@blamejs/exceptd-skills 0.21.2 → 0.21.3

package/data/zeroday-lessons.json

@@ -1,7 +1,7 @@
 {
   "_meta": {
     "schema_version": "1.1.0",
-    "last_updated": "2026-08-19",
+    "last_updated": "2026-09-24",
     "last_threat_review": "2026-05-17",
     "purpose": "Zero-day learning loop output. Each entry maps a CVE to: attack vector, defense chain analysis, framework coverage, new control requirements generated, and exposure scoring. v1.1.0 (2026-05-15): every entry now carries ai_discovered_zeroday boolean + ai_discovery_source enum + ai_discovery_date + ai_assist_factor ladder, per AGENTS.md Hard Rule #7.",
     "note": "Never delete entries. Closed gaps are marked status: closed. History is data.",
@@ -17,7 +17,7 @@
       "rebuild_after_days": 365,
       "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
     },
-    "entry_count": 1720
+    "entry_count": 1752
   },
   "CVE-2026-31431": {
     "name": "Copy Fail",
@@ -45909,7 +45909,7 @@
     "ai_discovery_source": "human_researcher"
   },
   "CVE-2020-14644": {
-    "name": "Oracle WebLogic Server Remote Code Execution Vulnerability",
+    "name": "Oracle WebLogic Server Remote Code Execution Vulnerability (CVE-2020-14644)",
     "lesson_date": "2026-07-11",
     "attack_vector": {
       "description": "An unauthenticated attacker sends a crafted serialized Java object over the WebLogic T3 or IIOP protocol; WebLogic deserializes it through a vulnerable gadget chain and executes attacker code as the server process, resulting in full takeover.",
@@ -72447,7 +72447,7 @@
     ]
   },
   "CVE-2022-41082": {
-    "name": "Microsoft Exchange Server Remote Code Execution Vulnerability",
+    "name": "Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2022-41082)",
     "lesson_date": "2026-08-06",
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "human_researcher",
@@ -112004,7 +112004,7 @@
     ]
   },
   "CVE-2017-11826": {
-    "name": "Microsoft Office Remote Code Execution Vulnerability",
+    "name": "Microsoft Office Remote Code Execution Vulnerability (CVE-2017-11826)",
     "lesson_date": "2026-08-21",
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "human_researcher",
@@ -142640,5 +142640,2662 @@
         ]
       }
     ]
+  },
+  "CVE-2026-93952": {
+    "name": "Arista VeloCloud Orchestrator Improper Input Validation Vulnerability",
+    "lesson_date": "2026-09-23",
+    "ai_discovered_zeroday": false,
+    "ai_discovery_source": "human_researcher",
+    "ai_discovery_date": null,
+    "ai_assist_factor": "none",
+    "attack_vector": {
+      "description": "An unauthenticated attacker with network access to the VCO web interface, and access to the public portion of a VeloCloud Edge authentication certificate, sends a request that improper input validation routes to privileged internal functionality, which can compromise the VCO host and the data the orchestrator manages and may give access to the managed edge devices.",
+      "privileges_required": "none; no VCO tenant or operator credentials are needed, only network access to the web interface and the public part of an Edge authentication certificate",
+      "complexity": "the CVSS 4.0 vector rates attack complexity high, but the flaw is confirmed as actively exploited in the field",
+      "ai_factor": "Not AI-discovered; the advisory credits an external finder without naming AI tooling, and no source claims AI built the exploit."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Restricting the VCO web interface to trusted administrative networks and upgrading to the fixed train (5.2.3.16 or 6.4.2.8) where one exists",
+        "was_this_required": false,
+        "framework_requiring_it": "NIS2-Art21-network-security",
+        "adequacy": "Network restriction reduces reach but does not close the flaw, and for the 6.1.x and 7.0.x trains no fixed release yet exists, so the interim measure is the only control available."
+      },
+      "detection": {
+        "what_would_have_worked": "Watching VCO web access logs for anomalous path components and encoded input, the x-vc-opt nginx header, and the advisory's file and systemd-unit indicators on the host",
+        "was_this_required": false,
+        "framework_requiring_it": "ISO-27001-2022-A.8.9",
+        "adequacy": "The indicators are concrete, but the advisory states there is no single definitive indicator, so detection depends on correlating web, application and host logs."
+      },
+      "response": {
+        "what_would_have_worked": "Capturing VCO logs and file-system timestamps, checking for the indicators of compromise, then rebuilding the orchestrator from a trusted source, rotating credentials and validating managed edge device state",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 26-04 forensic triage (flagged in the KEV entry), for agencies bound by the directive",
+        "adequacy": "Because a VCO compromise may give an attacker access to the managed VeloCloud Edge devices, restoring the orchestrator and rotating credentials is the load-bearing step; patching an already-compromised orchestrator without evidence capture leaves any implanted daemon or stolen credential in place."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-10": {
+        "covered": true,
+        "adequate": false
+      },
+      "NIS2-Art21-network-security": {
+        "covered": true,
+        "adequate": false
+      },
+      "UK-CAF-B4": {
+        "covered": true,
+        "adequate": false
+      },
+      "AU-Essential-8-Patch": {
+        "covered": true,
+        "adequate": false
+      },
+      "ISO-27001-2022-A.8.9": {
+        "covered": true,
+        "adequate": false
+      }
+    },
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-134",
+        "name": "DEVICE-MANAGEMENT-GATEWAY-CONFIG-ENDPOINT-AUTH-INPUT-NEUTRALIZATION",
+        "description": "A network device or orchestration service validates request input and checks the caller's authorization on every management endpoint before the request can invoke a privileged internal function.",
+        "evidence": "Arista Security Advisory 0183 describes CVE-2026-93952 as improper input validation that lets an unauthenticated network request to the VeloCloud Orchestrator web interface reach privileged internal functionality and impact the VCO host; authenticating every configuration endpoint and neutralizing the input before any privileged action would have kept the request from reaching that functionality.",
+        "gap_closes": [
+          "NIST-800-53-SI-10",
+          "UK-CAF-B4",
+          "NIS2-Art21-network-security",
+          "ISO-27001-2022-A.8.9"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-030",
+        "name": "PERIMETER-DEVICE-ZERODAY-SLA-TIER",
+        "description": "A device exposed directly to the internet is placed in a dedicated accelerated patch tier whose clock is independent of the severity label the vendor assigns to the flaw.",
+        "evidence": "CVE-2026-93952 was added to CISA KEV on 2026-09-22 with a 2026-09-25 due date while Arista had shipped fixed releases only for the 5.2.3 and 6.4.2 VeloCloud Orchestrator trains; a compressed remediation tier for the internet-reachable orchestrator, independent of any severity label, is what drives the 6.1.x and 7.0.x deployments to the interim restrictions inside the window.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "UK-CAF-B4",
+          "NIS2-Art21-network-security"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "After an actively exploited pre-authentication compromise of a network-reachable appliance, the response defaults to exporting configuration, rebuilding from a trusted image and rotating every credential the device held, rather than patching the running system.",
+        "evidence": "Arista's advisory for CVE-2026-93952 states that a compromise of the VeloCloud Orchestrator may reach the managed VeloCloud Edge devices and advises restoring or replacing affected orchestrator instances from trusted sources and rotating credentials, which is a rebuild-and-rotate response rather than patch-in-place.",
+        "gap_closes": [
+          "UK-CAF-B4",
+          "NIS2-Art21-network-security"
+        ]
+      }
+    ]
+  },
+  "CVE-2021-31207": {
+    "name": "Microsoft Exchange Server Security Feature Bypass Vulnerability",
+    "lesson_date": "2026-09-23",
+    "ai_discovered_zeroday": false,
+    "ai_discovery_source": "human_researcher",
+    "ai_discovery_date": null,
+    "ai_assist_factor": "none",
+    "attack_vector": {
+      "description": "After passing the ProxyShell authentication bypass, a caller self-assigns the Mailbox Import Export role and issues a mailbox export whose file path is a UNC path under the web root, writing a web shell that runs as SYSTEM. It chains with CVE-2021-34473 and CVE-2021-34523.",
+      "privileges_required": "None once the ProxyShell chain has bypassed authentication; the standalone flaw needs a mailbox role that the chain lets the attacker self-assign",
+      "complexity": "high",
+      "ai_factor": "Not AI-discovered and no AI-assisted weaponization; credited to an outside researcher who demonstrated it at Pwn2Own 2021, with no AI tooling claimed."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Installing Microsoft's May 2021 update KB5003435, which CISA states remediates all three ProxyShell vulnerabilities, removes the mailbox-export write.",
+        "was_this_required": true,
+        "framework_requiring_it": "AU-Essential-8-Patch",
+        "adequacy": "The update is the complete fix and was available months before mass exploitation; the failure was leaving it unapplied because the flaw was rated Moderate."
+      },
+      "detection": {
+        "what_would_have_worked": "Alerting on New-MailboxExportRequest with a -FilePath to a web-root UNC path and on New-ManagementRoleAssignment granting Mailbox Import Export through the remote PowerShell endpoint.",
+        "was_this_required": false,
+        "framework_requiring_it": "UK-CAF-B4",
+        "adequacy": "These are reliable exploitation signals but presuppose that PowerShell and export-request auditing is collected."
+      },
+      "response": {
+        "what_would_have_worked": "Treating a ProxyShell hit as a chain compromise: removing dropped web shells, reviewing mailbox exports, and rotating credentials before returning the server to service.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Applying KB5003435 stops re-exploitation but does not undo an export or remove a shell already written."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "The organization-defined timeframe let the May 2021 fix sit unapplied through the exploitation window under a Moderate rating."
+      },
+      "NIS2-Art21-patch-management": {
+        "covered": true,
+        "adequate": false,
+        "gap": "No known-exploited prioritization distinguished a chain-link Moderate flaw from routine maintenance."
+      },
+      "UK-CAF-B4": {
+        "covered": true,
+        "adequate": false,
+        "gap": "'Promptly' is not defined against a Moderate-rated flaw that completes an internet-facing code-execution chain, so a deferral could be judged prompt."
+      },
+      "AU-Essential-8-Patch": {
+        "covered": true,
+        "adequate": true,
+        "gap": "The applicable window closed by 2021-06-11, before the August 2021 exploitation, so meeting it would have prevented the compromise; only an internal instance at Maturity Level One has no window."
+      },
+      "ISO-27001-2022-A.8.8": {
+        "covered": true,
+        "adequate": false,
+        "gap": "A register that inherits vendor severity ranks the flaw low and does not surface its role in the chain."
