; the standard reading is unsafe for an actively-exploited client RCE, and the legacy re-listing exists because organizations still run vulnerable browser/reader builds (Internet Explorer is end-of-life and unsupported)."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "Essential 8 patch-applications (48h at ML3) is closer to the reality for a client RCE than 30 days, but legacy KEV re-listings show long-tail unpatched estates persist; centralized update management, application hardening (Protected View, ASR rules), and retiring end-of-life software (Internet Explorer) are the load-bearing controls."
+        "gap": "Acrobat is a PDF application, patched within two weeks at Maturity Levels One and Two under ISM-1691 and within 48 hours at Maturity Level Three when a working exploit exists under ISM-1692. With a public proof of concept and an update that needs a restart, an endpoint that opens PDFs routinely can stay exploitable for two weeks below Maturity Level Three."
       }
     },
     "compliance_exposure_score": {
@@ -9082,10 +9082,10 @@
         "adequate": false,
         "gap": "'Appropriate timescales' is undefined; the standard reading is unsafe for an actively-exploited browser/document-reader memory-corruption flaw reachable by drive-by content."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "Essential 8 patch-applications (48h at ML3) is closer to the operational reality for a client RCE than a 30-day cycle, but still trails same-day browser auto-update for an in-the-wild exploit."
+        "gap": "Acrobat and Reader are PDF applications, so ISM-1691 allows two weeks at Maturity Levels One and Two for this KEV-listed code execution flaw, and ISM-1692 requires 48 hours only at Level Three. Both windows run from Adobe's release, and neither plans for the restart that the update requires."
       }
     },
     "compliance_exposure_score": {
@@ -9429,10 +9429,10 @@
         "adequate": false,
         "gap": "'Appropriate timescales' is undefined; the standard reading is unsafe for an actively-exploited browser/document-reader memory-corruption flaw reachable by drive-by content."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "Essential 8 patch-applications (48h at ML3) is closer to the operational reality for a client RCE than a 30-day cycle, but still trails same-day browser auto-update for an in-the-wild exploit."
+        "gap": "ISM-1691 gives web browsers such as Chrome, Edge and Opera two weeks from the vendor's release at Maturity Levels One and Two, although this use-after-free is in CISA KEV as exploited in the wild. Only Maturity Level Three requires the fix within 48 hours (ISM-1692), and each browser's window starts at its own vendor's release and does not plan for the restart the fix requires before it takes effect."
       }
     },
     "compliance_exposure_score": {
@@ -12213,7 +12213,7 @@
         "gap_closes": [
           "NIST-800-53-SI-2",
           "ISO-27001-2022-A.8.8",
-          "AU-ISM-1546"
+          "AU-Essential-8-Patch"
         ]
       }
     ],
@@ -12518,10 +12518,10 @@
         "adequate": false,
         "gap": "'Appropriate timescales' is undefined; the standard reading is unsafe for an actively-exploited mobile/desktop OS flaw, often part of a targeted-spyware chain against high-risk users."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "Essential 8 patch-applications (48h at ML3) is closer to the reality for a client OS RCE than a 30-day cycle, but still trails same-day OS auto-update for an in-the-wild exploit; MDM-enforced update SLAs are the load-bearing control on managed mobile fleets."
+        "gap": "A malicious application can alter memory shared between processes on every affected Apple platform, yet macOS workstations get one month for this KEV-listed flaw at Maturity Levels One and Two (ISM-1695) and 48 hours only at Maturity Level Three (ISM-1696). iOS, iPadOS, watchOS, visionOS and tvOS devices fall under ISM-1878's 48-hour window outside the Essential Eight profiles, and every platform's update needs a restart."
       }
     },
     "compliance_exposure_score": {
@@ -12595,10 +12595,10 @@
         "adequate": false,
         "gap": "'Appropriate timescales' is undefined; the standard reading is unsafe for an actively-exploited mobile/desktop OS flaw, often part of a targeted-spyware chain against high-risk users."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "Essential 8 patch-applications (48h at ML3) is closer to the reality for a client OS RCE than a 30-day cycle, but still trails same-day OS auto-update for an in-the-wild exploit; MDM-enforced update SLAs are the load-bearing control on managed mobile fleets."
+        "gap": "This KEV-listed overflow lets a malicious application write kernel memory, but macOS workstations get one month at Maturity Levels One and Two (ISM-1695) and 48 hours only at Maturity Level Three (ISM-1696), and the update needs a restart. The iOS, iPadOS, watchOS, visionOS and tvOS devices it also affects fall under ISM-1878, outside the Essential Eight profiles."
       }
     },
     "compliance_exposure_score": {
@@ -12675,10 +12675,10 @@
         "adequate": false,
         "gap": "'Appropriate timescales' is undefined; the standard reading is unsafe for an actively-exploited mobile/desktop OS flaw, often part of a targeted-spyware chain against high-risk users."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "Essential 8 patch-applications (48h at ML3) is closer to the reality for a client OS RCE than a 30-day cycle, but still trails same-day OS auto-update for an in-the-wild exploit; MDM-enforced update SLAs are the load-bearing control on managed mobile fleets."
+        "gap": "Safari is due within two weeks and macOS within one month at Maturity Levels One and Two, with 48 hours only at Level Three (ISM-1692, ISM-1696), and iOS, iPadOS, watchOS, visionOS and tvOS fall under ISM-1878 (48 hours) and ISM-1751, outside every Essential Eight profile. A proof-of-concept exploit exists, CISA listed the flaw on 2026-03-20, and each product needs its own fixed-release check and a restart."
       }
     },
     "compliance_exposure_score": {
@@ -13077,10 +13077,10 @@
         "adequate": false,
         "gap": "'Appropriate timescales' is undefined; the standard reading is unsafe for an actively-exploited browser/document-reader memory-corruption flaw reachable by drive-by content."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "Essential 8 patch-applications (48h at ML3) is closer to the operational reality for a client RCE than a 30-day cycle, but still trails same-day browser auto-update for an in-the-wild exploit."
+        "gap": "Chrome, Edge and Opera are web browsers, so ISM-1691 allows two weeks at Maturity Levels One and Two for this KEV-listed V8 flaw, and ISM-1692 requires 48 hours only at Level Three. Each window runs from that browser vendor's own release of the fix, and the update requires a restart that neither window plans for."
       }
     },
     "compliance_exposure_score": {
@@ -13164,10 +13164,10 @@
         "adequate": false,
         "gap": "'Appropriate timescales' is undefined; the standard reading is unsafe for an actively-exploited browser/document-reader memory-corruption flaw reachable by drive-by content."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "Essential 8 patch-applications (48h at ML3) is closer to the operational reality for a client RCE than a 30-day cycle, but still trails same-day browser auto-update for an in-the-wild exploit."
+        "gap": "Skia is part of Chrome, ChromeOS, Android and Flutter, so this KEV-listed fix falls under several controls: ISM-1691 gives Chrome two weeks at Maturity Levels One and Two and ISM-1692 gives it 48 hours at Level Three, ISM-1695 gives ChromeOS one month below Level Three, and ISM-1693 gives Flutter-built applications one month from Level Two. A Flutter-built application's window starts only when its own vendor releases an update that carries the Skia fix."
       }
     },
     "compliance_exposure_score": {
@@ -13773,10 +13773,10 @@
         "adequate": false,
         "gap": "'Appropriate timescales' is undefined; the standard reading is unsafe for an actively-exploited mobile/desktop OS flaw, often part of a targeted-spyware chain against high-risk users."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "Essential 8 patch-applications (48h at ML3) is closer to the reality for a client OS RCE than a 30-day cycle, but still trails same-day OS auto-update for an in-the-wild exploit; MDM-enforced update SLAs are the load-bearing control on managed mobile fleets."
+        "gap": "At Maturity Levels One and Two, ISM-1691 allows two weeks to patch Safari and ISM-1695 allows one month for macOS, although this KEV-listed use-after-free has a working exploit; only Maturity Level Three applies the 48-hour windows of ISM-1692 and ISM-1696. Every window starts at Apple's release of each fixed build, and the fix requires a restart."
       }
     },
     "compliance_exposure_score": {
@@ -13852,10 +13852,10 @@
         "adequate": false,
         "gap": "'Appropriate timescales' is undefined; the standard reading is unsafe for an actively-exploited mobile/desktop OS flaw, often part of a targeted-spyware chain against high-risk users."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "Essential 8 patch-applications (48h at ML3) is closer to the reality for a client OS RCE than a 30-day cycle, but still trails same-day OS auto-update for an in-the-wild exploit; MDM-enforced update SLAs are the load-bearing control on managed mobile fleets."
+        "gap": "Safari is a web browser, patched within two weeks at Maturity Levels One and Two (ISM-1691) and within 48 hours only at Level Three when a working exploit exists (ISM-1692); macOS gets one month below Level Three (ISM-1695). CISA confirms exploitation of this WebKit flaw, yet below Level Three those windows do not shorten for it, and the tvOS, iPadOS and watchOS builds fall under ISM-1878 and ISM-1751, outside the Essential Eight profiles."
       }
     },
     "compliance_exposure_score": {
@@ -13931,10 +13931,10 @@
         "adequate": false,
         "gap": "'Appropriate timescales' is undefined; the standard reading is unsafe for an actively-exploited mobile/desktop OS flaw, often part of a targeted-spyware chain against high-risk users."
       },
-      "AU-ISM-1546": {
-        "covered": true,
+      "AU-Essential-8-Patch": {
+        "covered": false,
         "adequate": false,
-        "gap": "Essential 8 patch-applications (48h at ML3) is closer to the reality for a client OS RCE than a 30-day cycle, but still trails same-day OS auto-update for an in-the-wild exploit; MDM-enforced update SLAs are the load-bearing control on managed mobile fleets."
+        "gap": "iOS and iPadOS devices are IT equipment other than workstations, servers and network devices, and ISM-1878 sets 48 hours for their operating systems when a flaw is critical or a working exploit exists, but it sits outside the Essential Eight profiles. No Essential Eight maturity level therefore sets a window for this exploited kernel code execution flaw, and the fix needs a device restart."
       }
     },
     "compliance_exposure_score": {
@@ -14092,10 +14092,10 @@
         "adequate": false,
         "gap": "'Appropriate timescales' is undefined; the standard reading is unsafe for an actively-exploited kernel/driver LPE, and the long tail of unpatched mobile/server estates keeps these exploitable for years."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "Essential 8 patch-applications (operating systems, 48h at ML3) is the right tier, but the load-bearing controls are kernel/driver hardening and a timely vendor patch cadence — Android Security Bulletin OTA updates for the mobile-chipset entries, distribution kernel updates or live-patching for the Linux entries — none of which the framework names explicitly."
+        "gap": "The Essential Eight covers drivers and firmware only at Maturity Level Three, where ISM-1879 and ISM-1903 require this exploited flaw to be fixed within 48 hours of release, and Maturity Levels One and Two set no timeframe for it. The flaw stays exploitable until the device maker ships a build carrying the fix, and that build needs a reboot."
       }
     },
     "compliance_exposure_score": {
@@ -14958,10 +14958,10 @@
         "adequate": false,
         "gap": "'Appropriate timescales' is undefined; the standard reading is unsafe for an actively-exploited client flaw, and the legacy re-listings exist because organizations still run vulnerable or end-of-life software."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
-        "adequate": false,
-        "gap": "Essential 8 names application patching and hardening, but the load-bearing controls here are file-provenance enforcement (Mark-of-the-Web propagation to extracted files), ASR rules, disabling risky ActiveX, and hardened version-control settings (protectNTFS, disabling symlinks on clone) — none of which the framework names explicitly."
+        "adequate": true,
+        "gap": "The Video ActiveX control is part of Windows, so on workstations and internal servers ISM-1695 requires the fix within one month of release at Maturity Levels One and Two, ISM-1696 requires it within 48 hours at Maturity Level Three because a working exploit exists, and ISM-1501 requires an unsupported Windows version to be replaced. A user who views a crafted web page on a host that has not installed the update and rebooted is exposed, and the 2026 KEV listing means such hosts are being exploited."
       }
     },
     "compliance_exposure_score": {
@@ -15026,10 +15026,10 @@
         "adequate": false,
         "gap": "'Appropriate timescales' is undefined; the standard reading is unsafe for an actively-exploited browser RCE, where the safe SLA is same-day Chrome component-updater rollout."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "Essential 8 patch-applications (48h at ML3) is the right tier for a browser RCE, but the load-bearing controls are forced auto-update via enterprise browser policy and not gating Chrome updates behind a managed change window — neither of which the framework names explicitly."
+        "gap": "ISM-1691 gives Chromium-based browsers two weeks from release at Maturity Levels One and Two, and the 48-hour window for a working exploit (ISM-1692) applies only at Maturity Level Three, although this use-after-free was KEV-listed on 2026-02-17 and its update needs a restart to take effect. Neither control requires enforced automatic updates through enterprise browser policy or forbids holding browser updates for a managed change window."
       }
     },
     "compliance_exposure_score": {
@@ -15200,10 +15200,10 @@
         "adequate": false,
         "gap": "'Appropriate timescales' is undefined; the standard reading is unsafe for an actively-exploited mobile/desktop OS flaw, often part of a targeted-spyware chain against high-risk users."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "Essential 8 patch-applications (48h at ML3) is closer to the reality for a client OS RCE than a 30-day cycle, but still trails same-day OS auto-update for an in-the-wild exploit; MDM-enforced update SLAs are the load-bearing control on managed mobile fleets."
+        "gap": "A Mac is a workstation, so ISM-1695 allows one month at Maturity Levels One and Two for this exploited flaw, and only Maturity Level Three requires 48 hours (ISM-1696). Devices running iOS, tvOS, watchOS or visionOS fall under ISM-1878, which requires 48 hours for a critical flaw or working exploit but is outside the Essential Eight profiles, and every one of these updates needs a restart."
       }
     },
     "compliance_exposure_score": {
@@ -15547,10 +15547,10 @@
         "adequate": false,
         "gap": "'Appropriate timescales' is undefined; the standard reading is unsafe for an actively-exploited client flaw, and security-feature-bypass flaws mean a single layered control (Protected View, SmartScreen, Mark-of-the-Web) cannot be relied on alone."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "Essential 8 names application patching, application hardening, and macro/Office controls separately, but does not require defence-in-depth for the case where the protection mechanism itself is bypassed — ASR rules, application control, and mail/web content filtering are the load-bearing layers when SmartScreen/Protected View fail."
+        "gap": "MSHTML is a component of Microsoft Windows, so its fix is a workstation operating system patch that ISM-1695 allows one month to apply at Maturity Levels One and Two, and only Maturity Level Three requires 48 hours once a working exploit exists (ISM-1696). Below Maturity Level Three this KEV-listed bypass with a public proof of concept can stay open for a month, and the update requires a reboot."
       }
     },
     "compliance_exposure_score": {
@@ -15713,10 +15713,10 @@
         "adequate": false,
         "gap": "'Appropriate timescales' is undefined; the standard reading is unsafe for an actively-exploited client flaw, and security-feature-bypass flaws mean a single layered control (Protected View, SmartScreen, Mark-of-the-Web) cannot be relied on alone."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "Essential 8 names application patching, application hardening, and macro/Office controls separately, but does not require defence-in-depth for the case where the protection mechanism itself is bypassed — ASR rules, application control, and mail/web content filtering are the load-bearing layers when SmartScreen/Protected View fail."
+        "gap": "The Windows Shell is part of the workstation operating system, which ISM-1695 requires patched within one month at Maturity Levels One and Two; only Maturity Level Three requires this KEV-listed security feature bypass patched within 48 hours of release once a working exploit exists (ISM-1696). That window starts at the vendor's release and does not plan for the reboot the update requires."
       }
     },
     "compliance_exposure_score": {
@@ -15794,10 +15794,10 @@
         "adequate": false,
         "gap": "'Appropriate timescales' is undefined; the standard reading is unsafe for an actively-exploited kernel/driver LPE that is part of every modern ransomware kit."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "Essential 8 patch-applications (48h at ML3) is the right tier for a Windows LPE, but the load-bearing endpoint controls are hypervisor-protected code integrity (HVCI/VBS) and the Microsoft Vulnerable Driver Blocklist — neither of which the framework demands explicitly."
+        "gap": "Remote Desktop Services is part of the Windows operating system, which ISM-1695 allows one month to patch on workstations and internal servers at Maturity Levels One and Two, with 48 hours for a working exploit only at Maturity Level Three (ISM-1696); an internet-facing Remote Desktop host falls under ISM-1877, which requires 48 hours at every level. On an internal multi-user host below Maturity Level Three, one authorized user can escalate privileges for up to a month, and the update requires a reboot that ends every session."
       }
     },
     "compliance_exposure_score": {
@@ -15865,10 +15865,10 @@
         "adequate": false,
         "gap": "'Appropriate timescales' is undefined; the standard reading is unsafe for an actively-exploited client flaw, and security-feature-bypass flaws mean a single layered control (Protected View, SmartScreen, Mark-of-the-Web) cannot be relied on alone."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "Essential 8 names application patching, application hardening, and macro/Office controls separately, but does not require defence-in-depth for the case where the protection mechanism itself is bypassed — ASR rules, application control, and mail/web content filtering are the load-bearing layers when SmartScreen/Protected View fail."
+        "gap": "Desktop Window Manager is part of the Windows workstation operating system, which ISM-1695 allows one month to patch at Maturity Levels One and Two; the 48-hour requirement for a working exploit applies only at Maturity Level Three (ISM-1696). Below that level this KEV-listed local privilege escalation stays available for up to a month to an attacker who already has local access, and the update requires a reboot."
       }
     },
     "compliance_exposure_score": {
@@ -15934,10 +15934,10 @@
         "adequate": false,
         "gap": "'Appropriate timescales' is undefined; the standard reading is unsafe for an actively-exploited client flaw, and security-feature-bypass flaws mean a single layered control (Protected View, SmartScreen, Mark-of-the-Web) cannot be relied on alone."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "Essential 8 names application patching, application hardening, and macro/Office controls separately, but does not require defence-in-depth for the case where the protection mechanism itself is bypassed — ASR rules, application control, and mail/web content filtering are the load-bearing layers when SmartScreen/Protected View fail."
+        "gap": "Word is an office productivity suite, which ISM-1691 requires patched within two weeks of release at Maturity Levels One and Two, and the 48-hour requirement for a critical vulnerability or a working exploit applies only at Maturity Level Three (ISM-1692). Below that level this KEV-listed flaw with a public proof of concept can stay unpatched for two weeks, and the update requires a restart."
       }
     },
     "compliance_exposure_score": {
@@ -16706,10 +16706,10 @@
         "adequate": false,
         "gap": "'Appropriate timescales' is undefined; the standard reading is unsafe for an actively-exploited kernel/driver LPE, and the long tail of unpatched mobile/server estates keeps these exploitable for years."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "Essential 8 patch-applications (operating systems, 48h at ML3) is the right tier, but the load-bearing controls are kernel/driver hardening and a timely vendor patch cadence — Android Security Bulletin OTA updates for the mobile-chipset entries, distribution kernel updates or live-patching for the Linux entries — none of which the framework names explicitly."
+        "gap": "ISM-1877 gives an internet-facing Linux server 48 hours at every maturity level and ISM-1696 gives workstations and internal servers 48 hours at Maturity Level Three, but ISM-1695 allows those hosts one month at Maturity Levels One and Two while this create_elf_tables() overflow is listed as exploited. The fixed kernel needs a reboot, and no live patch is recorded for this flaw."
       }
     },
     "compliance_exposure_score": {
@@ -17045,10 +17045,10 @@
         "adequate": false,
         "gap": "'Appropriate timescales' is undefined; the standard reading is unsafe for an actively-exploited client flaw, and security-feature-bypass flaws mean a single layered control (Protected View, SmartScreen, Mark-of-the-Web) cannot be relied on alone."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "Essential 8 names application patching, application hardening, and macro/Office controls separately, but does not require defence-in-depth for the case where the protection mechanism itself is bypassed — ASR rules, application control, and mail/web content filtering are the load-bearing layers when SmartScreen/Protected View fail."
+        "gap": "Microsoft Office is an office productivity suite, so ISM-1691 allows two weeks at Maturity Levels One and Two for this exploited flaw, and ISM-1692 requires 48 hours only at Maturity Level Three. CISA notes that some affected products could be end of life; any Office version its vendor no longer supports must be removed under ISM-1704 at every maturity level."
       }
     },
     "compliance_exposure_score": {
@@ -17642,10 +17642,10 @@
         "adequate": false,
         "gap": "'Appropriate timescales' is undefined; the standard reading is unsafe for an actively-exploited kernel/driver LPE that is part of every modern ransomware kit."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "Essential 8 patch-applications (48h at ML3) is the right tier for a Windows LPE, but the load-bearing endpoint controls are hypervisor-protected code integrity (HVCI/VBS) and the Microsoft Vulnerable Driver Blocklist — neither of which the framework demands explicitly."
+        "gap": "The Essential Eight covers the Windows operating system, but on workstations and internal servers only Maturity Level Three requires this exploited flaw with a public proof of concept to be fixed within 48 hours (ISM-1696), while Maturity Levels One and Two allow one month (ISM-1695). The fix also takes effect only after a reboot."
       }
     },
     "compliance_exposure_score": {
@@ -17796,10 +17796,10 @@
         "adequate": false,
         "gap": "'Appropriate timescales' is undefined; the standard reading is unsafe for an actively-exploited client RCE, and the legacy KEV re-listing exists because organizations still run vulnerable Office/IE/Windows builds."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
-        "adequate": false,
-        "gap": "Essential 8 patch-applications (48h at ML3) is closer to the reality for a client RCE than 30 days, but legacy KEV re-listings show that long-tail unpatched estates persist; centralized update management and Office hardening are the load-bearing controls."
+        "adequate": true,
+        "gap": "PowerPoint is an office productivity suite, so the fix for the OutlineTextRefAtom memory corruption is due within two weeks of release at Maturity Levels One and Two (ISM-1691) and within 48 hours at Maturity Level Three because a working exploit exists (ISM-1692), and ISM-1704 requires an unsupported Office version to be removed. An estate that meets those controls has no vulnerable PowerPoint build; the 2026 KEV listing means builds that missed them are being exploited, and each patched host stays exposed until the reboot the update requires."
       }
     },
     "compliance_exposure_score": {
@@ -18721,10 +18721,10 @@
         "adequate": false,
         "gap": "'Appropriate timescales' is undefined; the standard reading is unsafe for an actively-exploited client flaw, and the legacy re-listings exist because organizations still run vulnerable or end-of-life software."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "Essential 8 names application patching and hardening, but the load-bearing controls here are file-provenance enforcement (Mark-of-the-Web propagation to extracted files), ASR rules, disabling risky ActiveX, and hardened version-control settings (protectNTFS, disabling symlinks on clone) — none of which the framework names explicitly."
+        "gap": "WinRAR is in the other applications class, so ISM-1693 allows one month from release, applies only from Maturity Level Two and has no 48-hour variant for a working exploit; a compliant estate can leave the path traversal that CISA listed in KEV on 2025-12-09, which lets an attacker run code as the current user, open for that month, and Maturity Level One sets no timeframe for it. The control does not require interim measures such as Mark-of-the-Web propagation to extracted files or ASR rules while the month runs."
       }
     },
     "compliance_exposure_score": {
@@ -18799,10 +18799,10 @@
         "adequate": false,
         "gap": "'Appropriate timescales' is undefined; the standard reading is unsafe for an actively-exploited kernel/driver LPE that is part of every modern ransomware kit."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "Essential 8 patch-applications (48h at ML3) is the right tier for a Windows LPE, but the load-bearing endpoint controls are hypervisor-protected code integrity (HVCI/VBS) and the Microsoft Vulnerable Driver Blocklist — neither of which the framework demands explicitly."
+        "gap": "The Cloud Files Mini Filter Driver ships in Windows and is fixed by the Windows update, so the operating system controls apply: ISM-1695 allows one month on workstations and internal servers at Maturity Levels One and Two, and ISM-1696 applies 48 hours for a working exploit only at Maturity Level Three. On a compliant estate below that level, the use after free that CISA listed in KEV on 2025-12-09 lets an authorized local user elevate privileges for up to a month, and the timeframe does not allow for the reboot the fix requires."
       }
     },
     "compliance_exposure_score": {
@@ -18904,7 +18904,7 @@
         "description": "An affected D-Link router is the trust boundary for everything behind it, and this overflow is reachable without credentials, so it cannot share a patch queue with interior workstations. Put the router class in its own SLA tier: firmware for each affected model deployed within hours of the KEV listing, or the reachable interface isolated from untrusted networks until firmware lands. The tier has to name an owner and a per-model firmware inventory, because router firmware is applied by hand per device on a schedule nobody audits — an SLA with no named owner and no model-level inventory expires silently on exactly this device class. Build the restart into the tier as well: there is no hot-fix path, so the plan needs a window in which the device goes down, and a tier that assumes zero-downtime remediation will not be executed.",
         "evidence": "Packet: buffer overflow (CWE-120) on affected D-Link routers 'reachable by an unauthenticated attacker', with 'a high impact on confidentiality, integrity, and availability'; CVSS 8.8, RWEP 77, poc_available true. CISA KEV-listed 2025-12-08 with active_exploitation confirmed. patch_available is true and live_patch_available is false, with the note that the vendor patch typically requires service restart or system reboot per the KEV requiredAction.",
         "gap_closes": [
-          "AU-ISM-1546",
+          "AU-Essential-8-Patch",
           "NIS2-Art21-network-security",
           "UK-CAF-B4"
         ]
@@ -19218,10 +19218,10 @@
         "adequate": false,
         "gap": "'Appropriate timescales' is undefined; the standard reading is unsafe for an actively-exploited mobile OS flaw, and the OEM/carrier OTA chain means many devices receive the fix weeks-to-never after disclosure."
       },
-      "AU-ISM-1546": {
-        "covered": true,
+      "AU-Essential-8-Patch": {
+        "covered": false,
         "adequate": false,
-        "gap": "Essential 8 patch-applications (operating systems) is the right tier, but the load-bearing controls for mobile are vendor OTA cadence (Android Security Bulletin / Samsung SMR), MDM-enforced update SLAs on managed fleets, mobile-threat-defense, and hardened/locked-down configurations for high-risk users — none of which the framework names explicitly."
+        "gap": "Android devices fall under ISM-1878, which requires this exploited Framework information disclosure to be patched within 48 hours of release but is outside the Essential Eight maturity profiles, so meeting any maturity level does not require it. Each device receives the fix through its maker's or carrier's OTA on that party's schedule, and no control requires MDM-enforced update deadlines on the fleet."
       }
     },
     "compliance_exposure_score": {
@@ -19287,10 +19287,10 @@
         "adequate": false,
         "gap": "'Appropriate timescales' is undefined; the standard reading is unsafe for an actively-exploited mobile OS flaw, and the OEM/carrier OTA chain means many devices receive the fix weeks-to-never after disclosure."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "Essential 8 patch-applications (operating systems) is the right tier, but the load-bearing controls for mobile are vendor OTA cadence (Android Security Bulletin / Samsung SMR), MDM-enforced update SLAs on managed fleets, mobile-threat-defense, and hardened/locked-down configurations for high-risk users — none of which the framework names explicitly."
+        "gap": "Android handsets are outside the Essential Eight patch timeframes (ISM-1877, ISM-1695, ISM-1696), so the 48-hour window for this exploited Android Framework flaw comes from ISM-1878, which no Essential Eight maturity level includes, and starts at each manufacturer's update release. The Essential Eight applies through ISM-1501, which requires handsets whose operating system the manufacturer no longer supports to be replaced at every maturity level, and the Essential Eight sets no deadline for a supported handset still waiting for its update."
       }
     },
     "compliance_exposure_score": {
@@ -19521,10 +19521,10 @@
         "adequate": false,
         "gap": "'Appropriate timescales' is undefined; the standard reading is unsafe for an actively-exploited browser RCE, where the safe SLA is same-day Chrome component-updater rollout."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "Essential 8 patch-applications (48h at ML3) is the right tier for a browser RCE, but the load-bearing controls are forced auto-update via enterprise browser policy and not gating Chrome updates behind a managed change window — neither of which the framework names explicitly."
+        "gap": "At Maturity Level Three, ISM-1692 requires the fix for a Chromium-based browser within 48 hours of release because a working exploit exists, but at Maturity Levels One and Two ISM-1691 allows two weeks for a V8 flaw CISA listed as exploited on 2025-11-19. The fix takes effect only after the browser restarts, and no patching control requires enterprise browser policy to force that restart or to keep browser updates out of a managed change window."
       }
     },
     "compliance_exposure_score": {
@@ -19854,10 +19854,10 @@
         "adequate": false,
         "gap": "'Appropriate timescales' is undefined; the standard reading is unsafe for an actively-exploited kernel/driver LPE that is part of every modern ransomware kit."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "Essential 8 patch-applications (48h at ML3) is the right tier for a Windows LPE, but the load-bearing endpoint controls are hypervisor-protected code integrity (HVCI/VBS) and the Microsoft Vulnerable Driver Blocklist — neither of which the framework demands explicitly."
+        "gap": "Windows kernel fixes fall under the patch operating systems controls, and because a working exploit exists, ISM-1696 requires them within 48 hours at Maturity Level Three and ISM-1877 requires them within 48 hours on internet-facing servers at every level. At Maturity Levels One and Two, ISM-1695 still allows workstations and non-internet-facing servers one month for a flaw CISA lists as exploited, and the controls set the same deadlines although this fix requires a reboot."
       }
     },
     "compliance_exposure_score": {
@@ -20038,10 +20038,10 @@
         "adequate": false,
         "gap": "'Appropriate timescales' is undefined; the standard reading is unsafe for an actively-exploited mobile OS flaw, and the OEM/carrier OTA chain means many devices receive the fix weeks-to-never after disclosure."
       },
-      "AU-ISM-1546": {
-        "covered": true,
+      "AU-Essential-8-Patch": {
+        "covered": false,
         "adequate": false,
-        "gap": "Essential 8 patch-applications (operating systems) is the right tier, but the load-bearing controls for mobile are vendor OTA cadence (Android Security Bulletin / Samsung SMR), MDM-enforced update SLAs on managed fleets, mobile-threat-defense, and hardened/locked-down configurations for high-risk users — none of which the framework names explicitly."
+        "gap": "Samsung phone operating systems, including the vulnerable libimagecodec.quram.so library, fall under ISM-1878, which requires the fix within 48 hours of release when a working exploit exists and is in no Essential Eight maturity profile, so an Essential Eight assessment at any maturity level does not measure patching of these phones. For this remote code execution flaw, which CISA listed as exploited on 2025-11-10, the ISM-1878 window begins only when Samsung releases the update, and each phone must then reboot to install it."
       }
     },
     "compliance_exposure_score": {
@@ -20291,10 +20291,10 @@
         "adequate": false,
         "gap": "'Appropriate timescales' is undefined; the standard reading is unsafe for an actively-exploited escalation flaw, which is the second half of nearly every intrusion chain."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "Essential 8 names OS/application patching, but the load-bearing backstops are platform-specific and unnamed: least-privilege and SELinux/seccomp on Linux, MDM-enforced OTA SLAs on Android, management-account segmentation for virtualization, and SMB signing / NTLM-disablement for the reflection class (the last breaks the attack regardless of patch state)."
+        "gap": "An Aria Operations instance directly accessible over the internet is an online service, which ISM-1876 requires to be patched within 48 hours of release at every maturity level because CISA lists this flaw as known exploited, while an internal instance and VMware Tools are other applications that ISM-1693 allows one month from Maturity Level Two only. Both products are affected, including VMware Tools in each guest that Aria Operations manages with SDMP enabled, and the update needs a restart."
       }
     },
     "compliance_exposure_score": {
@@ -20871,10 +20871,10 @@
         "adequate": false,
         "gap": "'Appropriate timescales' is undefined; the standard reading is unsafe for an actively-exploited mobile/desktop OS flaw, often part of a targeted-spyware chain against high-risk users."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "Essential 8 patch-applications (48h at ML3) is closer to the reality for a client OS RCE than a 30-day cycle, but still trails same-day OS auto-update for an in-the-wild exploit; MDM-enforced update SLAs are the load-bearing control on managed mobile fleets."