+      }
+    },
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "A vulnerability listed in a national known-exploited catalog starts a fixed mitigation clock measured in hours, applied independently of the vendor's own severity rating.",
+        "evidence": "Microsoft fixed CVE-2021-31207 in KB5003435 on 2021-05-11 under a Moderate rating; CISA reported active exploitation of ProxyShell on 2021-08-21 and added CVE-2021-31207 to KEV on 2021-11-03 with a 2021-11-17 due date and known ransomware use, so for a server still unpatched at the listing the catalog entry, not the Moderate rating, sets the clock.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "ISO-27001-2022-A.8.8"
+        ]
+      }
+    ]
+  },
+  "CVE-2021-34473": {
+    "name": "Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-34473)",
+    "lesson_date": "2026-09-23",
+    "ai_discovered_zeroday": false,
+    "ai_discovery_source": "human_researcher",
+    "ai_discovery_date": null,
+    "ai_assist_factor": "none",
+    "attack_vector": {
+      "description": "A pre-authentication request forgery in the Autodiscover service accepts a URI that is not validated before the backend is reached, so an unauthenticated attacker reaches internal endpoints such as PowerShell and MAPI. Chained with CVE-2021-34523 and CVE-2021-31207 it gives code execution as SYSTEM.",
+      "privileges_required": "None; the flaw is reachable without authentication",
+      "complexity": "low",
+      "ai_factor": "Not AI-discovered and no AI-assisted weaponization; credited to an outside researcher, with no AI tooling claimed."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Installing the April 2021 update KB5001779, which Microsoft released for other Critical Exchange CVEs and which already fixed this Autodiscover request forgery (fixed builds Exchange 2013 CU23 15.0.1497.015, Exchange 2016 CU19 15.1.2176.012 or CU20 15.1.2242.008, Exchange 2019 CU8 15.2.792.013 or CU9 15.2.858.010), or the May 2021 update KB5003435, which supersedes it and closes the full ProxyShell chain (fixed builds Exchange 2013 CU23 15.0.1497.018, Exchange 2016 CU19 15.1.2176.014 or CU20 15.1.2242.010, Exchange 2019 CU8 15.2.792.015 or CU9 15.2.858.012).",
+        "was_this_required": true,
+        "framework_requiring_it": "ISO-27001-2022-A.8.8",
+        "adequacy": "The update is the fix; input validation on the Autodiscover URI is the vendor-side change, and no configuration in front of the server substitutes for it against a pre-authentication request forgery."
+      },
+      "detection": {
+        "what_would_have_worked": "Alerting on web server log entries whose URI query carries the autodiscover.json request-forgery forms or /autodiscover.json with a backend path, in any HTTP method, as the SigmaHQ ProxyShell rules do, and treating responses exposing OwaADUserNotFoundException as a sign of scanning.",
+        "was_this_required": false,
+        "framework_requiring_it": "UK-CAF-B4",
+        "adequacy": "The query patterns catch both attempts and successful requests, but the exploit varies the impersonated endpoint, so match on the request-forgery shape rather than one path."
+      },
+      "response": {
+        "what_would_have_worked": "Following a nation-state initial-access playbook for a confirmed ProxyShell compromise: removing web shells, hunting for the follow-on tools reported in AA21-321A, and rotating credentials.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "For this flaw the update alone is insufficient once exploited, because state-sponsored actors used it for initial access ahead of encryption and ransomware."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Until Microsoft documented the CVE in July, a flaw record keyed by CVE could not show it on a server that had deferred the April update."
+      },
+      "NIS2-Art21-patch-management": {
+        "covered": true,
+        "adequate": false,
+        "gap": "The vendor's disclosure trailed its fix, so handling that works from published CVEs could not prioritize this flaw until July."
+      },
+      "UK-CAF-B4": {
+        "covered": true,
+        "adequate": false,
+        "gap": "A deferral of the April update was weighed without this unannounced pre-authentication entry point in view."
+      },
+      "AU-ISM-1546": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Configuring authentication in front of the system does not reach a flaw that admits an unauthenticated request through the product's own validation."
+      },
+      "ISO-27001-2022-A.8.8": {
+        "covered": true,
+        "adequate": false,
+        "gap": "A register fed by Microsoft's CVE list had no entry for three months, so exposure evaluations for servers below the April builds left the flaw out."
+      }
+    },
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "A vulnerability listed in a national known-exploited catalog starts a fixed mitigation clock measured in hours, driven by the presence of an exploited fix on installed builds rather than by the vendor advisory date.",
+        "evidence": "CISA added CVE-2021-34473 to KEV on 2021-11-03 with a 2021-11-17 due date and known ransomware use, after its 2021-08-21 alert on active ProxyShell exploitation, and AA21-321A reports Iranian state-sponsored actors using it for initial access since at least October 2021; for a Microsoft Exchange Server still below the April 2021 builds at the listing, the listing calls for an hours-scale clock rather than an organization-defined remediation period.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-043",
+        "name": "NATION-STATE-INITIAL-ACCESS-IR-ESCALATION",
+        "description": "Incident-response runbooks carry an explicit escalation path that activates when a confirmed exploit chain is attributed to a state-sponsored actor, because ordinary incident severity understates the response such intrusions require.",
+        "evidence": "CISA, FBI, ACSC and NCSC (AA21-321A) reported Iranian state-sponsored actors using CVE-2021-34473 in Microsoft Exchange Server for initial access since at least October 2021 ahead of encryption and ransomware, which is the nation-state escalation trigger a response plan must carry.",
+        "gap_closes": [
+          "UK-CAF-B4"
+        ]
+      }
+    ]
+  },
+  "CVE-2020-1380": {
+    "name": "Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability (CVE-2020-1380)",
+    "lesson_date": "2026-09-23",
+    "ai_discovered_zeroday": false,
+    "ai_discovery_source": "human_researcher",
+    "ai_discovery_date": null,
+    "ai_assist_factor": "none",
+    "attack_vector": {
+      "description": "A crafted page opened in Internet Explorer 11 triggers a use-after-free in the default jscript9.dll engine through two JIT mismodelings, detaching a Float32Array buffer inside a valueOf callback to gain code execution as the current user. The in-the-wild chain then elevated privilege with CVE-2020-0986.",
+      "privileges_required": "none beyond convincing the target to open a crafted page in Internet Explorer 11",
+      "complexity": "low to exploit, per the CVSS rating; Kaspersky observed reliable exploitation of Internet Explorer 11 on Windows 10 build 18363 x64",
+      "ai_factor": "None. Discovered in the wild by Kaspersky's Boris Larin; no AI tooling claimed."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Installing the August 11, 2020 updates (KB4571692, KB4571694, KB4571741, KB4571709, KB4565349, KB4565351 or KB4566782 on Windows 10 and Windows Server 2016 and 2019; the IE Cumulative KB4571687 or the Monthly Rollup KB4571703, KB4571736 or KB4571729 on the older lines, with Extended Security Updates on Windows 7 SP1 and Windows Server 2008 R2 SP1), plus the June 2020 CVE-2020-0986 update (KB4561666, KB4561673, KB4561612 or KB4561674) where only the IE Cumulative is installed on Windows 8.1 and Windows Server 2012 and 2012 R2; there is no configuration workaround because the flaw is in jscript9.dll rather than jscript.dll",
+        "was_this_required": true,
+        "framework_requiring_it": "NIST-800-53-SI-2",
+        "adequacy": "The update is the only fix, and it could not close the May 2020 zero-day window; the jscript.dll workaround used for earlier bugs gave no protection here."
+      },
+      "detection": {
+        "what_would_have_worked": "Alerting on script that detaches a typed-array buffer inside a valueOf callback and calls CollectGarbage, on Internet Explorer dropping ok.exe to a temporary folder, and on splwow64.exe launching PowerShell",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Kaspersky documented these behaviors, but detecting them needs endpoint monitoring of the browser and its child processes."
+      },
+      "response": {
+        "what_would_have_worked": "Rebuilding any host that ran the exploit and rotating its credentials, and blocking the Operation PowerFall download host and sample hashes",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "The in-the-wild chain escalated to a second exploit and fetched a payload, so a full rebuild is warranted rather than a browser reset."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false
+      },
+      "NIS2-Art21-patch-management": {
+        "covered": true,
+        "adequate": false
+      },
+      "UK-CAF-B4": {
+        "covered": true,
+        "adequate": false
+      },
+      "AU-Essential-8-Patch": {
+        "covered": true,
+        "adequate": false
+      },
+      "ISO-27001-2022-A.8.8": {
+        "covered": true,
+        "adequate": false
+      }
+    },
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "A KEV listing starts a fixed mitigation clock measured in hours, and where no configuration workaround exists the clock runs against deploying the vendor update itself.",
+        "evidence": "CVE-2020-1380 was exploited in the wild in Operation PowerFall in May 2020 and Microsoft shipped the fix on August 11, 2020; it is listed in CISA KEV (added 2021-11-03). A clock measured from the update, not from advisory browsing, is what a program needs, since no jscript9.dll workaround exists.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-038",
+        "name": "MITIGATION-ACTIVE-PATCH-PENDING-VERDICT-CLASS",
+        "description": "A compliance verdict must confirm that a compensating control actually covers the reachable code path, and must not carry a mitigation adopted for a related flaw as coverage for one it does not touch.",
+        "evidence": "CVE-2020-1380 is in jscript9.dll, so the jscript.dll access-restriction that operators recorded as mitigating the earlier JScript bugs gives no protection; a host carrying that workaround as coverage for this flaw is unmitigated, and Kaspersky's analysis confirms the restriction does not apply.",
+        "gap_closes": [
+          "UK-CAF-B4",
+          "NIST-800-53-SI-2"
+        ]
+      }
+    ]
+  },
+  "CVE-2021-27085": {
+    "name": "Microsoft Internet Explorer Remote Code Execution Vulnerability",
+    "lesson_date": "2026-09-23",
+    "ai_discovered_zeroday": false,
+    "ai_discovery_source": "human_researcher",
+    "ai_discovery_date": null,
+    "ai_assist_factor": "none",
+    "attack_vector": {
+      "description": "A crafted web page opened in Internet Explorer 11 triggers an unspecified flaw that gives code execution in the context of the current user. Microsoft marks it exploited in the wild and publishes no mechanism, CWE or indicators.",
+      "privileges_required": "none beyond convincing the target to open a crafted page in Internet Explorer 11",
+      "complexity": "low to exploit, per the CVSS rating; no public exploit is available",
+      "ai_factor": "None. Reported to Microsoft by FireEye; no AI tooling claimed."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Installing the March 9, 2021 updates for Internet Explorer 11 (KB5000809, KB5000822, KB5000808 or KB5000802), and disabling or removing Internet Explorer where it is not required",
+        "was_this_required": true,
+        "framework_requiring_it": "AU-Essential-8-Patch",
+        "adequacy": "The update is the only fix Microsoft offered and no workaround was published, so before March 2021 the exposure could be reduced only by not using the browser."