+        "gap": "ISM-1501 and ISM-1704 require an unsupported Apple operating system or browser to be replaced or removed at every maturity level, and on a device that has reached end of service only replacing it or taking it out of use removes the flaw. On supported devices below Maturity Level Three, ISM-1691 allows two weeks to patch Safari and ISM-1695 allows one month to patch macOS for this exploited flaw, and the 48-hour windows in ISM-1692 and ISM-1696 apply only at Maturity Level Three."
       }
     },
     "compliance_exposure_score": {
@@ -21124,10 +21124,10 @@
         "adequate": false,
         "gap": "'Appropriate timescales' is undefined; the standard reading is unsafe for an actively-exploited escalation flaw, which is the second half of nearly every intrusion chain."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "Essential 8 names OS/application patching, but the load-bearing backstops are platform-specific and unnamed: least-privilege and SELinux/seccomp on Linux, MDM-enforced OTA SLAs on Android, management-account segmentation for virtualization, and SMB signing / NTLM-disablement for the reflection class (the last breaks the attack regardless of patch state)."
+        "gap": "Internet-facing Windows servers get 48 hours at every maturity level (ISM-1877), but workstations and internal servers get one month for this SMB client flaw at Maturity Levels One and Two (ISM-1695) and 48 hours only at Maturity Level Three (ISM-1696), although it is KEV-listed with a public exploit and the update needs a reboot. No patch control requires enforcing SMB signing, which blocks the reflection before the update is installed, while that window runs."
       }
     },
     "compliance_exposure_score": {
@@ -21437,10 +21437,10 @@
         "adequate": false,
         "gap": "'Appropriate timescales' is undefined; the standard reading is unsafe for an actively-exploited kernel/driver LPE that is part of every modern ransomware kit."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "Essential 8 patch-applications (48h at ML3) is the right tier for a Windows LPE, but the load-bearing endpoint controls are hypervisor-protected code integrity (HVCI/VBS) and the Microsoft Vulnerable Driver Blocklist — neither of which the framework demands explicitly."
+        "gap": "ISM-1695 allows one month from release at Maturity Levels One and Two for this Windows driver fix, although CISA listed the flaw as exploited on 2025-10-14 with a proof of concept available, and the 48-hour windows in ISM-1696 and ISM-1879 apply only at Maturity Level Three. The update requires a restart that the patch windows do not plan for."
       }
     },
     "compliance_exposure_score": {
@@ -21525,10 +21525,10 @@
         "adequate": false,
         "gap": "'Appropriate timescales' is undefined; the standard reading is unsafe for an actively-exploited kernel/driver LPE that is part of every modern ransomware kit."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "Essential 8 patch-applications (48h at ML3) is the right tier for a Windows LPE, but the load-bearing endpoint controls are hypervisor-protected code integrity (HVCI/VBS) and the Microsoft Vulnerable Driver Blocklist — neither of which the framework demands explicitly."
+        "gap": "Windows on workstations and internal servers is patched within one month of release at Maturity Levels One and Two (ISM-1695), and the 48-hour window for a working exploit (ISM-1696) applies only at Maturity Level Three, so the lower levels leave this exploited RasMan privilege escalation open for a month; only internet-facing servers get 48 hours at every level (ISM-1877). The fix takes effect only after a reboot, which the window does not plan for."
       }
     },
     "compliance_exposure_score": {
@@ -21851,10 +21851,10 @@
         "adequate": false,
         "gap": "'Appropriate timescales' is undefined; the standard reading is unsafe for an actively-exploited kernel/driver LPE, and the long tail of unpatched mobile/server estates keeps these exploitable for years."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "Essential 8 patch-applications (operating systems, 48h at ML3) is the right tier, but the load-bearing controls are kernel/driver hardening and a timely vendor patch cadence — Android Security Bulletin OTA updates for the mobile-chipset entries, distribution kernel updates or live-patching for the Linux entries — none of which the framework names explicitly."
+        "gap": "The Linux kernel is an operating system: with a working exploit available, internet-facing servers are patched within 48 hours at every maturity level (ISM-1877), while workstations and internal servers get one month at Maturity Levels One and Two (ISM-1695) and 48 hours only at Level Three (ISM-1696). The fix takes effect only after a reboot, no live patch is registered, and none of these windows plans for the restart."
       }
     },
     "compliance_exposure_score": {
@@ -21938,10 +21938,10 @@
         "adequate": false,
         "gap": "'Appropriate timescales' is undefined; the standard reading is unsafe for an actively-exploited client RCE, and the legacy KEV re-listing exists because organizations still run vulnerable Office/IE/Windows builds."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "Essential 8 patch-applications (48h at ML3) is closer to the reality for a client RCE than 30 days, but legacy KEV re-listings show that long-tail unpatched estates persist; centralized update management and Office hardening are the load-bearing controls."
+        "gap": "ISM-1691 gives Internet Explorer two weeks at Maturity Levels One and Two and ISM-1692 gives it 48 hours at Maturity Level Three, so below the top level the browser can stay unpatched for two weeks although CISA lists the flaw as exploited, and neither window provides for the reboot the fix requires. ISM-1704 requires removal where Internet Explorer is unsupported, and removal is then the effective remediation."
       }
     },
     "compliance_exposure_score": {
@@ -22021,10 +22021,10 @@
         "adequate": false,
         "gap": "'Appropriate timescales' is undefined; the standard reading is unsafe for an actively-exploited kernel/driver LPE that is part of every modern ransomware kit."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "Essential 8 patch-applications (48h at ML3) is the right tier for a Windows LPE, but the load-bearing endpoint controls are hypervisor-protected code integrity (HVCI/VBS) and the Microsoft Vulnerable Driver Blocklist — neither of which the framework demands explicitly."
+        "gap": "On workstations and internal servers, ISM-1695 allows one month at Maturity Levels One and Two for this KEV-listed flaw with a public proof of concept, and only ISM-1696 at Maturity Level Three requires 48 hours. None of these windows plans for the reboot the fix needs."
       }
     },
     "compliance_exposure_score": {
@@ -22091,10 +22091,10 @@
         "adequate": false,
         "gap": "'Appropriate timescales' is undefined; the standard reading is unsafe for an actively-exploited client RCE, and the legacy KEV re-listing exists because organizations still run vulnerable Office/IE/Windows builds."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "Essential 8 patch-applications (48h at ML3) is closer to the reality for a client RCE than 30 days, but legacy KEV re-listings show that long-tail unpatched estates persist; centralized update management and Office hardening are the load-bearing controls."
+        "gap": "The flaw is in a Windows ActiveX control, so the workstation operating system controls apply: one month from release at Maturity Levels One and Two (ISM-1695), 48 hours at Maturity Level Three once a working exploit exists (ISM-1696), and replacement of an unsupported Windows release at every level (ISM-1501). Viewing a crafted webpage gives the attacker code execution as the current user, so below Maturity Level Three the exploited path stays open for a month, and the 2025-10-06 KEV listing sets no new deadline."
       }
     },
     "compliance_exposure_score": {
@@ -22179,10 +22179,10 @@
         "adequate": false,
         "gap": "'Appropriate timescales' is undefined; the standard reading is unsafe for an actively-exploited client RCE, and the legacy KEV re-listing exists because organizations still run vulnerable Office/IE/Windows builds."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
-        "adequate": false,
-        "gap": "Essential 8 patch-applications (48h at ML3) is closer to the reality for a client RCE than 30 days, but legacy KEV re-listings show that long-tail unpatched estates persist; centralized update management and Office hardening are the load-bearing controls."
+        "adequate": true,
+        "gap": "The TrueType font parser is in win32k.sys, part of the Windows kernel, so on workstations and internal servers ISM-1695 requires the fix within one month of release at Maturity Levels One and Two and ISM-1696 requires it within 48 hours at Maturity Level Three because a working exploit exists. The 2025 KEV listing for a CVE from 2011 records exploitation continuing against hosts still running an unpatched win32k.sys, and a host that has installed the update keeps running the vulnerable parser until it restarts."
       }
     },
     "compliance_exposure_score": {
@@ -22210,7 +22210,7 @@
         "id": "NEW-CTRL-018",
         "name": "SCANNER-PAPER-COMPLIANCE-TEST",
         "description": "The reason a fourteen-year-old Windows kernel flaw needed a 2025 KEV listing is as much a measurement failure as a remediation one, and this is where paper compliance hides on this entry: a vulnerability console reports the estate clean for CVE-2011-3402 because no check fires for a 2011 Windows CVE that every inventory treats as permanently closed — an outcome byte-identical to an estate where every host is above the fixed build. Prove the check works before trusting its verdict. Point the scanner at a host whose Windows build predates the fix — a restored backup, an archived image, or a VM known never to have taken it — and confirm the CVE is actually reported on it; a clean result from a scan that never tested is not evidence of remediation. The check must read the build the host is running rather than the update-approval or download state in the management console, because live_patch_available is false and there is a restart-or-reboot requirement, so a downloaded-but-not-restarted host is still executing the vulnerable win32k.sys font parser while every console field says patched. Precondition and limit: this control produces a truthful inventory and removes nothing — it tells the operator which hosts the KEV clock actually applies to, and the fixed build plus its restart is still what closes them.",
-        "evidence": "Packet fields for CVE-2011-3402: cisa_kev true with kev_date 2025-10-06 against a CVE identifier from 2011, active_exploitation confirmed, poc_available true; attack_vector states the legacy re-listing exists because long-tail unpatched estates remain exposed; framework_coverage for NIST-800-53-SI-2 records that legacy KEV re-listings document organizations still running unpatched builds, and the AU-ISM-1546 coverage entry records that long-tail unpatched estates persist; patch_available true with patch_required_reboot true and live_patch_available false, live_patch_notes recording the service restart or system reboot per the KEV requiredAction.",
+        "evidence": "Packet fields for CVE-2011-3402: cisa_kev true with kev_date 2025-10-06 against a CVE identifier from 2011, active_exploitation confirmed, poc_available true; attack_vector states the legacy re-listing exists because long-tail unpatched estates remain exposed; framework_coverage for NIST-800-53-SI-2 records that legacy KEV re-listings document organizations still running unpatched builds, and the AU-Essential-8-Patch coverage entry records exploitation continuing against hosts still running an unpatched win32k.sys; patch_available true with patch_required_reboot true and live_patch_available false, live_patch_notes recording the service restart or system reboot per the KEV requiredAction.",
         "gap_closes": [
           "NIST-800-53-SI-2",
           "ISO-27001-2022-A.8.8"
@@ -22258,10 +22258,10 @@
         "adequate": false,
         "gap": "'Appropriate timescales' is undefined; the standard reading is unsafe for an actively-exploited client RCE, and the legacy re-listing exists because organizations still run vulnerable browser/reader builds (Internet Explorer is end-of-life and unsupported)."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
-        "adequate": false,
-        "gap": "Essential 8 patch-applications (48h at ML3) is closer to the reality for a client RCE than 30 days, but legacy KEV re-listings show long-tail unpatched estates persist; centralized update management, application hardening (Protected View, ASR rules), and retiring end-of-life software (Internet Explorer) are the load-bearing controls."
+        "adequate": true,
+        "gap": "Firefox and SeaMonkey are web browsers and Thunderbird is an email client, so all three fall under ISM-1691 (two weeks at Maturity Levels One and Two) and ISM-1692 (48 hours at Maturity Level Three, because a working exploit exists), and ISM-1704 requires unsupported versions to be removed. Each product takes its own update, so an estate meets the control only when SeaMonkey and Thunderbird installs are updated as well as Firefox."
       }
     },
     "compliance_exposure_score": {
@@ -22696,10 +22696,10 @@
         "adequate": false,
         "gap": "'Appropriate timescales' is undefined; the standard reading is unsafe for an actively-exploited mobile OS flaw, and the OEM/carrier OTA chain means many devices receive the fix weeks-to-never after disclosure."
       },
-      "AU-ISM-1546": {
-        "covered": true,
+      "AU-Essential-8-Patch": {
+        "covered": false,
         "adequate": false,
-        "gap": "Essential 8 patch-applications (operating systems) is the right tier, but the load-bearing controls for mobile are vendor OTA cadence (Android Security Bulletin / Samsung SMR), MDM-enforced update SLAs on managed fleets, mobile-threat-defense, and hardened/locked-down configurations for high-risk users — none of which the framework names explicitly."
+        "gap": "Samsung phones are IT equipment other than workstations, servers and network devices, so updates to their operating system, which contains the vulnerable libimagecodec.quram.so library, fall under ISM-1878 (48 hours after release when a working exploit exists), a control that no Essential Eight maturity profile includes. On a personally owned phone, the owner decides when to install Samsung's update and restart the device, and no Essential Eight control sets or checks that timeframe while CISA lists this remote code execution flaw as exploited (since 2025-10-02)."
       }
     },
     "compliance_exposure_score": {
@@ -22861,10 +22861,10 @@
         "adequate": false,
         "gap": "'Appropriate timescales' is undefined; the standard reading is unsafe for an actively-exploited escalation flaw, which is the second half of nearly every intrusion chain."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "Essential 8 names OS/application patching, but the load-bearing backstops are platform-specific and unnamed: least-privilege and SELinux/seccomp on Linux, MDM-enforced OTA SLAs on Android, management-account segmentation for virtualization, and SMB signing / NTLM-disablement for the reflection class (the last breaks the attack regardless of patch state)."
+        "gap": "Sudo is part of the operating system, so ISM-1695 allows workstations and non-internet-facing servers one month at Maturity Levels One and Two, and 48 hours applies only at Maturity Level Three (ISM-1696) or on an internet-facing server (ISM-1877), although a proof of concept exists and CISA KEV-listed the flaw on 2025-09-29. A local user not listed in the sudoers file can use the -R (--chroot) option to run commands as root, which exposes every host still on a vulnerable build."
       }
     },
     "compliance_exposure_score": {
@@ -23549,10 +23549,10 @@
         "adequate": false,
         "gap": "'Appropriate timescales' is undefined; the standard reading is unsafe for an actively-exploited escalation flaw, which is the second half of nearly every intrusion chain."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "Essential 8 names OS/application patching, but the load-bearing backstops are platform-specific and unnamed: least-privilege and SELinux/seccomp on Linux, MDM-enforced OTA SLAs on Android, management-account segmentation for virtualization, and SMB signing / NTLM-disablement for the reflection class (the last breaks the attack regardless of patch state)."
+        "gap": "The Essential Eight operating system patch timeframes (ISM-1877, ISM-1695, ISM-1696) do not include Android handsets, so the 48-hour window for this exploited Android Runtime flaw comes from ISM-1878, outside the Essential Eight, and does not start until an update for the handset is released. The Essential Eight applies through ISM-1501, which requires handsets whose operating system the manufacturer no longer supports to be replaced at every maturity level, so it covers this CVE only on handsets that no longer receive updates."
       }
     },
     "compliance_exposure_score": {
@@ -23750,7 +23750,7 @@
         "description": "TL-WR841N units are consumer-grade routers that typically sit outside a managed patch pipeline, so a KEV listing produces no action at all unless the SLA explicitly enumerates them as in-scope assets. Bind the 2025-09-03 listing to a 4-hour clock covering every deployed unit, and use the control's own allowance for documented compensating controls as the closure path where a supported firmware release does not exist for the specific hardware revision: removing the port-80 httpd management surface from any untrusted segment satisfies the SLA where an update cannot. This matters because the packet's KEV text also records that the affected products could be end-of-life or end-of-service with a discontinue-use instruction — an SLA that can only be discharged by patching will not close at all across part of this fleet.",
         "evidence": "Packet: CISA KEV-listed 2025-09-03, active_exploitation 'confirmed', poc_available true, CVSS 9.1, RWEP 77, patch_available true, live_patch_available false. Vector text: 'The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.' The httpd service 'listens on TCP port 80 by default'. The control's own definition admits patch, live patch, or documented compensating controls as valid mitigation.",
         "gap_closes": [
-          "AU-ISM-1546",
+          "AU-Essential-8-Patch",
           "ISO-27001-2022-A.8.8",
           "NIST-800-53-SI-2"
         ]
@@ -23967,10 +23967,10 @@
         "adequate": false,
         "gap": "The 30-day flaw-remediation SLA is far longer than the observed exploitation window for a KEV-listed, actively-exploited zero-click messaging-app flaw; commercial-surveillance chains weaponize these within days, and app-update reach depends on app-store/MDM cadence."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "Essential 8 names application patching, but the load-bearing controls for a zero-click messaging flaw are forced app auto-update, MDM-enforced update SLAs, mobile-threat-defense, and hardened/locked-down configurations (e.g. Lockdown Mode) for high-risk users — none named explicitly."
+        "gap": "WhatsApp is an other application under ISM-1693, which requires the fix to be applied within one month of release at Maturity Levels Two and Three, sets no timeframe at Maturity Level One, and allows no shorter window although CISA lists the flaw as known exploited. That leaves this linked-device authorization flaw, which lets an unrelated user make the target's device process content from an arbitrary URL, open for up to a month after Meta's release at Maturity Levels Two and Three, with no deadline at Maturity Level One; no control requires forcing the app to update automatically."
       },
       "ISO-27001-2022-A.8.8": {
         "covered": true,
@@ -24238,10 +24238,10 @@
         "adequate": false,
         "gap": "'Appropriate timescales' is undefined; the standard reading is unsafe for an actively-exploited client flaw, and the legacy re-listings exist because organizations still run vulnerable or end-of-life software."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "Essential 8 names application patching and hardening, but the load-bearing controls here are file-provenance enforcement (Mark-of-the-Web propagation to extracted files), ASR rules, disabling risky ActiveX, and hardened version-control settings (protectNTFS, disabling symlinks on clone) — none of which the framework names explicitly."
+        "gap": "Git falls in the ISM's other-applications class, so ISM-1693 allows one month from Maturity Level Two and sets no timeframe at Maturity Level One, although this flaw in Git's handling of carriage returns in configuration files is KEV-listed with a working exploit. No patch control limits the handling of untrusted repositories while that window runs."
       }
     },
     "compliance_exposure_score": {
@@ -24750,10 +24750,10 @@
         "adequate": false,
         "gap": "'Appropriate timescales' is undefined; the standard reading is unsafe for an actively-exploited client flaw, and the legacy re-listings exist because organizations still run vulnerable or end-of-life software."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "Essential 8 names application patching and hardening, but the load-bearing controls here are file-provenance enforcement (Mark-of-the-Web propagation to extracted files), ASR rules, disabling risky ActiveX, and hardened version-control settings (protectNTFS, disabling symlinks on clone) — none of which the framework names explicitly."
+        "gap": "ISM-1693 gives WinRAR for Windows one month from release and applies only from Maturity Level Two, and other applications have no 48-hour window at any level, so the path traversal that CISA listed in KEV on 2025-08-12, which an attacker exploits with a crafted archive to run arbitrary code, can stay unpatched for that month on a compliant estate and has no patching timeframe at Maturity Level One. No patching control requires Mark-of-the-Web propagation to extracted files or ASR rules in the meantime."
       }
     },
     "compliance_exposure_score": {
@@ -24831,10 +24831,10 @@
         "adequate": false,
         "gap": "'Appropriate timescales' is undefined; the standard reading is unsafe for an actively-exploited client RCE, and the legacy KEV re-listing exists because organizations still run vulnerable Office/IE/Windows builds."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
-        "adequate": false,
-        "gap": "Essential 8 patch-applications (48h at ML3) is closer to the reality for a client RCE than 30 days, but legacy KEV re-listings show that long-tail unpatched estates persist; centralized update management and Office hardening are the load-bearing controls."
+        "adequate": true,
+        "gap": "Excel is an office productivity suite, so ISM-1691 requires the fix within two weeks of release at Maturity Levels One and Two, ISM-1692 requires it within 48 hours at Maturity Level Three because a working exploit exists, and ISM-1704 requires an unsupported Office version to be removed. The 2025 KEV listing for a CVE from 2007 means hosts that did not meet those controls are being exploited, and a host that installs the update remains exposed until the restart or reboot it requires."
       }
     },
     "compliance_exposure_score": {
@@ -24918,10 +24918,10 @@
         "adequate": false,
         "gap": "'Appropriate timescales' is undefined; the standard reading is unsafe for an actively-exploited client RCE, and the legacy re-listing exists because organizations still run vulnerable browser/reader builds (Internet Explorer is end-of-life and unsupported)."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "Essential 8 patch-applications (48h at ML3) is closer to the reality for a client RCE than 30 days, but legacy KEV re-listings show long-tail unpatched estates persist; centralized update management, application hardening (Protected View, ASR rules), and retiring end-of-life software (Internet Explorer) are the load-bearing controls."
+        "gap": "Internet Explorer is a web browser, patched within two weeks of release at Maturity Levels One and Two (ISM-1691) and within 48 hours at Maturity Level Three once a working exploit exists (ISM-1692), and where Microsoft no longer supports the installed version, ISM-1704 requires its removal at every level. The window runs from Microsoft's release, so the 2025-08-12 KEV listing sets no new deadline for an estate that missed the fix or kept the browser."
       }
     },
     "compliance_exposure_score": {
@@ -25675,10 +25675,10 @@
         "adequate": false,
         "gap": "'Appropriate timescales' is undefined; the standard reading is unsafe for an actively-exploited browser RCE, where the safe SLA is same-day Chrome component-updater rollout."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "Essential 8 patch-applications (48h at ML3) is the right tier for a browser RCE, but the load-bearing controls are forced auto-update via enterprise browser policy and not gating Chrome updates behind a managed change window — neither of which the framework names explicitly."
+        "gap": "ISM-1691 allows two weeks for web browsers at Maturity Levels One and Two, and ISM-1692 applies 48 hours for a working exploit only at Maturity Level Three, so a compliant estate below that level can leave this KEV-listed ANGLE and GPU flaw, which a remote attacker uses to escape the sandbox from a crafted HTML page, open for two weeks. Browser hardening settings do not affect the flaw, the fix needs a browser restart, and the control does not require forced auto-update through enterprise browser policy while the window runs."
       }
     },
     "compliance_exposure_score": {
@@ -26716,10 +26716,10 @@
         "adequate": false,
         "gap": "'Appropriate timescales' is undefined; the standard reading is unsafe for an actively-exploited browser RCE, where the safe SLA is same-day Chrome component-updater rollout."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "Essential 8 patch-applications (48h at ML3) is the right tier for a browser RCE, but the load-bearing controls are forced auto-update via enterprise browser policy and not gating Chrome updates behind a managed change window — neither of which the framework names explicitly."
+        "gap": "ISM-1691 gives web browsers two weeks from release at Maturity Levels One and Two, and only Maturity Level Three applies the 48-hour window of ISM-1692 for a working exploit, so a compliant estate below that level can leave this KEV-listed V8 type confusion, which an attacker triggers with a crafted HTML page to gain arbitrary read and write, open for two weeks. Chrome, Edge and Opera each ship their own fixed build, so each browser's window starts at its own vendor's release, and the control does not require forced auto-update through enterprise browser policy or keeping browser updates out of a managed change window."
       }
     },
     "compliance_exposure_score": {
@@ -27326,10 +27326,10 @@
         "adequate": false,
         "gap": "'Appropriate timescales' is undefined; the standard reading is unsafe for an actively-exploited kernel/driver LPE, and the long tail of unpatched mobile/server estates keeps these exploitable for years."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "Essential 8 patch-applications (operating systems, 48h at ML3) is the right tier, but the load-bearing controls are kernel/driver hardening and a timely vendor patch cadence — Android Security Bulletin OTA updates for the mobile-chipset entries, distribution kernel updates or live-patching for the Linux entries — none of which the framework names explicitly."
+        "gap": "A kernel fix is an operating system patch, so ISM-1877 requires it within 48 hours on internet-facing servers at every maturity level, but ISM-1695 gives workstations and internal servers a month below Maturity Level Three for this local escalation CISA lists as exploited. The fixed kernel runs only after a reboot, and the windows do not plan for hosts where reboots are deferred."
       }
     },
     "compliance_exposure_score": {
@@ -27497,10 +27497,10 @@
         "adequate": false,
         "gap": "'Appropriate timescales' is undefined; the standard reading is unsafe for an actively-exploited mobile/desktop OS flaw, often part of a targeted-spyware chain against high-risk users."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "Essential 8 patch-applications (48h at ML3) is closer to the reality for a client OS RCE than a 30-day cycle, but still trails same-day OS auto-update for an in-the-wild exploit; MDM-enforced update SLAs are the load-bearing control on managed mobile fleets."
+        "gap": "macOS workstations get one month for this KEV-listed flaw in processing photos and videos shared through iCloud Links at Maturity Levels One and Two (ISM-1695) and 48 hours only at Maturity Level Three (ISM-1696), and the update needs a restart. iPhones, iPads and the other affected Apple devices fall under ISM-1878, whose 48-hour window sits outside the Essential Eight profiles."
       }
     },
     "compliance_exposure_score": {
@@ -27578,10 +27578,10 @@
         "adequate": false,
         "gap": "The 30-day flaw-remediation SLA is far longer than the observed exploitation window for a KEV-listed, actively-exploited client-side flaw delivered by a crafted shortcut; targeted-espionage actors weaponize these within days."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "Essential 8 names application patching, but the load-bearing controls here are blocking outbound WebDAV/SMB to the internet, ASR rules, Mark-of-the-Web enforcement on downloaded shortcuts, and disabling the WebClient service where unneeded — none named explicitly."
+        "gap": "The flaw is in Windows, so ISM-1695 allows workstations one month at Maturity Levels One and Two, and the 48-hour window for a working exploit applies only at Maturity Level Three (ISM-1696), although a proof of concept exists and CISA KEV-listed the flaw on 2025-06-10. Until the update is installed and the host restarted, a crafted Internet Shortcut file can run code from the remote WebDAV location its WorkingDirectory attribute names."
       },
       "ISO-27001-2022-A.8.8": {
         "covered": true,
@@ -27922,10 +27922,10 @@
         "adequate": false,
         "gap": "'Appropriate timescales' is undefined; the standard reading is unsafe for an actively-exploited browser RCE, where the safe SLA is same-day Chrome component-updater rollout."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "Essential 8 patch-applications (48h at ML3) is the right tier for a browser RCE, but the load-bearing controls are forced auto-update via enterprise browser policy and not gating Chrome updates behind a managed change window — neither of which the framework names explicitly."
+        "gap": "Browsers are patched within two weeks of release at Maturity Levels One and Two (ISM-1691), and the 48-hour window for a working exploit (ISM-1692) applies only at Maturity Level Three, so the lower levels leave this exploited V8 flaw open for two weeks. The flaw affects Chrome, Edge and Opera, so each window runs from that browser vendor's own release, and no control requires forced auto-update through enterprise browser policy."
       }
     },
     "compliance_exposure_score": {
@@ -28002,10 +28002,10 @@
         "adequate": false,
         "gap": "'Appropriate timescales' is undefined; the standard reading is unsafe for an actively-exploited kernel/driver LPE, and the long tail of unpatched mobile/server estates keeps these exploitable for years."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "Essential 8 patch-applications (operating systems, 48h at ML3) is the right tier, but the load-bearing controls are kernel/driver hardening and a timely vendor patch cadence — Android Security Bulletin OTA updates for the mobile-chipset entries, distribution kernel updates or live-patching for the Linux entries — none of which the framework names explicitly."
+        "gap": "For phones and other devices built on these chipsets, ISM-1878 requires the fix within 48 hours of release because a working exploit exists, but it is in no Essential Eight maturity profile; treated as a driver or firmware, the fix falls under ISM-1879 or ISM-1903, which apply at Maturity Level Three only. Neither window starts until a device maker releases an update carrying the GPU-micronode fix, and that update needs a restart."
       }
     },
     "compliance_exposure_score": {
@@ -28088,10 +28088,10 @@
         "adequate": false,
         "gap": "'Appropriate timescales' is undefined; the standard reading is unsafe for an actively-exploited kernel/driver LPE, and the long tail of unpatched mobile/server estates keeps these exploitable for years."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "Essential 8 patch-applications (operating systems, 48h at ML3) is the right tier, but the load-bearing controls are kernel/driver hardening and a timely vendor patch cadence — Android Security Bulletin OTA updates for the mobile-chipset entries, distribution kernel updates or live-patching for the Linux entries — none of which the framework names explicitly."
+        "gap": "As a GPU driver or firmware fix, the correction for this incorrect-authorization flaw in the Qualcomm GPU micronode falls under ISM-1879 (drivers) or ISM-1903 (firmware), which require it within 48 hours of release when a working exploit exists, and the Essential Eight includes both controls at Maturity Level Three only, so Maturity Levels One and Two set no timeframe for it. At Maturity Level Three the 48 hours begin only when the device maker ships Qualcomm's fix in its own update, and that update needs a reboot, while CISA has listed the flaw as exploited since 2025-06-03."
       }
     },
     "compliance_exposure_score": {
@@ -28178,10 +28178,10 @@
         "adequate": false,
         "gap": "'Appropriate timescales' is undefined; the standard reading is unsafe for an actively-exploited kernel/driver LPE, and the long tail of unpatched mobile/server estates keeps these exploitable for years."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "Essential 8 patch-applications (operating systems, 48h at ML3) is the right tier, but the load-bearing controls are kernel/driver hardening and a timely vendor patch cadence — Android Security Bulletin OTA updates for the mobile-chipset entries, distribution kernel updates or live-patching for the Linux entries — none of which the framework names explicitly."
+        "gap": "Only Maturity Level Three sets a timeframe for this Adreno GPU driver fix, 48 hours under ISM-1879 for a flaw CISA listed as exploited on 2025-06-03 with a proof of concept available, and Maturity Levels One and Two set none. On handsets the operating system update that carries the driver falls under ISM-1878, outside the Essential Eight profiles, and the fix requires a restart that the window does not plan for."
       }
     },
     "compliance_exposure_score": {
@@ -28807,11 +28807,11 @@
         "id": "NEW-CTRL-001",
         "name": "CISA-KEV-RESPONSE-SLA",
         "description": "For this entry the KEV clock opened 2025-05-19 against a flaw with confirmed in-the-wild exploitation and a public proof of concept, so the standard flaw-remediation cadence the citing gaps rest on is longer than the window an unauthenticated file-read on an internet-reachable attendance server actually gets. Two things make the clock behave differently here than on a generic application patch. First, the packet registers no live-patch tool and states the vendor patch typically requires a service restart or system reboot per the KEV requiredAction, so a BioTime server on which the installer has run but the service has not restarted is still serving the vulnerable iclock handler; completion has to be measured per server by the build actually running and the date the service last restarted, not by the installer-run date in a patch console. Second, and this is the half no patch-timescale control asks for: the update stops further reads, it does not un-disclose a file that was already read. Because exploitation is confirmed and a working proof of concept is public, every secret the service could open on a server that was reachable during the exposure window — database and integration credentials held in configuration, service-account material, anything else within the process's read scope — is treated as disclosed and rotated, with the rotation tracked to completion as its own item rather than folded into the patch ticket. Distinguishing test: produce, per BioTime server, the running build, the service restart timestamp, and the rotation record for the credentials that server holds; a flaw-remediation SLA marked met on installer-run date with no restart evidence and no rotation is the specific way this entry gets closed while it stays exploitable. Precondition: this control is a clock and an evidence standard, not a mitigation — it changes when the fixed build arrives and how completion is proven, and it gives an operator nothing during the interval before the update and restart land.",
-        "evidence": "Packet: CISA KEV-listed 2025-05-19 with active_exploitation confirmed and poc_available true; RWEP 77 against CVSS 7.5. patch_available true, live_patch_available false, live_patch_notes: no live-patch tool registered for this entry at bulk-import time, vendor patch typically requires service restart or system reboot per the KEV requiredAction. Vector: unauthenticated arbitrary file read via the iclock API. Citing gaps include NIST-800-53-SI-2 (Flaw Remediation), ISO-27001-2022-A.8.8 (Management of technical vulnerabilities) and AU-ISM-1546 (Patch operating systems and applications).",
+        "evidence": "Packet: CISA KEV-listed 2025-05-19 with active_exploitation confirmed and poc_available true; RWEP 77 against CVSS 7.5. patch_available true, live_patch_available false, live_patch_notes: no live-patch tool registered for this entry at bulk-import time, vendor patch typically requires service restart or system reboot per the KEV requiredAction. Vector: unauthenticated arbitrary file read via the iclock API. Citing gaps include NIST-800-53-SI-2 (Flaw Remediation), ISO-27001-2022-A.8.8 (Management of technical vulnerabilities) and AU-Essential-8-Patch (Patch applications and patch operating systems).",
         "gap_closes": [
           "ISO-27001-2022-A.8.8",
           "NIST-800-53-SI-2",
-          "AU-ISM-1546"
+          "AU-Essential-8-Patch"
         ]
       }
     ]
@@ -29560,10 +29560,10 @@
         "adequate": false,
         "gap": "'Appropriate timescales' is undefined; the standard reading is unsafe for an actively-exploited kernel/driver LPE that is part of every modern ransomware kit."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "Essential 8 patch-applications (48h at ML3) is the right tier for a Windows LPE, but the load-bearing endpoint controls are hypervisor-protected code integrity (HVCI/VBS) and the Microsoft Vulnerable Driver Blocklist — neither of which the framework demands explicitly."
+        "gap": "The Ancillary Function Driver for WinSock is part of Windows, so its fix falls under ISM-1695, one month at Maturity Levels One and Two, and ISM-1696, 48 hours at Maturity Level Three for a working exploit, while an internet-facing server gets 48 hours at every level (ISM-1877). CISA KEV-listed this escalation to administrator on 2025-05-13 and a proof of concept exists, so a Level One or Two workstation stays exploitable for up to a month, and the fix needs a reboot."
       }
     },
     "compliance_exposure_score": {
@@ -29638,10 +29638,10 @@
         "adequate": false,
         "gap": "'Appropriate timescales' is undefined; the standard reading is unsafe for an actively-exploited client flaw, and security-feature-bypass flaws mean a single layered control (Protected View, SmartScreen, Mark-of-the-Web) cannot be relied on alone."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "Essential 8 names application patching, application hardening, and macro/Office controls separately, but does not require defence-in-depth for the case where the protection mechanism itself is bypassed — ASR rules, application control, and mail/web content filtering are the load-bearing layers when SmartScreen/Protected View fail."
+        "gap": "The scripting engine is part of Windows, so on workstations ISM-1695 allows one month for its fix at Maturity Levels One and Two, and the 48-hour window for a working exploit (ISM-1696) applies only at Maturity Level Three, although this crafted-URL RCE is KEV-listed. Until the update is installed and the machine restarted, application control, attack surface reduction rules and web content filtering are the layers that limit it."
       }
     },
     "compliance_exposure_score": {
@@ -29706,10 +29706,10 @@
         "adequate": false,
         "gap": "'Appropriate timescales' is undefined; the standard reading is unsafe for an actively-exploited kernel/driver LPE that is part of every modern ransomware kit."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "Essential 8 patch-applications (48h at ML3) is the right tier for a Windows LPE, but the load-bearing endpoint controls are hypervisor-protected code integrity (HVCI/VBS) and the Microsoft Vulnerable Driver Blocklist — neither of which the framework demands explicitly."
+        "gap": "On workstations and non-internet-facing servers the CLFS fix is due within one month at Maturity Levels One and Two (ISM-1695) and within 48 hours at Level Three (ISM-1696), and ISM-1877 gives internet-facing servers 48 hours at every level. With a proof-of-concept exploit and a KEV listing on 2025-05-13, the lower levels allow a month for an exploited heap overflow, and the fix takes effect only after a reboot."
       }
     },
     "compliance_exposure_score": {
@@ -29795,10 +29795,10 @@
         "adequate": false,
         "gap": "'Appropriate timescales' is undefined; the standard reading is unsafe for an actively-exploited kernel/driver LPE that is part of every modern ransomware kit."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "Essential 8 patch-applications (48h at ML3) is the right tier for a Windows LPE, but the load-bearing endpoint controls are hypervisor-protected code integrity (HVCI/VBS) and the Microsoft Vulnerable Driver Blocklist — neither of which the framework demands explicitly."
+        "gap": "On workstations and non-internet-facing servers the Windows update is due within one month at Maturity Levels One and Two (ISM-1695) and within 48 hours only at Level Three (ISM-1696), while ISM-1877 gives internet-facing servers 48 hours at every level. CISA listed this use-after-free on 2025-05-13 and a proof-of-concept exploit exists, so the lower levels allow a month for an exploited flaw, and the update needs a reboot with no live patch available."
       }
     },
     "compliance_exposure_score": {
@@ -30810,10 +30810,10 @@
         "adequate": false,
         "gap": "Silent on the reality that a patched device can still carry attacker persistence seeded before the patch; cleanup/rebuild verification is required."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "Essential 8 ML3 (48h) is closer to reality than NIST SI-2 but still misses the mass-scanning window for this internet-facing class."
+        "gap": "For an internet-facing Connect Secure appliance, ISM-1877 sets 48 hours from release at every maturity level, but exploitation began by mid-December 2024, before the 2025-01-08 advisory, and a compromised appliance needs a factory reset, rebuild and credential rotation the timeframe does not plan for. A Policy Secure appliance on an internal network gets one month under ISM-1695 at Maturity Levels One and Two."
       }
     },
     "compliance_exposure_score": {
@@ -30834,7 +30834,7 @@
           "ISO-27001-2022-A.8.8",
           "NIST-800-53-SI-2",
           "PCI-DSS-4.0-6.3.3",
-          "AU-ISM-1546",
+          "AU-Essential-8-Patch",
           "UK-CAF-B4"
         ]
       },
@@ -30846,7 +30846,7 @@
         "gap_closes": [
           "NIST-800-53-SI-2",
           "PCI-DSS-4.0-6.3.3",
-          "AU-ISM-1546",
+          "AU-Essential-8-Patch",
           "NIS2-Art21-network-security"
         ]
       },
@@ -30917,10 +30917,10 @@
         "adequate": false,
         "gap": "Silent on the reality that a patched device can still carry attacker persistence seeded before the patch; cleanup/rebuild verification is required."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "Essential 8 ML3 (48h) is closer to reality than NIST SI-2 but still misses the mass-scanning window for this internet-facing class."
+        "gap": "ISM-1694 allowed two weeks for Connect Secure from the 2025-02-11 release of 22.7R2.6, a window that ended before the exploitation recorded from mid-March 2025, but Policy Secure and ZTA Gateways need their own builds, 22.7R1.4 and 22.8R2.2, and each window starts only when that build is released. Neither ISM-1877 nor ISM-1694 requires the factory reset and rebuild that a gateway with compromise indicators needs."
       }
     },
     "compliance_exposure_score": {
@@ -30941,7 +30941,7 @@
           "ISO-27001-2022-A.8.8",
           "NIST-800-53-SI-2",
           "PCI-DSS-4.0-6.3.3",
-          "AU-ISM-1546"
+          "AU-Essential-8-Patch"
         ]
       },
       {
@@ -31020,10 +31020,10 @@
         "adequate": false,
         "gap": "Silent on the reality that a patched device can still carry attacker persistence seeded before the patch; cleanup/rebuild verification is required."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "Essential 8 ML3 (48h) is closer to reality than NIST SI-2 but still misses the mass-scanning window for this internet-facing class."
+        "gap": "ISM-1876 requires Note 3594142 within 48 hours at every maturity level on internet-facing instances, and ISM-1693 allows one month from Maturity Level Two on internal ones. A patch record showing the note applied does not show whether a JSP webshell was written before it, and no control requires blocking the uploader endpoint while the window runs."
       }
     },
     "compliance_exposure_score": {
@@ -31050,12 +31050,12 @@
         "id": "NEW-CTRL-032",
         "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
         "description": "For this SAP flaw the artifact left behind is a JSP webshell already written into a directory the NetWeaver application server serves and executes, so applying the Visual Composer fix closes the upload path and removes nothing that came through it. Any instance that was reachable at /developmentserver/metadatauploader during the mass-exploitation window has to be triaged as compromised rather than patched and closed: hunt the served and deployment directories for files that do not correspond to a sanctioned deployment, rotate the SAP service account and every credential recoverable from the host, and rebuild rather than clean where a webshell is found. Hands-on-keyboard follow-on including ransomware staging has been observed behind this access, and it chains frequently with the NetWeaver deserialization flaw CVE-2025-42999, which means an operator whose entire response is the vendor update may be closing the door behind an actor already inside, and may leave the second flaw's path open as well. The distinguishing test: on an instance already updated, enumerate the served directory tree against a known-good deployment manifest — a patch-compliance record showing the fix applied is not evidence that nothing was written before it landed.",
-        "evidence": "The packet's vector states the uploaded executable binary / JSP webshell is served and executed by the application server itself. Its attack_vector records mass exploitation from April 2025, webshell access leading to hands-on-keyboard follow-on including ransomware staging, and frequent chaining with CVE-2025-42999. patch_available is true and live_patch_available is false with no live-patch notes recorded, so the remediation on offer is a vendor update — an action that cannot remove a webshell already written to disk. CISA KEV-listed 2025-04-29, active_exploitation confirmed, poc_available true, CVSS 10, RWEP 78. The citing gaps ISO-27001-2022-A.8.8, NIST-800-53-SI-2, PCI-DSS-4.0-6.3.3 and AU-ISM-1546 are all patch-installation controls whose satisfied state is 'update applied'.",
+        "evidence": "The packet's vector states the uploaded executable binary / JSP webshell is served and executed by the application server itself. Its attack_vector records mass exploitation from April 2025, webshell access leading to hands-on-keyboard follow-on including ransomware staging, and frequent chaining with CVE-2025-42999. patch_available is true and live_patch_available is false with no live-patch notes recorded, so the remediation on offer is a vendor update, which cannot remove a webshell already written to disk. CISA KEV-listed 2025-04-29, active_exploitation confirmed, poc_available true, CVSS 10, RWEP 78. The citing gaps ISO-27001-2022-A.8.8, NIST-800-53-SI-2, PCI-DSS-4.0-6.3.3 and AU-Essential-8-Patch are all patch-installation controls whose satisfied state is 'update applied'.",
         "gap_closes": [
           "ISO-27001-2022-A.8.8",
           "NIST-800-53-SI-2",
           "PCI-DSS-4.0-6.3.3",
-          "AU-ISM-1546"
+          "AU-Essential-8-Patch"
         ]
       }
     ]
@@ -31115,10 +31115,10 @@
         "adequate": false,
         "gap": "Silent on the reality that a patched device can still carry attacker persistence seeded before the patch; cleanup/rebuild verification is required."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "Essential 8 ML3 (48h) is closer to reality than NIST SI-2 but still misses the mass-scanning window for this internet-facing class."
+        "gap": "ISM-1876 requires the fix within 48 hours at every maturity level for an instance exposed directly to the internet, and ISM-1693 allows one month from Maturity Level Two for an internal one. No control requires the DMZ proxy mitigation while the window runs, and the upgrade leaves crushadmin sessions and accounts created through the bypass in place, so the vendor's audit and credential rotation fall outside the requirement."
       }
     },
     "compliance_exposure_score": {
@@ -31138,7 +31138,7 @@
         "gap_closes": [
           "NIST-800-53-SI-2",
           "PCI-DSS-4.0-6.3.3",
-          "AU-ISM-1546",
+          "AU-Essential-8-Patch",
           "NIS2-Art21-network-security",
           "DORA-Art-9"
         ]
@@ -31152,7 +31152,7 @@
           "ISO-27001-2022-A.8.8",
           "NIST-800-53-SI-2",
           "PCI-DSS-4.0-6.3.3",
-          "AU-ISM-1546"
+          "AU-Essential-8-Patch"
         ]
       }
     ]
@@ -31197,10 +31197,10 @@
         "adequate": false,
         "gap": "'Appropriate timescales' is undefined; the standard reading is unsafe for an actively-exploited client RCE, and the legacy re-listing exists because organizations still run vulnerable browser/reader builds (Internet Explorer is end-of-life and unsupported)."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
-        "adequate": false,
-        "gap": "Essential 8 patch-applications (48h at ML3) is closer to the reality for a client RCE than 30 days, but legacy KEV re-listings show long-tail unpatched estates persist; centralized update management, application hardening (Protected View, ASR rules), and retiring end-of-life software (Internet Explorer) are the load-bearing controls."
+        "adequate": true,
+        "gap": "Acrobat and Reader are PDF applications, so APSB09-15 is due within two weeks of release at Maturity Levels One and Two (ISM-1691) and within 48 hours at Maturity Level Three because a working exploit exists (ISM-1692), and it is an application update that needs no reboot. ISM-1704 requires end-of-life Acrobat and Reader installs to be removed at every maturity level, and the 2026 KEV re-listing records exploitation of installs that remain unpatched."
       }
     },
     "compliance_exposure_score": {
@@ -31275,10 +31275,10 @@
         "adequate": false,
         "gap": "'Appropriate timescales' is undefined; the standard reading is unsafe for an actively-exploited client RCE, and the legacy re-listing exists because organizations still run vulnerable browser/reader builds (Internet Explorer is end-of-life and unsupported)."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
-        "adequate": false,
-        "gap": "Essential 8 patch-applications (48h at ML3) is closer to the reality for a client RCE than 30 days, but legacy KEV re-listings show long-tail unpatched estates persist; centralized update management, application hardening (Protected View, ASR rules), and retiring end-of-life software (Internet Explorer) are the load-bearing controls."
+        "adequate": true,
+        "gap": "Internet Explorer is a web browser, so MS10-002 is due within two weeks of release at Maturity Levels One and Two (ISM-1691) and within 48 hours at Maturity Level Three because a working exploit exists (ISM-1692), and it requires a reboot. Internet Explorer 6, 7 and 8 are legacy builds the remediation path decommissions, and ISM-1704 requires a browser its vendor no longer supports to be removed at every maturity level, so meeting it removes the component the Operation Aurora use-after-free exploits."
       }
     },
     "compliance_exposure_score": {
@@ -31351,10 +31351,10 @@
         "adequate": false,
         "gap": "'Appropriate timescales' is undefined; the standard reading is unsafe for an actively-exploited client RCE, and the legacy re-listing exists because organizations still run vulnerable browser/reader builds (Internet Explorer is end-of-life and unsupported)."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
-        "adequate": false,
-        "gap": "Essential 8 patch-applications (48h at ML3) is closer to the reality for a client RCE than 30 days, but legacy KEV re-listings show long-tail unpatched estates persist; centralized update management, application hardening (Protected View, ASR rules), and retiring end-of-life software (Internet Explorer) are the load-bearing controls."
+        "adequate": true,
+        "gap": "Internet Explorer 6 and 7 are web browsers, so MS10-018 is due within two weeks of release at Maturity Levels One and Two (ISM-1691) and within 48 hours at Maturity Level Three because a working exploit exists (ISM-1692). Internet Explorer is no longer supported by its vendor, so ISM-1704 requires it to be removed at every maturity level, and a host that keeps it as the renderer for a legacy line-of-business application does not meet the control even when another browser is the default."
       }
     },
     "compliance_exposure_score": {
@@ -31370,7 +31370,7 @@
         "id": "NEW-CTRL-122",
         "name": "EOL-ASSET-DECOMMISSION",
         "description": "A vendor fix for this specific CVE exists — Microsoft patch MS10-018 (2010), requiring a reboot — but the browser carrying it has no ongoing patch path: the entry's own framework_coverage states that Internet Explorer is end-of-life and unsupported, and its attack_vector explains the 2026-05-20 re-listing as existing because long-tail unpatched and end-of-life estates remain exposed. So MS10-018 plus its reboot is the interim state on any host that can still take it, and removing Internet Explorer is the terminal one. Applied here: enumerate every host on which Internet Explorer can still render attacker-supplied web content, including hosts where it survives not as the user's browser but as the renderer behind a legacy line-of-business application, and carry each to removal or replacement on a bounded, dated schedule rather than an open-ended risk acceptance. Scope it to Internet Explorer as the packet does — the packet ties the use-after-free to that browser's iepeers component and gives no mapping into other browsers or HTML renderers, so putting every browser in the estate on a removal schedule manufactures work against software no evidence implicates. Precondition, and the reason the interim measures are a holding action rather than a fix: restricting Internet Explorer to a named allowlist of internal legacy applications narrows the paths by which an attacker-controlled page reaches the vulnerable renderer, but it covers only the paths the policy actually mediates and leaves the vulnerable component installed and reachable — an allowlisted internal application that loads third-party content, or a redirect out of one, still lands on the sink. Distinguishing test: on a representative host, produce evidence that Internet Explorer is gone, not evidence that it has been demoted from default browser or configured with hardened zones — a host that keeps the renderer while the policy points users elsewhere still carries the vulnerable code.",
-        "evidence": "Packet fields for this entry: vector 'A use-after-free in Internet Explorer's iepeers.dll allows remote code execution when the victim visits a crafted page'; attack_vector 'a use-after-free (CWE-416) in the Internet Explorer iepeers component, exploitable by an attacker-controlled web page for code execution in the browser. CISA KEV-listed 2026-05-20 with confirmed in-the-wild exploitation; the legacy re-listing exists because long-tail unpatched/end-of-life estates remain exposed'; cwe_refs CWE-416; cisa_kev true, kev_date 2026-05-20, active_exploitation confirmed, poc_available true, cvss 8.8, rwep_score 70; patch_available true, live_patch_available false, live_patch_notes 'Microsoft patch MS10-018 (2010); requires reboot.' AU-Essential-8-App-Hardening (User application hardening) and UK-CAF-B4 (System security) are recorded as citing gaps. The entry's own framework_coverage supplies the end-of-life fact: its ISO-27001-2022-A.8.8 gap states 'the legacy re-listing exists because organizations still run vulnerable browser/reader builds (Internet Explorer is end-of-life and unsupported)', its AU-ISM-1546 gap names 'retiring end-of-life software (Internet Explorer)' among the load-bearing controls, and its defense_chain prevention step reads 'retire end-of-life software such as Internet Explorer'.",
+        "evidence": "Packet fields for this entry: vector 'A use-after-free in Internet Explorer's iepeers.dll allows remote code execution when the victim visits a crafted page'; attack_vector 'a use-after-free (CWE-416) in the Internet Explorer iepeers component, exploitable by an attacker-controlled web page for code execution in the browser. CISA KEV-listed 2026-05-20 with confirmed in-the-wild exploitation; the legacy re-listing exists because long-tail unpatched/end-of-life estates remain exposed'; cwe_refs CWE-416; cisa_kev true, kev_date 2026-05-20, active_exploitation confirmed, poc_available true, cvss 8.8, rwep_score 70; patch_available true, live_patch_available false, live_patch_notes 'Microsoft patch MS10-018 (2010); requires reboot.' AU-Essential-8-App-Hardening (User application hardening) and UK-CAF-B4 (System security) are recorded as citing gaps. The entry's own framework_coverage supplies the end-of-life fact: its ISO-27001-2022-A.8.8 gap states 'the legacy re-listing exists because organizations still run vulnerable browser/reader builds (Internet Explorer is end-of-life and unsupported)', its AU-Essential-8-Patch gap states 'Internet Explorer is no longer supported by its vendor, so ISM-1704 requires it to be removed at every maturity level', and its defense_chain prevention step reads 'retire end-of-life software such as Internet Explorer'.",
         "gap_closes": [
           "AU-Essential-8-App-Hardening",
           "UK-CAF-B4"
@@ -31428,10 +31428,10 @@
         "adequate": false,
         "gap": "'Appropriate timescales' is undefined; the standard reading is unsafe for an actively-exploited client flaw, and security-feature-bypass flaws mean a single layered control (Protected View, SmartScreen, Mark-of-the-Web) cannot be relied on alone."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
-        "adequate": false,
-        "gap": "Essential 8 names application patching, application hardening, and macro/Office controls separately, but does not require defence-in-depth for the case where the protection mechanism itself is bypassed — ASR rules, application control, and mail/web content filtering are the load-bearing layers when SmartScreen/Protected View fail."
+        "adequate": true,
+        "gap": "DirectShow is part of Windows 2000, XP and Server 2003, so MS09-028 falls under the workstation and internal server operating system controls: one month at Maturity Levels One and Two (ISM-1695) and 48 hours at Maturity Level Three because a working exploit exists (ISM-1696). The remediation path for these legacy hosts is MS09-028 or decommissioning or isolating end-of-life Windows, and ISM-1501 requires an operating system its vendor no longer supports to be replaced at every maturity level, so an isolated host does not meet ISM-1501 until it is replaced."
       }
     },
     "compliance_exposure_score": {
@@ -32115,12 +32115,12 @@
       {
         "id": "NEW-CTRL-042",
         "name": "INCOMPLETE-PATCH-SEQUENCE-SEVERITY-MULTIPLIER",
-        "description": "On its own scoring this Exim flaw sorts to the bottom of any patch queue — no KEV listing, no observed exploitation, RWEP 21 — and every citing control (SI-2, ISO A.8.8, AU-ISM-1546) would rank it accordingly, because each treats a CVE as a discrete item. That framing loses the history: this is part of the NO STARTTLS research lineage running from 2011 Postfix to the 2021 multi-MTA round, the same pre-handshake buffering primitive resurfacing across a decade and across independent MTA implementations. A vulnerability-management program must apply a severity multiplier on that basis and act on the class rather than the entry: raise this above its nominal rank, and when the fixed Exim lands, re-test the pre-handshake buffer-discard behaviour on every other MTA and mail-submission agent in the estate rather than closing the ticket on the one product named in the advisory.",
-        "evidence": "Packet attack_vector: 'STARTTLS command/response injection: the server/client does not discard bytes buffered before the TLS handshake... Part of the NO STARTTLS research lineage (2011 Postfix -> 2021 multi-MTA).' cisa_kev false, kev_date null, active_exploitation none, rwep_score 21, cvss 7.5, poc_available true. Cited against ISO-27001-2022-A.8.8, NIST-800-53-SI-2 and AU-ISM-1546 ('Patch operating systems and applications').",
+        "description": "On its own scoring this Exim flaw sorts to the bottom of any patch queue (no KEV listing, no observed exploitation, RWEP 21), and every citing control (SI-2, ISO A.8.8, AU-Essential-8-Patch) would rank it accordingly, because each treats a CVE as a discrete item. That framing loses the history: this is part of the NO STARTTLS research lineage running from 2011 Postfix to the 2021 multi-MTA round, the same pre-handshake buffering primitive resurfacing across a decade and across independent MTA implementations. A vulnerability-management program must apply a severity multiplier on that basis and act on the class rather than the entry: raise this above its nominal rank, and when the fixed Exim lands, re-test the pre-handshake buffer-discard behavior on every other MTA and mail-submission agent in the estate rather than closing the ticket on the one product named in the advisory.",
+        "evidence": "Packet attack_vector: 'STARTTLS command/response injection: the server/client does not discard bytes buffered before the TLS handshake... Part of the NO STARTTLS research lineage (2011 Postfix -> 2021 multi-MTA).' cisa_kev false, kev_date null, active_exploitation none, rwep_score 21, cvss 7.5, poc_available true. Cited against ISO-27001-2022-A.8.8, NIST-800-53-SI-2 and AU-Essential-8-Patch ('Patch applications and patch operating systems').",
         "gap_closes": [
           "ISO-27001-2022-A.8.8",
           "NIST-800-53-SI-2",
-          "AU-ISM-1546"
+          "AU-Essential-8-Patch"
         ]
       }
     ]
@@ -32548,10 +32548,10 @@
         "adequate": false,
         "gap": "Process/namespace isolation is treated as a boundary, but a single cgroups v1 release_agent flaw crosses it from container to host."
       },
-      "AU-ISM-1807": {
+      "AU-ISM-1409": {
         "covered": true,
         "adequate": false,
-        "gap": "OS-hardening guidance does not mandate disabling unprivileged user namespaces and requiring MAC + seccomp confinement on container hosts - the compensating controls that block this escape before the kernel is patched."
+        "gap": "ISM-1409 requires operating systems to be hardened using ASD and vendor guidance but names no specific setting, so a container host can meet it with unprivileged user namespaces enabled and no mandatory access control or seccomp confinement, which are the settings that block this escape before the kernel is patched."
       }
     },
     "compliance_exposure_score": {
@@ -32571,7 +32571,7 @@
         "gap_closes": [
           "NIST-800-53-AC-6",
           "NIST-800-53-SC-39",
-          "AU-ISM-1807"
+          "AU-Essential-8-Patch"
         ]
       }
     ],
@@ -32648,10 +32648,10 @@
         "adequate": false,
         "gap": "Boundary protection does not restrict WebLogic T3/IIOP listen ports to trusted hosts, leaving the unauthenticated data-access path internet-reachable."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "Patch-application guidance does not single out middleware critical patch updates (Oracle CPU) for accelerated application when the flaw is KEV-listed and the protocol is network-exposed."
+        "gap": "For an internet-accessible instance, an online service, ISM-1876 and ISM-1690 apply at every maturity level, and meeting either would have installed the July 2024 Critical Patch Update long before CISA's 2026-06-01 known-exploited listing. An internal-only instance falls under ISM-1693, which sets no timeframe at Maturity Level One while its T3/IIOP port answers unauthenticated requests, and neither window plans for the application-server restart the patch needs."
       }
     },
     "compliance_exposure_score": {
@@ -32671,7 +32671,7 @@
         "gap_closes": [
           "NIST-800-53-AC-3",
           "NIST-800-53-SC-7",
-          "AU-ISM-1546"
+          "AU-Essential-8-Patch"
         ]
       }
     ],
@@ -32940,7 +32940,7 @@
       "AU-ISM-1407": {
         "covered": true,
         "adequate": false,
-        "gap": "Mobile patching guidance does not require enforcing the current monthly Android patch level as the remediation control for Framework privilege-escalation flaws."
+        "gap": "ISM-1407 requires the latest or previous release of an operating system at Maturity Level Three, which an Android device meets while running a security patch level older than the one that fixes this flaw. The Essential Eight patch windows name workstations, servers and network devices rather than mobile devices."