+      },
+      "detection": {
+        "what_would_have_worked": "Alerting on Internet Explorer 11 rendering untrusted pages and spawning child processes on hosts that do not need the browser",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Microsoft published no technical detail or indicators for this flaw, so detection rests on generic browser-exploitation behavior rather than a specific signature."
+      },
+      "response": {
+        "what_would_have_worked": "Treating any affected host as running code at the current user's rights, then reimaging it and rotating credentials",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "With the flaw confirmed exploited in the wild and no public detail, a conservative rebuild is the safer response."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false
+      },
+      "NIS2-Art21-patch-management": {
+        "covered": true,
+        "adequate": false
+      },
+      "UK-CAF-B4": {
+        "covered": true,
+        "adequate": false
+      },
+      "AU-Essential-8-Patch": {
+        "covered": true,
+        "adequate": false
+      },
+      "ISO-27001-2022-A.8.8": {
+        "covered": true,
+        "adequate": false
+      }
+    },
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "A KEV listing starts a fixed mitigation clock measured in hours, and where the vendor publishes no detail the listing and the exploited flag are what the clock keys on.",
+        "evidence": "Microsoft released the fix for CVE-2021-27085 on March 9, 2021 and changed its exploited flag to Yes on March 12, 2021, crediting FireEye; CISA added it to KEV on 2021-11-03. With no published detail, the exploited flag and the KEV listing are what a mitigation clock must key on.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-122",
+        "name": "EOL-ASSET-DECOMMISSION",
+        "description": "Software the supplier no longer patches is isolated and scheduled for removal within a bounded window, with mandatory compensating configuration applied until it is gone.",
+        "evidence": "CVE-2021-27085 affects Internet Explorer 11 only on Windows 10 versions 1803 through 20H2 and Windows Server 2019, and the Internet Explorer 11 desktop application ended support on Windows 10 semi-annual channel releases on June 15, 2022; where the browser is unsupported or not needed, disabling or removing it is the response.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "UK-CAF-B4"
+        ]
+      }
+    ]
+  },
+  "CVE-2019-0541": {
+    "name": "Microsoft MSHTML Remote Code Execution Vulnerability",
+    "lesson_date": "2026-09-23",
+    "ai_discovered_zeroday": false,
+    "ai_discovery_source": "human_researcher",
+    "ai_discovery_date": null,
+    "ai_assist_factor": "none",
+    "attack_vector": {
+      "description": "The MSHTML engine improperly validates input. In the HTML editing scenario Microsoft describes, a user who edits a specially crafted file runs attacker code in the context of that user, and if the user holds administrative rights the attacker can take control of the host.",
+      "privileges_required": "None beyond convincing a user to edit a specially crafted file; execution runs as the current user.",
+      "complexity": "Low; a public proof of concept exists (Exploit-DB 46536), and exploitation needs a user to edit a crafted file.",
+      "ai_factor": "Not AI-discovered; no source claims AI tooling. Credited to an outside researcher working with iDefense Labs."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Applying the January 2019 update for every listed product: the Internet Explorer cumulative update, monthly rollup or Windows 10 cumulative update, and the separate Office and viewer updates.",
+        "was_this_required": true,
+        "framework_requiring_it": "AU-Essential-8-Patch",
+        "adequacy": "The updates remove the flaw, but only where each listed product is patched, so a program that tracks one product's update can leave another listed product on the same host exposed."
+      },
+      "detection": {
+        "what_would_have_worked": "Alerting when a process starts right after a user chooses Edit on an HTML file in Internet Explorer or msohtmed.exe, and flagging .htm, .html and .xhtml files in local folders or on network shares that carry a meta tag named ProgId.",
+        "was_this_required": false,
+        "framework_requiring_it": "ISO-27001-2022-A.8.8",
+        "adequacy": "The process-spawn signal fires after code runs, and no detection-grade template for this CVE was available to build a request-level rule."
+      },
+      "response": {
+        "what_would_have_worked": "Isolating the host and rotating credentials the user held after a confirmed execution, then confirming that every listed product on the host received its January 2019 update.",
+        "was_this_required": false,
+        "framework_requiring_it": "UK-CAF-B4",
+        "adequacy": "Endpoint cleanup restores the host, but confirming each listed product is patched is the step that prevents a repeat through a different product."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false
+      },
+      "NIS2-Art21-vulnerability-management": {
+        "covered": true,
+        "adequate": false
+      },
+      "UK-CAF-B4": {
+        "covered": true,
+        "adequate": false
+      },
+      "AU-Essential-8-Patch": {
+        "covered": true,
+        "adequate": true
+      },
+      "ISO-27001-2022-A.8.8": {
+        "covered": true,
+        "adequate": false
+      }
+    },
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "When a vulnerability is listed in the national known-exploited catalog, treat it as an incident-tempo event and apply the vendor fix or a documented mitigation within a short, fixed service-level window rather than on the routine patch cycle.",
+        "evidence": "CVE-2019-0541 in the MSHTML engine was added to the CISA known-exploited catalog on 2021-11-03; Microsoft shipped the fix in the January 2019 updates and a public proof of concept (Exploit-DB 46536) followed in March 2019, so for hosts still unpatched when the flaw was listed, a known-exploited-anchored window would have put the January 2019 updates on a fixed deadline.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "ISO-27001-2022-A.8.8",
+          "AU-Essential-8-Patch",
+          "UK-CAF-B4",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-018",
+        "name": "SCANNER-PAPER-COMPLIANCE-TEST",
+        "description": "Reporting a component patched from one product's version string alone is treated as paper compliance, and the operational check must resolve the specific build and configuration that actually decides whether the flaw is reachable.",
+        "evidence": "Microsoft lists Internet Explorer 9, 10 and 11, Office 2010, 2013, 2016 and 2019, Office 365 ProPlus, Word Viewer and Excel Viewer 2007 as affected by CVE-2019-0541, each fixed by a different January 2019 update; a scanner keyed to one product's version string can report a host patched while another listed product on it stays vulnerable.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "AU-Essential-8-Patch",
+          "NIST-800-53-SI-2",
+          "UK-CAF-B4",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      }
+    ]
+  },
+  "CVE-2017-11774": {
+    "name": "Microsoft Office Outlook Security Feature Bypass Vulnerability",
+    "lesson_date": "2026-09-23",
+    "ai_discovered_zeroday": false,
+    "ai_discovery_source": "human_researcher",
+    "ai_discovery_date": null,
+    "ai_assist_factor": "none",
+    "attack_vector": {
+      "description": "With valid mailbox credentials, an attacker sets a folder's home page (the PR_FOLDER_WEBVIEWINFO property) to an attacker-hosted HTML page loaded through ieframe; the page uses the OutlookViewCtl ActiveX control and script to run commands with the user's privileges the next time the folder is refreshed or Outlook restarts.",
+      "privileges_required": "for the documented home page technique, valid mailbox credentials for the target account, obtained by credential theft, password spraying or reuse before the home page can be set",
+      "complexity": "low once credentials are held, since RULER automates setting the home page and forcing the refresh; the credential requirement is the gating step",
+      "ai_factor": "Not AI-discovered. Credited to Etienne Stalmans of SensePost; no AI tooling is claimed."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Applying the October 2017 Outlook update for the installed version (4011196, 4011178 or 4011162) to disable the folder home page feature, keeping the EnableRoamingFolderHomepages value off, replacing Outlook releases now past end of support, and enforcing multi-factor authentication so stolen credentials cannot be used to set a home page",
+        "was_this_required": true,
+        "framework_requiring_it": "UK-CAF-B2",
+        "adequacy": "The update removes the feature, but it can be re-enabled by registry and the flaw depends on a credential compromise that patching does not address, so multi-factor authentication on mailbox access is the load-bearing preventive control."
+      },
+      "detection": {
+        "what_would_have_worked": "Alerting when outlook.exe spawns a script host or shell child process, and auditing mailbox folders for an unexpected PR_FOLDER_WEBVIEWINFO home page with the NotRuler homepage check",
+        "was_this_required": false,
+        "framework_requiring_it": "ISO-27001-2022-A.8.16",
+        "adequacy": "Both signals are reliable and documented, but FireEye notes defenders often misread the Outlook-spawned process as a phishing attachment and miss that valid credentials and mailbox persistence are involved, understating the scope."
+      },
+      "response": {
+        "what_would_have_worked": "Resetting the compromised mailbox credentials, removing the planted home page property from every affected folder, and rebuilding hosts where POSHC2 or POWERTON persistence was established",
+        "was_this_required": false,
+        "framework_requiring_it": "NIS2-Art21-vulnerability-management",
+        "adequacy": "Clearing the home page and resetting credentials is necessary, but because the activity was attributed to a state-linked actor the response has to assume broader access than the single mailbox where the persistence was found."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false
+      },
+      "NIS2-Art21-vulnerability-management": {
+        "covered": true,
+        "adequate": false
+      },
+      "UK-CAF-B2": {
+        "covered": true,
+        "adequate": false
+      },
+      "AU-Essential-8-Patch": {
+        "covered": true,
+        "adequate": false
+      },
+      "ISO-27001-2022-A.8.16": {
+        "covered": true,
+        "adequate": false
+      }
+    },
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "A vulnerability on the CISA KEV list is handled on an incident-speed clock: a documented four-hour mitigation service level applies from the listing, whether the mitigation is a patch, a vendor configuration change or isolation of the affected system.",
+        "evidence": "CVE-2017-11774 was used by the APT33-linked activity FireEye documented and is KEV-listed since 2021-11-03; a KEV-anchored clock drives the October 2017 Outlook updates (4011196, 4011178 and 4011162) and the removal of any planted home page at incident tempo rather than on a routine Office patch cycle.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "AU-Essential-8-Patch",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-018",
+        "name": "SCANNER-PAPER-COMPLIANCE-TEST",
+        "description": "A scanner that reports a system patched from a version string alone is paper compliance; the operational test resolves the configuration state that actually decides whether the flaw is reachable.",
+        "evidence": "For CVE-2017-11774 the October 2017 Outlook updates (4011196, 4011178 and 4011162) disable the folder home page feature in the client, but the EnableRoamingFolderHomepages registry value restores it, and a home page URL already written to a mailbox folder's PR_FOLDER_WEBVIEWINFO property stays on the mailbox and runs on any client that lacks the update or has that value set to 1 until the property is cleared; a scanner reading only the Outlook patch level records such a host as compliant.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "AU-Essential-8-Patch",
+          "UK-CAF-B2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-043",
+        "name": "NATION-STATE-INITIAL-ACCESS-IR-ESCALATION",
+        "description": "An incident-response runbook includes a dedicated escalation path that triggers on attribution of a confirmed exploit chain to a state-sponsored actor, since routine incident severity understates the intrusion.",
+        "evidence": "FireEye attributes in-the-wild CVE-2017-11774 home page persistence to APT33, an Iranian-linked actor deploying POSHC2 and POWERTON; discovery of this technique on a mailbox warrants nation-state escalation rather than treatment as a single-user phishing incident.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.16"
+        ]
+      }
+    ]
+  },
+  "CVE-2021-27059": {
+    "name": "Microsoft Office Remote Code Execution Vulnerability (CVE-2021-27059)",
+    "lesson_date": "2026-09-23",
+    "ai_discovered_zeroday": false,
+    "ai_discovery_source": "human_researcher",
+    "ai_discovery_date": null,
+    "ai_assist_factor": "none",
+    "attack_vector": {
+      "description": "Microsoft publishes no technical description of CVE-2021-27059 beyond its title and CVSS vector: a network attack vector with high attack complexity, high privileges required and required user interaction, a change of scope, and high impact on confidentiality, integrity and availability. The Preview Pane is not an attack vector. The Office 2016 fix is the KB4493225 package, which updates mso.dll to 16.0.5134.1000.",
+      "privileges_required": "High, according to Microsoft's CVSS vector (PR:H). Microsoft does not say which privileges an attacker needs.",
+      "complexity": "High attack complexity (AC:H), and a user must take an action (UI:R); displaying a file in the Preview Pane does not trigger the flaw.",
+      "ai_factor": "Not AI-discovered. Microsoft credits Chi-Yu You and Dhanesh Kizhakkinan of FireEye Inc. as the finders, and no source describes AI tooling."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Installing KB4493225 on Office 2016 MSI-based editions (build 16.0.5134.1000), KB4493228 on Office 2013 SP1 MSI-based editions (build 15.0.5327.1000) and Office 2013 RT SP1, and KB4504703 on Office 2010 SP2 MSI-based editions (build 14.0.7266.5000), then replacing all three releases with a supported Office release.",
+        "was_this_required": true,
+        "framework_requiring_it": "AU-Essential-8-Patch (ISM-1691 at Maturity Levels One and Two, ISM-1692 and ISM-1901 at Maturity Level Three, ISM-1704 for unsupported office suites)",
+        "adequacy": "The three updates close CVE-2021-27059 on each affected release. They do not keep the host supported: Office 2016, the newest affected release, reached its end of support on October 14, 2025, so only the replacement step removes the host from an unsupported Office release."