       }
     },
     "compliance_exposure_score": {
@@ -33106,7 +33106,7 @@
         "gap_closes": [
           "ISO-27001-2022-A.8.8",
           "NIST-800-53-SI-2",
-          "AU-ISM-1546",
+          "AU-Essential-8-Patch",
           "NIS2-Art21-vulnerability-handling",
           "DORA-Art-9"
         ]
@@ -33156,7 +33156,7 @@
         "description": "Enforce timely remediation of CISA KEV-listed Privilege Escalation in Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage) and SD-WAN vSmart Controller across the affected 20: KEV due-date as the binding SLA, not a 30-day default.",
         "evidence": "CVE-2026-20245 — Cisco Catalyst SD-WAN Manager root command execution via improper output encoding, CISA KEV-listed with confirmed exploitation (RWEP 56). Network-management appliances sit outside the OS patch pipeline these controls assume, so the remediation tempo has to be stated for the appliance estate explicitly.",
         "gap_closes": [
-          "AU-ISM-1546",
+          "AU-Essential-8-Patch",
           "DORA-Art-9"
         ]
       }
@@ -33516,7 +33516,7 @@
         "evidence": "CVE-2026-7473 — Arista EOS tunnel-decapsulation access-control bypass via incomplete comparison, CISA KEV-listed with confirmed exploitation (RWEP 69), affecting all release trains. Arista states no software fix or upgrade path is planned, so patch_available is false: the only mitigation is MAC/IP access-control lists on the affected switches or upstream devices that drop unexpected tunnel types. The KEV deadline therefore has to be met by deploying and evidencing that ACL, which is precisely the documented-compensating-control limb of the SLA rather than a patch window.",
         "gap_closes": [
           "NIST-800-53-SI-2",
-          "AU-ISM-1546",
+          "AU-Essential-8-Patch",
           "DORA-Art-9",
           "UK-CAF-B4"
         ]
@@ -38842,12 +38842,12 @@
         "id": "NEW-CTRL-018",
         "name": "SCANNER-PAPER-COMPLIANCE-TEST",
         "description": "Every framework control cited on this entry closes on a version number, and this is the packet where that is not evidence of remediation: the live-patch note records community reports on the JoomShaper forum, post-6.6.2, that the IconsTrait.php code path may remain exploitable after the 6.6.2 patch, and states that operators should verify remediation rather than treat the version bump alone as sufficient. An extension inventory that reads SP Page Builder's reported version and marks the site patched is therefore paper compliance on this specific defect. The operational test for this product is a request rather than a version read: against a staging copy of the site, from an unauthenticated client carrying no session and no CSRF token, POST a PHP payload to SP Page Builder's asset.uploadCustomIcon task and then attempt to fetch the resulting file. The site is remediated when the upload is refused before anything is written — not when the extension reports 6.6.2. Re-run the test after every subsequent SP Page Builder update, because the packet's point is that a version bump on this exact code path has already once been reported as not closing it. Precondition: this control verifies, it does not repair. The missing session, permission and CSRF checks on the upload task are the vendor's to restore, so a site that fails the test has only the vendor's next release, or removal of the extension, as an actual fix — the test result is not itself a mitigation. And because exploitation is confirmed with a public PoC, a site passing the test today establishes nothing about whether it was already exploited before the test was run.",
-        "evidence": "Packet live_patch_notes: 'Community reports (JoomShaper forum, post-6.6.2) indicate the IconsTrait.php code path may remain exploitable after the 6.6.2 patch; operators should verify remediation rather than treat the version bump alone as sufficient.' patch_available true, live_patch_available false. attack_vector: 'An unauthenticated attacker POSTs directly to SP Page Builder's asset.uploadCustomIcon task, which accepts any file type with no session, permission, or CSRF check, then requests the uploaded PHP file to execute code and create a rogue Super User account.' Vector: 'A vulnerability in SP Page Builder for Joomla allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code.' cisa_kev true, kev_date 2026-07-07, active_exploitation 'confirmed', poc_available true, cvss 9.8, rwep_score 68, cwe_refs CWE-434. Citing gaps: ISO-27001-2022-A.8.8 Management of technical vulnerabilities, NIST-800-53-SI-2 Flaw Remediation, NIS2-Art21-vulnerability-management and AU-ISM-1546 Patch operating systems and applications.",
+        "evidence": "Live-patch note: 'Community reports (JoomShaper forum, post-6.6.2) indicate the IconsTrait.php code path may remain exploitable after the 6.6.2 patch; operators should verify remediation rather than treat the version bump alone as sufficient.' A patch is available and no live patch is available. Attack vector: 'An unauthenticated attacker POSTs directly to SP Page Builder's asset.uploadCustomIcon task, which accepts any file type with no session, permission, or CSRF check, then requests the uploaded PHP file to execute code and create a rogue Super User account.' Vector: 'A vulnerability in SP Page Builder for Joomla allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code.' CISA added it to the Known Exploited Vulnerabilities catalog on 2026-07-07. Exploitation is confirmed and a proof of concept exists. The CVSS score is 9.8, the RWEP score is 68 and the weakness is CWE-434. Citing gaps: ISO-27001-2022-A.8.8 Management of technical vulnerabilities, NIST-800-53-SI-2 Flaw Remediation, NIS2-Art21-vulnerability-management and AU-Essential-8-Patch Patch applications and patch operating systems.",
         "gap_closes": [
           "ISO-27001-2022-A.8.8",
           "NIST-800-53-SI-2",
           "NIS2-Art21-vulnerability-management",
-          "AU-ISM-1546"
+          "AU-Essential-8-Patch"
         ]
       },
       {
@@ -39242,7 +39242,7 @@
         "description": "Every enrolled iPhone and iPad must be driven to the fixed build for its own OS line by declarative device management on a KEV-tied clock, with user deferral removed. USB Restricted Mode is the only thing standing between a locked handset in someone else's hands and its data over a port that is supposed to be delivering charge only; because the attack needs physical possession rather than network reach, no perimeter rule, no VPN posture check and no conditional-access policy compensates while the device is still on a vulnerable build, and a user who postpones the update for a week is carrying an extractable device for that week. The campaign has to target four separate fixed builds (iOS/iPadOS 15.8.4, iOS/iPadOS 16.7.11, iPadOS 17.7.5, iOS/iPadOS 18.3.1) rather than a single 'update to latest', because the older lines exist precisely for hardware that cannot take the newest release.",
         "evidence": "Packet: CISA KEV-listed 2025-02-12 with active_exploitation confirmed. patch_available is true and the vendor text names the fixed builds — 'This issue is fixed in iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 18.3.1 and iPadOS 18.3.1, iPadOS 17.7.5.' The recorded exploitation path is an attacker with physical possession of a locked iOS/iPadOS device using specialized forensic-extraction hardware to disable USB Restricted Mode; Apple 'is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals.' poc_available is false and CVSS is 6.1 (RWEP 49), so a severity-threshold patch queue leaves this below the cut line even though exploitation is confirmed — which is exactly why the SLA has to key off the KEV listing, not the score.",
         "gap_closes": [
-          "AU-ISM-1546",
+          "AU-Essential-8-Patch",
           "NIS2-Art21-vulnerability-handling"
         ]
       },
@@ -39419,7 +39419,7 @@
         "description": "Windows Storage is an OS component rather than an optional server role, so the exposed population is the whole Windows fleet and there is no subset an operator can enumerate and isolate instead of updating. The exploitation precondition the packet names is standard user access — the local attacker plants a symbolic link that redirects a privileged Windows Storage file-management operation to a target of their choosing — so account-privilege policy is not a containment story here: the flaw is the thing that converts a standard user into a privileged one, which is precisely why this control says privilege policy must not be relied on to hold the line. Applied to this entry, the Windows update carrying the fix has to be driven across every affected endpoint on the clock that started with the 2025-02-11 KEV listing rather than folded into the normal monthly ring, and the packet's live_patch_available: false with no live_patch_notes has to be treated as a hard planning fact — nothing can be applied to a running endpoint, so the rollout needs restart windows for the fleet and not just a deployment ring. One scheduling signal is actively misleading on this entry: poc_available is false while active_exploitation is confirmed, so a program that gates urgency on public proof-of-concept availability will hold this at routine severity indefinitely. The distinguishing test: enumerate installed build numbers across the fleet against the fixed build for each Windows SKU in the estate and confirm zero endpoints remain below it past the KEV due date — an attestation that 'standard users are not local administrators' passes cleanly while this path stays wide open.",
         "evidence": "Packet: CISA KEV-listed 2025-02-11, active_exploitation confirmed, CVSS 7.1, RWEP 61, CWE-59. Attack path as recorded: 'A local attacker with standard user access creates a symbolic link that redirects a privileged Windows Storage file-management operation to an unintended target, allowing them to delete arbitrary files — including security event logs — and escalate privileges.' Remediation fields: patch_available true; live_patch_available false with live_patch_notes null. poc_available false, i.e. confirmed in-the-wild exploitation with no public PoC recorded.",
         "gap_closes": [
-          "AU-ISM-1546",
+          "AU-Essential-8-Patch",
           "ISO-27001-2022-A.8.8"
         ]
       }
@@ -39846,10 +39846,10 @@
         "id": "NEW-CTRL-127",
         "name": "UNSUPPORTED-NETWORK-DEVICE-ENUMERATION-AND-RETIREMENT",
         "description": "The packet's live_patch_notes carry the whole decision: a hotfix was distributed December 4, 2020, including to EOL versions 10.6.2+, but CyberoamOS is now fully end-of-life/end-of-service per CISA's required action and no further updates will be issued for remaining deployments. That makes the hotfix worth applying to any unit that never took it, and worthless as a posture — it settles this defect and leaves the next WebAdmin defect with no fix path at all. Applied to this product, the control means every surviving CyberoamOS unit carries an end-of-support date in the asset inventory together with a dated replacement decision, because the packet's exploitation path is an unauthenticated remote request to the appliance's web management surface, so reachability is the entire precondition and the inventory is what tells the operator where reachability exists. Until replacement lands, the WebAdmin surface comes off every untrusted segment. Name the precondition instead of claiming the surface is gone: that restriction holds only while it is enforced from every segment an attacker can occupy; it does not cover a unit whose WebAdmin must stay reachable for remote administration, which has to be moved behind an authenticated gateway performing its own enforcement, since the appliance's own authentication is precisely what the injection bypasses; and it does nothing for a unit that already carries an attacker-created administrator. The distinguishing test: from each untrusted segment, attempt to load WebAdmin on every inventoried unit — anything that answers is reachable by the exact request the packet describes, and a risk-acceptance record with no replacement date leaves a KEV-listed device on a retired platform in service indefinitely.",
-        "evidence": "Packet live_patch_notes, verbatim: 'A hotfix was distributed December 4, 2020 (including to EOL versions 10.6.2+), but CyberoamOS is now fully end-of-life/end-of-service per CISA's required action — no further updates will be issued for remaining deployments.' live_patch_available false. Vector: 'An SQL injection vulnerability in the WebAdmin of Cyberoam OS through 2020-12-04 allows unauthenticated attackers to execute arbitrary SQL statements remotely.' CISA KEV-listed 2025-02-06, active_exploitation confirmed, CVSS 9.8, RWEP 73. NIST-800-53-AC-3, AU-ISM-1546 and UK-CAF-B4 are recorded as citing gaps.",
+        "evidence": "A hotfix was distributed on December 4, 2020, including to end-of-life versions 10.6.2 and later, but CyberoamOS is now fully end-of-life and end-of-service per CISA's required action, and no further updates will be issued for remaining deployments. No live patch is available. The flaw is an SQL injection in the WebAdmin of Cyberoam OS through 2020-12-04 that lets unauthenticated attackers run arbitrary SQL statements remotely. CISA listed it as known exploited on 2025-02-06, exploitation is confirmed, and it scores CVSS 9.8 and RWEP 73. The NIST-800-53-AC-3, AU-Essential-8-Patch and UK-CAF-B4 gaps on this entry cite it.",
         "gap_closes": [
           "NIST-800-53-AC-3",
-          "AU-ISM-1546",
+          "AU-Essential-8-Patch",
           "UK-CAF-B4"
         ]
       }
@@ -41052,10 +41052,10 @@
         "id": "NEW-CTRL-001",
         "name": "CISA-KEV-RESPONSE-SLA",
         "description": "The interval this control has to compress on MiCollab is the one the packet measures: watchTowr's disclosure in December 2024, active exploitation of internet-facing NuPoint Unified Messaging endpoints within days of it, and the KEV listing on 2025-01-07 — days, against the change-management cycle a unified-communications platform is normally patched on, which is what this entry's flaw-remediation, internet-facing-patching and vulnerability-handling gaps each record. Applied here the requirement is an out-of-cycle emergency window rather than the next UC maintenance slot, and the population is every instance publishing the NuPoint Unified Messaging component, not only the one the asset register lists as the UC platform. The vulnerable range is the NPM component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201), with no fixed build named, so the target level has to be taken from the vendor advisory for the deployed release rather than assumed. patch_required_reboot is false, meaning no host reboot — not that the fixed code is live: live_patch_available is false and no live-patch path is recorded, so an instance counts as remediated only once the running NuPoint service is executing the fixed build. Priority follows the exploitation record rather than the CVSS band alone — a public proof-of-concept, confirmed exploitation, a KEV ransomware association, and this traversal being frequently chained with CVE-2024-55550 make it a chain-entry item rather than a standalone UC patch ticket. And the update is not the whole of remediation: an instance that was internet-facing while the exploit was public has already had provisioning and configuration data read by an unauthenticated caller, and applying the fix closes the path without recalling what was taken, so material held there needs rotation rather than being closed on the patch record.",
-        "evidence": "Packet: patch_available true; affected_versions 'NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201)' with no fixed build named; cisa_kev true with kev_date 2025-01-07; active_exploitation confirmed, notes record exploitation against internet-facing MiCollab NuPoint Unified Messaging endpoints shortly after watchTowr's December 2024 disclosure, frequent chaining with CVE-2024-55550, and a CISA KEV ransomware association; poc_available true; cvss 9.1, rwep_score 72. patch_required_reboot false, live_patch_available false, live_patch_notes null. The NIST-800-53-SI-2 gap records the disclosure-to-KEV window as days, far shorter than typical enterprise patch-SLA cycles for UC platforms; AU-ISM-1546 records exploitation within days of disclosure. The vector states the exploit allows an attacker to view, corrupt, or delete users' data and system configurations.",
+        "evidence": "Packet: patch_available true; affected_versions 'NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201)' with no fixed build named; cisa_kev true with kev_date 2025-01-07; active_exploitation confirmed, notes record exploitation against internet-facing MiCollab NuPoint Unified Messaging endpoints shortly after watchTowr's December 2024 disclosure, frequent chaining with CVE-2024-55550, and a CISA KEV ransomware association; poc_available true; cvss 9.1, rwep_score 72. patch_required_reboot false, live_patch_available false, live_patch_notes null. The NIST-800-53-SI-2 gap records the disclosure-to-KEV window as days, far shorter than typical enterprise patch-SLA cycles for UC platforms; AU-Essential-8-Patch records a 48-hour window under ISM-1876 for a deployment reachable from the internet and no Maturity Level One timeframe under ISM-1693 for one that is not. The vector states the exploit allows an attacker to view, corrupt, or delete users' data and system configurations.",
         "gap_closes": [
           "NIST-800-53-SI-2",
-          "AU-ISM-1546",
+          "AU-Essential-8-Patch",
           "NIS2-Art21-vulnerability-management",
           "ISO-27001-2022-A.8.8"
         ]
@@ -41269,11 +41269,11 @@
       {
         "id": "NEW-CTRL-001",
         "name": "CISA-KEV-RESPONSE-SLA",
-        "description": "The clock on this entry opened with the 2024-12-23 KEV listing against confirmed in-the-wild exploitation, and the remediation shape leaves no shortcut: there is a vendor patch with no live-patch path, so the only way the fix reaches a USAHERDS instance is by taking it off the affected build (through 7.4.0.1) and through the vendor update, with the service interruption that implies. For this application the control means that upgrade is scheduled against the KEV clock rather than against the general application-patching cadence the cited AU ISM 1546 and NIST SI-2 attestations are measured on — a line-of-business web application inside a periodic patch cycle is precisely the population that carried this flaw into a KEV listing years after the affected build was identified. The condition to state plainly: meeting the SLA on version alone is not sufficient remediation here, because the vulnerable primitive is a shipped secret rather than a code defect the update independently guarantees to re-key; the version move is the SLA-bearing action and the key-uniqueness verification recorded alongside it is what makes the instance actually non-forgeable. Distinguishing test: for each USAHERDS instance, compare the deployed build against the affected range and the completion date against the 2024-12-23 listing; an instance recorded as 'scheduled in the next maintenance cycle' is an accepted exposure on an actively exploited path, not a remediation.",
-        "evidence": "Packet: CISA KEV-listed 2024-12-23, active_exploitation 'confirmed', RWEP 42, CVSS 8.1. Vector places the flaw in 'Acclaim USAHERDS through 7.4.0.1'. patch_available true; live_patch_available false with live_patch_notes null, so no live-patch path is recorded for this entry. Cited gaps include NIST-800-53-SI-2 (Flaw Remediation), AU-ISM-1546 (Patch operating systems and applications), NIS2-Art21-vulnerability-management (Vulnerability handling) and UK-CAF-B4 (System security).",
+        "description": "The clock on this entry opened with the 2024-12-23 KEV listing against confirmed in-the-wild exploitation, and the remediation shape leaves no shortcut: there is a vendor patch with no live-patch path, so the only way the fix reaches a USAHERDS instance is by taking it off the affected build (through 7.4.0.1) and through the vendor update, with the service interruption that implies. For this application the control means that upgrade is scheduled against the KEV clock rather than against the general application-patching cadence the cited Essential Eight patch applications and NIST SI-2 attestations are measured on. A line-of-business web application inside a periodic patch cycle is the kind of deployment that carried this flaw into a KEV listing years after the affected build was identified. The condition to state plainly: meeting the SLA on version alone is not sufficient remediation here, because the vulnerable primitive is a shipped secret rather than a code defect the update independently guarantees to re-key; the version move is the SLA-bearing action and the key-uniqueness verification recorded alongside it is what makes the instance actually non-forgeable. Distinguishing test: for each USAHERDS instance, compare the deployed build against the affected range and the completion date against the 2024-12-23 listing; an instance recorded as 'scheduled in the next maintenance cycle' is an accepted exposure on an actively exploited path, not a remediation.",
+        "evidence": "Packet: CISA KEV-listed 2024-12-23, active_exploitation 'confirmed', RWEP 42, CVSS 8.1. Vector places the flaw in 'Acclaim USAHERDS through 7.4.0.1'. patch_available true; live_patch_available false with live_patch_notes null, so no live-patch path is recorded for this entry. Cited gaps include NIST-800-53-SI-2 (Flaw Remediation), AU-Essential-8-Patch (Patch applications and patch operating systems), NIS2-Art21-vulnerability-management (Vulnerability handling) and UK-CAF-B4 (System security).",
         "gap_closes": [
           "NIST-800-53-SI-2",
-          "AU-ISM-1546",
+          "AU-Essential-8-Patch",
           "NIS2-Art21-vulnerability-management",
           "UK-CAF-B4"
         ]
@@ -43444,10 +43444,10 @@
         "adequate": false,
         "gap": "Bypassing shouldHideDocument() grants an app filesystem reach beyond its declared, least-functionality scope inside the OS content-provider layer."
       },
-      "AU-ISM-1546": {
-        "covered": true,
+      "AU-Essential-8-Patch": {
+        "covered": false,
         "adequate": false,
-        "gap": "The ISM's patch-timeframe control for extreme-risk vulnerabilities is difficult to meet given fragmented Android OEM patch-distribution timelines."
+        "gap": "The Essential Eight patch strategies do not include handset operating systems; ISM-1878, outside the maturity profiles, sets 48 hours from release for this exploited flaw. The fix spans five Android versions and needs a restart, and each handset's window starts only when a build for that device is released."
       }
     },
     "new_control_requirements": [
@@ -43457,7 +43457,7 @@
         "description": "The defect is in the Android Framework's own filter: shouldHideDocument() in ExternalStorageProvider.java decides which directories a document request may reach, and incorrect Unicode normalization lets a normalized path walk past that decision. There is no provider to disable and no setting that re-closes the filter, so a handset is either on a build carrying the fix or it is exposed. On an Android estate that makes the Android security patch level an access condition rather than a dashboard column: an enrolled handset below the level carrying this Framework fix is denied mail, VPN and document access, instead of being flagged non-compliant while its mail keeps syncing. The install-restriction half of this control carries unusual weight for this CVE, because the entire exploitation path sits behind an application the attacker controls - the crafted path arrives at shouldHideDocument() from a malicious or compromised app already on the device - so restricting installs to a managed catalogue and blocking side-loading removes the most common way that app arrives. Precondition, and it must be stated rather than assumed: install policy does not evict an app already on the handset, and the packet's own wording covers a compromised app, one that arrived legitimately and turned, which no install allowlist would have stopped. A handset suspected of already running such an app belongs on the incident path, with rotation of any credential reachable through the directories the filter was protecting, not on the install-policy path; and the lever is unavailable entirely on an estate that permits personal-profile installs. Distinguishing test: enrol a handset pinned below the fixing security patch level and confirm the access policy actually denies it the protected resources - an estate that surfaces the stale patch level in a report while the device keeps its access has recorded the exposure, not removed it. This is a holding measure for the window before the fixed build reaches the model; the packet registers a vendor patch and no live-patch path, so nothing short of the device taking that build closes the filter.",
         "evidence": "Packet vector: 'In shouldHideDocument of ExternalStorageProvider.java, there is a possible bypass of a file path filter designed to prevent access to sensitive directories due to incorrect unicode normalization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.' attack_vector: 'A malicious or compromised app on the device supplies a Unicode-normalized path to ExternalStorageProvider's shouldHideDocument() filter, bypassing the restricted-directory check to reach files it should not be able to access, escalating local privileges with user interaction required.' CWE-176. cisa_kev true, kev_date 2024-11-07, active_exploitation confirmed, CVSS 7.3, RWEP 57, poc_available false, ai_discovered false. patch_available true, live_patch_available false, live_patch_notes null - a vendor fix exists with no live-patch path, and no restart or reboot requirement is recorded.",
         "gap_closes": [
-          "AU-ISM-1546",
+          "AU-Essential-8-Patch",
           "ISO-27001-2022-A.8.9",
           "NIST-800-53-CM-7"
         ]
@@ -43786,7 +43786,7 @@
         "description": "The affected device is the remote-access concentrator itself - Cisco ASA and FTD terminating the RAVPN service - so what fails is the trust boundary's availability rather than code execution on it, and that is precisely what routes this CVE into the wrong tier. At CVSS 5.8 it lands in the medium queue most estates service on a 30- or 90-day cycle, while CISA KEV listed it on 2024-10-24, with confirmed in-the-wild exploitation and RWEP 57. Bound to this product, the tier means the Cisco software update is scheduled against the KEV clock and not the next appliance-maintenance window, because an unauthenticated attacker who exhausts RAVPN resources removes remote access for the entire remote workforce and, per the packet, may leave the device requiring a reload before that service returns. Precondition, and it removes the alternative this tier normally offers: the tier permits isolating the vulnerable interface in place of patching to the clock, and that option does not exist here - the RAVPN service exists to accept connections from unauthenticated clients on the public internet, so there is no source restriction that leaves the service usable. Narrowing which addresses may reach it is available only to an estate whose remote users all originate from a fixed set of ranges; for everyone else the clock is the only lever. The note that services unrelated to VPN are unaffected should not be read as bounding the impact either, because for a remote workforce the VPN service is the access path. Distinguishing test: pull the remediation date recorded against this CVE and compare it to 2024-10-24 rather than to the ticket's CVSS-derived due date - a vulnerability-management attestation reporting that the medium-severity SLA was met is the specific way this one is missed.",
         "evidence": "Packet vector: 'A vulnerability in the Remote Access VPN (RAVPN) service of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) of the RAVPN service... This vulnerability is due to resource exhaustion... Depending on the impact of the attack, a reload of the device may be required to restore the RAVPN service. Services that are not related to VPN are not affected.' CWE-772. cisa_kev true, kev_date 2024-10-24, active_exploitation confirmed, CVSS 5.8, RWEP 57, poc_available false, ai_discovered false. patch_available true, live_patch_available false, live_patch_notes null.",
         "gap_closes": [
-          "AU-ISM-1546",
+          "AU-Essential-8-Patch",
           "NIS2-Art21-network-security"
         ]
       },
@@ -45115,12 +45115,12 @@
       {
         "id": "NEW-CTRL-122",
         "name": "EOL-ASSET-DECOMMISSION",
-        "description": "The packet supplies both facts this control turns on: a vendor fix exists — Ivanti CSA 4.6 Patch 519 — and the 4.6 branch itself is recorded as End-of-Life, with the NIS2, ISO, AU-ISM and UK-CAF gaps each stating in their own vocabulary that there is no supported remediation path beyond migration. So for this product a unit that reaches Patch 519 is fixed for this specific path traversal and holds no security-update path for anything found in that branch afterward: Patch 519 is the interim state and removal of the 4.6 appliance is the terminal one. In operational terms, inventory every Ivanti Cloud Services Appliance in service with its branch and patch level; put any unit below Patch 519 on the clock that opened with the 2024-09-19 KEV listing against CISA's 2024-10-10 due date; and put every 4.6 unit, including those that reach Patch 519, on a dated migration schedule off the branch — a risk acceptance with no removal date leaves an internet-facing appliance with a public PoC and confirmed exploitation in service indefinitely, and it is precisely what lets a patch-compliance report mark this estate clean. Scope the inventory to what the packet names: the CSA appliance, its broker web server and its PHP CGI path handling. The packet ties the URL-decoding-order defect to that appliance and gives no mapping into other Ivanti products, so sweeping the wider estate as instances of this CVE manufactures replacement work against software no evidence implicates. Precondition on the interim half: patch_required_reboot is true and no live-patch path is recorded, so a unit that has taken Patch 519 without the restart is still executing the vulnerable code and counts as exposed. And because exploitation is confirmed and the packet describes webshells and reverse-shell implants deployed through this appliance, a unit that was internet-reachable while unpatched is not made clean by either the patch or the migration on its own — its disposition is rebuild and credential rotation, not a configuration carried forward onto its replacement.",
-        "evidence": "affected_versions: 'Ivanti CSA 4.6.x before Patch 519 (branch now End-of-Life)'; patch_available true, patch_required_reboot true, live_patch_available false, live_patch_notes null; cisa_kev true, kev_date 2024-09-19, active_exploitation_notes 'CISA KEV added 2024-09-19 (due 2024-10-10)'; NIS2-Art21-vulnerability-handling gap: 'Ivanti CSA 4.6 was already flagged End-of-Life when the flaw was disclosed, leaving organizations with no vendor-supported patch path other than full migration'; AU-ISM-1546 gap: control 1546 'cannot be satisfied for a product the vendor states will receive no further security updates'; ISO-27001-2022-A.8.8 gap: 'an EOL appliance falls outside normal patch-remediation SLAs, requiring a decommission/migration control instead of a patch cycle'; UK-CAF-B4 gap: 'running an EOL CSA 4.6 branch in production is itself a CAF B4 gap independent of this specific CVE'; affected: the CSA 'broker' web server and PHP CGI path-handling; poc_available true; active_exploitation_notes record webshells and reverse-shell implants deployed on internet-facing CSA appliances by suspected nation-state actors chaining CVE-2024-8190.",
+        "description": "Two facts decide this control: a vendor fix exists (Ivanti CSA 4.6 Patch 519), and the 4.6 branch itself is End-of-Life, with the NIS2, ISO, Essential Eight and UK-CAF gaps each stating in their own vocabulary that there is no supported remediation path beyond migration. So for this product a unit that reaches Patch 519 is fixed for this specific path traversal and holds no security-update path for anything found in that branch afterward: Patch 519 is the interim state and removal of the 4.6 appliance is the terminal one. In operational terms, inventory every Ivanti Cloud Services Appliance in service with its branch and patch level; put any unit below Patch 519 on the clock that opened with the 2024-09-19 KEV listing against CISA's 2024-10-10 due date; and put every 4.6 unit, including those that reach Patch 519, on a dated migration schedule off the branch. A risk acceptance with no removal date leaves an internet-facing appliance with a public PoC and confirmed exploitation in service indefinitely, and it is precisely what lets a patch-compliance report mark this estate clean. Scope the inventory to what this entry names: the CSA appliance, its broker web server and its PHP CGI path handling. The entry ties the URL-decoding-order defect to that appliance and gives no mapping into other Ivanti products, so sweeping the wider estate as instances of this CVE manufactures replacement work against software no evidence implicates. Precondition on the interim half: the fix requires a reboot and no live patch is recorded, so a unit that has taken Patch 519 without the restart is still executing the vulnerable code and counts as exposed. And because exploitation is confirmed and webshells and reverse-shell implants were deployed through this appliance, a unit that was internet-reachable while unpatched is not made clean by either the patch or the migration on its own. Its disposition is a rebuild and credential rotation, not a configuration carried forward onto its replacement.",
+        "evidence": "affected_versions: 'Ivanti CSA 4.6.x before Patch 519 (branch now End-of-Life)'; patch_available true, patch_required_reboot true, live_patch_available false, live_patch_notes null; cisa_kev true, kev_date 2024-09-19, active_exploitation_notes 'CISA KEV added 2024-09-19 (due 2024-10-10)'; NIS2-Art21-vulnerability-handling gap: 'Ivanti CSA 4.6 was already flagged End-of-Life when the flaw was disclosed, leaving organizations with no vendor-supported patch path other than full migration'; AU-Essential-8-Patch gap: 'the 4.6 branch is End-of-Life with no further security updates, so ISM-1501 then requires the appliance's unsupported operating system to be replaced, with no deadline'; ISO-27001-2022-A.8.8 gap: 'an EOL appliance falls outside normal patch-remediation SLAs, requiring a decommission/migration control instead of a patch cycle'; UK-CAF-B4 gap: 'running an EOL CSA 4.6 branch in production is itself a CAF B4 gap independent of this specific CVE'; affected: the CSA 'broker' web server and PHP CGI path-handling; poc_available true; active_exploitation_notes record webshells and reverse-shell implants deployed on internet-facing CSA appliances by suspected nation-state actors chaining CVE-2024-8190.",
         "gap_closes": [
           "NIS2-Art21-vulnerability-handling",
           "ISO-27001-2022-A.8.8",
-          "AU-ISM-1546",
+          "AU-Essential-8-Patch",
           "UK-CAF-B4"
         ]
       },
@@ -45137,11 +45137,11 @@
       {
         "id": "NEW-CTRL-030",
         "name": "PERIMETER-DEVICE-ZERODAY-SLA-TIER",
-        "description": "The CSA is itself the boundary this flaw defeats, which is what the boundary-protection gap on this entry says: the control assumes the appliance correctly parses and enforces path restrictions at its network edge, and the URL-decoding-order bug smuggled traversal past that parser entirely. A defect of that shape on a device that IS the trust boundary does not belong in a severity-keyed patch timeframe — which is the second gap here, since the Australian ISM control prescribes timeframes based on severity and cannot deliver them for this product at all past Patch 519. The requirement for this appliance is a distinct tier: an unauthenticated-reachable defect on the CSA is mitigated within hours of the KEV listing rather than within a 14- or 30-day window, measured against CISA's 2024-10-10 due date on a 2024-09-19 listing, and the tier must state its own exit condition — for an End-of-Life branch that condition is migration, not a patch level. Precondition, and this is where this control is most often over-claimed: the alternative the tier normally offers — isolate the vulnerable interface — is not generally available here. The packet's exploited population is internet-facing CSA appliances, so restricting who can send the %3F-encoded request works only where the set of legitimate client addresses is enumerable and can be enforced ahead of the appliance; where the appliance must stay reachable from untrusted networks there is no segment that removes the path, and recording a reachability restriction as the mitigation while the broker web server still answers the internet leaves the flaw fully exploitable. Under those conditions the tier's only honest exit is the migration the decommission requirement describes.",
-        "evidence": "NIST-800-53-SC-7 gap: 'SC-7 boundary protection assumes the appliance correctly parses and enforces path restrictions at its network edge; the URL-decoding-order bug let attackers smuggle traversal past the boundary parser entirely'; AU-ISM-1546 gap: 'ISM control 1546 (patching within timeframes based on severity) cannot be satisfied for a product the vendor states will receive no further security updates'; vector: remote unauthenticated attacker accesses restricted functionality in Ivanti CSA before 4.6 Patch 519; active_exploitation_notes: KEV added 2024-09-19 (due 2024-10-10), exploitation against internet-facing CSA appliances; affected: the CSA 'broker' web server and PHP CGI path-handling allowing unauthenticated access to restricted administrative functionality; affected_versions: CSA 4.6.x before Patch 519, branch now End-of-Life; cvss 9.4, rwep_score 76, poc_available true, patch_required_reboot true, live_patch_available false.",
+        "description": "The CSA is itself the boundary this flaw defeats, which is what the boundary-protection gap on this entry says: the control assumes the appliance correctly parses and enforces path restrictions at its network edge, and the URL-decoding-order bug smuggled traversal past that parser entirely. A defect of that shape on a device that IS the trust boundary does not belong in a severity-keyed patch timeframe, which is the second gap here, since the Essential Eight patching controls set their timeframes from the vendor's release and cannot deliver them for this product at all past Patch 519. The requirement for this appliance is a distinct tier: an unauthenticated-reachable defect on the CSA is mitigated within hours of the KEV listing rather than within a 14- or 30-day window, measured against CISA's 2024-10-10 due date on a 2024-09-19 listing, and the tier must state its own exit condition. For an End-of-Life branch that condition is migration, not a patch level. Precondition, and this is where this control is most often over-claimed: the alternative the tier normally offers, isolating the vulnerable interface, is not generally available here. The exploited population is internet-facing CSA appliances, so restricting who can send the %3F-encoded request works only where the set of legitimate client addresses is enumerable and can be enforced ahead of the appliance; where the appliance must stay reachable from untrusted networks there is no segment that removes the path, and recording a reachability restriction as the mitigation while the broker web server still answers the internet leaves the flaw fully exploitable. Under those conditions the tier's only honest exit is the migration the decommission requirement describes.",