+      },
+      "detection": {
+        "what_would_have_worked": "Inventorying Office installations by release, install technology and build or mso.dll version to find MSI-based installations of Office 2016 below 16.0.5134.1000, Office 2013 below 15.0.5327.1000 and Office 2010 below 14.0.7266.5000, and alerting when an Office application starts a command interpreter or script host.",
+        "was_this_required": true,
+        "framework_requiring_it": "ISO-27001-2022-A.8.8",
+        "adequacy": "The version check is exact because Microsoft publishes the fixed builds. The process alert is a general heuristic, because Microsoft has published no exploitation details for this CVE and no detection is specific to it."
+      },
+      "response": {
+        "what_would_have_worked": "Reviewing the process-creation and file-write history of Office applications on hosts that stayed below the fixed builds after the March 2021 release, and treating a host where an Office application started an unexplained child process as compromised.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "With no published indicators, the review depends on general Office exploitation signals and on how long process telemetry is retained. The KEV entry does not flag this CVE for forensic triage."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "A remediation period keyed to the Important rating and a 7.6 base score places an update that Microsoft marks exploited below the critical tier."
+      },
+      "NIS2-Art21-patch-management": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Neither Annex point 6.6.1 nor 6.10.2 sets a fixed timeframe, and whether Microsoft's exploited status, added three days after release in an informational revision, makes the update critical is left to the entity."
+      },
+      "UK-CAF-B4": {
+        "covered": true,
+        "adequate": false,
+        "gap": "B4.d gives no time limit for prompt mitigation of an update marked exploited three days after release, and its Partially achieved outcome sets no end date for temporary mitigations on the unsupported Office 2010, 2013 and 2016 releases."
+      },
+      "AU-Essential-8-Patch": {
+        "covered": true,
+        "adequate": false,
+        "gap": "At Maturity Level Three the 48-hour window from the 2021-03-09 release closed before Microsoft marked the flaw exploited on 2021-03-12, so the update fell into the two-week window ending 2021-03-23."
+      },
+      "ISO-27001-2022-A.8.8": {
+        "covered": true,
+        "adequate": false,
+        "gap": "A register that records an Office release without its install technology and build cannot evaluate the MSI-edition boundaries 16.0.5134.1000, 15.0.5327.1000 and 14.0.7266.5000."
+      }
+    },
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "When the vendor or a government catalog marks a vulnerability as exploited, the fix must be deployed within an expedited window that starts when that status is published, including when the status changes after the original release.",
+        "evidence": "Microsoft released the fix for CVE-2021-27059 on 2021-03-09 with an Important rating, and revision 1.1 of its update guide entry on 2021-03-12 changed the Exploited flag to Yes and added the FireEye acknowledgement. CISA added the CVE to its KEV catalog on 2021-11-03 with a 2021-11-17 due date. A response clock that starts from the exploited status would have started on 2021-03-12 for any Office 2010, 2013 or 2016 host still below builds 14.0.7266.5000, 15.0.5327.1000 or 16.0.5134.1000.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-patch-management",
+          "AU-Essential-8-Patch"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-122",
+        "name": "EOL-ASSET-DECOMMISSION",
+        "description": "Productivity software that has passed its supplier's end-of-support date must be replaced or removed within a set period, and every host that still runs it must be recorded with that date until it is removed.",
+        "evidence": "Every product Microsoft lists as affected by CVE-2021-27059 is past its end of support date according to Microsoft's upgrade planning page: Office 2010 on October 13, 2020, Office 2013 on April 11, 2023 and Office 2016 on October 14, 2025. Microsoft still shipped KB4504703 for Office 2010 SP2 in March 2021, after that product's end of support date, so a host that carries the fix can still be running an unsupported release.",
+        "gap_closes": [
+          "UK-CAF-B4"
+        ]
+      }
+    ]
+  },
+  "CVE-2021-36948": {
+    "name": "Microsoft Windows Update Medic Service Privilege Escalation Vulnerability",
+    "lesson_date": "2026-09-23",
+    "ai_discovered_zeroday": false,
+    "ai_discovery_source": "vendor_research",
+    "ai_discovery_date": null,
+    "ai_assist_factor": "none",
+    "attack_vector": {
+      "description": "A user who can already run code on a Windows 10 1809 to 21H1, Windows Server 2019, or Windows Server, version 2004 or 20H2 host exploits a flaw in the Windows Update Medic Service to gain elevated privileges. Microsoft has published no root cause or trigger.",
+      "privileges_required": "Low: a local account able to run code on the host (CVSS AV:L, PR:L), with no user interaction.",
+      "complexity": "Low (CVSS AC:L). Microsoft's temporal vector records functional exploit code maturity (E:F) and its advisory marks exploitation detected; no public exploit code was found.",
+      "ai_factor": "Not AI-discovered. Microsoft credits its own MSTIC and MSRC teams, and no source mentions AI tooling."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Installing KB5005030 (build 10.0.17763.2114) on Windows 10 Enterprise LTSC 2019, Windows 10 IoT Enterprise LTSC 2019, Windows 10 IoT Core LTSC or Windows Server 2019, KB5005031 (build 10.0.18363.1734) on Windows 10 Version 1909 Enterprise, Education or IoT Enterprise, or KB5005033 (builds 10.0.19041.1165, 10.0.19042.1165 and 10.0.19043.1165) on Windows 10 Versions 2004, 20H2 and 21H1 and Windows Server, version 2004 and 20H2, or a later monthly update, and restarting into the fixed build. The non-LTSC editions of Windows 10 Version 1809 and Windows 10 Version 1909 Home, Pro, Pro Education and Pro for Workstations received no fix, so they needed an upgrade to a supported release. Before 2021-08-10 no fix existed, so limiting who could run code locally on affected hosts was the only way to reduce exposure.",
+        "was_this_required": true,
+        "framework_requiring_it": "AU-Essential-8-Patch (ISM-1695, ISM-1696, ISM-1877)",
+        "adequacy": "Complete for this CVE once the host is running the fixed build. It could not stop the exploitation Microsoft detected before the fix was released, and on Windows 10 versions that no longer receive updates it closes this flaw but no later one."
+      },
+      "detection": {
+        "what_would_have_worked": "Comparing each host's running OS build with the fixed build for its version, and alerting on processes at System integrity level started by a parent running under an ordinary user account (Sysmon Event ID 1).",
+        "was_this_required": false,
+        "framework_requiring_it": "NIST-800-53-SI-4",
+        "adequacy": "The build comparison is exact for exposure. The process-integrity analytic is a generic privilege-escalation signal, because Microsoft published no artifact specific to this flaw, and it does not fire on an escalation that never starts a new process."
+      },
+      "response": {
+        "what_would_have_worked": "Reviewing any affected host on which untrusted code ran before it restarted into the fixed build for persistence, new services and credential access at elevated privilege, instead of treating the update as the end of the incident.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Microsoft published no indicators for this flaw, so the review relies on general signs of privilege escalation. Installing the update removes the flaw but not anything an attacker installed with the privileges it gave."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "A remediation period keyed to the Important rating treats an exploited-at-release flaw as routine, and deployment evidence does not show the restart into the fixed build."
+      },
+      "NIST-800-53-SI-4": {
+        "covered": true,
+        "adequate": false,
+        "gap": "With no published artifact, monitoring can only watch for generic privilege escalation and cannot attribute an alert to this flaw."
+      },
+      "NIS2-Art21-patch-management": {
+        "covered": true,
+        "adequate": false,
+        "gap": "The without-undue-delay tier in Annex point 6.10.2(c) applies to vulnerabilities the entity itself identifies as critical, and the Annex does not tie that judgment to the vendor's exploitation flag."
+      },
+      "UK-CAF-B4": {
+        "covered": true,
+        "adequate": false,
+        "gap": "With no vendor mitigation, any temporary mitigation for this local flaw is the operator's own design, B4.d does not say what makes one adequate, and 'promptly' has no timeframe."
+      },
+      "AU-Essential-8-Patch": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Workstations at Maturity Levels One and Two keep one month after exploitation is known, and no window covers exploitation before the release."
+      },
+      "ISO-27001-2022-A.8.8": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Timescales left to the organization let a ranking by the Important rating schedule an exploited flaw as routine."
+      }
+    },
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-145",
+        "name": "ACTIVELY-EXPLOITED-OS-LPE-REMEDIATION-WINDOW-ENFORCEMENT",
+        "description": "When an operating system vendor reports that a local privilege-escalation flaw was exploited before its fix, the monthly update carrying the fix must be installed and the host restarted into the fixed build inside the remediation window, and the running build must be read from each host.",
+        "evidence": "Microsoft's August 2021 advisory for CVE-2021-36948 marks the flaw 'Exploitation Detected', lists only KB5005030, KB5005031 and KB5005033 as remediations, marks each as requiring a restart, and offers no workaround. A Windows 10 or Windows Server 2019 host that has installed the update but not restarted still runs a build below 10.0.17763.2114, 10.0.18363.1734, 10.0.19041.1165, 10.0.19042.1165 or 10.0.19043.1165.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "UK-CAF-B4",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "A flaw listed as known exploited must be remediated or mitigated on every affected host within a short fixed period, measured from the earlier of the catalog listing and the vendor's own exploitation notice.",
+        "evidence": "Microsoft published the fix for CVE-2021-36948 on 2021-08-10 with its advisory already marking the flaw 'Exploitation Detected', and CISA added it to KEV on 2021-11-03 with a due date of 2021-11-17. A clock started at the KEV listing would begin 85 days after Microsoft's own exploitation notice.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-122",
+        "name": "EOL-ASSET-DECOMMISSION",
+        "description": "Operating system releases that no longer receive vendor security updates must be upgraded, isolated or removed within a set period, and a fix installed before the end of updates must not be counted as continuing coverage.",
+        "evidence": "The August 2021 fix for CVE-2021-36948 exists for Windows 10 Version 1909 Enterprise, Education and IoT Enterprise, for Windows 10 Versions 2004, 20H2 and 21H1, and for Windows Server, version 2004 and 20H2, but Microsoft's Windows 10 release information page marks Windows 10 Versions 1909, 2004, 20H2 and 21H1 as end of updates, and its Windows Server Semi-Annual Channel lifecycle page shows that servicing has ended for Windows Server, version 2004 and 20H2. A host on one of them can be closed against this CVE and still be exposed to flaws fixed after its last update. The non-LTSC editions of Windows 10 Version 1809 and Windows 10 Version 1909 Home, Pro, Pro Education and Pro for Workstations had left servicing before 2021-08-10 and received no fix, according to the KB5005030 and KB5005031 pages and Microsoft's Windows 10 lifecycle pages.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8"
+        ]
+      }
+    ]
+  },
+  "CVE-2021-31199": {
+    "name": "Microsoft Enhanced Cryptographic Provider Privilege Escalation Vulnerability (CVE-2021-31199)",
+    "lesson_date": "2026-09-23",
+    "ai_discovered_zeroday": false,
+    "ai_discovery_source": "unknown",
+    "ai_discovery_date": null,
+    "ai_assist_factor": "none",
+    "attack_vector": {
+      "description": "A local, low-privileged user triggers a flaw in the Windows Enhanced Cryptographic Provider to elevate privilege. Sources describe this as the privilege-escalation stage of an exploit chain that pairs it with the Adobe Acrobat and Reader use-after-free flaw CVE-2021-28550.",
+      "privileges_required": "low; a local user context is required before the escalation, consistent with the CVSS vector AV:L/PR:L",
+      "complexity": "low",
+      "ai_factor": "None. No source claims AI tooling in the discovery or weaponization of this flaw."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Installing the June 8, 2021 Windows security update for the running version (KB5003646, KB5003637, KB5003671, KB5003667 and the related builds), which removes the escalation, then rebooting the host, and applying the Adobe APSB21-29 update to close the document-reader entry point.",
+        "was_this_required": true,
+        "framework_requiring_it": "AU-Essential-8-Patch",
+        "adequacy": "Adequate once the June 2021 updates exist, but the flaw was exploited as a zero-day before that date, so no patch could have prevented the earliest exploitation; the update also requires a reboot, which the sub-Maturity-Level-Three windows do not force quickly."
+      },
+      "detection": {
+        "what_would_have_worked": "Watching for a low-privileged process obtaining a higher-integrity token shortly after a document reader opens an untrusted file, and checking hosts for the paired Adobe CVE-2021-28550 exploitation.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Weak on its own, because no public exploit or indicator feed exists for this local escalation; detection depends on generic privilege-transition monitoring rather than a signature specific to the flaw."
+      },
+      "response": {
+        "what_would_have_worked": "Applying the June 2021 Windows update and the Adobe update across the fleet, prioritizing hosts that open untrusted documents, and confirming the installed build after reboot.",
+        "was_this_required": true,
+        "framework_requiring_it": "NIST-800-53-SI-2",
+        "adequacy": "The update is the durable fix, but because the flaw is only the escalation half of a chain, response must also close the paired document-reader flaw or the chain remains usable."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false
+      },
+      "NIS2-Art21-vulnerability-management": {
+        "covered": true,
+        "adequate": false
+      },
+      "UK-CAF-B4": {
+        "covered": true,
+        "adequate": false
+      },
+      "AU-Essential-8-Patch": {
+        "covered": true,
+        "adequate": false
+      },
+      "ISO-27001-2022-A.8.8": {
+        "covered": true,
+        "adequate": false
+      }
+    },
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-145",
+        "name": "ACTIVELY-EXPLOITED-OS-LPE-REMEDIATION-WINDOW-ENFORCEMENT",
+        "description": "A local privilege-escalation flaw the operating-system vendor reports as already exploited moves onto the accelerated remediation track as soon as that status is published, and the fix is counted as applied only after the host has restarted into it and the running build has been confirmed on the machine.",
+        "evidence": "Microsoft's June 2021 update guide marks CVE-2021-31199, a Windows Enhanced Cryptographic Provider elevation-of-privilege flaw, as exploited at release, and every fix (for example KB5003646 for Windows 10 Version 1809 and Windows Server 2019, KB5003637 for Windows 10 Versions 2004 through 21H1) requires a restart, so a fleet that stages the update without restarting still carries the escalation.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "NIST-800-53-SI-2",
+          "ISO-27001-2022-A.8.8",
+          "UK-CAF-B4",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      }
+    ]
+  },
+  "CVE-2021-31201": {
+    "name": "Microsoft Enhanced Cryptographic Provider Privilege Escalation Vulnerability (CVE-2021-31201)",
+    "lesson_date": "2026-09-23",
+    "ai_discovered_zeroday": false,
+    "ai_discovery_source": "unknown",
+    "ai_discovery_date": null,
+    "ai_assist_factor": "none",
+    "attack_vector": {
+      "description": "A local, low-privileged user triggers a flaw in the Windows Enhanced Cryptographic Provider to elevate privilege. Sources place it, with the sibling flaw CVE-2021-31199, as the privilege-escalation stage of a chain paired with the Adobe Acrobat and Reader use-after-free flaw CVE-2021-28550.",
+      "privileges_required": "low; a local user context is required before the escalation, consistent with the CVSS vector AV:L/PR:L",
+      "complexity": "low",
+      "ai_factor": "None. No source claims AI tooling in the discovery or weaponization of this flaw."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Installing the June 8, 2021 Windows security update for the running version (KB5003646, KB5003637, KB5003697, KB5003661 and the related builds), which removes the escalation, then rebooting the host, and applying the Adobe APSB21-29 update to close the paired document-reader entry point.",
+        "was_this_required": true,
+        "framework_requiring_it": "AU-Essential-8-Patch",
+        "adequacy": "Adequate once the June 2021 updates exist, but the flaw was exploited as a zero-day beforehand, so no update could have prevented the earliest exploitation, and the fix requires a reboot the lower maturity windows do not compel quickly."
+      },
+      "detection": {
+        "what_would_have_worked": "Alerting on a low-privileged process acquiring a higher-integrity token soon after a document reader opens an untrusted file, and checking hosts for the paired CVE-2021-28550 exploitation.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Weak on its own, since no public exploit or indicator feed exists for this local escalation and detection rests on generic privilege-transition monitoring."
+      },
+      "response": {
+        "what_would_have_worked": "Deploying the June 2021 Windows update and the Adobe update across the fleet, prioritizing hosts that open untrusted documents, and verifying the installed build after reboot.",
+        "was_this_required": true,
+        "framework_requiring_it": "NIS2-Art21-patch-management",
+        "adequacy": "The update is the durable fix, but because this is only the escalation half of a chain, response must also close the paired document-reader flaw or the chain stays usable."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false
+      },
+      "NIS2-Art21-patch-management": {
+        "covered": true,
+        "adequate": false
+      },
+      "UK-CAF-B4": {
+        "covered": true,
+        "adequate": false
+      },
+      "AU-Essential-8-Patch": {
+        "covered": true,
+        "adequate": false
+      },
+      "ISO-27001-2022-A.8.8": {
+        "covered": true,
+        "adequate": false
+      }
+    },
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-145",
+        "name": "ACTIVELY-EXPLOITED-OS-LPE-REMEDIATION-WINDOW-ENFORCEMENT",
+        "description": "An operating-system privilege-escalation flaw that its vendor reports as exploited gets a shortened remediation deadline from the date of that report, and a host counts as remediated only when, after a restart, the build it is running matches the vendor's fixed build.",
+        "evidence": "Microsoft's June 2021 update guide marks CVE-2021-31201, the sibling Enhanced Cryptographic Provider elevation-of-privilege flaw, as exploited at release; its fixes (for example KB5003697 for Windows Server 2012 and KB5003661 for Windows Server 2008 SP2) all require a restart, so a host that installs but does not reboot keeps the flaw live.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "NIST-800-53-SI-2",
+          "ISO-27001-2022-A.8.8",
+          "UK-CAF-B4",
+          "NIS2-Art21-patch-management"
+        ]
+      }
+    ]
+  },
+  "CVE-2018-8653": {
+    "name": "Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability (CVE-2018-8653)",
+    "lesson_date": "2026-09-23",
+    "ai_discovered_zeroday": false,
+    "ai_discovery_source": "human_researcher",
+    "ai_discovery_date": null,
+    "ai_assist_factor": "none",
+    "attack_vector": {
+      "description": "A crafted web page, which the attacker persuades the user to view, for example through a link sent by email, serves JScript that runs on the legacy jscript.dll engine and triggers a use-after-free in the way it handles objects in memory, giving remote code execution in the context of the current user.",
+      "privileges_required": "None on the target beyond persuading the user to view the page; the code runs with the current user's rights.",
+      "complexity": "High: the exploit needs the legacy engine selected and a reliable use-after-free, reflected in the network attack vector with high complexity and required user interaction.",
+      "ai_factor": "Not AI-discovered. Credited to Clement Lecigne of Google's Threat Analysis Group; no AI tooling is claimed."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Installing the December 19, 2018 out-of-band update (KB4483187 or the matching Windows 10 security update) promptly, and restricting access to jscript.dll in the interim.",
+        "was_this_required": true,
+        "framework_requiring_it": "AU-Essential-8-Patch",
+        "adequacy": "The update fixes the flaw, but because it was exploited as a zero-day before release, prompt patching limits future exposure without undoing any pre-patch compromise."