+        "evidence": "NIST-800-53-SC-7 gap: 'SC-7 boundary protection assumes the appliance correctly parses and enforces path restrictions at its network edge; the URL-decoding-order bug let attackers smuggle traversal past the boundary parser entirely'; AU-Essential-8-Patch gap: 'ISM-1877 requires the fix within 48 hours of release at every Essential Eight maturity level when a working exploit exists' and 'the 4.6 branch is End-of-Life with no further security updates'; vector: remote unauthenticated attacker accesses restricted functionality in Ivanti CSA before 4.6 Patch 519; active_exploitation_notes: KEV added 2024-09-19 (due 2024-10-10), exploitation against internet-facing CSA appliances; affected: the CSA 'broker' web server and PHP CGI path-handling allowing unauthenticated access to restricted administrative functionality; affected_versions: CSA 4.6.x before Patch 519, branch now End-of-Life; cvss 9.4, rwep_score 76, poc_available true, patch_required_reboot true, live_patch_available false.",
         "gap_closes": [
           "NIST-800-53-SC-7",
-          "AU-ISM-1546"
+          "AU-Essential-8-Patch"
         ]
       }
     ]
@@ -45645,7 +45645,7 @@
         "evidence": "Packet entry 'SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability' (CWE-918), cisa_kev true with kev_date 2026-07-14 and active_exploitation 'confirmed'; cvss 10, rwep_score 61, poc_available false, ai_discovered false. Vector: 'A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could potentially cause the appliance to make requests to unintended location.' patch_available true, live_patch_available false, live_patch_notes: 'No live-patching primitive for this product; the vendor update requires a reboot and is the remediation.'",
         "gap_closes": [
           "NIST-800-53-SI-2",
-          "AU-ISM-1546",
+          "AU-Essential-8-Patch",
           "UK-CAF-B4"
         ]
       },
@@ -47050,12 +47050,12 @@
         "id": "NEW-CTRL-134",
         "name": "DEVICE-MANAGEMENT-GATEWAY-CONFIG-ENDPOINT-AUTH-INPUT-NEUTRALIZATION",
         "description": "VigorConnect is the device-management platform the packet names and the defect sits directly on its API surface: the DownloadFileServlet endpoint performs a file download with root privileges, with no path sanitization, for a caller that never authenticates. Bound to this product, the control means that endpoint authorizes its caller before any file is opened, and resolves the requested path to a canonical absolute form and verifies the result is still under the intended download root — rejecting absolute paths, ../ sequences and symlinks that leave the root — with the check performed before the file handle is opened rather than by filtering the request string; and that no VigorConnect instance is left with its web interface reachable from the public internet or from any segment with no operational need to manage DrayTek devices. Note the direction, because it is where this differs from the upload-side case the control is usually written against: the primitive here is read, so containment has to be enforced on the download path, and because the servlet runs as root an unbounded read returns every file on the host — on a network-management server that is where its configuration and credential material lives, which is what the campaign took. This is also why the flaw is reachable with no account at all: the attacker never holds a VigorConnect operator identity, so per-account privilege scoping is never consulted and an access-control attestation passes cleanly while the path stays open. Distinguishing test: from an external address and from a general user VLAN, send DownloadFileServlet an unauthenticated request whose path resolves outside the intended download root against a staging instance, and confirm it is refused before anything is read. Precondition: the endpoint-side authorization and path canonicalization are properties the vendor update establishes — this control states what to verify, it does not implement it. Until that update is running, restricting which networks can reach the VigorConnect web interface bounds who can send the request but leaves the endpoint fully exploitable to anything inside a permitted segment, and that lever is unavailable wherever the portal must stay reachable for remote device management.",
-        "evidence": "`affected` records DrayTek VigorConnect network management software with the DownloadFileServlet endpoint performing unauthenticated file download with root privileges and no path sanitization; affected_versions gives VigorConnect 1.6.0-B3 and earlier. attack_vector records an unauthenticated attacker sending a crafted request with directory-traversal sequences, causing VigorConnect to return arbitrary files from the OS with root privileges. active_exploitation_notes record a global campaign against DrayTek devices in which unauthenticated attackers abuse this path traversal to read arbitrary files such as credentials as root from internet-exposed VigorConnect management servers. The NIST-800-53-SC-7 gap states boundary protection is insufficient when the management interface is deliberately internet-exposed; the NIS2-Art21-network-security gap that network-security measures do not mandate isolating device-management portals from untrusted networks; the UK-CAF-B4 gap that the system-security principle does not require keeping the VigorConnect management portal off untrusted networks; the AU-ISM-1546 gap that internet-facing service hardening guidance is not enforced strongly enough to keep an unauthenticated file-read endpoint off the public edge. CISA KEV 2024-09-03, active_exploitation confirmed, poc_available true, CVSS 7.5, RWEP 64.",
+        "evidence": "`affected` records DrayTek VigorConnect network management software with the DownloadFileServlet endpoint performing unauthenticated file download with root privileges and no path sanitization; affected_versions gives VigorConnect 1.6.0-B3 and earlier. attack_vector records an unauthenticated attacker sending a crafted request with directory-traversal sequences, causing VigorConnect to return arbitrary files from the OS with root privileges. active_exploitation_notes record a global campaign against DrayTek devices in which unauthenticated attackers abuse this path traversal to read arbitrary files such as credentials as root from internet-exposed VigorConnect management servers. The NIST-800-53-SC-7 gap states boundary protection is insufficient when the management interface is deliberately internet-exposed; the NIS2-Art21-network-security gap that network-security measures do not mandate isolating device-management portals from untrusted networks; the UK-CAF-B4 gap that the system-security principle does not require keeping the VigorConnect management portal off untrusted networks; the AU-Essential-8-Patch gap that internet-exposed VigorConnect servers are online services under ISM-1876, with 48 hours from release at every maturity level, while internal-only servers fall under ISM-1693 from Maturity Level Two. CISA KEV 2024-09-03, active_exploitation confirmed, poc_available true, CVSS 7.5, RWEP 64.",
         "gap_closes": [
           "NIST-800-53-SC-7",
           "NIS2-Art21-network-security",
           "UK-CAF-B4",
-          "AU-ISM-1546"
+          "AU-Essential-8-Patch"
         ]
       },
       {
@@ -47292,13 +47292,13 @@
         "id": "NEW-CTRL-134",
         "name": "DEVICE-MANAGEMENT-GATEWAY-CONFIG-ENDPOINT-AUTH-INPUT-NEUTRALIZATION",
         "description": "Versa Director is an SD-WAN orchestrator and this defect sits on a file-accepting function of its management GUI: the packet's vector places it in the 'Change Favicon' option, where a malicious file ending in .png is accepted as an image and executed, enabling web-shell deployment (CWE-434). Bound to this product the control means the Change Favicon path — and every other upload endpoint on the Director GUI — decides what a file actually is before storing it anywhere the server will execute from, rather than treating the extension as a content claim; and that no Director instance is left with its management interface reachable from a network with no operational need to reach it. The packet is specific on that second half: Versa's own guidance was to firewall management ports 4566 and 4570, many operators left them internet-reachable, and observed intrusions reached those exposed management ports before the upload. Note which half of this control is load-bearing here, because it differs from the unauthenticated cases in this class: the packet's stated precondition is a successfully authenticated Provider-Data-Center-Admin or Provider-Data-Center-System-Admin session, and tenant-level users do not hold the privilege — so the endpoint's authorization decision is present and functioning, and it is the content validation that fails. Distinguishing test: on a staging Director, upload a file whose contents are a JSP payload and whose name ends in .png through Change Favicon and confirm it is rejected on content rather than accepted on extension; then, from a general corporate segment and from an external address, attempt to reach ports 4566 and 4570 and confirm nothing answers. Precondition: the content-validation repair is what the vendor update delivers — that update is the remediation, with a reboot required and no live-patching primitive for this product — so until each Director has been taken through it and restarted, firewalling the management ports bounds who can present the upload but leaves the path fully usable to anything inside a permitted segment and to any account that legitimately administers the Director. Scope the version check from the affected list rather than from the current release train: it names builds below 22.1.4 together with 21.2.3, 22.1.2 and 22.1.3, so a 21.2.x Director is in scope alongside the 22.1.x fleet and an estate that inventories only its 22.1 line will report clean while an older orchestrator stays exposed.",
-        "evidence": "Catalog facts only: CWE-434; vector describing the Change Favicon option available only to Provider-Data-Center-Admin or Provider-Data-Center-System-Admin, tenant-level users excluded, with a malicious file 'ending with .png extension to masquerade as image file' and exploitation 'possible only after a user with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin has successfully authenticated and logged in'; affected naming the Change Favicon upload where a malicious .png can be 'uploaded and executed, enabling web-shell deployment'; affected_versions '< 22.1.4', '21.2.3', '22.1.2', '22.1.3'; the SC-7 gap \"Versa's own guidance was to firewall management ports 4566/4570, but many operators left them internet-reachable; the boundary control was available yet not enforced, enabling the initial upload\"; the ISO A.8.9 gap 'Configuration management did not restrict management-plane exposure of the Director appliance'; the AU-ISM-1546 gap 'The ISM control for restricting web-application file uploads was not applied to the appliance's admin UI'; the SI-2 gap 'Zero-day exploitation preceded any patch by months ... so compensating network controls were the only defense'; attack_vector 'in observed intrusions attackers reached the exposed management ports'; patch_available true, patch_required_reboot true, live_patch_notes 'No live-patching primitive for this product; the vendor update requires a reboot and is the remediation'.",
+        "evidence": "Catalog facts only: CWE-434; vector describing the Change Favicon option available only to Provider-Data-Center-Admin or Provider-Data-Center-System-Admin, tenant-level users excluded, with a malicious file 'ending with .png extension to masquerade as image file' and exploitation 'possible only after a user with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin has successfully authenticated and logged in'; affected naming the Change Favicon upload where a malicious .png can be 'uploaded and executed, enabling web-shell deployment'; affected_versions '< 22.1.4', '21.2.3', '22.1.2', '22.1.3'; the SC-7 gap \"Versa's own guidance was to firewall management ports 4566/4570, but many operators left them internet-reachable; the boundary control was available yet not enforced, enabling the initial upload\"; the ISO A.8.9 gap 'Configuration management did not restrict management-plane exposure of the Director appliance'; the AU-Essential-8-Patch gap 'The update requires a reboot and no live-patching option exists, so each Director stays exposed until it restarts on the fixed build'; the SI-2 gap 'Zero-day exploitation preceded any patch by months ... so compensating network controls were the only defense'; attack_vector 'in observed intrusions attackers reached the exposed management ports'; patch_available true, patch_required_reboot true, live_patch_notes 'No live-patching primitive for this product; the vendor update requires a reboot and is the remediation'.",
         "gap_closes": [
           "NIST-800-53-SC-7",
           "NIST-800-53-SI-2",
           "NIS2-Art21-network-security",
           "ISO-27001-2022-A.8.9",
-          "AU-ISM-1546"
+          "AU-Essential-8-Patch"
         ]
       },
       {
@@ -47553,7 +47553,7 @@
         "id": "NEW-CTRL-001",
         "name": "CISA-KEV-RESPONSE-SLA",
         "description": "The remediation for this entry is the Dahua firmware fix, and the packet is explicit that it cannot be applied live: live_patch_available is false and live_patch_notes record that the vendor update requires a reboot and is the remediation. A camera or NVR that has received firmware but has not restarted onto it is still running the bypassable login path and is counted as exposed, not as patched — on camera fleets that restart is the step most often skipped, because taking it drops recording and live view, and a deferral recorded as patched is the specific way this remediation goes wrong. Scope comes from the affected field rather than the CVE's headline product: Dahua IP cameras, NVRs and OEM-rebranded devices are all in scope, so an inventory keyed on the vendor name reports clean across an estate standardised on a rebrand, and the recorders are as much in scope as the cameras they hold. The fixed level is per-model — affected versions are the builds prior to the fixes listed in Dahua advisory 957 — so each model, and each rebranded equivalent, is checked against the fixed build for that model rather than against one estate-wide firmware number, and for a rebranded unit the fixed build has to be obtained from whoever ships that unit's firmware rather than assumed from the Dahua model it derives from. The clock is the 2024-08-21 KEV listing, and the packet's exposure note is why this cannot ride the normal cadence: EPSS near 0.999 with mass scanning and botnet exploitation of internet-exposed units, against a flaw whose fix has been available since well before the listing. The patch requirement is also the only closure for the authentication side: an alternate login path built into the firmware is not something gateway or authentication hardening guidance can compensate for, so reaching the fixed build is the control, not a supplement to it.",
-        "evidence": "live_patch_notes: 'No live-patching primitive for this product; the vendor update requires a reboot and is the remediation.' patch_required_reboot true; live_patch_available false; patch_available true. affected: 'Dahua IP cameras, NVRs and OEM-rebranded devices — authentication bypass during login when the client specifies the NetKeyboard type argument.' affected_versions: 'Multiple Dahua camera/NVR firmware builds prior to the fixes listed in Dahua advisory 957.' CISA KEV listing 2024-08-21; active_exploitation 'confirmed'; poc_available true; CVSS 9.8; RWEP 77. active_exploitation_notes: 'EPSS ~0.999 reflects mass scanning and botnet exploitation of internet-exposed Dahua cameras and OEM-rebranded devices.' The packet's ISO-27001-2022-A.8.8 gap: 'Technical-vulnerability management often excludes long-lived IP-camera firmware from the patch scope, so the flaw persists for years.' The AU-ISM-1546 gap: 'Gateway/authentication hardening guidance does not account for firmware that ships an alternate auth path bypassing the primary check.'",
+        "evidence": "Dahua's vendor update requires a reboot and is the remediation; no live patch exists. The flaw affects Dahua IP cameras, NVRs and OEM-rebranded devices: login skips authentication when the client specifies the NetKeyboard type argument, in firmware builds before the fixes listed in Dahua advisory 957. CISA listed it as known exploited on 2024-08-21, exploitation is confirmed, a proof of concept exists, and it scores CVSS 9.8 and RWEP 77. An EPSS score near 0.999 reflects mass scanning and botnet exploitation of internet-exposed devices. Technical vulnerability management often leaves long-lived camera firmware out of the patch scope. ISM-1546, which requires users to be authenticated before they are granted access to a system and its resources, governs how the organization configures authentication rather than the vendor's login code, so a device can pass an assessment while botnets exploit it.",
         "gap_closes": [
           "ISO-27001-2022-A.8.8",
           "AU-ISM-1546"
@@ -49518,10 +49518,10 @@
       }
     },
     "framework_coverage": {
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "Mobile-device patching guidance cannot close a firmware logic flaw until the OEM update lands, so the control is insufficient against active zero-day use."
+        "gap": "The ISM sets 48 hours from release for this Pixel update when a working exploit exists (ISM-1878, outside the Essential Eight profiles, with the firmware under ISM-1903 at Maturity Level Three only). Exploitation began before the fix was released, and the update takes effect only after a reboot that no timeframe requires."
       }
     },
     "new_control_requirements": [
@@ -49529,11 +49529,11 @@
         "id": "NEW-CTRL-056",
         "name": "MOBILE-ENDPOINT-MDM-ENFORCED-KEV-SLA",
         "description": "Pixel handsets take this fix as a vendor update that requires a reboot, with no live-patch path, so remediation is the update plus a restart on every affected device — and on a handset both steps sit with the user unless enrolment makes them mandatory. For this CVE the control means the update policy on managed Pixel devices is enforced rather than advisory: automatic installation of the security update, a mandated restart window, user deferral disallowed, and completion measured by the security patch level each device reports after it has restarted rather than by 'update pushed' or 'update downloaded'. The restart is the specific step that goes wrong here — the packet ties remediation to a reboot, so a Pixel that has taken the update and not restarted still runs the vulnerable code, and counting it as patched is how this remediation is recorded complete while the exposure stands. Priority follows the packet rather than the 7.8 base score: confirmed in-the-wild exploitation and a public PoC against an escalation that needs no additional execution privileges, on a device class that leaves the managed network every day. Precondition: enforcement reaches only devices the estate actually manages. An unenrolled or personally-owned Pixel carrying organizational data is outside this control's reach entirely, and is remediated by enrolling it or withdrawing the data from it, not by leaving it uncounted on a compliance report. And the update does nothing about a device already exploited during the window before it landed — with exploitation confirmed, a device on which the crafted application ran belongs on the incident path rather than being closed on its new patch level.",
-        "evidence": "The packet describes a logic-error bypass leading to local escalation of privilege with no additional execution privileges needed, and states that user interaction is needed for exploitation; the attack path is a locally present, crafted application escalating from an unprivileged context to system-level privileges on Pixel firmware / the Android Framework (CWE-670, CWE-783). CISA KEV-listed 2024-06-13, active_exploitation confirmed, poc_available true, CVSS 7.8, RWEP 73. patch_available is true, live_patch_available is false, and live_patch_notes states: \"No live-patching primitive for this product; the vendor update requires a reboot and is the remediation.\" NIS2-Art21-patch-management, NIST-800-53-SI-2, AU-ISM-1546 and ISO-27001-2022-A.8.8 are cited as the insufficient controls.",
+        "evidence": "The packet describes a logic-error bypass leading to local escalation of privilege with no additional execution privileges needed, and states that user interaction is needed for exploitation; the attack path is a locally present, crafted application escalating from an unprivileged context to system-level privileges on Pixel firmware / the Android Framework (CWE-670, CWE-783). CISA KEV-listed 2024-06-13, active_exploitation confirmed, poc_available true, CVSS 7.8, RWEP 73. patch_available is true, live_patch_available is false, and live_patch_notes states: \"No live-patching primitive for this product; the vendor update requires a reboot and is the remediation.\" NIS2-Art21-patch-management, NIST-800-53-SI-2, AU-Essential-8-Patch and ISO-27001-2022-A.8.8 are cited as the insufficient controls.",
         "gap_closes": [
           "NIS2-Art21-patch-management",
           "NIST-800-53-SI-2",
-          "AU-ISM-1546",
+          "AU-Essential-8-Patch",
           "ISO-27001-2022-A.8.8"
         ]
       },
@@ -49928,11 +49928,11 @@
         "id": "NEW-CTRL-132",
         "name": "INDEPENDENT-INTEGRITY-VERIFICATION-OF-SIGNED-VENDOR-INSTALLERS",
         "description": "The defect here is not in JAVS Viewer's code — it is that the installer users pulled from the vendor's own supply chain, Viewer Setup 8.3.7.250-1, contained a malicious binary and was signed with an unexpected Authenticode signature. A signature check on that download returns a valid answer to the wrong question: the file is signed, and signed by a certificate the installing organization never established as this vendor's. Bound to this product, the control means JAVS Viewer builds are not installed onto courtroom recording hosts straight from the vendor download page, but pulled into managed software distribution and checked against an integrity source independent of the download itself — a vendor-published per-release hash obtained over a separate channel, or the signer identity pinned to the certificate the vendor's prior releases carried — before any endpoint is permitted to run them. Distinguishing test: take the version string and the Authenticode signer of the JAVS Viewer build actually installed on each recording host and compare the signer against the pinned vendor identity, not merely against \"signed and trusted\" — a software-installation policy that requires signed installers accepts 8.3.7.250-1 without complaint, which is precisely what happened. Precondition: this control governs the intake decision and gives nothing to a host that already ran the trojanized installer. That installer dropped fffmpeg.exe, beaconed to a C2 server and executed unauthorized PowerShell to grant attacker control of the host, so a host that installed 8.3.7 is an incident — installing the vendor's clean build over the top does not remove what the attacker placed or revoke what it already took.",
-        "evidence": "Packet vector: \"Justice AV Solutions Viewer Setup 8.3.7.250-1 contains a malicious binary when executed and is signed with an unexpected authenticode signature. A remote, privileged threat actor may exploit this vulnerability to execute of unauthorized PowerShell commands.\" attack_vector: \"Users downloaded a trojanized JAVS Viewer 8.3.7 installer from the vendor's supply chain; the installer dropped a malicious fffmpeg.exe that beaconed to a C2 server and executed unauthorized PowerShell, granting attacker control of the courtroom recording host.\" CWE-506 (embedded malicious code); cisa_kev true, kev_date 2024-05-29; active_exploitation \"confirmed\"; CVSS 8.7; RWEP 42; poc_available false. Citing gaps NIST-800-53-SI-3 (Malicious Code Protection), ISO-27001-2022-A.8.7 (Protection against malware) and AU-ISM-1546 (Patch operating systems and applications).",
+        "evidence": "Packet vector: \"Justice AV Solutions Viewer Setup 8.3.7.250-1 contains a malicious binary when executed and is signed with an unexpected authenticode signature. A remote, privileged threat actor may exploit this vulnerability to execute of unauthorized PowerShell commands.\" attack_vector: \"Users downloaded a trojanized JAVS Viewer 8.3.7 installer from the vendor's supply chain; the installer dropped a malicious fffmpeg.exe that beaconed to a C2 server and executed unauthorized PowerShell, granting attacker control of the courtroom recording host.\" CWE-506 (embedded malicious code); cisa_kev true, kev_date 2024-05-29; active_exploitation \"confirmed\"; CVSS 8.7; RWEP 42; poc_available false. Citing gaps NIST-800-53-SI-3 (Malicious Code Protection), ISO-27001-2022-A.8.7 (Protection against malware) and AU-ISM-1452 (Supply chain risk assessment for suppliers of operating systems, applications, IT equipment, OT equipment and services).",
         "gap_closes": [
           "NIST-800-53-SI-3",
           "ISO-27001-2022-A.8.7",
-          "AU-ISM-1546"
+          "AU-ISM-1452"
         ]
       },
       {
@@ -50759,10 +50759,10 @@
         "id": "NEW-CTRL-135",
         "name": "CONTROL-PANEL-PLUGIN-USER-SURFACE-MUST-NOT-REACH-ROOT-OPERATIONS",
         "description": "The surface this control governs on an ASA or FTD unit is the legacy VPN client and plug-in preloading capability the packet names, and this CVE is that surface wired straight to a root operation: a file copied into the disk0: file system is read from flash without proper validation and executed with root-level privileges on the next reload. Bound to this appliance the control means the preload path validates the origin and integrity of what it loads from flash before executing it, so that an administrator's ability to place a file on disk0: — an ordinary operational capability on these devices — is not the same capability as running root code that survives reboots. This is exactly why the least-privilege and privileged-access gaps cited on this entry pass their attestations while the path stays open: the actor is a legitimate administrator, so no account model is being violated, and a privileged-access review confirming every ASA administrator is named, approved and multi-factor protected never touches the flash-to-root path. Distinguishing test: on a staging ASA or FTD unit, place an unvalidated file into the preload location on disk0: and reload, and confirm it is refused rather than executed. Precondition: the validation is a property the vendor update establishes — this control states what to verify, it does not implement it. Until the update and its required reboot land, the only operator-side lever is restricting which accounts and which source networks reach the appliance's administrative and file-transfer interfaces, which bounds the population that can perform the write but does not close the path, because any account that legitimately administers the device still reaches disk0:.",
-        "evidence": "The packet's vector places the flaw in a legacy capability that allowed for the preloading of VPN clients and plug-ins in Cisco ASA and FTD Software, states that administrator-level privileges are required to exploit it, and attributes it to improper validation of a file when it is read from system flash memory; the recorded weakness is CWE-94. The attack_vector records an attacker holding administrator credentials copying a crafted file to the disk0: file system, which on the next device reload executes as root and persists across reboots. The cited NIST 800-53 AC-6 gap states least privilege assumes administrator accounts are trustworthy but this flaw lets an admin-level actor escalate to persistent root code execution, a privilege boundary AC-6 does not enforce within the appliance; the AU ISM 1546 gap states privileged-access management controls do not prevent a compromised administrator from writing a malicious file to flash, so the ISM control leaves the escalation-to-root path open.",
+        "evidence": "The packet's vector places the flaw in a legacy capability that allowed for the preloading of VPN clients and plug-ins in Cisco ASA and FTD Software, states that administrator-level privileges are required to exploit it, and attributes it to improper validation of a file when it is read from system flash memory; the recorded weakness is CWE-94. The attack_vector records an attacker holding administrator credentials copying a crafted file to the disk0: file system, which on the next device reload executes as root and persists across reboots. The cited NIST 800-53 AC-6 gap states least privilege assumes administrator accounts are trustworthy but this flaw lets an admin-level actor escalate to persistent root code execution, a privilege boundary AC-6 does not enforce within the appliance; the AU Essential Eight patching gap states that ISM-1877 requires the fix within 48 hours on this internet-facing appliance because ArcaneDoor exploited the flaw, but the window does not plan for the required reboot and the patching controls require no check of disk0: for a crafted file an administrator account already wrote.",
         "gap_closes": [
           "NIST-800-53-AC-6",
-          "AU-ISM-1546"
+          "AU-Essential-8-Patch"
         ]
       },
       {
@@ -50817,12 +50817,12 @@
         "id": "NEW-CTRL-030",
         "name": "PERIMETER-DEVICE-ZERODAY-SLA-TIER",
         "description": "The vulnerable code sits in the management and VPN web servers of Cisco ASA and Cisco FTD — the appliance that is itself the trust boundary — and the packet's path needs no credential: an unauthenticated remote attacker sends a crafted HTTP request, incomplete error checking while parsing an HTTP header drives an infinite loop (CWE-835), and the device reloads. For this CVE the tier means the vendor update runs on a clock that opened at the 2024-04-24 KEV listing rather than being folded into the next appliance maintenance window, and completion is measured per unit by the reload the update requires having actually been taken: patch_available is true with no live-patch path and the vendor update requires a reboot, so an appliance staged with the fixed image but not yet reloaded is still running the vulnerable parser and must be counted as exposed. Precondition on the isolation half of this control, which is where it is usually over-claimed on ASA/FTD: restricting which networks can reach the management web server bounds one of the two surfaces the packet names, but the VPN web server has to answer unauthenticated requests from untrusted networks to do its job, so on any unit terminating remote-access VPN there is no segment that removes the path — isolation shrinks the management-side surface while the reload is scheduled, it is not an alternative to the update. Distinguishing test: produce, per appliance, the running image and the time of its last reload, and show the reload post-dates the update; a boundary-protection or flaw-remediation attestation that reads 'update deployed' off the management console records an appliance still running the vulnerable image as remediated.",
-        "evidence": "Packet fields: cisa_kev true, kev_date 2024-04-24, active_exploitation 'confirmed', cvss 8.6, rwep_score 57, poc_available false. patch_available true, live_patch_available false, live_patch_notes 'No live-patching primitive for this product; the vendor update requires a reboot and is the remediation.' Vector places the flaw in 'the management and VPN web servers for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software', reachable by 'an unauthenticated, remote attacker', 'due to incomplete error checking when parsing an HTTP header', exploited 'by sending a crafted HTTP request to a targeted web server on a device'. cwe_refs CWE-835. Citing gaps include NIST-800-53-SC-7 Boundary Protection, NIST-800-53-SI-2 Flaw Remediation and AU-ISM-1546 Patch operating systems and applications.",
+        "evidence": "Packet fields: cisa_kev true, kev_date 2024-04-24, active_exploitation 'confirmed', cvss 8.6, rwep_score 57, poc_available false. patch_available true, live_patch_available false, live_patch_notes 'No live-patching primitive for this product; the vendor update requires a reboot and is the remediation.' Vector places the flaw in 'the management and VPN web servers for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software', reachable by 'an unauthenticated, remote attacker', 'due to incomplete error checking when parsing an HTTP header', exploited 'by sending a crafted HTTP request to a targeted web server on a device'. cwe_refs CWE-835. Citing gaps include NIST-800-53-SC-7 Boundary Protection, NIST-800-53-SI-2 Flaw Remediation and AU-Essential-8-Patch Patch applications and patch operating systems.",
         "gap_closes": [
           "NIST-800-53-SC-7",
           "NIST-800-53-SI-2",
           "ISO-27001-2022-A.8.8",
-          "AU-ISM-1546"
+          "AU-Essential-8-Patch"
         ]
       },
       {
@@ -51343,11 +51343,11 @@
         "id": "NEW-CTRL-134",
         "name": "DEVICE-MANAGEMENT-GATEWAY-CONFIG-ENDPOINT-AUTH-INPUT-NEUTRALIZATION",
         "description": "The Nice/Linear eMerge E3-Series panel is the management surface for the door hardware it drives, and this defect sits on its web endpoints: the packet has an unauthenticated remote attacker sending a crafted HTTP request whose parameter is passed into a shell command without sanitization, executing OS commands on the panel. Bound to this product, the control means each web endpoint on the panel authorizes its caller before the request is processed at all, and neutralizes request parameters before any of them reach a shell invocation, so a caller-supplied string cannot select what the panel executes; and no panel is left with that web interface reachable from the internet or from a segment with no operational need to reach it. This is why the least-privilege style of control never engages here — the attacker holds no account on the panel, so no account model is consulted and no credential policy is exercised; the endpoint's own authorization decision is the only thing between an untrusted caller and a shell. Preconditions, both load-bearing. The endpoint-side authorization and input neutralization are properties the vendor firmware update establishes — this control states what to verify, it does not implement it — and affected firmware is recorded only as 1.00-06 and earlier per the vendor advisory, so the target build must be obtained from that advisory for the model in service rather than assumed. And the reachability half bounds who can send the request without closing the endpoint: anything inside the permitted segment still reaches it unauthenticated, so for a panel that the badge readers, door controllers and its administrators must reach, the achievable reduction is isolating that segment from everything else, not removing the path. Distinguishing test: from an ordinary user VLAN and from an external address, attempt to load the panel's web interface — anything that answers is within reach of the published exploit, because the attacker supplies no credential past that point.",
-        "evidence": "The affected field records OS command injection in the eMerge E3-Series web interface reachable by an unauthenticated remote attacker, and the attack vector is a crafted HTTP request to a web endpoint that passes a parameter into a shell command without sanitization, enabling botnet enrollment or full takeover. poc_available true, active_exploitation confirmed, CVSS 9.8, RWEP 75, with EPSS ~0.97 reflecting long-running mass exploitation by IoT botnets including Mirai variants against internet-exposed panels. The SC-7 gap records the panels frequently exposed directly to the internet with the boundary controls that would block the CGI endpoints commonly absent for physical-security appliances; the NIS2 network-security gap records physical-access-control systems rarely segmented from IT networks, so a compromised panel pivots into the enterprise; the AU-ISM-1546 gap records appliance-hardening guidance not covering embedded PHP web stacks on access-control panels that pass input to shell commands; the UK-CAF-B4 gap records system-security governance seldom extending to these panels, leaving the unauthenticated command injection unhardened. Affected versions are recorded as firmware 1.00-06 and earlier per the vendor advisory.",
+        "evidence": "The affected field records OS command injection in the eMerge E3-Series web interface reachable by an unauthenticated remote attacker, and the attack vector is a crafted HTTP request to a web endpoint that passes a parameter into a shell command without sanitization, enabling botnet enrollment or full takeover. poc_available true, active_exploitation confirmed, CVSS 9.8, RWEP 75, with EPSS ~0.97 reflecting long-running mass exploitation by IoT botnets including Mirai variants against internet-exposed panels. The SC-7 gap records the panels frequently exposed directly to the internet with the boundary controls that would block the CGI endpoints commonly absent for physical-security appliances; the NIS2 network-security gap records physical-access-control systems rarely segmented from IT networks, so a compromised panel pivots into the enterprise; the AU-Essential-8-Patch gap records that internet-exposed panels are online services under ISM-1876, which requires the firmware update within 48 hours of release at every maturity level, while panels reachable only internally fall under the firmware control ISM-1903 at Maturity Level Three only, and the update needs a reboot; the UK-CAF-B4 gap records system-security governance seldom extending to these panels, leaving the unauthenticated command injection unhardened. Affected versions are recorded as firmware 1.00-06 and earlier per the vendor advisory.",
         "gap_closes": [
           "NIST-800-53-SC-7",
           "NIS2-Art21-network-security",
-          "AU-ISM-1546",
+          "AU-Essential-8-Patch",
           "UK-CAF-B4"
         ]
       },
@@ -54445,7 +54445,7 @@
       "AU-ISM-1546": {
         "covered": true,
         "adequate": false,
-        "gap": "Privileged/default-account controls are inconsistently applied to embedded OT devices, so the factory password persists on safety-relevant equipment."
+        "gap": "The PLC authenticates administrators with a password, so it meets ISM-1546 while the factory default password remains in place. CyberAv3ngers used that public default to take control of internet-exposed units."
       }
     },
     "new_control_requirements": [
@@ -54682,10 +54682,10 @@
         "adequate": false,
         "gap": "Patch-management cadence cannot force firmware/driver updates onto devices whose vendor has not yet shipped the OEM build, undermining timely remediation of a KEV kernel flaw."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "Mobile-device hardening controls rarely account for a GPU-driver LPE that undoes app-sandbox isolation once a malicious app is already present."
+        "gap": "The Essential Eight covers drivers only at Maturity Level Three, where ISM-1879 requires 48 hours, so below that level no Essential Eight window governs this exploited GPU driver flaw. The fix arrives per device model at the December 2023 security patch level and needs a reboot."
       }
     },
     "new_control_requirements": [
@@ -54697,7 +54697,7 @@
         "gap_closes": [
           "NIS2-Art21-patch-management",
           "NIST-800-53-SI-2",
-          "AU-ISM-1546"
+          "AU-Essential-8-Patch"
         ]
       },
       {
@@ -55700,10 +55700,10 @@
         "adequate": false,
         "gap": "Technical-vulnerability management scheduled on patch cadence cannot address an actively-exploited zero-day LPE; it needs behavioral detection of privilege escalation as a compensating layer."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "Applying vendor patches within the ISM timeframe still leaves the zero-day window uncovered; the control does not mandate the EDR/exploit-guard telemetry that would catch DWM token abuse."
+        "gap": "The DWM flaw was exploited as a zero-day, so the ISM-1695 and ISM-1696 windows opened only after attacks began, and below Maturity Level Three a host still has one month. A host that installed the November 2023 update without restarting still runs the vulnerable library."