+      },
+      "detection": {
+        "what_would_have_worked": "Alerting on pages that force IE8 rendering and select jscript.dll from outside a local intranet, on script blocks that name the JScript.Compact engine, on scripts that call CollectGarbage or use the Enumerator object, and on the svchost.exe process hosting the WPAD service running proxy-script content or starting processes after an Internet Explorer session, built on the detection methods and exploit details Google Project Zero and the Threat Analysis Group publish.",
+        "was_this_required": false,
+        "framework_requiring_it": "UK-CAF-B4",
+        "adequacy": "These are useful heuristics but noisy; the page-content checks require inspection of content that reaches Internet Explorer directly, and the WPAD check needs process telemetry from the endpoint."
+      },
+      "response": {
+        "what_would_have_worked": "Applying the out-of-band update fleet-wide, restricting jscript.dll where the update could not be installed at once, and moving users off the legacy engine.",
+        "was_this_required": false,
+        "framework_requiring_it": "NIS2-Art21-patch-management",
+        "adequacy": "Restricting jscript.dll removes the vulnerable path immediately but reduces functionality for content that relies on it, so it is a stopgap until the update lands."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false
+      },
+      "NIS2-Art21-patch-management": {
+        "covered": true,
+        "adequate": false
+      },
+      "UK-CAF-B4": {
+        "covered": true,
+        "adequate": false
+      },
+      "AU-Essential-8-Patch": {
+        "covered": true,
+        "adequate": false
+      },
+      "ISO-27001-2022-A.8.8": {
+        "covered": true,
+        "adequate": false
+      }
+    },
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-057",
+        "name": "BROWSER-MANAGED-UPDATE-NO-DEFERRAL",
+        "description": "A security-channel browser release must be deployed on its own expedited clock and never held back into the monthly operating-system patch cadence, and the browser build must be inventoried as a patch surface separate from the operating system.",
+        "evidence": "CVE-2018-8653 is a use-after-free in the Internet Explorer jscript.dll engine fixed only by an out-of-band cumulative update; an update ring that defers browser releases or folds them into the monthly operating-system cadence would have left the actively exploited engine unpatched.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-018",
+        "name": "SCANNER-PAPER-COMPLIANCE-TEST",
+        "description": "A vulnerability scanner that reports a host as fully patched is paper compliance unless its detection content already covers the latest fix, out-of-band releases included, and the operational test must also account for the mitigation state that decides exposure.",
+        "evidence": "Microsoft's December 2018 advisory for CVE-2018-8653 states that an updated Wsusscn2.cab offline scan file would not be available until the January 2019 security release, so an offline scan against the December 2018 file could not list the December 19, 2018 out-of-band Internet Explorer update as missing while the flaw was being exploited.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8"
+        ]
+      }
+    ]
+  },
+  "CVE-2019-1429": {
+    "name": "Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability (CVE-2019-1429)",
+    "lesson_date": "2026-09-23",
+    "ai_discovered_zeroday": false,
+    "ai_discovery_source": "human_researcher",
+    "ai_discovery_date": null,
+    "ai_assist_factor": "none",
+    "attack_vector": {
+      "description": "A crafted web page or an Office document hosting the Internet Explorer engine serves JScript on the legacy jscript.dll engine that frees a member of the arguments object during a toJSON callback, or a variable assigned to the arguments object during an Array.sort callback (the incompletely fixed CVE-2019-1367 path), and re-accesses it, a use-after-free that gives remote code execution in the context of the current user.",
+      "privileges_required": "None on the target beyond persuading the user to view the page or open the document; the code runs with the current user's rights.",
+      "complexity": "High to build a reliable exploit, reflected in the network attack vector with high complexity and required user interaction; a crash proof of concept is public as Exploit-DB 47707.",
+      "ai_factor": "Not AI-discovered. Credited to Resecurity, iDefense Labs, Ivan Fratric of Project Zero and Clement Lecigne of the Threat Analysis Group; no AI tooling is claimed."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Installing the November 12, 2019 update (IE Cumulative KB4525106, the matching Windows 10 security update or the Monthly Rollup) promptly.",
+        "was_this_required": true,
+        "framework_requiring_it": "AU-Essential-8-Patch",
+        "adequacy": "The update fixes the flaw, but because it was exploited as a zero-day and a variant of a prior flaw, prompt patching plus watching for siblings of the earlier bug was needed to cover the class."
+      },
+      "detection": {
+        "what_would_have_worked": "Alerting on pages that force IE8 rendering and select jscript.dll from outside a local intranet, on scripts that free arguments members during a toJSON or Array.sort callback, on CollectGarbage or Enumerator use, and on the svchost.exe process hosting the WPAD service running proxy-script content or starting processes after an Internet Explorer session.",
+        "was_this_required": false,
+        "framework_requiring_it": "UK-CAF-B4",
+        "adequacy": "These heuristics are reliable but require content inspection in front of the browser, which is absent where Internet Explorer is reached directly; the WPAD check needs process telemetry from the endpoint."
+      },
+      "response": {
+        "what_would_have_worked": "Keeping the jscript.dll restriction from the CVE-2019-1367 advisory in place, or re-applying it after the September 2019 update, until the November 12, 2019 update was installed, treating the fix for CVE-2019-1367 as a trigger to expect siblings in the same primitive, and applying the November update across the fleet.",
+        "was_this_required": false,
+        "framework_requiring_it": "NIS2-Art21-vulnerability-handling",
+        "adequacy": "Because this flaw came from variant analysis of an incompletely fixed predecessor, a response keyed only on the original CVE would have missed the sibling until its own advisory; the jscript.dll restriction covered it only where operators kept it after the September update, which Microsoft asked them to install with the restriction reverted."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false
+      },
+      "NIS2-Art21-vulnerability-handling": {
+        "covered": true,
+        "adequate": false
+      },
+      "UK-CAF-B4": {
+        "covered": true,
+        "adequate": false
+      },
+      "AU-Essential-8-Patch": {
+        "covered": true,
+        "adequate": false
+      },
+      "ISO-27001-2022-A.8.8": {
+        "covered": true,
+        "adequate": false
+      }
+    },
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-042",
+        "name": "INCOMPLETE-PATCH-SEQUENCE-SEVERITY-MULTIPLIER",
+        "description": "Vulnerability-management programs must apply a severity multiplier when a flaw is one in an incomplete-patch sequence on the same primitive, and must re-open the item rather than treating the first fix as terminal.",
+        "evidence": "CVE-2019-1429 is the variant of CVE-2019-1367 that Google Project Zero found by variant analysis in the same JScript garbage-collector primitive, so the earlier fix should have re-opened the item and driven a search for siblings rather than being treated as the end of the sequence.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-handling",
+          "ISO-27001-2022-A.8.8"
+        ]
+      }
+    ]
+  },
+  "CVE-2021-38649": {
+    "name": "Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability (CVE-2021-38649)",
+    "lesson_date": "2026-09-23",
+    "ai_discovered_zeroday": false,
+    "ai_discovery_source": "human_researcher",
+    "ai_discovery_date": null,
+    "ai_assist_factor": "none",
+    "attack_vector": {
+      "description": "A local user with a low-privileged account on a host running OMI below 1.6.8-1 elevates privileges. Microsoft describes the flaw only as an elevation of privilege, and Wiz, which reported it, publishes technical detail for three sibling OMI flaws but not for this one; Wiz reports the OMI agent runs as root.",
+      "privileges_required": "A low-privileged local account on a host running an OMI agent below 1.6.8-1; the remote-code-execution sibling CVE-2021-38647 needs no account when the OMI HTTPS port is exposed.",
+      "complexity": "High, per NVD's CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N); no source describes the conditions an attacker must meet.",
+      "ai_factor": "None. Found by human researchers at Wiz.io; no AI tooling is claimed by any source."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Updating the OMI agent to 1.6.8-1 on every host, including self-installed OMI, System Center Operations Manager instances and Azure HDInsight nodes whose configuration blocked Microsoft's automatic update, and bringing each extension that carries OMI to its fixed build: OMS Agent for Linux v1.13.40-0, Linux Diagnostics extension v4.0.15 or v3.0.135 (v4.0.13 in the Security Update Guide), DSC Linux agent 2.71.1.25, 2.70.0.30 or 3.0.0.3 on the matching branch, the Container Monitoring Solution image sha256:12b7682d8f9a2f67752bf121029e315abcae89bc0c34a0e05f07baec72280707, and on Azure Stack Hub Azure Monitor, Update and Configuration Management 1.14.02 and Microsoft Azure Diagnostic Extension for Linux Virtual Machines 3.1.135.",
+        "was_this_required": false,
+        "framework_requiring_it": "AU-Essential-8-Patch",
+        "adequacy": "The 1.6.8-1 update removes the flaw, but an inventory that never recorded the silently bundled agent cannot drive the update, so prevention depends on discovering OMI first."
+      },
+      "detection": {
+        "what_would_have_worked": "Enabling scxadmin verbose logging and alerting on Invoke_ExecuteShellCommand entries in /var/opt/microsoft/scx/log/scx.log, and on shell commands run as root from /var/opt/microsoft/scx/tmp, as Microsoft's guidance describes for commands run remotely through the OMI flaws.",
+        "was_this_required": false,
+        "framework_requiring_it": "ISO-27001-2022-A.8.8",
+        "adequacy": "Microsoft wrote this guidance for attackers who run commands remotely through the SCXcore service, so for this local flaw it is a heuristic, and the scx.log record exists only where scxadmin verbose logging was enabled beforehand."
+      },
+      "response": {
+        "what_would_have_worked": "Rotating any credentials reachable from the root context of the OMI host and confirming OMI is at 1.6.8-1 across the managed and self-managed fleet.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Credential rotation is the load-bearing step because the agent runs as root; simply updating the package restores a safe state without addressing what a prior root compromise reached."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "A silently bundled agent may be absent from the remediation program's inventory, so the 1.6.8-1 update is never scheduled."
+      },
+      "NIST-800-53-AC-6": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Least privilege on the VM's own accounts does not bound a flaw in the vendor daemon's root-running privilege boundary."
+      },
+      "NIS2-Art21-patch-management": {
+        "covered": true,
+        "adequate": false,
+        "gap": "The directive sets no clock for applying the manual OMI update on self-managed hosts."
+      },
+      "UK-CAF-B4": {
+        "covered": true,
+        "adequate": false,
+        "gap": "A port restriction offered against the remote flaw can be accepted as temporary mitigation for an extended period while the local elevation stays open."
+      },
+      "AU-Essential-8-Patch": {
+        "covered": true,
+        "adequate": false,
+        "gap": "The asset class follows OMI port exposure, so an internally reachable instance has no timeframe at Maturity Level One although the flaw is local."
+      },
+      "ISO-27001-2022-A.8.8": {
+        "covered": true,
+        "adequate": false,
+        "gap": "A.8.8 does not say how provider-installed software is identified, so a register built from deployed services or the Azure portal omits OMI unless each Linux host's packages are inventoried."
+      }
+    },
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "When a flaw is listed in the CISA Known Exploited Vulnerabilities catalog, the response clock is measured in hours, and where the vendor fix is not yet installed a compensating measure that meets that clock is deployed first.",
+        "evidence": "CVE-2021-38649 was added to CISA KEV on 2021-11-03 with a 2021-11-17 due date, and Wiz reports that the Open Management Infrastructure agent runs as root. Microsoft's September 2021 security update data for CVE-2021-38649 lists only security updates (OMI 1.6.8-1 and the fixed extension builds) and no workaround or mitigation, and the OMI port restriction in Microsoft's guidance is offered against the remote-code-execution sibling CVE-2021-38647, not this local flaw. Installing the fixed build is therefore the only vendor-documented measure; limiting who can log on to the host is an operator-side measure that Microsoft does not document.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "ISO-27001-2022-A.8.8",
+          "AU-Essential-8-Patch"
+        ]
+      }
+    ]
+  },
+  "CVE-2019-0604": {
+    "name": "Microsoft SharePoint Remote Code Execution Vulnerability",
+    "lesson_date": "2026-09-23",
+    "ai_discovered_zeroday": false,
+    "ai_discovery_source": "human_researcher",
+    "ai_discovery_date": null,
+    "ai_assist_factor": "none",
+    "attack_vector": {
+      "description": "A request to /_layouts/15/Picker.aspx sets the PickerDialogType parameter to an ItemPickerDialog type and posts a hiddenSpanData field whose value reaches an XmlSerializer with an attacker-controlled type, deserializing a payload that runs as the SharePoint application pool and farm account.",
+      "privileges_required": "NVD scores privileges required as none (PR:N), while Microsoft's advisory states that exploitation requires a user to upload a specially crafted SharePoint application package to an affected version of SharePoint.",
+      "complexity": "Low with the public tool once the endpoint is reachable; it builds the picker request and serialized command automatically.",
+      "ai_factor": "None. Found by an external researcher and reported through the Zero Day Initiative; no AI tooling is claimed."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Installing every update Microsoft lists for the edition in the April 25, 2019 revision of its advisory: KB4462199 (SharePoint Server 2019), KB4462211 (SharePoint Enterprise Server 2016), KB4462202 plus KB4462143 (SharePoint Server 2013 SP1), KB4462143 (SharePoint Foundation 2013 SP1), KB4462184 plus KB4461630 (SharePoint Server 2010 SP2) and KB4461630 (SharePoint Foundation 2010 SP2), with restricted network access to Picker.aspx as an operator-side measure that Microsoft does not document.",
+        "was_this_required": false,
+        "framework_requiring_it": "AU-Essential-8-Patch",
+        "adequacy": "The April 2019 update set is a complete fix. A SharePoint Server farm with only its February 12, 2019 update stayed exploitable until the March 12, 2019 update was installed, and until April 25, 2019 Microsoft's list for SharePoint Server 2010 SP2 omitted KB4461630, so a program that installed only the updates listed against this CVE depended on tracking each revision of the advisory."
+      },
+      "detection": {
+        "what_would_have_worked": "Watching for new .aspx files under the SharePoint layouts directory, for POSTs to any path ending in Picker.aspx with a PickerDialogType parameter naming a Microsoft.SharePoint type and a hiddenSpanData body field, as Emerging Threats rule sid 2027345 matches, and for the SharePoint worker process spawning a shell.",
+        "was_this_required": false,
+        "framework_requiring_it": "UK-CAF-C1",
+        "adequacy": "The webshell file-creation signal is reliable, but monitoring that watches user activity or one campaign's filenames rather than the layouts directory misses a webshell planted under another name."
+      },
+      "response": {
+        "what_would_have_worked": "Escalating a confirmed webshell to the response a state-actor intrusion warrants, removing all webshells, rotating the farm and application-pool credentials and auditing for lateral movement, given the Emissary Panda activity.",
+        "was_this_required": false,
+        "framework_requiring_it": "NIS2-Art21-incident-handling",
+        "adequacy": "Removing one webshell is insufficient because Unit 42 found several on one server and observed credential dumping, so response must rotate credentials and hunt for the tools uploaded alongside."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "On the SharePoint Server editions a program can record the February 2019 update as closing the flaw and miss the March 2019 update, and on Server 2010 SP2 miss KB4461630 until the April 2019 revision listed it."
+      },
+      "NIS2-Art21-vulnerability-handling": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Neither Article 21(2)(e) nor point 6.6.1 requires re-opening a closed finding when a fix is re-released or the list of required updates is revised."
+      },
+      "NIS2-Art21-incident-handling": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Handling is not tied to a nation-state initial-access trigger, so a webshell may be treated as a routine web incident."
+      },
+      "UK-CAF-C1": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Monitoring keyed to user activity or one campaign's filenames rather than the layouts directory misses a planted webshell."
+      },
+      "AU-Essential-8-Patch": {
+        "covered": true,
+        "adequate": true,
+        "gap": "Applying each update within 48 hours of its February 12 or March 12, 2019 release would have installed the complete set before the April 2019 activity; the April 25, 2019 revision changed only the CVE mapping."
+      },
+      "ISO-27001-2022-A.8.8": {
+        "covered": true,
+        "adequate": false,
+        "gap": "A.8.8 does not require re-evaluating exposure when the vendor revises which updates close a CVE, so a register closed after the February 2019 update can miss the March 2019 update on the Server editions."
+      }
+    },
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-042",
+        "name": "INCOMPLETE-PATCH-SEQUENCE-SEVERITY-MULTIPLIER",
+        "description": "When a fix for a flaw proves incomplete and the vendor re-releases it, the vulnerability-management program re-opens the item and raises its severity rather than treating the first fix as terminal.",
+        "evidence": "The original February 12, 2019 SharePoint update for CVE-2019-0604 fixed only the encoder in Microsoft.SharePoint.dll, and the Zero Day Initiative write-up confirms the exploit still worked against the Portal.dll encoder until Microsoft re-released the updates on March 12, 2019; Microsoft revised the advisory again on April 25, 2019 to add SharePoint Server 2013 SP1 and Foundation 2010 SP2 and a second required update for Server 2010 SP2, so the item warranted re-opening at each revision.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-vulnerability-handling"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "When a flaw is listed in the CISA Known Exploited Vulnerabilities catalog, the response clock is measured in hours, and where the vendor fix is not yet installed a compensating measure that meets that clock is deployed first.",
+        "evidence": "CVE-2019-0604 was added to CISA KEV on 2021-11-03 with a 2022-05-03 due date, records known ransomware use, and has a public exploit (Exploit-DB 48053). Microsoft publishes no workaround for it, so on an internet-facing SharePoint farm the only hours-scale measure before the April 2019 update set is installed is an operator-side one that the vendor does not document, such as blocking external requests to Picker.aspx.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-043",
+        "name": "NATION-STATE-INITIAL-ACCESS-IR-ESCALATION",
+        "description": "Incident-response procedures define a distinct escalation tier for a confirmed exploit chain attributed to a state-sponsored operator, so it is not triaged at the severity an ordinary intrusion receives.",
+        "evidence": "Unit 42 observed Emissary Panda (APT27) China Chopper and Antak webshells on government SharePoint servers in April 2019, believes the actor exploited CVE-2019-0604 to install them, and saw it dump credentials; an intrusion of this kind is escalated beyond ordinary web-incident severity.",
+        "gap_closes": [
+          "NIS2-Art21-incident-handling",
+          "UK-CAF-C1"
+        ]
+      }
+    ]
+  },
+  "CVE-2019-0797": {
+    "name": "Microsoft Win32k Privilege Escalation Vulnerability (CVE-2019-0797)",
+    "lesson_date": "2026-09-23",
+    "ai_discovered_zeroday": false,
+    "ai_discovery_source": "human_researcher",
+    "ai_discovery_date": null,
+    "ai_assist_factor": "none",
+    "attack_vector": {
+      "description": "A local user runs a crafted application that calls the undocumented NtDCompositionDiscardFrame and NtDCompositionDestroyConnection syscalls concurrently; the missing lock lets one free a composition frame the other is still using, a use-after-free that is groomed with palettes or window objects into kernel-mode code execution.",
+      "privileges_required": "A local logon and the ability to run code; the exploit was delivered in targeted intrusions after initial access.",
+      "complexity": "A race condition, so the exploit must win a timing window; Kaspersky found it in use against 64-bit Windows 8 through Windows 10 build 15063.",
+      "ai_factor": "None. Found by Kaspersky researchers through in-the-wild detection; no AI tooling is claimed."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Applying the March 12, 2019 Windows update and rebooting, since no configuration workaround exists.",
+        "was_this_required": false,
+        "framework_requiring_it": "AU-Essential-8-Patch",
+        "adequacy": "The update removes the flaw, but it was exploited as a zero-day before the update shipped and Microsoft lists no workaround, so no vendor fix or mitigation existed during that exposure window."
+      },
+      "detection": {
+        "what_would_have_worked": "Kernel privilege-escalation monitoring for concurrent NtDComposition syscalls and for a user-mode process gaining kernel or SYSTEM privileges.",
+        "was_this_required": false,
+        "framework_requiring_it": "NIST-800-53-SC-39",
+        "adequacy": "Kaspersky's behavioral detection and Automatic Exploit Prevention are what first detected this exploit, so detection at the kernel boundary worked here, but only on hosts already running such tooling before the March 2019 fix."
+      },
+      "response": {
+        "what_would_have_worked": "Treating a confirmed escalation event as a targeted intrusion, given Kaspersky's belief that FruityArmor and SandCat used the exploit, rebuilding the host, and hunting for how the attacker first ran code and for the tools Kaspersky associates with SandCat, including CHAINSHOT and the FinFisher/FinSpy framework.",
+        "was_this_required": false,
+        "framework_requiring_it": "NIS2-Art21-incident-handling",
+        "adequacy": "Because the flaw yields kernel-mode control and was used in targeted attacks after the attacker already ran code, a confirmed event requires a full-host rebuild and a hunt for the initial access, not only patching."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "A zero-day exploited before the fix leaves an exposure window no organization-defined timeframe can address."
+      },
+      "NIST-800-53-SC-39": {
+        "covered": true,
+        "adequate": false,
+        "gap": "SC-39 does not require the sandboxing that Kaspersky says prevents exploitation, so ordinary unsandboxed processes can still reach the race."
+      },
+      "NIS2-Art21-patch-management": {
+        "covered": true,
+        "adequate": false,
+        "gap": "A reasonable time counted from availability starts after exploitation for a flaw already exploited at release."
+      },
+      "NIS2-Art21-incident-handling": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Article 21(2)(b) does not require tracing the initial access behind a detected escalation attempt."