       }
     },
     "new_control_requirements": [
@@ -55711,12 +55711,12 @@
         "id": "NEW-CTRL-145",
         "name": "ACTIVELY-EXPLOITED-OS-LPE-REMEDIATION-WINDOW-ENFORCEMENT",
         "description": "The packet places this in the Windows Desktop Window Manager (DWM) Core Library and describes an attacker who already holds a low-privilege foothold abusing an untrusted-pointer / memory-corruption flaw to move from the Window Manager\\DWM context the packet names to SYSTEM. The escalation starts from an account the host already accepts, so nothing in the account model is being abused — a privilege boundary inside the component is failing. For this CVE the control means driving the Windows update carrying the DWM Core Library fix across every affected host on the clock that opened with the 2023-11-14 KEV listing rather than folding it into the next monthly rollup, with completion measured per host by the installed build against the fixed build for that Windows release, not by 'approved' or 'downloaded' in the management console. There is no vendor live-patch mechanism and remediation requires the fixed release plus a reboot, so a host that has installed the update but not restarted is still running the vulnerable library and has to be counted as exposed; on a shared workstation or session host that restart is the step most likely to be deferred because taking it evicts logged-on users, and a deferral recorded as 'patched' is the specific way this remediation goes wrong. Enumerate first the hosts where an unprivileged interactive logon is the normal operating state, because that is where the exploit's stated precondition — an existing low-privilege foothold — is met continuously rather than exceptionally. The control's second half is the load-bearing one here: the entry cites NIST-800-53-AC-6 as insufficient and it is, because the attacker is a local user by precondition and tightening what that account may do does not contain a flaw that hands it SYSTEM, which is why a least-privilege attestation passes cleanly while the escalation stays fully available.",
-        "evidence": "Packet: CISA KEV-listed 2023-11-14, active_exploitation confirmed, CVSS 7.8, RWEP 59, CWE-822 / CWE-119. attack_vector: 'After gaining a low-privilege foothold, an attacker abuses a memory-corruption / untrusted-pointer flaw in the DWM Core Library to escalate from the Window Manager\\DWM context to SYSTEM.' patch_available true; live_patch_available false; live_patch_notes: 'No vendor live-patch mechanism; remediation requires applying the fixed release and rebooting.' NIST-800-53-AC-6 (Least Privilege), NIST-800-53-SI-2 (Flaw Remediation), ISO-27001-2022-A.8.8, NIS2-Art21-patch-management, AU-ISM-1546 and UK-CAF-B4 are all recorded as insufficient controls on this entry.",
+        "evidence": "Packet: CISA KEV-listed 2023-11-14, active_exploitation confirmed, CVSS 7.8, RWEP 59, CWE-822 / CWE-119. attack_vector: 'After gaining a low-privilege foothold, an attacker abuses a memory-corruption / untrusted-pointer flaw in the DWM Core Library to escalate from the Window Manager\\DWM context to SYSTEM.' patch_available true; live_patch_available false; live_patch_notes: 'No vendor live-patch mechanism; remediation requires applying the fixed release and rebooting.' NIST-800-53-AC-6 (Least Privilege), NIST-800-53-SI-2 (Flaw Remediation), ISO-27001-2022-A.8.8, NIS2-Art21-patch-management, AU-Essential-8-Patch and UK-CAF-B4 are all recorded as insufficient controls on this entry.",
         "gap_closes": [
           "NIST-800-53-SI-2",
           "ISO-27001-2022-A.8.8",
           "NIS2-Art21-patch-management",
-          "AU-ISM-1546",
+          "AU-Essential-8-Patch",
           "NIST-800-53-AC-6",
           "UK-CAF-B4"
         ]
@@ -56014,10 +56014,10 @@
         "adequate": false,
         "gap": "Network-security obligations do not specifically require isolating device management planes; leaving J-Web exposed keeps this chain viable despite general compliance."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "Patching within the ISM window helps, but the control does not mandate restricting the J-Web management interface that is the actual attack surface."
+        "gap": "Exploitation attempts began about a week after Juniper's fix, so an EX switch on the two-week ISM-1694 window or the one-month ISM-1695 window for internal devices was still exposed. No patching control requires J-Web to be turned off or restricted while the operator schedules the per-train fixed release and its reboot."
       }
     },
     "new_control_requirements": [
@@ -56031,7 +56031,7 @@
           "NIST-800-53-SC-7",
           "NIST-800-53-SI-2",
           "ISO-27001-2022-A.8.8",
-          "AU-ISM-1546"
+          "AU-Essential-8-Patch"
         ]
       },
       {
@@ -56388,9 +56388,9 @@
         "id": "NEW-CTRL-030",
         "name": "PERIMETER-DEVICE-ZERODAY-SLA-TIER",
         "description": "The SRX Series is a perimeter firewall — the trust boundary itself — and the packet describes an unauthenticated request to webauth_operation.php uploading and downloading arbitrary files through J-Web, with the write primitive chaining into pre-auth remote code execution via the PHPRC flaw the packet names as its chaining partner. That is the case this tier exists for, and this entry is also a clean demonstration of why a CVSS-keyed SLA misfiles it: the base score is 5.3, which routes the item to a routine queue, while the packet's own flaw-remediation gap records that the medium score understates a pre-auth upload/download primitive documented as part of a public RCE chain, and the entry's RWEP is 77. For this device the requirement is that remediation runs on the tier clock opened by the 2023-11-13 KEV listing — the fixed Junos release for whichever train is in service (21.2R3-S8, 21.4R3-S6, 22.1R3-S5, 22.2R3-S3, 22.3R3-S2, 22.4R2-S2 or 22.4R3, 23.2R1-S2 or 23.2R2) — or, where the maintenance window cannot be taken inside it, J-Web is made unreachable from untrusted networks until it can. Cover every train the packet names: an estate standardised on 22.4 or 23.2 is exposed at a different fixed build than one on 21.2, and a sweep scoped to a single train reports clean across the rest. Completion is measured on the release each chassis is actually running: there is no live-patch mechanism and remediation requires the fixed release plus a reboot, so a device staged with the image but not rebooted onto it is still serving the unauthenticated endpoint. Precondition on the isolation alternative: restricting or disabling J-Web bounds who can reach webauth_operation.php, it does not repair the missing authentication check — anything inside a permitted management segment still reaches it unauthenticated — and it is unavailable where J-Web is the operational management path for the device. It is a holding measure for the window before the fixed release and its reboot land, not a closure.",
-        "evidence": "CISA KEV 2023-11-13, active_exploitation confirmed, poc_available true, CVSS 5.3 against RWEP 77. The NIST-800-53-SI-2 gap states the medium base score understates a preauth upload/download primitive documented as part of a public RCE chain and that CVSS-keyed patch SLAs deprioritize it wrongly; the AU-ISM-1546 gap states patching within the ISM window does not mandate restricting the exposed webauth_operation.php endpoint; the ISO-27001-2022-A.8.8 gap states technical-vulnerability management under CVSS-medium scoring deprioritizes this endpoint, delaying remediation of an actively-exploited preauth flaw. patch_available true, patch_required_reboot true, live_patch_available false with live_patch_notes recording that remediation requires applying the fixed release and rebooting. affected_versions lists 21.2 prior to 21.2R3-S8, 21.4 prior to 21.4R3-S6, 22.1 prior to 22.1R3-S5, 22.2 prior to 22.2R3-S3, 22.3 prior to 22.3R3-S2, 22.4 prior to 22.4R2-S2 / 22.4R3, and 23.2 prior to 23.2R1-S2 / 23.2R2.",
+        "evidence": "CISA KEV 2023-11-13, active_exploitation confirmed, poc_available true, CVSS 5.3 against RWEP 77. The NIST-800-53-SI-2 gap states the medium base score understates a preauth upload/download primitive documented as part of a public RCE chain and that CVSS-keyed patch SLAs deprioritize it wrongly; the AU-Essential-8-Patch gap states patching within the ISM window does not mandate restricting the exposed webauth_operation.php endpoint; the ISO-27001-2022-A.8.8 gap states technical-vulnerability management under CVSS-medium scoring deprioritizes this endpoint, delaying remediation of an actively-exploited preauth flaw. patch_available true, patch_required_reboot true, live_patch_available false with live_patch_notes recording that remediation requires applying the fixed release and rebooting. affected_versions lists 21.2 prior to 21.2R3-S8, 21.4 prior to 21.4R3-S6, 22.1 prior to 22.1R3-S5, 22.2 prior to 22.2R3-S3, 22.3 prior to 22.3R3-S2, 22.4 prior to 22.4R2-S2 / 22.4R3, and 23.2 prior to 23.2R1-S2 / 23.2R2.",
         "gap_closes": [
-          "AU-ISM-1546",
+          "AU-Essential-8-Patch",
           "ISO-27001-2022-A.8.8",
           "NIST-800-53-SI-2"
         ]
@@ -56713,10 +56713,10 @@
         "adequate": false,
         "gap": "Patch-management SLAs for network appliances typically lag the F5 hotfix cadence, and this flaw is most dangerous chained with a preauth bypass — a slow patch leaves both halves exploitable."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "ISM management-interface segregation guidance is frequently unmet for BIG-IP, leaving the Configuration utility reachable where the SQLi can be exercised."
+        "gap": "Under ISM-1877, BIG-IP as an internet-facing network device is patched within 48 hours of F5's release at every maturity level because a working exploit exists, but the fix is split across five branches and takes effect only after a reboot. Units on versions past End of Technical Support have no evaluated fix, and ISM-1501 requires their unsupported software to be replaced with a supported branch, without setting a timeframe."
       },
       "ISO-27001-2022-A.8.8": {
         "covered": true,
@@ -56732,7 +56732,7 @@
         "evidence": "Packet: CWE-89; an authenticated attacker with network access to the Configuration utility through the BIG-IP management port and/or self IP addresses executes arbitrary system commands, in practice paired with CVE-2023-46747 to gain the needed unauthenticated reach. CISA KEV-listed 2023-10-31; active_exploitation confirmed; poc_available true; CVSS 8.8; RWEP 75. patch_available true; live_patch_available false with the note 'No vendor live-patch mechanism; remediation requires applying the fixed release and rebooting.' The vector also states: 'Software versions which have reached End of Technical Support (EoTS) are not evaluated.'",
         "gap_closes": [
           "NIST-800-53-SC-7",
-          "AU-ISM-1546",
+          "AU-Essential-8-Patch",
           "NIS2-Art21-patch-management"
         ]
       },
@@ -57147,10 +57147,10 @@
         "adequate": false,
         "gap": "Essential-service network-security obligations rarely require disabling/segmenting router management planes, leaving the web UI reachable for exploitation."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "ISM management-traffic-segregation guidance is widely unmet for edge routers, so the web UI remains internet-facing and abusable."
+        "gap": "ISM-1877 gives 48 hours from Cisco's fixed release, but the web UI flaw was exploited before any fix existed, and each IOS XE train needs its own fixed build and a reboot. Patching also leaves in place any privilege 15 account created during the exposure."
       }
     },
     "new_control_requirements": [
@@ -57170,11 +57170,11 @@
         "id": "NEW-CTRL-030",
         "name": "PERIMETER-DEVICE-ZERODAY-SLA-TIER",
         "description": "The web UI is the entire initial-access path in this packet — an unauthenticated remote attacker reaches it and issues a privilege 15 command — and it is a feature of IOS XE that can be turned off. On the routers and switches carrying that software the exposure has to be graded at the trust boundary rather than as a generic OS patch item: CVSS 10, KEV listing on 2023-10-16, confirmed exploitation and a public PoC, so the requirement is the fixed IOS XE release deployed with the reboot remediation requires, on a clock that opens at the KEV listing — or the HTTP/HTTPS management server disabled, or its reachability cut, on every affected unit until that reboot completes. The standard 14- and 30-day appliance SLAs do not apply, because this device is the boundary everything behind it depends on. Precondition on the interim lever: disabling or restricting the web UI removes the delivery path only where the unit is genuinely managed by another channel — console, SSH CLI, or a management platform — and it is unavailable where the web UI is the operational management path. It also does nothing for a unit already compromised during the exposure window: the packet's attacker-created privilege-15 account lives in configuration and the implant on the filesystem, and both persist whether or not the interface is later turned off. Distinguishing test: from every segment that can route to the device, including any internet-facing interface, attempt to load the IOS XE web UI on a staging unit and confirm nothing answers — a patch-compliance report listing units as scheduled while the HTTP server still answers from an untrusted segment is measuring the wrong thing.",
-        "evidence": "Packet: CVSS 10, RWEP 83, poc_available true, KEV listed 2023-10-16 with active_exploitation 'confirmed'. attack_vector: 'An unauthenticated remote attacker abuses the IOS XE web UI to issue a privilege-15 command that creates a local user/password...'. patch_available true (the vector notes the vendor 'updating the list of fixed releases and adding the Software Checker'), live_patch_available false with remediation requiring the fixed release and a reboot. NIST-800-53-CM-7 (Least Functionality), NIST-800-53-SC-7 (Boundary Protection) and AU-ISM-1546 are recorded among the citing framework gaps.",
+        "evidence": "Packet: CVSS 10, RWEP 83, poc_available true, KEV listed 2023-10-16 with active_exploitation 'confirmed'. attack_vector: 'An unauthenticated remote attacker abuses the IOS XE web UI to issue a privilege-15 command that creates a local user/password...'. patch_available true (the vector notes the vendor 'updating the list of fixed releases and adding the Software Checker'), live_patch_available false with remediation requiring the fixed release and a reboot. NIST-800-53-CM-7 (Least Functionality), NIST-800-53-SC-7 (Boundary Protection) and AU-Essential-8-Patch (Patch applications and patch operating systems) are recorded among the citing framework gaps.",
         "gap_closes": [
           "NIST-800-53-CM-7",
           "NIST-800-53-SC-7",
-          "AU-ISM-1546"
+          "AU-Essential-8-Patch"
         ]
       },
       {
@@ -57318,22 +57318,22 @@
         "adequate": false,
         "gap": "Technical-vulnerability management that scans hosts and web apps rarely enumerates IOS/IOS XE feature-level CVEs on GET VPN routers, leaving this class of appliance-firmware flaw untracked."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "Patch-application timeframes for network appliances are routinely exceeded because of change-freeze and maintenance-window constraints on core routing gear."
+        "gap": "ISM-1877 measures its 48 hours from Cisco's release, and Cisco PSIRT found this flaw while investigating attempted exploitation of the GET VPN feature, so those attempts came before any window started. The fixed image runs only after a reload, which change freezes on core routing gear routinely push past the window."
       }
     },
     "new_control_requirements": [
       {
         "id": "NEW-CTRL-001",
         "name": "CISA-KEV-RESPONSE-SLA",
-        "description": "The population here is not the router estate: it is every Cisco IOS device and every Cisco IOS XE device with the GET VPN feature enabled, in both roles, since the packet's path reaches the out-of-bounds write from a compromised key server or from a group member reconfigured to register against an attacker-controlled one. Producing that list is part of the requirement rather than a precursor to it, because the A.8.8 gap records that host and web-application scanning rarely enumerates IOS/IOS XE feature-level CVEs, so a GET VPN router will not surface as vulnerable unless the GET VPN configuration itself is what gets inventoried. For each device the 2023-10-10 KEV listing sets the clock rather than the change-freeze calendar the SI-2 and AU-ISM-1546 gaps describe. Fixed releases are per-train and the packet points at the Cisco advisory for them rather than naming one, so the per-device check is that the running image is at or above the advisory's fixed release for that train. There is no live-patch mechanism and remediation requires applying the fixed release and rebooting, so completion is measured on the image the device is executing after the reload — a fixed image copied to flash and set as the boot image is not remediation, and on core routing gear that pending reload is precisely the step that gets deferred into the next window and then recorded as patched.",
-        "evidence": "Packet: CISA KEV 2023-10-10, active_exploitation confirmed; active_exploitation_notes state Cisco PSIRT observed attempted exploitation of the GET VPN feature in the wild and discovered this out-of-bounds write during the ensuing code review. CVSS 6.6, RWEP 55, poc_available false. patch_available true, patch_required_reboot true, live_patch_available false, live_patch_notes: 'No vendor live-patch mechanism; remediation requires applying the fixed release and rebooting.' affected_versions: Cisco IOS with GET VPN enabled and Cisco IOS XE with GET VPN enabled, fixed releases per the Cisco advisory. The SI-2 gap states GET VPN routers are change-controlled infrastructure operators reboot infrequently so the patch window far exceeds the exploitation window; AU-ISM-1546 states patch timeframes are routinely exceeded because of change-freeze and maintenance-window constraints; A.8.8 states vulnerability management rarely enumerates IOS/IOS XE feature-level CVEs on GET VPN routers.",
+        "description": "The population here is not the router estate: it is every Cisco IOS device and every Cisco IOS XE device with the GET VPN feature enabled, in both roles, since the packet's path reaches the out-of-bounds write from a compromised key server or from a group member reconfigured to register against an attacker-controlled one. Producing that list is part of the requirement rather than a precursor to it, because the A.8.8 gap records that host and web-application scanning rarely enumerates IOS/IOS XE feature-level CVEs, so a GET VPN router will not surface as vulnerable unless the GET VPN configuration itself is what gets inventoried. For each device the 2023-10-10 KEV listing sets the clock rather than the change-freeze calendar the SI-2 and AU-Essential-8-Patch gaps describe. Fixed releases are per-train and the packet points at the Cisco advisory for them rather than naming one, so the per-device check is that the running image is at or above the advisory's fixed release for that train. There is no live-patch mechanism and remediation requires applying the fixed release and rebooting, so completion is measured on the image the device is executing after the reload. A fixed image copied to flash and set as the boot image is not remediation, and on core routing gear that pending reload is precisely the step that gets deferred into the next window and then recorded as patched.",
+        "evidence": "Packet: CISA KEV 2023-10-10, active_exploitation confirmed; active_exploitation_notes state Cisco PSIRT observed attempted exploitation of the GET VPN feature in the wild and discovered this out-of-bounds write during the ensuing code review. CVSS 6.6, RWEP 55, poc_available false. patch_available true, patch_required_reboot true, live_patch_available false, live_patch_notes: 'No vendor live-patch mechanism; remediation requires applying the fixed release and rebooting.' affected_versions: Cisco IOS with GET VPN enabled and Cisco IOS XE with GET VPN enabled, fixed releases per the Cisco advisory. The SI-2 gap states GET VPN routers are change-controlled infrastructure operators reboot infrequently so the patch window far exceeds the exploitation window; AU-Essential-8-Patch states the fixed image runs only after a reload, which change freezes on core routing gear routinely push past the ISM-1877 window; A.8.8 states vulnerability management rarely enumerates IOS/IOS XE feature-level CVEs on GET VPN routers.",
         "gap_closes": [
           "NIST-800-53-SI-2",
           "ISO-27001-2022-A.8.8",
-          "AU-ISM-1546"
+          "AU-Essential-8-Patch"
         ]
       },
       {
@@ -58486,10 +58486,10 @@
         "adequate": false,
         "gap": "Patch-management timelines for the security product's own console did not pre-empt the zero-day; the control is insufficient without console network isolation."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "Restricting privileged access reduces who can reach the console but does not remove the code-injection sink in the uninstaller module for those who legitimately have access."
+        "gap": "ISM-1691 allows two weeks below Maturity Level Three for a security product flaw that was exploited as a zero-day before Trend Micro's fix. The fix spans separate builds for Apex One on-premises, the Apex One as a Service agent and Worry-Free Business Security, so evidence for one product line leaves the others unverified."
       }
     },
     "new_control_requirements": [
@@ -59138,10 +59138,10 @@
         "adequate": false,
         "gap": "Network-security measures do not by themselves mandate MFA on the RA VPN or lockout on the default group, so the AAA-separation weakness stays exploitable on a compliant deployment."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "Requires MFA for remote access but does not force removal/lockdown of the default connection profile that the brute force targets."
+        "gap": "ISM-1877 gives 48 hours from the fixed release, but ransomware operators exploited the flaw as a zero-day, and the fix needs a reload. Credentials found by brute force during the exposure stay valid after patching until they are rotated."
       },
       "UK-CAF-B2": {
         "covered": true,
@@ -59156,7 +59156,7 @@
         "description": "ASA and FTD are the perimeter's remote-access authentication enforcement point, and the packet places this defect inside that enforcement rather than around it: AAA is not properly separated between the RA VPN feature and the HTTPS-management and site-to-site VPN features, so specifying a default connection profile/tunnel group lets an unauthenticated attacker run credential guessing directly against the gateway, and on ASA 9.16 and earlier lets a clientless SSL VPN session be established with an unauthorized user. Be precise about which half is which, because the packet is: it states the flaw does not allow bypassing authentication, and that valid credentials — including a valid second factor where MFA is configured — are still required to establish a remote-access VPN session. The expedited clock is therefore warranted not by a full authentication bypass but by what the gateway gives an unauthenticated attacker for free, which is unlimited credential discovery against the enforcement point itself, plus the authorization failure on 9.16 and earlier.\n\nFor this CVE the clock runs from the 2023-09-13 KEV listing through the reload of every affected ASA and FTD unit. patch_available is true, live_patch_available is false, and remediation is applying the fixed release and rebooting — so a unit that has taken the release but has not been reloaded still runs the vulnerable code and must be counted as exposed, not as patched. On a production VPN concentrator that reload is the step most likely to be deferred, because taking it drops live tunnels, and a deferral recorded as 'patched' is the specific way this remediation goes wrong. Enumerate units on ASA 9.16 or earlier first: those carry the clientless-session path on top of the credential-discovery path.\n\nDistinguishing test: report, per ASA and FTD unit, the software version the device is actually running and the timestamp of its last reload, rather than the version staged from the management console — a fleet where the console shows the fixed release pushed everywhere passes a patch attestation while unreloaded devices keep serving the vulnerable code.\n\nPrecondition on interim exposure, which is where this is normally over-claimed: the packet's stated exploitation requirement is reaching a default connection profile/tunnel group on the RA VPN feature. Restricting who can reach that profile bounds the population that can attempt it, but a remote-access VPN exists to answer from untrusted networks, so on any gateway serving general remote access there is no source restriction that removes the path — only the fixed release and the reload do. Interim measures narrow the attempt rate; they do not close it.\n\nAnd what the reload does not do: the flaw's product is valid username and password combinations identified by brute force, and Akira ransomware has used this for initial access. Credentials harvested during the exposure window remain valid after the fixed release is applied — the update repairs the AAA separation, it does not invalidate what was already taken — so a gateway whose RA VPN was reachable during the window needs those accounts rotated and established sessions reviewed, not closed on the patch record.",
         "evidence": "Recorded facts only. CISA KEV-listed 2023-09-13; active_exploitation 'confirmed'; CVSS 9.1; RWEP 62; poc_available false; CWE-288 and CWE-863; ai_discovered false. Vector: the RA VPN feature of Cisco ASA and FTD 'could allow an unauthenticated, remote attacker to conduct a brute force attack in an attempt to identify valid username and password combinations or an authenticated, remote attacker to establish a clientless SSL VPN session with an unauthorized user'; 'due to improper separation of authentication, authorization, and accounting (AAA) between the remote access VPN feature and the HTTPS management and site-to-site VPN features'; exploited 'by specifying a default connection profile/tunnel group'; clientless SSL VPN session 'only when running Cisco ASA Software Release 9.16 or earlier'; and the packet's own notes that 'This vulnerability does not allow an attacker to bypass authentication. To successfully establish a remote access VPN session, valid credentials are required, including a valid second factor if multi-factor authentication (MFA) is configured.' Attack vector records 'Akira ransomware used this for initial access'. patch_available true; live_patch_available false; live_patch_notes: 'No vendor live-patch mechanism; remediation requires applying the fixed release and rebooting.'",
         "gap_closes": [
-          "AU-ISM-1546",
+          "AU-Essential-8-Patch",
           "NIS2-Art21-network-security"
         ]
       },
@@ -59638,7 +59638,7 @@
       "AU-ISM-1546": {
         "covered": true,
         "adequate": false,
-        "gap": "Access-control guidance for services does not force authentication on the RocketMQ remoting interface, so the missing permission check remains the exploited gap."
+        "gap": "ISM-1546 evidence records that authentication exists for a system, and does not test whether the RocketMQ NameServer, Broker and Controller accept the update-configuration command from an unauthenticated caller. The control sets no timeframe for closing that path, and the upgrade to 5.1.1 or 4.9.6 falls under the patching controls."
       },
       "ISO-27001-2022-A.8.8": {
         "covered": true,
@@ -59662,7 +59662,7 @@
         "id": "NEW-CTRL-129",
         "name": "ENTERPRISE-ERP-MANAGEMENT-FUNCTION-AUTHENTICATION",
         "description": "The update-configuration function is a broker administration operation, and on RocketMQ 5.1.0 and below it runs for a caller the component never verified - the packet places the missing permission check on the components themselves, not on an account model that was misconfigured. Bound to this product, the control means the configuration-mutating remoting commands, updateBrokerConfig among them, make their own authorization decision before the configuration value is applied, rather than inheriting trust from the caller's network position or from the fact that the connection reached a listener at all; and that the administration surface is not left enabled by default on components that also carry production messaging traffic, where nothing distinguishes an operator's config write from a producer's connection. This is the least-functionality gap on this entry rather than the privilege gap, and the distinction matters operationally: the attacker never holds any RocketMQ operator account, so per-account privilege scoping is never consulted and an access-review attestation over the cluster's administrators passes cleanly while this path stays open. Distinguishing test: on a staging cluster, issue a configuration-mutating remoting command from a host holding no RocketMQ credential and confirm it is refused before the value is applied - not merely that the request was logged. Precondition: the vendor releases the packet names, 5.1.1 or above for 5.x and 4.9.6 or above for 4.x, are the remediation it records; this control states the property to verify and the surface to reduce, it does not implement either, and it gives nothing on its own to a cluster still running an affected build.",
-        "evidence": "Packet vector: components 'lack permission verification, an attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running as'; recommended upgrade '5.1.1 or above for using RocketMQ 5.x or 4.9.6 or above for using RocketMQ 4.x'. framework_control_gaps NIST-800-53-CM-7: 'Least functionality is violated when the update-configuration remoting function is reachable unauthenticated; CM-7 does not by default disable/lock down the broker management interface.' framework_control_gaps AU-ISM-1546: 'Access-control guidance for services does not force authentication on the RocketMQ remoting interface, so the missing permission check remains the exploited gap.' cwe_refs CWE-94; active_exploitation confirmed.",
+        "evidence": "Packet vector: components 'lack permission verification, an attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running as'; recommended upgrade '5.1.1 or above for using RocketMQ 5.x or 4.9.6 or above for using RocketMQ 4.x'. framework_control_gaps NIST-800-53-CM-7: 'Least functionality is violated when the update-configuration remoting function is reachable unauthenticated; CM-7 does not by default disable/lock down the broker management interface.' framework_control_gaps AU-ISM-1546 (Users are authenticated before they are granted access to a system and its resources): 'An organization can record authentication for its messaging users while that remoting interface accepts unauthenticated commands, which the DreamBus botnet used to run commands as the RocketMQ service user.' cwe_refs CWE-94; active_exploitation confirmed.",
         "gap_closes": [
           "NIST-800-53-CM-7",
           "AU-ISM-1546"
@@ -68900,10 +68900,10 @@
         "adequate": false,
         "gap": "B4 is assessed on how the deployed system is hardened, and no operator-side configuration of 4.4.2 PL1 closed this path — the gadget chain fires inside the application's own parse of the external_emails field. A strong B4 rating and total exposure to this CVE were fully compatible."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "ISM 1546's 48-hour window for an internet-facing application with a working exploit cannot be met by an appliance upgrade that requires a scheduled file-transfer outage and partner coordination, so the control sets a timeframe that is unachievable on precisely the asset class it matters most on."
+        "gap": "An internet-accessible Faspex server has 48 hours from release under ISM-1876 because Assetnote published a working exploit on 2023-02-02, and that window does not plan for the service outage and partner scheduling the upgrade needs. An internal server has one month under ISM-1693 at Maturity Levels Two and Three and no timeframe at Level One, and IceFire was encrypting Faspex hosts by 2023-03-09."
       },
       "ISO-27001-2022-A.8.8": {
         "covered": true,
@@ -68920,7 +68920,7 @@
         "gap_closes": [
           "ISO-27001-2022-A.8.8",
           "NIS2-Art21-vulnerability-handling",
-          "AU-ISM-1546"
+          "AU-Essential-8-Patch"
         ]
       },
       {
@@ -69058,10 +69058,10 @@
         "adequate": false,
         "gap": "B4 evidence for a UC estate reduces to 'vendor-supported appliance, patched per vendor guidance', but with the fix living only in a login-gated bulletin there is no published version string an assessor can reconcile against — the control's evidence becomes the operator's own assertion."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "ISM 1546's verification model assumes a public fixed version to reconcile the patch register against, and Mitel disclosed the fixed build only through customer-portal bulletin 22-0007-001, so an ISM-aligned register for this platform cannot be closed out against anything verifiable."
+        "gap": "Mitel names no fixed release publicly and delivers the fix only through customer-portal bulletin 22-0007-001, so an operator without portal access cannot tell when the ISM-1877 or ISM-1694 window began, and the patch register has no public build to reconcile the Edge Gateway against."
       },
       "ISO-27001-2022-A.8.22": {
         "covered": true,
@@ -69140,10 +69140,10 @@
         "adequate": false,
         "gap": "C1 assumes the monitoring infrastructure is a trusted observer, and this CVE hands the attacker the collector itself. Nothing in the principle requires monitoring of the monitoring host, so the bots run on the one server least likely to be watched by the capability C1 assesses."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "The fix arrived through entirely ordinary channels, but Cacti is characteristically installed from a distribution package by a NOC team and never enters the application register the control is measured against — so patch-compliance reporting stays green on a host it cannot see."
+        "gap": "An internet-accessible Cacti server has 48 hours from release under ISM-1876 because CISA lists the flaw as known exploited, and an internal one has one month from the 2022-12-05 fix under ISM-1693 at Maturity Levels Two and Three and no timeframe at Level One. MooBot and ShellBot exploited it from January 2023, and a Cacti host installed from a distribution package often sits outside the application register, so the patching evidence does not show it."
       },
       "ISO-27001-2022-A.8.9": {
         "covered": true,
@@ -69159,7 +69159,7 @@
         "evidence": "CVE-2022-46169 was fixed on 2022-12-05, MooBot and ShellBot were mass-exploiting it from January 2023, and the KEV due date of 2023-03-09 sat two months behind the fix — a cadence that catalogues Cacti as a support utility rather than an in-scope service never reaches it inside that window. A KEV-triggered clock takes the internal asset rating out of the decision on a pre-auth RCE with EPSS 0.99826.",
         "gap_closes": [
           "NIS2-Art21-vulnerability-management",
-          "AU-ISM-1546"
+          "AU-Essential-8-Patch"
         ]
       },
       {
@@ -69472,10 +69472,10 @@
         "adequate": false,
         "gap": "Blocking the Microsoft Store is standard secure-baseline advice a B4 assessment scores favourably, and it is precisely what prevents this fix from arriving — the control and the remediation are in direct conflict, so a stronger B4 posture leaves the CVE open longer."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "The patch timeframe is measurable and enforceable for the Windows KBs but unenforceable for the app-store-delivered Office builds, where the organisation controls neither release cadence nor install trigger — so ISM-1546 evidence for this CVE cannot be made complete across the published product set."
+        "gap": "ISM-1695 allows one month at Maturity Levels One and Two for this CISA-listed Windows flaw, and ISM-1696 requires 48 hours only at Maturity Level Three. The fix spans per-version cumulative updates and separately delivered app-store Office builds, so patch evidence for the Windows updates alone leaves the Office builds unverified."
       },
       "ISO-27001-2022-A.8.8": {
         "covered": true,
@@ -70083,10 +70083,10 @@
         "adequate": false,
         "gap": "This is a direct B2 failure that the operator cannot remediate: the identity is vendor-embedded and authenticates over the standard web interface, so joiners/movers/leavers processes, privilege reviews and credential-rotation policy — the activities B2 is assessed on — have no reach over it, and B2 outcomes are scored against what the organisation controls."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "The control assumes a patch exists for the release in use. Cisco published hotfixes for the 7.0, 7.2, 7.4, 7.6, 7.7 and 10.0 trains and none for 7.3, despite listing 7.3.0 through 7.3.1.2 as affected, so a conformant entity on 7.3 had nothing to apply and had to plan a train migration while the exposure persisted through the whole migration window."
+        "gap": "Cisco published hotfixes for the 7.0, 7.2, 7.4, 7.6, 7.7 and 10.0 trains and none for 7.3, although 7.3.0 through 7.3.1.2 are affected, so a deployment on 7.3 cannot meet the patching timeframe except by migrating trains. The static credential cannot be disabled or rotated and Cisco lists no workaround, so the exposure lasts for the whole migration."
       },
       "ISO-27001-2022-A.5.21": {
         "covered": true,
@@ -70101,7 +70101,7 @@
         "description": "Compliance frameworks must define a distinct patch SLA tier for pre-auth RCE on perimeter-trust-boundary devices (firewalls, VPN concentrators, WAFs, edge load-balancers). Tier requirement: vendor-mitigation deployed within 4 hours of KEV listing OR isolation of the vulnerable interface; standard 14/30-day SLAs do not apply because the device IS the trust boundary.",
         "evidence": "CVE-2026-20316 is a static credential compiled into the Cisco Secure FMC image that the operator cannot disable, rotate or remove, and Cisco published hotfixes for the 7.0, 7.2, 7.4, 7.6, 7.7 and 10.0 trains but none for 7.3 despite listing 7.3.0 through 7.3.1.2 as affected. For those deployments the tier's alternative limb — isolation of the vulnerable interface, keeping the FMC management interface off the public internet on a dedicated management network — is the only remediation reachable inside the three-day KEV window, and FMC is the management plane of the perimeter itself.",
         "gap_closes": [
-          "AU-ISM-1546"
+          "AU-Essential-8-Patch"
         ]
       },
       {
@@ -70343,10 +70343,10 @@
         "adequate": false,
         "gap": "The hardening advice and the vulnerable surface are the same toggle: enabling spark.acls.enable is the secure-configuration step, and it is also what opens the impersonation-to-shell path — a distinction B4's outcome-based assessment has no vocabulary for."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "Patch-application timeframes key off advisory date rather than exploit availability, so the control cannot express that a turnkey Metasploit module and a Nuclei template moved this from patchable to point-and-shoot well inside the nominal window."
+        "gap": "An internet-accessible Spark UI has 48 hours from release under ISM-1876 because CISA lists the flaw as known exploited, and an internal UI has one month under ISM-1693 at Maturity Levels Two and Three and no timeframe at Level One, although a Metasploit module and a Nuclei template are public. A cluster on 3.0.3 or earlier has no fix on its line and must move to 3.1.3, 3.2.2 or 3.3.0 or later."
       },
       "ISO-27001-2022-A.8.28": {
         "covered": true,
@@ -70372,7 +70372,7 @@
         "evidence": "CVE-2022-33891 had fixed maintenance releases from 2022-07-18 while KEV listing came only on 2023-03-07, and across that eight-month gap an Excellent-rank Metasploit module and a ProjectDiscovery Nuclei template made every reachable Spark UI with ACLs enabled point-and-shoot. A clock keyed to KEV listing and exploit availability — with network restriction of the master/worker UI as the documented compensating control — is what an advisory-date patch timeframe cannot express.",
         "gap_closes": [
           "NIS2-Art21-vulnerability-management",
-          "AU-ISM-1546"
+          "AU-Essential-8-Patch"
         ]
       }
     ]
@@ -70701,10 +70701,10 @@
         "adequate": false,
         "gap": "The failure lives in closed-source vendor extraction code — BneUnZip joining the staging path to an attacker-chosen ZIP entry name. No configuration setting, host hardening measure or B4 evidence artefact available to the EBS operator controls where the extracted file lands; only the CPU or a proxy-level block on the upload parameter does."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "ISM 1546 keys off vendor patch availability and treats an internet-facing ERP servlet the same as an internal batch component, so a legitimate compliance record shows the CPU scheduled for the next quarterly maintenance window while an unauthenticated arbitrary file write to the application tier stays live and, by February 2023, exploited."
+        "gap": "An internet-facing E-Business Suite is an online service, and ISM-1876 gives this CVSS 9.8, KEV-listed flaw 48 hours at every level without planning for the adop cutover and application-tier restart the CPU needs. An internal instance is an other application under ISM-1693 with no Maturity Level One timeframe, so at that level it could remain unpatched at the 2023-02-02 KEV listing without breaching the profile."
       },
       "ISO-27001-2022-A.8.28": {
         "covered": true,
@@ -71579,10 +71579,10 @@
         "adequate": false,
         "gap": "B4 expects protective measures at the platform layer, but port-mapped I/O reaches PCI configuration space, the SMBus and platform controllers where no OS-level hardening, privilege boundary or file-integrity control applies. B4 cannot mediate a hardware bus that a user-mode process reaches through a legitimate signed driver."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "ISM 1546 requires operating systems and applications to be patched, yet the exposure survives patching in both directions — a host with no GIGABYTE software is exploitable once the attacker copies the driver in, and a host patched to AORUS 1.57 still has no listed fixed APP Center build. The control's patch-centric framing never produces the instruction that matters, a signed-driver deny rule."
+        "gap": "The 48-hour ISM-1879 window for this known-exploited driver applies only at Maturity Level Three, and NVD names no fixed build for APP Center or OC GURU II 2.08, so a host can meet every patch timeframe and still carry a vulnerable driver. An attacker can also load the signed driver on a host that never had GIGABYTE software installed."
       },
       "ISO-27001-2022-A.8.9": {
         "covered": true,
@@ -71598,7 +71598,7 @@
         "evidence": "CVE-2018-19322 is reachable through two distinct signed drivers — gdrv.sys and GPCIDrv64.sys — while GIGABYTE denied the report on 2018-07-12, NVD still names no fixed APP Center build, and OC GURU II 2.08 is a retired line with no fixed version, so there is no advisory-to-fix pipeline to schedule against. A hash deny rule covering both binaries is the only remediation that does not depend on the vendor shipping something.",
         "gap_closes": [
           "NIS2-Art21-patch-management",
-          "AU-ISM-1546",
+          "AU-Essential-8-Patch",
           "NIST-800-53-CM-7"
         ]
       },
@@ -72021,10 +72021,10 @@
         "adequate": false,
         "gap": "B2 is evidenced through privileged-account management — named admins, MFA coverage, session logging, periodic review — and all of it stays green while the attacker adds a super_admin and pushes an SSH key into the admin's ssh-public-key1 field. The account inventory B2 asks for is precisely the artefact the attack modifies, and nothing requires reconciling it against the device's own configuration history."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "The ISM patch clock starts at vendor release, but Fortinet shipped fixed builds on 2022-10-03 and published FG-IR-22-377 only on 2022-10-10 after a confidential customer notice. An operator tracking public advisories lost the first week outright, and Horizon3's PoC plus a Nuclei template and Metasploit module arrived from 2022-10-13 — the compliant patch window opened after mass scanning had begun."
+        "gap": "ISM-1877 measures its 48 hours from the vendor's release, and Fortinet released fixed builds on 2022-10-03 but published FG-IR-22-377 only on 2022-10-10, so an operator relying on the public advisory started a week late. Horizon3's proof of concept followed on 2022-10-13, and each upgrade needs a device reboot."
       },
       "ISO-27001-2022-A.8.22": {
         "covered": true,
@@ -72039,7 +72039,7 @@
         "description": "Compliance frameworks must define a distinct patch SLA tier for pre-auth RCE on perimeter-trust-boundary devices (firewalls, VPN concentrators, WAFs, edge load-balancers). Tier requirement: vendor-mitigation deployed within 4 hours of KEV listing OR isolation of the vulnerable interface; standard 14/30-day SLAs do not apply because the device IS the trust boundary.",
         "evidence": "CVE-2022-40684 let an unauthenticated request reach the FortiGate / FortiProxy / FortiSwitchManager administrative interface via a Forwarded header claiming 127.0.0.1 and a Report Runner User-Agent, taking over the device that enforces segmentation for everything behind it. Fortinet shipped fixed builds on 2022-10-03 but published FG-IR-22-377 only on 2022-10-10 and Horizon3's PoC landed 2022-10-13, so a routine appliance-patch window opened after mass scanning had begun — the alternative tier requirement, isolating the management interface with a local-in policy, was the only control available in that gap.",
         "gap_closes": [
-          "AU-ISM-1546",
+          "AU-Essential-8-Patch",
           "ISO-27001-2022-A.8.22",
           "NIS2-Art21-network-security"
         ]
@@ -72379,10 +72379,10 @@
         "adequate": false,
         "gap": "B2 assumes a privileged process acts under one coherent identity, but authority and identity split inside a single operation here and the lower-privileged half governed path resolution. No B2 evidence artefact — account inventories, privileged-access reviews, impersonation policy — records which identity resolves namespaces inside CSRSS."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "Evidence that the November 2022 update landed inside the ISM timeframe would be true and still insufficient, because Microsoft shipped the fix in three stages and the root-cause mitigation was not enabled for the exploited service until January 2023; 1546 has no concept of a symptom fix versus a root-cause fix."
+        "gap": "Below Maturity Level Three, ISM-1695 gives workstations and internal servers a month to apply a fix for a flaw CISA listed as exploited on its release day, 2022-11-08. The fix came in three stages and the root-cause mitigation was enabled for printfilterpipelinesvc.exe only in January 2023, so a host recorded as patched in November still carried the root cause."
       },
       "ISO-27001-2022-A.8.9": {
         "covered": true,
@@ -72397,7 +72397,7 @@
         "description": "For any CVE listed in CISA KEV: deploy verified mitigation (patch, live patch, or documented compensating controls) within 4 hours of KEV listing or patch availability, whichever is later.",
         "evidence": "CVE-2022-41073 was KEV-listed on 2022-11-08 with a 2022-12-09 due date and ransomware campaign use recorded, and Project Zero assesses the in-the-wild actor built it from the CVE-2022-29104 proof of concept already sitting on VirusTotal in July 2022 — four months before Microsoft detected the use. A month-long remediation window on a standard-user-to-SYSTEM primitive with a public sibling PoC is exploitation acceptance.",
         "gap_closes": [
-          "AU-ISM-1546"
+          "AU-Essential-8-Patch"
         ]
       },
       {
@@ -72407,7 +72407,7 @@
         "evidence": "CVE-2022-41073's November 2022 update reverted impersonation around the winspool.drv LoadLibraryExW call and broke the exploit, but the broader CSRSS OBJ_IGNORE_IMPERSONATED_DEVICEMAP mitigation only shipped in December 2022 and was not enabled for printfilterpipelinesvc.exe until January 2023 — so the Print Spooler disable used as a pre-patch compensating control still applied to the unfixed device-map root cause for two months after the host was recorded as patched.",
         "gap_closes": [
           "NIS2-Art21-vulnerability-handling",
-          "AU-ISM-1546"
+          "AU-Essential-8-Patch"
         ]
       },
       {
@@ -72634,10 +72634,10 @@
         "adequate": false,
         "gap": "Platform separation never broke — a single missing caller check let one untrusted app use system_server as a file-writing proxy four times without defeating SELinux, Linux permissions or the app sandbox — so a B4 hardening review finds every protective feature enabled and enforcing while the escalation runs straight through them."
       },
-      "AU-ISM-1808": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "1808 is written around software an entity procures and can hold a supplier to; handset firmware inverts that, with the OEM injecting privileged code into the OS and the fix arriving through a carrier-gated SMR that stops entirely at end of support, so for the affected device generation the outcome cannot be achieved at all — only accepted, or the fleet replaced."
+        "gap": "The ISM patches a handset's operating system under ISM-1878 and ISM-1751, outside the Essential Eight profiles, and the recovered sample targeted devices in late 2020, before the SMR Mar-2021 Release 1 fix those windows start from. For a handset Samsung no longer updates, the Essential Eight control that applies is replacement of the unsupported operating system under ISM-1501."
       },
       "ISO-27001-2022-A.5.15": {
         "covered": true,
@@ -72653,7 +72653,7 @@
         "evidence": "CVE-2021-25337 is driven entirely by a locally installed untrusted app calling Samsung's exported SemClipboardProvider in system_server with no permission attribute, and the caller check that fixes it exists only in SMR Mar-2021 Release 1 or later — a carrier-staggered, reboot-bearing OEM update that Google Play system updates do not cover. Blocking handsets below that SMR level from organizational data and constraining side-loaded installs on devices that cannot yet reach it is the only operator-side lever, since no MDM policy or platform hardening setting affects the provider declaration.",
         "gap_closes": [
           "UK-CAF-B4",
-          "AU-ISM-1808"
+          "AU-Essential-8-Patch"
         ]
       },
       {
@@ -72662,7 +72662,7 @@
         "description": "Network-reachable end-of-life devices with no vendor patch path must be isolated and decommissioned within a bounded window; mandatory compensating segmentation applies until removal since no remediation exists.",
         "evidence": "CVE-2021-25337's affected generation — the Galaxy S10, A50 SM-A505F and A51 SM-A515F class that the recovered commercial-surveillance chain targeted — is past Samsung's SMR support window, so any handset that never took the March 2021 build carries the exported system_server provider permanently with no fixed version obtainable. Those devices can only be isolated from sensitive networks and replaced.",
         "gap_closes": [
-          "AU-ISM-1808"
+          "AU-Essential-8-Patch"
         ]
       }
     ]
@@ -72806,10 +72806,10 @@
         "adequate": false,
         "gap": "There is no operator-side hardening for a use-after-free in an OEM display driver: the vulnerable path is the ordinary DECON window-configuration ioctl and the fix was Samsung moving fd_install() later inside its own code, so B4 offers no setting to disable, no interface to restrict and no compensating control on the device."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "1546 keys its timeframes to vendor advisory severity, and Samsung published this as a Moderate memory-corruption-leading-to-kernel-panic issue, so a conformant programme applied it on the routine monthly schedule while the same defect was already serving as the escalation stage of an in-the-wild chain TAG had captured in late 2020."
+        "gap": "Driver patching applies only at Maturity Level Three, and its 48-hour condition depends on a critical vendor rating or a known working exploit, so Samsung's Moderate rating put this flaw on the one-month schedule (ISM-1697). An in-the-wild chain captured in late 2020 already used it for kernel read and write."
       },
       "ISO-27001-2022-A.8.28": {
         "covered": true,
@@ -72834,7 +72834,7 @@
         "description": "For any CVE listed in CISA KEV: deploy verified mitigation (patch, live patch, or documented compensating controls) within 4 hours of KEV listing or patch availability, whichever is later.",
         "evidence": "CVE-2021-25370 was published by Samsung as a Moderate 'memory corruption in dpu driver' and scored 4.4 availability-only by NVD, so severity-keyed patch queues ranked it as a local denial of service on a phone while it was in fact the arbitrary-kernel-read/write stage of an in-the-wild surveillance chain, overwriting addr_limit and patching sys_call_table. A clock keyed to the 2022-11-08 KEV listing overrides the vendor's under-rating; one keyed to advisory severity does not.",
         "gap_closes": [
-          "AU-ISM-1546",
+          "AU-Essential-8-Patch",
           "NIS2-Art21-patch-management"
         ]
       },
@@ -73073,10 +73073,10 @@
         "adequate": false,
         "gap": "B2 rests on distinguishing standard users from privileged ones and governing privileged access through approvals and separate admin accounts, but on any host below 4.9.00086 standard-user credentials plus one crafted localhost IPC message produced NT AUTHORITY\\SYSTEM — privileged-access management controlled nothing the attacker actually needed."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "This is the control that would have closed it and it failed on dwell time rather than design: the fixed release and advisory landed 2020-08-05, public PoC availability was recorded in revision 1.1 on 2020-08-13, and CISA still had to add the CVE in October 2022 — because patch programmes routinely exempt the VPN client on the grounds that upgrading disconnects users."
+        "gap": "Below Maturity Level Three, ISM-1691 allows two weeks while a public proof of concept exists. The 4.9.00086 upgrade restarts the Secure Mobility Agent, drops the VPN session and needs a reboot that neither window plans for."
       },
       "ISO-27001-2022-A.8.9": {
         "covered": true,
@@ -73091,7 +73091,7 @@
         "description": "For any CVE listed in CISA KEV: deploy verified mitigation (patch, live patch, or documented compensating controls) within 4 hours of KEV listing or patch availability, whichever is later.",
         "evidence": "CVE-2020-3433 had a fixed release — AnyConnect 4.9.00086 — and an advisory on 2020-08-05, with public proof-of-concept code recorded in advisory revision 1.1 on 2020-08-13, yet CISA still had to add it to KEV on 2022-10-24 with knownRansomwareCampaignUse=Known. That is more than two years of dwell on a remote-access estate, caused by patch programmes exempting the VPN client because the upgrade restarts the Secure Mobility Agent and drops the session.",
         "gap_closes": [
-          "AU-ISM-1546"
+          "AU-Essential-8-Patch"
         ]
       },
       {
@@ -74050,10 +74050,10 @@
         "adequate": false,
         "gap": "B2 governs entitlements against identities the operator administers, with joiner-mover-leaver process and credential-strength policy; here the device itself hands the credential over before any authorisation is evaluated, and CAF's identity scope stops at enterprise IdM rather than the router terminating the circuit."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "ISM-1546's patch clocks run from a vendor release date, and twelve of the affected models have no release to measure from — no maturity level is reachable by patching an AC1450 or a DGN2200v4, and the position that actually works (enable password recovery, disable remote management) has no expression the control can evidence."
+        "gap": "ISM-1877 requires fixed firmware or NETGEAR's workaround within 48 hours of release at every maturity level once a working exploit exists. For the twelve models with no fixed build, the exposure closes only with the workaround (password recovery enabled and remote management disabled together) or with replacement, and a firmware-version check does not show whether the workaround is applied."
       },
       "ISO-27001-2022-A.8.9": {
         "covered": true,
@@ -74068,7 +74068,7 @@
         "description": "Every network-attached embedded device (IP cameras, video servers, NVRs, routers, print/scan appliances) must carry an end-of-support date in the asset inventory, and any device past that date that exposes a remotely reachable management or media surface must be removed from untrusted networks and scheduled for replacement — patching is not an option once the vendor retires the model. The distinguishing test: query the asset inventory for devices whose firmware lifecycle has ended and whose management interface is reachable from an untrusted segment; any non-empty result that lacks a replace-or-formally-risk-accept decision is a finding. Paper patch-management policies that assume a fix always exists leave actively-exploited EOL devices (GeoVision IP cameras, recruited by Mirai-style botnets) on the network indefinitely.",
         "evidence": "CVE-2017-5521 — NETGEAR published fixed firmware for 19 router models in KB 30632 but left eight routers and four DSL gateways (AC1450, WNR1000v3, WNDR4000, DGN2200v4 and others) with no build at all, and CISA's KEV required action adds that any affected unit past end-of-life should be disconnected rather than kept in service. Only an inventory that carries each router's end-of-support date and forces a replace-or-risk-accept decision produces an action for those twelve models, because there is no vendor release to patch to.",
         "gap_closes": [
-          "AU-ISM-1546",
+          "AU-Essential-8-Patch",
           "EU-CRA-Art13"
         ]
       },
@@ -74078,7 +74078,7 @@
         "description": "For any CVE listed in CISA KEV: deploy verified mitigation (patch, live patch, or documented compensating controls) within 4 hours of KEV listing or patch availability, whichever is later.",
         "evidence": "CVE-2017-5521 — two unauthenticated requests to /unauth.cgi then /passwordrecovered.cgi return the router admin username and password in cleartext, with the exploit shipped in Exploit-DB 41205, a Nuclei template and a RouterSploit module; on the twelve unfixed models the entire remediation is the vendor workaround (enable password recovery AND disable remote management, either alone insufficient). The KEV clock has to bind documented compensating controls, not only firmware, which a patch timeframe measured from a vendor release date cannot express.",
         "gap_closes": [
-          "AU-ISM-1546"
+          "AU-Essential-8-Patch"
         ]
       }
     ]
@@ -74381,10 +74381,10 @@
         "adequate": false,
         "gap": "B2 assumes authentication runs against managed identities subject to entitlement review and credential lifecycle; the distribution port authenticates peers with one shared secret set to 'monster' for every installation worldwide, a credential no joiner-mover-leaver or privileged-access review ever touched, while B2 assessments of CouchDB admin accounts and HTTP auth found nothing wrong."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "The 48-hour ML3 target is orders of magnitude slower than the sub-second reconnaissance-to-execution tempo observed against exposed nodes, and it is measured against an exposure the operator could not identify by port number — the honest control statement is that the distribution port needed firewalling before the advisory, not patching within two days after it."
+        "gap": "For an internet-exposed node, which is an online service, ISM-1876 allows 48 hours at every level, far slower than the under-half-second reconnaissance-to-execution time CounterCraft observed; an internal node is an other application under ISM-1693, with one month from Maturity Level Two and no Maturity Level One timeframe. A node whose epmd and distribution port are unreachable from outside the host is not vulnerable, and the patching controls do not require that restriction."
       },
       "ISO-27001-2022-A.8.22": {
         "covered": true,
@@ -74419,7 +74419,7 @@
         "description": "For any CVE listed in CISA KEV: deploy verified mitigation (patch, live patch, or documented compensating controls) within 4 hours of KEV listing or patch availability, whichever is later.",
         "evidence": "CVE-2022-24706 — the public exploit landed 2022-05-11 and CounterCraft observed under half a second from first reconnaissance to command execution against exposed nodes before Kinsing enrolment, so a two-day patch timeframe is orders of magnitude behind the tempo. A KEV-bound 4-hour clock that accepts the firewall-plus-unique-cookie mitigation as verified remediation is the only response window in the same order of magnitude.",
         "gap_closes": [
-          "AU-ISM-1546"
+          "AU-Essential-8-Patch"
         ]
       }
     ]
@@ -75327,10 +75327,10 @@
         "adequate": false,
         "gap": "B2 asks whether sensitive data is reachable only by authorised identities and whether privileged access is minimised, but the attacker needs no privilege: the identity performing the bypass is the ordinary interactive user, and the boundary crossed is macOS consent, which is not an identity or directory construct a B2 assessment enumerates. An estate scoring well through MDM-enforced non-admin accounts is exactly the estate this works on."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "ISM-1546's patch windows are driven by vendor-assessed severity and internet exposure, and a local confidentiality-only macOS flaw lands in the slowest band under any reading, with the operating-system guidance written around a Windows SOE rather than a Catalina fleet. The one action that closes it therefore never receives an accelerated window, despite the exploit being four shell commands with a maintained module behind them."
+        "gap": "Below Maturity Level Three, ISM-1695 gives a Mac one month to reach 10.15.6 although a maintained Metasploit post module exploits the flaw. ISM-1696 applies the 48-hour window only at Maturity Level Three, and the update needs a restart."
       },
       "ISO-27001-2022-A.8.8": {
         "covered": true,
@@ -75345,7 +75345,7 @@
         "description": "iOS / iPadOS / macOS estates must enforce KEV-class updates within 24h via DDM; user-deferral disallowed.",
         "evidence": "CVE-2020-9934 was fixed by Apple on 2020-07-15 in macOS Catalina 10.15.6 and iOS/iPadOS 13.6 but not KEV-listed until 2022-09-08, and as a local confidentiality-only flaw scored CVSS 5.5 with no CWE it lands in the slowest band of every severity-driven patch window — only a KEV-deadline-bound, deferral-disallowed Apple update policy moves an estate off 10.15.x while a maintained Metasploit post module is turning any low-privilege foothold into camera, microphone and Full Disk Access.",
         "gap_closes": [
-          "AU-ISM-1546",
+          "AU-Essential-8-Patch",
           "ISO-27001-2022-A.8.8"
         ]
       },
@@ -75593,10 +75593,10 @@
         "adequate": false,
         "gap": "B4 expects unnecessary services and interfaces to be removed and the rest secured, but T3 is not removable in that sense: it is WebLogic's own administration and clustering protocol, multiplexed onto the same port 7001 as HTTP. Hardening the visible tier with TLS, a WAF and application authentication leaves the same socket deserializing untrusted Java objects pre-authentication, and nothing in a B4 review prompts an assessor to separate two protocols on one port."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "This is the maximum case on both of ISM-1546's axes — an internet-facing application, CVSS 9.8, working public exploit four days after the vendor fix — and the control still fails, because 'patched' is a binary state in the assessment with no expression for a vendor patch that is itself incomplete. A host recorded as remediated on the April CPU dropped out of the remediation queue while the bypass route stayed open until July."
+        "gap": "An internet-reachable WebLogic server is an online service under ISM-1876, which requires the fix within 48 hours of release at every maturity level, and an internal one falls under ISM-1693 from Maturity Level Two. Applying the April 2018 Critical Patch Update met either control, but public bypasses of its resolveProxyClass blacklist kept the host exploitable until Oracle released the July fix."
       },
       "ISO-27001-2022-A.8.8": {
         "covered": true,
@@ -75612,7 +75612,7 @@
         "evidence": "CVE-2018-2628 is unauthenticated deserialization of T3 traffic on WebLogic port 7001, where T3 is multiplexed onto the same socket as HTTP so TLS, a WAF and application authentication leave the pre-authentication listener untouched; the one action that removes the attack surface independent of which Critical Patch Update is installed is a weblogic.security.net.ConnectionFilterImpl filter or a network ACL in front of 7001 so untrusted hosts never reach the protocol.",
         "gap_closes": [
           "UK-CAF-B4",
-          "AU-ISM-1546",
+          "AU-Essential-8-Patch",
           "ISO-27001-2022-A.8.8"
         ]
       },
@@ -75623,7 +75623,7 @@
         "evidence": "CVE-2018-2628’s April 2018 Critical Patch Update was a class blacklist inside resolveProxyClass (sun.rmi.server.UnicastRef, java.rmi.registry.Registry) rather than a fix to the deserialization path, and bypasses using java.rmi.activation.Activator and weblogic.jms.common.StreamMessageImpl were public within days, so for three months an attestation showing cpuapr2018 installed was evidence of a still-exploitable internet-reachable listener — the check must be that the build carries the July fix, not merely a CPU newer than April.",
         "gap_closes": [
           "NIST-800-53-SI-2",
-          "AU-ISM-1546"
+          "AU-Essential-8-Patch"
         ]
       },
       {
@@ -75870,10 +75870,10 @@
         "adequate": false,
         "gap": "B4 credits keeping repositories private as hardening, but the threshold is read access to a single repository, granted anonymously wherever any public repository exists. The archive endpoint is core Bitbucket function and cannot be removed, so B4's configuration levers narrow the attacker pool without closing the path."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "ISM-1546 scales patch timeframes by whether a system is internet-facing, and most Bitbucket Server deployments sit on the corporate network and inherit the longer window. Atlassian's advisory landed 2022-08-24; a working public exploit, a Metasploit module and in-the-wild attempts followed within about four weeks, outrunning a clock keyed to exposure classification rather than to exploit availability."
+        "gap": "An internet-accessible instance has 48 hours from release under ISM-1876 because CISA lists the flaw as known exploited. An internal instance has one month from Atlassian's 2022-08-24 fix under ISM-1693 at Maturity Levels Two and Three and no timeframe at Level One, and in-the-wild attempts on 2022-09-20 and 2022-09-23 fell inside that month."
       },
       "ISO-27001-2022-A.8.28": {
         "covered": true,
@@ -75888,7 +75888,7 @@
         "description": "For any CVE listed in CISA KEV: deploy verified mitigation (patch, live patch, or documented compensating controls) within 4 hours of KEV listing or patch availability, whichever is later.",
         "evidence": "CVE-2022-36804 had fixed builds from Atlassian's 2022-08-24 advisory, but a Metasploit module, a Nuclei template that self-discovers project keys and slugs, and in-the-wild attempts arrived roughly four weeks later, with KEV listing on 2022-09-30. Most Bitbucket Server deployments sit on the corporate network and inherit the longer patch window that keys on exposure classification; a KEV-listing-triggered clock is what re-prioritises an internally-classified SCM the moment point-and-shoot tooling exists.",
         "gap_closes": [
-          "AU-ISM-1546"
+          "AU-Essential-8-Patch"
         ]
       },
       {
@@ -76127,10 +76127,10 @@
         "adequate": false,
         "gap": "B2 would classify the Apex One console as an administrative interface needing privileged-account separation and strong authentication, and many deployments run it as a shared operations console instead. This CVE makes console access equivalent to arbitrary code execution on every managed endpoint through the rollback channel, so the account-tiering decision has to be taken against estate-wide blast radius, not console-scoped risk."
       },
-      "AU-ISM-1808": {
+      "AU-ISM-1452": {
         "covered": true,
         "adequate": false,
-        "gap": "Software supply-chain risk management sees the product as an artefact received and evidences it with questionnaires, provenance and vendor attestation. None of that asks whether the product's own agent verifies the integrity of packages its management server tells it to install, so a fully compliant assessment would have rated Apex One low risk on precisely the property that failed."
+        "gap": "ISM-1452 assesses Trend Micro as a supplier and does not test whether the Apex One client verifies a rollback package before installing it. An assessment that meets the control can rate the supplier low risk while console access still leads to code execution on the managed endpoints."
       },
       "ISO-27001-2022-A.8.7": {
         "covered": true,
@@ -76147,7 +76147,7 @@
         "gap_closes": [
           "NIST-800-53-SR-11",
           "NIS2-Art21-supply-chain",
-          "AU-ISM-1808"
+          "AU-ISM-1452"
         ]
       },
       {
@@ -76303,10 +76303,10 @@
         "adequate": false,
         "gap": "B4 assumes attack surface can be reduced by configuration, but /dev/msm_acdb is the node the audio calibration subsystem needs to function — removing it breaks audio on every MSM handset. There is no compensating control B4 can name for an unbounded copy_from_user into a stack buffer inside a driver the operator cannot rebuild."
       },
-      "AU-ISM-1808": {
+      "AU-ISM-1452": {
         "covered": true,
         "adequate": false,
-        "gap": "The control assumes an operator can inventory components and validate software integrity. For a Code Aurora driver baked into a device image there is no component record, no version string to compare against QCIR-2013-00002-1 and no way to determine whether a given build carries the 2013-06-21 fix, so its evidence requirements simply cannot be met on this asset class."
+        "gap": "ISM-1452 applies to the handset supplier, but the vulnerable driver is inherited Code Aurora board-support code whose 2013-06-21 fix appeared on a device only if its OEM rebased, and some handsets never received a fixed image. With no component record required below the direct supplier, the assessment cannot establish whether a given boot image carries the QCIR-2013-00002-1 fix."
       },
       "ISO-27001-2022-A.8.8": {
         "covered": true,
@@ -76332,7 +76332,7 @@
         "evidence": "CVE-2013-2597's driver is compiled into the boot image rather than loaded as a module, so it cannot be replaced without reflashing an OEM firmware image that for these MSM handsets never shipped, and the vendor advisory URL NVD carries for QCIR-2013-00002-1 is now a dead link. /dev/msm_acdb cannot be removed without breaking audio on the device, so there is no configuration lever left and bounded-window retirement is the only remediation available.",
         "gap_closes": [
           "UK-CAF-B4",
-          "AU-ISM-1808"
+          "AU-ISM-1452"
         ]
       },
       {
@@ -76342,7 +76342,7 @@
         "evidence": "CVE-2013-2597 lives in Qualcomm/Code Aurora board-support code inherited unmodified into every MSM-based OEM Android build — two tiers upstream of the handset vendor that supplier assessments were pointed at — with no component record, no version string to compare against QCIR-2013-00002-1 and no SBOM for a flashed boot image. Inventory that reaches transitive upstream components is the precondition for knowing the vulnerable driver is present at all, which is why the assessment could not be evidenced on this asset class.",
         "gap_closes": [
           "NIS2-Art21-supply-chain",
-          "AU-ISM-1808"
+          "AU-ISM-1452"
         ]
       }
     ]
@@ -76488,10 +76488,10 @@
         "adequate": false,
         "gap": "B4 is evidenced through hardening baselines and patch state, but the introducing commit sat unnoticed for three years and the bug was ultimately found by Trinity syscall fuzzing — an assurance activity B4 does not contemplate. A fully-evidenced B4 posture told the operator nothing about this exposure between 2011 and 2013."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "The patch clock starts at advisory publication, but semtex.c circulated at the same moment the fix landed in 3.8.9, so even the 48-hour Maturity Level 3 window is a window in which every unprivileged shell account on the host already held root. A timeframe-based control cannot express a clock that starts simultaneously with the exploit's."
+        "gap": "The kernel is patched as an operating system, but the semtex.c exploit circulated as the fix landed in 3.8.9, so even the 48-hour windows of ISM-1877 and ISM-1696 left local users able to gain root, and internal hosts below Maturity Level Three have one month under ISM-1695. Every vendor fix needs a reboot with no live patch available, which neither window plans for."
       },
       "ISO-27001-2022-A.8.8": {
         "covered": true,
@@ -76516,7 +76516,7 @@
         "description": "For any system that processes production workloads and cannot tolerate unplanned reboots: live kernel patching capability (kpatch, livepatch, kGraft, or equivalent) must be deployed and tested quarterly.",
         "evidence": "CVE-2013-2094's every vendor remediation — RHSA-2013:0830, 0832, 0840 and 0841, RHSA-2013:0829 for MRG 2, and USN-1825-1 through USN-1838-1 — is a kernel package upgrade requiring a reboot, in code compiled into vmlinux with no hot-swap path, while semtex.c circulated at the moment the fix landed in 3.8.9. A shared batch, jump or hosting tier that could not take an unplanned reboot was owned inside its own patch window, so the capability to apply the fix without restarting is what makes any patch timeframe achievable here.",
         "gap_closes": [
-          "AU-ISM-1546",
+          "AU-Essential-8-Patch",
           "DORA-Art-9"
         ]
       },
@@ -76765,10 +76765,10 @@
         "adequate": false,
         "gap": "B4 expects unneeded functionality to be disabled, but the vulnerable function here is ordinary archive extraction — the mechanism the CMS uses to install modules and themes. That is why Drupal offered blocking tar-family uploads as an emergency mitigation rather than as a hardening default: the control's cost is the platform's core administrative workflow, and B4 gives an operator no framework for that trade."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "ISM-1546 drives patching of applications with known exploited vulnerabilities, but a PHP library inside a CMS tarball is not an application any inventory tool enumerates. Worse, the naive compliant action — bump to the version the advisory names — satisfies the control while shipping the release that broke relative-symlink extraction, so operators who then reverted reopened the traversal with a green control."
+        "gap": "An internet-accessible Drupal site, and the php-pear Archive_Tar that serves it, is an online service, and the KEV listing records exploitation, so ISM-1876 requires the fix within 48 hours of release at every maturity level. Internal installs fall under ISM-1693 from Maturity Level Two. Archive_Tar 1.4.12 broke relative-symlink extraction, so an estate that reverted to 1.4.11 reopened the traversal while the control was recorded as met, and only 1.4.13 is both fixed and free of the regression."
       },
       "ISO-27001-2022-A.8.28": {
         "covered": false,
@@ -76793,7 +76793,7 @@
         "description": "A vulnerability scanner that reports 'patched' based on kernel package version alone is paper compliance. The operational test: does the scan account for the module-unload mitigation surface, AND does it verify the kernel is on a build that includes the specific Fragnesia patch (not just any version newer than the Dirty Frag patch that introduced Fragnesia)?",
         "evidence": "CVE-2020-36193's advisory names Archive_Tar 1.4.12 as the fix, but 1.4.12 rejected legitimate relative symlinks (pear/Archive_Tar issue #35) and was widely rolled back to restore module and theme installs — so a version-string check records the host as remediated at 1.4.12 and stays green after the revert to 1.4.11, while only 1.4.13 is both fixed and functional.",
         "gap_closes": [
-          "AU-ISM-1546"
+          "AU-Essential-8-Patch"
         ]
       }
     ]
@@ -76930,10 +76930,10 @@
         "adequate": false,
         "gap": "B5 asks whether the essential function is resilient to disruption. The essential function stays up throughout — that is the substance of the vendor's own severity FAQ — so a B5 assessment framed as 'can we keep operating' returns green with the misconfiguration untouched, because the outcome B5 measures is not the outcome at risk."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "ISM-1546 drives patching of known-exploited vulnerabilities, and a PAN-OS upgrade on the device carrying all site traffic realistically takes weeks. The gap is that the vendor's no-reboot workarounds neutralise the reflection in a single commit, and the control's patch-centric framing gives an assessor neither credit for nor a prompt toward taking that immediate mitigation while the upgrade is scheduled."
+        "gap": "ISM-1877 gives this KEV-listed firewall flaw 48 hours at every maturity level, but the fix is split across six PAN-OS branches and each upgrade reboots the device carrying all site traffic. Meeting the window therefore depends on the single-commit, no-reboot configuration workaround, which ISM-1877 accepts as a vendor mitigation but does not name."
       },
       "ISO-27001-2022-A.8.9": {
         "covered": true,
@@ -76948,7 +76948,7 @@
         "description": "Compliance frameworks must define a distinct patch SLA tier for pre-auth RCE on perimeter-trust-boundary devices (firewalls, VPN concentrators, WAFs, edge load-balancers). Tier requirement: vendor-mitigation deployed within 4 hours of KEV listing OR isolation of the vulnerable interface; standard 14/30-day SLAs do not apply because the device IS the trust boundary.",
         "evidence": "CVE-2022-0028 is a KEV-listed (2022-08-22) defect on PA-Series, VM-Series and CN-Series firewalls whose external-facing interface is the perimeter itself, and Palo Alto states outright that exploitation does not affect the confidentiality, integrity or availability of the appliance — so a routine appliance-patch window generates no internal pressure at all while the device amplifies spoofed TCP at a third party. Only an SLA tier keyed to KEV listing on a perimeter device, rather than to measured self-impact, starts the clock.",
         "gap_closes": [
-          "AU-ISM-1546",
+          "AU-Essential-8-Patch",
           "NIS2-Art21-network-security"
         ]
       },
@@ -76958,7 +76958,7 @@
         "description": "For any web-fabric vulnerability with a configuration-side mitigation path: that path must be inventoried, tested, and deployable independent of the vendor-patch path. Operators cannot wait for nginx 1.30.1+ if a named-capture refactor mitigates immediately.",
         "evidence": "CVE-2022-0028's vendor workarounds — removing the URL-filtering profile from any security rule whose source zone has an external-facing interface, or enabling zone protection with 'TCP Drop > TCP SYN with Data' and 'Strip TCP Options > TCP Fast Open' or a SYN activation threshold of 0 — neutralise the reflection in a single configuration commit with no reboot, while the PAN-OS 10.2.2-h2-class upgrade is maintenance-window work on the device carrying all site traffic. The mitigation path has to be pre-inventoried and tested, because the patch-centric framing gives an assessor no prompt toward taking it.",
         "gap_closes": [
-          "AU-ISM-1546",
+          "AU-Essential-8-Patch",
           "ISO-27001-2022-A.8.9"
         ]
       }
@@ -77278,10 +77278,10 @@
         "adequate": false,
         "gap": "B4 treats the browser as a hardened client, but the boundary this breaks is the Intent dispatcher arbitrating between a web origin and an OS-level navigation, and no B4 configuration control — managed policy baseline, extension allowlist, download restriction, enterprise proxy — changes its input validation. An outcome rated achieved describes hardening this path never had to pass through."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "ISM-1546 is scoped to applications in the Standard Operating Environment, so Chrome on a personally owned handset is neither measured nor compelled. For the desktop estate the exploited-vulnerability window starts at the KEV listing, while the vendor had known of in-the-wild use for a month before that — compliance was achievable throughout the exposure window without shortening it by a day."
+        "gap": "An exploit was in the wild from at least 2022-07-19, four weeks before the 2022-08-16 fix started any window, and Maturity Levels One and Two then allow a browser two more weeks (ISM-1691); only Maturity Level Three requires 48 hours (ISM-1692). The fix needs a full browser restart and ships separately for Edge, Opera and other Chromium-derived browsers."
       },
       "ISO-27001-2022-A.8.9": {
         "covered": true,
@@ -77297,7 +77297,7 @@
         "evidence": "CVE-2022-2856 cannot be policy-gated at all — Chrome's Intent handling cannot be disabled or restricted by enterprise policy, and the fix does not take effect until every browser window closes — so a fully enforced hardened-Chrome baseline leaves the dispatcher identically reachable and only the move to 104.0.5112.101/102 removes it. Any update ring that defers the security channel extends a window Google already knew was being exploited.",
         "gap_closes": [
           "ISO-27001-2022-A.8.9",
-          "AU-ISM-1546"
+          "AU-Essential-8-Patch"
         ]
       },
       {
@@ -77306,7 +77306,7 @@
         "description": "For any CVE listed in CISA KEV: deploy verified mitigation (patch, live patch, or documented compensating controls) within 4 hours of KEV listing or patch availability, whichever is later.",
         "evidence": "CVE-2022-2856 was reported by Google TAG on 2022-07-19 with an exploit already in the wild, fixed on 2022-08-16 and KEV-listed 2022-08-18, and CISA's note records that the same Chromium defect reaches Edge, Opera and other derivatives — so a routine application-patch cycle scoped to the Chrome version string moved neither fast enough nor across the whole exposed population, while a 4-hour KEV-triggered mitigation deadline compresses the remaining window to hours.",
         "gap_closes": [
-          "AU-ISM-1546"
+          "AU-Essential-8-Patch"
         ]
       }
     ]
@@ -86639,7 +86639,7 @@
       "AU-ISM-1546": {
         "covered": true,
         "adequate": false,
-        "gap": "A coerced NTLM exchange is a legitimate credential use steered to the wrong endpoint."
+        "gap": "An estate that authenticates every user meets ISM-1546 while unauthenticated LSARPC calls make a domain controller authenticate over NTLM to an attacker, and AD CS web enrollment accepts the relayed machine-account credential. The control does not require Extended Protection for Authentication or NTLM restriction, which the May 2022 update needs alongside it to stop the relay."
       },
       "ISO-27001-2022-A.8.8": {
         "covered": true,
@@ -96132,15 +96132,10 @@
         "adequate": false,
         "gap": "D1 asks for response and recovery plans that are documented, tested and adequate for the systems in scope, and most such plans for a firewall describe failover and configuration restore. Neither addresses recovering an appliance a state actor implanted through the firmware update path, where the config restore may carry the compromise forward and every stored VPN secret must be treated as disclosed. A tested plan that ends at restoring the last known-good configuration satisfies D1 and reinstates the adversary's access."
       },
-      "AU-ISM-1546": {
-        "covered": true,
-        "adequate": false,
-        "gap": "The control requires users to authenticate before being granted access, and every step of this attack complies: the caller presents a real Firebox credential and is authenticated. The defect is in what the appliance grants afterwards, mapping an unprivileged identity onto a privileged management session, which is an authorisation decision no authentication control inspects. Evidence that all Firebox accounts authenticate correctly is true and does not touch the flaw."
-      },
       "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "Patching drives the Fireware upgrade and measures completion by installed version, which misreads this appliance family in two ways. A unit that has staged 12.7.2_U1 but not restarted is still executing the vulnerable build while reporting the fixed version, and a unit that was externally reachable beforehand may carry a firmware-resident implant the upgrade does not remove. The control also tends to be scoped to current T-series and M-series hardware, leaving T15, T35 and the legacy XTM line off the report entirely."
+        "gap": "Patching drives the Fireware upgrade and records completion by installed version, yet a unit that has not restarted onto the update still runs the vulnerable build, and a unit whose management was externally reachable may keep a firmware-resident implant the upgrade does not remove. The attacker authenticates with a real unprivileged account, so authentication evidence does not show the flaw, and a report scoped to current T-series and M-series hardware leaves T15, T35 and the legacy XTM line out."
       },
       "ISO-27001-2022-A.8.22": {
         "covered": true,
@@ -104451,10 +104446,10 @@
         "adequate": false,
         "gap": "CAF B2 is undercut because the access-enforcement point itself — the firewall authenticating VPN and management access — accepts a forged identity, up to administrator on the web UI; no downstream authorization control can recover once the authentication decision is bypassed at the gateway."
       },
-      "AU-ISM-1559-IdP": {
+      "AU-ISM-1546": {
         "covered": true,
         "adequate": false,
-        "gap": "ISM 1559 is treated as met once IdP integration exists, but on an affected PAN-OS with validation disabled the trust anchor is missing entirely and any assertion is honoured; a compliant-on-paper SSO integration is materially broken until the validation toggle is confirmed set."
+        "gap": "A PAN-OS device with SAML single sign-on meets the control by configuration, but with 'Validate Identity Provider Certificate' unchecked it accepts a crafted assertion from an unauthenticated attacker as a user or administrator. Evidence for the control does not show whether that option is set or whether the device runs 8.1.15, 9.0.9, 9.1.3 or later."
       },
       "ISO-27001-2022-A.5.16-Federated": {
         "covered": true,
@@ -104475,7 +104470,7 @@
         "evidence": "PAN-OS CVE-2020-2021 is a CVSS 10.0 authentication bypass on internet-facing GlobalProtect gateways, KEV-listed 2022-03-25 with known ransomware use; a KEV-tied SLA forces the 8.1.15/9.0.9/9.1.3 upgrade — or, on a CA-signed IdP certificate, the advisory's configuration route — onto a bounded clock rather than an appliance patch window, and puts EoL 8.0 units on a migration clock instead.",
         "gap_closes": [
           "NIST-800-53-SI-2",
-          "AU-ISM-1559-IdP"
+          "AU-ISM-1546"
         ]
       }
     ]
@@ -107469,7 +107464,7 @@
       "AU-ISM-1546": {
         "covered": true,
         "adequate": false,
-        "gap": "ISM-1546 requires authentication before access, yet the unconfigured-password state admits an attacker with no authentication event, so the control reads as met while the product accepts access without a credential."
+        "gap": "ISM-1546 applies to the ColdFusion Administrator, but ColdFusion 9.0, 9.0.1 and 9.0.2 allow a remote attacker to bypass authentication when a password is not configured, and a record that the Administrator has a login does not show whether both the Administrator and RDS passwords are set. The control sets no response to Adobe's disclosure, so the exposure closes only when both passwords are set, the APSB13-03 hotfix is applied, or the install is migrated off end-of-life 9.x."
       },
       "ISO-27001-2022-A.5.15": {
         "covered": true,
@@ -107859,7 +107854,7 @@
       "AU-ISM-1546": {
         "covered": true,
         "adequate": false,
-        "gap": "ISM-1546 authentication implemented at the login page does not cover the unauthenticated management path this CVE reaches, because the privileged operation runs for a caller who was never authenticated in the first place."
+        "gap": "A router with administrator authentication configured at the login page meets ISM-1546, yet the management interface runs privileged functions for a caller who never authenticated. The control sets no response to the vendor's disclosure, so closing the exposure depends on ISM-1877 and on the firmware upgrade or the interim restriction of web management."
       },
       "ISO-27001-2022-A.8.22": {
         "covered": true,
@@ -114460,10 +114455,10 @@
         "adequate": false,
         "gap": "B4 records default distribution packaging as the hardened baseline, and default packaging on Red Hat-derived distributions is what installs setuid-root userhelper — the entry point the attack needs. The minimisation that actually closes the path, de-suid-ing or removing usermode where its chfn interface is unused, is available and is not something a B4 assessment asks for."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "ISM-1546 measures a patch window from vendor release, and that window closed in 2015. It gives an assessor no language for a host still running libuser below 0.56.13-8 in 2026, because the finding it would raise was raised and closed a decade ago and the control has no concept of exploitation evidence arriving after remediation was recorded."
+        "gap": "The operating system controls applied from Red Hat's July 2015 release, and with the working exploit Qualys disclosed on 2015-07-23, every window, including the one month under ISM-1695, closed in 2015. A host still below libuser 0.56.13-8 or 0.60-7 has been out of compliance since then, and the 2026-08-26 KEV listing sets no new deadline for it."
       },
       "ISO-27001-2022-A.8.8": {
         "covered": true,
@@ -114480,7 +114475,7 @@
         "gap_closes": [
           "NIST-800-53-SI-2",
           "NIS2-Art21-patch-management",
-          "AU-ISM-1546",
+          "AU-Essential-8-Patch",
           "ISO-27001-2022-A.8.8"
         ]
       },
@@ -116326,7 +116321,7 @@
       "AU-ISM-1546": {
         "covered": true,
         "adequate": false,
-        "gap": "The ISM requirement that users are authenticated before being granted access to a system and its resources was met, and the attacker authenticated - to RDS, with the empty password the product shipped. The control does not distinguish between authenticating and authenticating against something worth authenticating against, and it has no requirement that a session issued by one component be scoped to that component rather than accepted by another. That transitivity, not the strength of any password, is the defect."
+        "gap": "ISM-1546 applies, but an RDS login on the default empty password yields a session the ColdFusion Administrator honors, so a system whose Administrator prompts for its own password meets the control on assessment while an attacker holds administrative access. The control does not require that RDS carries a password or is disabled, or that a session one component issues is refused by another."
       },
       "ISO-27001-2022-A.8.8": {
         "covered": true,
@@ -119627,10 +119622,10 @@
         "adequate": false,
         "gap": "A build-server recovery plan written around availability restores the controller and restarts the pipelines. The decision this incident needs pre-agreed is that every credential the controller held is exposed and every artefact built in the window is suspect — and Watchbog's cron persistence, reported against this CVE in 2019, means a restored-not-rebuilt controller comes back compromised."
       },
-      "AU-ISM-1808": {
+      "AU-ISM-1452": {
         "covered": true,
         "adequate": false,
-        "gap": "ISM-1808 governs the software an organisation consumes. Jenkins is simultaneously consumed software and the machine that produces the organisation's own software, and the control reaches only the first half — it imposes no requirement to establish what a controller signed or published while it was running weekly 2.153 or LTS 2.138.3."
+        "gap": "ISM-1452 assesses the supplier of Jenkins as a source of software the organization consumes, but a controller also builds and publishes the organization's own software with credentials this flaw exposes. The control sets no requirement to establish which artifacts a controller published while it ran weekly 2.153 or earlier or LTS 2.138.3 or earlier and was reachable."
       },
       "ISO-27001-2022-A.5.21": {
         "covered": true,
@@ -119655,7 +119650,7 @@
         "evidence": "Attached as the closest existing control on build-output provenance, and extended here from the tag case to the controller case: this CVE gives an unauthenticated HTTP request the Jenkins service account, and with it the credentials store, signing material and deploy tokens for everything the instance publishes. The provenance question the control asks about a release tag is the same one nobody can answer about an artefact built on a controller that was running weekly 2.153 or LTS 2.138.3 while reachable — which is what turns this from a host compromise into a downstream one. The testable requirement is that every published artefact is traceable to a commit reachable from the default branch and to a build whose inputs are recorded, so that an exposure window can be converted into a specific list of suspect artefacts rather than a blanket assumption.",
         "gap_closes": [
           "NIS2-Art21-supply-chain",
-          "AU-ISM-1808",
+          "AU-ISM-1452",
           "ISO-27001-2022-A.5.21"
         ]
       },
@@ -122201,10 +122196,10 @@
         "adequate": false,
         "gap": "B4 examines the platform build, and the exposure that matters here is inbound reachability of the web interface plus how many accounts can authenticate to it. On an internet-reachable Nagios XI a read-only monitoring login is an unauthenticated-equivalent path the moment the credential leaks, and the assessment does not ask that question."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "The control measures an Essential Eight Maturity Model window anchored on the vendor advisory date, and there is no clearly published vendor release to anchor to. The Metasploit module carries a 2021-02-13 disclosure date and CISA listed the CVE on 2022-01-18, but no reviewed Nagios advisory names the fixed build — so neither the assessor nor the operator can state when the clock started."
+        "gap": "An internet-reachable Nagios XI server is an online service with a 48-hour window at every level when a working exploit exists (ISM-1876), and an internal one gets one month from Maturity Level Two (ISM-1693). Both windows run from a vendor release that no reviewed Nagios advisory identifies, so neither the assessor nor the operator can state when the clock started."
       },
       "ISO-27001-2022-A.8.8": {
         "covered": true,
@@ -122239,7 +122234,7 @@
         "description": "For any CVE listed in CISA KEV: deploy verified mitigation (patch, live patch, or documented compensating controls) within 4 hours of KEV listing or patch availability, whichever is later.",
         "evidence": "CISA listed this on 2022-01-18 with a 2022-02-01 due date, eleven months after the Metasploit module's 2021-02-13 disclosure date. The 'documented compensating controls' branch carries the weight here more than usual, because the fixed build cannot be established from a Nagios source — the GitHub advisory records affected and patched versions as unknown. What can be verified and written down is that the web interface is unreachable from untrusted networks and that the account inventory has been reduced, which is a defensible mitigation state even when 'upgraded to version X' cannot be evidenced.",
         "gap_closes": [
-          "AU-ISM-1546"
+          "AU-Essential-8-Patch"
         ]
       }
     ]
@@ -126632,10 +126627,10 @@
         "adequate": false,
         "gap": "Identity and access control assesses the access model - who holds which role, how access is granted and reviewed - and that evidence is unaffected by this flaw and remains accurate after it. A B2 outcome judged achieved on a documented, reviewed, least-privilege ITSM access model sits on top of an instance that answers REST routes to nobody in particular."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "Patch operating systems and applications sets 48-hour timeframes at ML2/ML3 for internet-facing or exploited applications, which is this CVE on both counts, so the control is capable. Its weakness here is the trigger: the window anchors on advisory date and this CVE's advisory surface is thin - NVD records no references and the vendor readme entry for build 11302 is no longer on the live page - so an entity working from vendor advisory feeds may never receive the event the timeframe measures from."
+        "gap": "An internet-reachable instance is an online service with a 48-hour window at every level when a working exploit exists (ISM-1876), and an internal one gets one month from Maturity Level Two (ISM-1693). The release that starts the window is poorly documented, and the build that closes CVE-2021-44077 on the same host is higher than 11302."
       },
       "ISO-27001-2022-A.5.15": {
         "covered": true,
@@ -126671,7 +126666,7 @@
         "description": "4h KEV-listing mitigation SLA applies.",
         "evidence": "KEV listed this on 2021-12-01 with a 2021-12-15 due date, and listed CVE-2021-44077 on the same product on the same day with the same due date. The two obligations land on one host and one upgrade, so the SLA has to be measured against the build that closes both rather than against the earlier CVE's minimum of 11302 - closing this entry at 11302 while the sibling stays open converts one satisfied SLA into one missed one on the same asset. Verified mitigation for this CVE is the public template's request re-run against the upgraded instance and refused, not the build number alone.",
         "gap_closes": [
-          "AU-ISM-1546",
+          "AU-Essential-8-Patch",
           "NIS2-Art21-identity-management"
         ]
       }
@@ -127141,10 +127136,10 @@
         "adequate": false,
         "gap": "Every party in the attack is an authorised user by B2's definition. The boundary that fails is inside the Exchange application, so no strengthening of identity and access control, multi-factor authentication included, removes the flaw once a session exists."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "The Essential Eight window the ISM control inherits measures 'patch applied'. On Exchange the reboot is a separate deferrable act that the control never asks anyone to evidence."
+        "gap": "An internet-reachable Exchange server is an online service with a 48-hour window at every level when a working exploit exists (ISM-1876), and an internal one gets one month from Maturity Level Two (ISM-1693). The update requires a reboot that is a separate, deferrable step, and none of these windows asks for evidence of it."
       },
       "ISO-27001-2022-A.8.15": {
         "covered": true,
@@ -127170,7 +127165,7 @@
         "evidence": "Both anchors the SLA depends on are unambiguous for this CVE and are only eight days apart: KB5007409 shipped 2021-11-09 and CISA listed the entry 2021-11-17 with a 2021-12-01 due date, against Microsoft's own 'Exploitation Detected' status and a ransomware association recorded by CISA. The verification half of the control is what this CVE tests — Microsoft marks the update reboot-required on all four affected builds, so 'verified mitigation' means the server reports a fixed build and has restarted since, not that the update was approved or installed.",
         "gap_closes": [
           "NIST-800-53-SI-2",
-          "AU-ISM-1546"
+          "AU-Essential-8-Patch"
         ]
       },
       {
@@ -127180,7 +127175,7 @@
         "evidence": "Exchange adds a fourth state this CVE makes concrete: update installed, reboot deferred. Microsoft's record marks KB5007409 reboot-required on all four affected builds, so a server showing 15.02.0986.014 in a management console but with no restart since the install is running the pre-fix code with a clean patch attestation. On a mail server the restart interrupts organisation-wide mail flow and is the most deferred step in the sequence, which is exactly why the verdict class has to name it. The audit test is the uptime of the Exchange server against the install timestamp of the update, not the build number alone.",
         "gap_closes": [
           "NIST-800-53-SI-2",
-          "AU-ISM-1546",
+          "AU-Essential-8-Patch",
           "UK-CAF-B2"
         ]
       }
@@ -129150,7 +129145,7 @@
       "AU-ISM-1546": {
         "covered": true,
         "adequate": false,
-        "gap": "The control presumes an authentication decision exists to assess. Solr's Config API sits on the same unauthenticated surface as its query API, and the control does not ask which internal services accept unauthenticated administrative writes."
+        "gap": "Solr accepts Config API writes without authentication unless security.json is configured, and an assessment of the application in front of Solr does not examine the search tier. Authenticating callers does not by itself limit which of them can re-enable the Velocity params loader on an affected build, so the upgrade to 8.4.0 or 7.7.3 still applies."
       },
       "ISO-27001-2022-A.8.9": {
         "covered": true,
@@ -129917,10 +129912,10 @@
         "adequate": false,
         "gap": "On iOS and iPadOS the operator has no configuration reaching the kernel extension. The only variable that changes exposure is update enforcement speed, which B4 does not express as an outcome."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "The control counts the update as applied. On Apple platforms remediation completes at the restart, and a device holding a downloaded 14.7.1 without restarting still runs the vulnerable kernel."
+        "gap": "ISM-1878 sets 48 hours for iOS, iPadOS and watchOS here, outside any Essential Eight profile, while a Mac below Maturity Level Three has one month under ISM-1695 despite a working exploit. The fix takes effect only at a restart, so a device holding a downloaded 14.7.1 or 11.5.1 without restarting still runs the vulnerable kernel while the update counts as applied."
       },
       "ISO-27001-2022-A.8.8": {
         "covered": true,
@@ -129935,7 +129930,7 @@
         "description": "DDM-enforced 24h KEV update on mobile estates.",
         "evidence": "The affected products are exactly the platforms this control names, and the remediation window CISA set was fourteen days from a 2021-11-03 listing. There is no configuration-side alternative to fall back on — no operator setting reaches the IOMobileFrameBuffer user client — so the update is the entire remediation and enforcement speed is the only operator variable. The deferral clause is the load-bearing half: the fix is delivered in iOS and iPadOS 14.7.1, macOS Big Sur 11.5.1 and watchOS 7.6.1, all of which restart the device, and a user-deferrable restart is what separates an estate that is patched from one that has merely been sent the patch.",
         "gap_closes": [
-          "AU-ISM-1546",
+          "AU-Essential-8-Patch",
           "NIS2-Art21-patch-management",
           "ISO-27001-2022-A.8.8"
         ]
@@ -129957,7 +129952,7 @@
         "evidence": "Both anchors are unambiguous: Apple shipped the fixed builds before the KEV listing of 2021-11-03, so the listing date is the later anchor and starts the clock, with CISA's own due date at 2021-11-17. The verification half is what this CVE tests, because the mitigation is not complete at install — every fixed build restarts the device, so verified means the device reports 14.7.1, 11.5.1 or 7.6.1 and has restarted since. There is no documented compensating control to fall back on: no operator-side configuration reaches the IOMobileFrameBuffer user client.",
         "gap_closes": [
           "NIST-800-53-AC-6",
-          "AU-ISM-1546"
+          "AU-Essential-8-Patch"
         ]
       }
     ]
@@ -132044,10 +132039,10 @@
         "adequate": false,
         "gap": "The maintenance path is outside the operator's control, and the assessable evidence does not reach the component: a handset reports a security patch level, not a Mali driver revision, and the mapping between them is held by the manufacturer."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "Authentication to the system is correct and irrelevant. The code that exploits this is already running with the privileges any installed application holds, and the boundary crossed is application sandbox to kernel, not user to system."
+        "gap": "Driver patching applies only at Maturity Level Three (ISM-1879, ISM-1697), and Android devices receive the fixed Mali driver only in a manufacturer build at patch level 2021-05-05 or later that reboots the device. Midgard r30p0 is still affected, so a policy written as r29p0 or later admits vulnerable devices."
       },
       "ISO-27001-2022-A.8.8": {
         "covered": true,
@@ -132659,10 +132654,10 @@
         "adequate": false,
         "gap": "Exploitation is a handful of GET requests returning HTTP 200 with no failed-authentication record, on the device whose request-level logs an operator is least likely to be forwarding. C1 can be achieved across the server estate while the perimeter device is unmonitored."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "The window is keyed to exploit existence, which is satisfied, but the control counts the patch as applied. The fix reloads an appliance that is often the only remote-access path, and the reload is the deferred step the control never asks anyone to evidence."
+        "gap": "The flaw meets the ISM-1877 48-hour condition, but the fix reloads an appliance that is usually the only remote-access path, and FTD 6.3.0 and 6.5.0 also need a hot fix. ASA releases before 9.6 and 9.7 have no fixed build, so only replacement under ISM-1501 closes the exposure there."
       },
       "ISO-27001-2022-A.8.22": {
         "covered": true,
@@ -132678,7 +132673,7 @@
         "evidence": "The fit is partial in one respect worth naming: this is not a pre-auth RCE but a pre-auth read-only disclosure, which is why a severity-band SLA routes it to a slower tier than the device class deserves. Everything else the tier is built on holds — the device is the trust boundary, the attacker is unauthenticated, Cisco confirms public exploit code and active exploitation, and the check is automated in the public Nuclei template set with an EPSS score at the top of the distribution. The tier's isolation alternative is weaker here than usual: Cisco states there are no workarounds, so isolating the vulnerable interface means removing the WebVPN or IKEv2 client-services configuration, which removes the service. That leaves the upgrade-and-reload as the only path, which is precisely the argument for putting it on a compressed clock.",
         "gap_closes": [
           "NIST-800-53-SI-2",
-          "AU-ISM-1546",
+          "AU-Essential-8-Patch",
           "NIS2-Art21-network-security"
         ]
       },
@@ -132709,7 +132704,7 @@
         "evidence": "Cisco's advisory records that ASA releases earlier than 9.6 and the 9.7 release have reached end of software maintenance, and it lists no first fixed release for them. An appliance on one of those trains with `webvpn enable` configured could not meet the 2022-05-03 KEV date by any patching action, and cannot meet it today. The segmentation clause needs reading carefully for this device: the appliance's own exposure is its internet-facing WebVPN interface, so the compensating measure is withdrawing that interface from untrusted networks — which ends the remote-access service — and the bounded window therefore has to end in migration to a supported train rather than in indefinite compensation.",
         "gap_closes": [
           "NIST-800-53-SI-2",
-          "AU-ISM-1546"
+          "AU-Essential-8-Patch"
         ]
       }
     ]
@@ -133052,10 +133047,10 @@
         "adequate": false,
         "gap": "Static Tundra modified TACACS+ logging on compromised devices, so the audit trail for privileged access was written by the compromised device."
       },
-      "AU-ISM-1546": {
+      "AU-Essential-8-Patch": {
         "covered": true,
         "adequate": false,
-        "gap": "Patch currency is measured against the running image, but exposure is set by whether the Smart Install client is enabled, so `no vstack` removes the flaw without moving the score and a train with no fixed release never satisfies the timeframe."
+        "gap": "ISM-1877 sets 48 hours at every maturity level for an internet-facing switch with a working exploit, ISM-1696 sets 48 hours for an internal switch at Maturity Level Three, and ISM-1695 allows an internal switch one month at Maturity Levels One and Two. Each accepts `no vstack` as a vendor mitigation on a switch that does not use Smart Install, but none requires it before the window ends, and a switch that needs Smart Install can close the flaw only by reloading onto the fixed release."
       },
       "ISO-27001-2022-A.8.22": {
         "covered": true,
@@ -133081,7 +133076,7 @@
         "evidence": "CVE-2018-0171 - Cisco's own workaround is `no vstack` for customers not requiring Smart Install, with `show vstack config` as the inventory query that identifies the affected population. The configuration path needs no reload and no image, so it is deployable across a switching estate on a timescale the upgrade path cannot match, and it is the reason a device can be safe on an unfixed release.",
         "gap_closes": [
           "NIST-800-53-CM-7",
-          "AU-ISM-1546"
+          "AU-Essential-8-Patch"
         ]
       },
       {