+      },
+      "UK-CAF-B4": {
+        "covered": true,
+        "adequate": false,
+        "gap": "With no workaround, a local flaw classed as not externally exposed can wait for an extended period with no temporary mitigation."
+      },
+      "AU-Essential-8-Patch": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Exploitation from February 2019, before the March 12 release, is outside every window at every maturity level."
+      },
+      "ISO-27001-2022-A.8.8": {
+        "covered": true,
+        "adequate": false,
+        "gap": "No public information existed before the release, and the register need not confirm the reboot into the fixed component."
+      }
+    },
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-145",
+        "name": "ACTIVELY-EXPLOITED-OS-LPE-REMEDIATION-WINDOW-ENFORCEMENT",
+        "description": "When an operating-system vendor flags a local privilege-escalation flaw as exploited in the wild and it is listed as known-exploited, the cumulative update that fixes it is applied and the host rebooted within the stated window, not merely staged.",
+        "evidence": "CVE-2019-0797 was fixed by Microsoft's March 12, 2019 Win32k update and is KEV-listed after being exploited as a zero-day; the cumulative update must be installed and the host rebooted within the stated window rather than staged, because the fixed Win32k component loads only after a restart.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "NIST-800-53-SI-2",
+          "ISO-27001-2022-A.8.8"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-003",
+        "name": "KERNEL-EXPLOITATION-DETECTION",
+        "description": "Endpoint monitoring carries rules for kernel privilege-escalation indicators, with alerting fast enough to catch an escalation attempt in progress rather than only in retrospect.",
+        "evidence": "Kaspersky found CVE-2019-0797 when its Automatic Exploit Prevention detected an exploitation attempt in February 2019, before any fix existed, and Microsoft lists no workaround; on an unpatched Windows 8.1 through Windows 10 1809 or Server 2012 through 2019 host, kernel privilege-escalation monitoring of this kind is the available detection.",
+        "gap_closes": [
+          "UK-CAF-B4",
+          "NIST-800-53-SC-39"
+        ]
+      }
+    ]
+  },
+  "CVE-2021-28310": {
+    "name": "Microsoft Win32k Privilege Escalation Vulnerability (CVE-2021-28310)",
+    "lesson_date": "2026-09-23",
+    "ai_discovered_zeroday": false,
+    "ai_discovery_source": "human_researcher",
+    "ai_discovery_date": null,
+    "ai_assist_factor": "none",
+    "attack_vector": {
+      "description": "A local process drives the DirectComposition API through three win32kbase.sys syscalls, grooms the dwm.exe heap with CreateResource, ReleaseResource and SetResourceBufferProperty commands, then triggers an out-of-bounds write in dwmcore.dll to run shellcode and inject a second stage into another system process, reaching SYSTEM.",
+      "privileges_required": "a local low-privileged account already able to run code on the host; Kaspersky reports it was likely used together with a browser exploit to escape a sandbox or gain system privileges, though it did not capture the full chain",
+      "complexity": "low once the primitive is understood, though the exploit performs a multi-stage heap groom and spray to place a controlled buffer",
+      "ai_factor": "none; found by a human researcher through exploit-prevention telemetry, with no AI tooling claimed"
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Applying the April 13, 2021 cumulative update for the running build (KB5001339, KB5001342, KB5001337 or KB5001330) and rebooting; before that release existed there was no patch-side prevention, so the flaw was open as a zero-day.",
+        "was_this_required": true,
+        "framework_requiring_it": "AU-Essential-8-Patch",
+        "adequacy": "Complete after April 13, 2021, but inadequate for the pre-patch period: the exploit was used in the wild before Microsoft shipped a fix, so no patch window covers the time of compromise."
+      },
+      "detection": {
+        "what_would_have_worked": "Alerting on the exploit's behavior: a non-graphics process issuing the DirectComposition syscalls in volume, dwm.exe instability, and the Kaspersky endpoint verdicts named for this exploit.",
+        "was_this_required": false,
+        "framework_requiring_it": "UK-CAF-B4",
+        "adequacy": "Behavioral detection can catch the heap groom and the injection stage. The exploit runs its shellcode inside the user-mode dwm.exe process and then injects into another system process, so detection depends on user-mode telemetry of code execution inside dwm.exe and of process injection from dwm.exe into another system process, which is absent on hosts without an endpoint agent that records it."
+      },
+      "response": {
+        "what_would_have_worked": "Treating any host that ran untrusted local code before the update as potentially compromised, investigating for the injected second stage, and rebuilding rather than only patching.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "A reboot into the patched build closes the flaw, but a system exploited before patching may already carry an implanted payload that patching alone does not remove."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false
+      },
+      "NIS2-Art21-patch-management": {
+        "covered": true,
+        "adequate": false
+      },
+      "UK-CAF-B4": {
+        "covered": true,
+        "adequate": false
+      },
+      "AU-Essential-8-Patch": {
+        "covered": true,
+        "adequate": false
+      },
+      "ISO-27001-2022-A.8.8": {
+        "covered": true,
+        "adequate": false
+      }
+    },
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "A KEV listing must trigger a fixed mitigation clock measured in hours, not the routine monthly patch cycle.",
+        "evidence": "CVE-2021-28310 was added to CISA KEV on 2021-11-03 with a 2021-11-17 due date. The fixing April 13, 2021 cumulative updates (KB5001330, KB5001337, KB5001339, KB5001342) had shipped seven months earlier, so a KEV-anchored clock closes the gap between the listing and installation on hosts still unpatched at listing time.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management",
+          "AU-Essential-8-Patch"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-145",
+        "name": "ACTIVELY-EXPLOITED-OS-LPE-REMEDIATION-WINDOW-ENFORCEMENT",
+        "description": "KEV designation of an operating-system privilege-escalation flaw starts a remediation clock that ends only when the fixing update is installed, the host has rebooted into it, and the running build is confirmed on the host itself; a staged-but-not-rebooted update does not stop the clock.",
+        "evidence": "CVE-2021-28310 is a Windows privilege escalation through an out-of-bounds write in dwmcore.dll inside the user-mode Desktop Window Manager process (dwm.exe), reached through the win32kbase.sys DirectComposition syscalls, and Microsoft records it as exploited at release. The April 13, 2021 updates require a reboot, so a host that shows the update as staged but not rebooted is still exploitable; verification must confirm the running build.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "NIST-800-53-SI-2",
+          "ISO-27001-2022-A.8.8",
+          "UK-CAF-B4"
+        ]
+      }
+    ]
+  },
+  "CVE-2019-0863": {
+    "name": "Microsoft Windows Error Reporting (WER) Privilege Escalation Vulnerability",
+    "lesson_date": "2026-09-23",
+    "ai_discovered_zeroday": false,
+    "ai_discovery_source": "human_researcher",
+    "ai_discovery_date": null,
+    "ai_assist_factor": "none",
+    "attack_vector": {
+      "description": "A local user turns the Windows Error Reporting report-queue directory into a junction to an attacker-controlled folder, drops a crafted .wer file, and triggers the WER reporting queue task so the service (via UtilAddAccessToPath in wer.dll) writes an attacker-chosen DACL onto a protected file, for example making a driver in system32\\drivers writable and reaching SYSTEM.",
+      "privileges_required": "a local low-privileged account able to run code and create junctions on the host",
+      "complexity": "low; a public proof of concept demonstrates the full chain",
+      "ai_factor": "none; credited to human researchers with no AI tooling claimed"
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Applying the May 14, 2019 update for the running build (the Monthly Rollup KB4499164/KB4499151/KB4499171 or Security-Only KB4499175/KB4499165/KB4499158, or the Windows 10 cumulative updates KB4499154, KB4494440, KB4499181, KB4499179, KB4499167, KB4494441, KB4497936) and rebooting.",
+        "was_this_required": true,
+        "framework_requiring_it": "AU-Essential-8-Patch",
+        "adequacy": "The update removes the flaw, but it was public and exploited at release, so hosts patched on a slow cycle stayed exposed for the window between disclosure and installation."
+      },
+      "detection": {
+        "what_would_have_worked": "Alerting on junction creation under the WER report-queue path, on the WER service writing to protected locations on behalf of a non-admin user, and on protected drivers becoming writable.",
+        "was_this_required": false,
+        "framework_requiring_it": "UK-CAF-B4",
+        "adequacy": "The junction and the unexpected DACL write are observable, but only where file-system and service telemetry is collected and tuned for this pattern."
+      },
+      "response": {
+        "what_would_have_worked": "Investigating shared or multi-user hosts that ran untrusted code before patching for tampered protected files, and rebuilding where a writable-driver primitive may have been used.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Patching closes the flaw but does not undo a DACL change or a modified driver already planted before the update."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false
+      },
+      "NIS2-Art21-patch-management": {
+        "covered": true,
+        "adequate": false
+      },
+      "UK-CAF-B4": {
+        "covered": true,
+        "adequate": false
+      },
+      "AU-Essential-8-Patch": {
+        "covered": true,
+        "adequate": false
+      },
+      "ISO-27001-2022-A.8.8": {
+        "covered": true,
+        "adequate": false
+      }
+    },
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "A KEV listing must trigger a fixed mitigation clock measured in hours, not the routine monthly patch cycle.",
+        "evidence": "CVE-2019-0863 was added to CISA KEV on 2021-11-03 with a 2022-05-03 due date, and a public proof of concept (Exploit-DB 46917) has existed since May 2019. A KEV-anchored clock forces the May 2019 update onto any host still unpatched at listing rather than deferring a locally exploitable escalation to a routine cycle.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management",
+          "AU-Essential-8-Patch"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-145",
+        "name": "ACTIVELY-EXPLOITED-OS-LPE-REMEDIATION-WINDOW-ENFORCEMENT",
+        "description": "KEV designation of an operating-system privilege-escalation flaw starts a remediation clock that ends only when the fixing update is installed, the host has rebooted into it, and the running build is confirmed on the host itself; a staged-but-not-rebooted update does not stop the clock.",
+        "evidence": "CVE-2019-0863 is a Windows privilege escalation that Microsoft records as exploited and publicly disclosed at release and that reaches SYSTEM through a writable-driver primitive. The May 14, 2019 update requires a reboot, so a host that shows it as staged but not rebooted remains exploitable and needs on-host verification of the running build.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "NIST-800-53-SI-2",
+          "ISO-27001-2022-A.8.8",
+          "UK-CAF-B4"
+        ]
+      }
+    ]
+  },
+  "CVE-2019-1214": {
+    "name": "Microsoft Windows Privilege Common Log File System (CLFS) Escalation Vulnerability",
+    "lesson_date": "2026-09-23",
+    "ai_discovered_zeroday": false,
+    "ai_discovery_source": "human_researcher",
+    "ai_discovery_date": null,
+    "ai_assist_factor": "none",
+    "attack_vector": {
+      "description": "A local process abuses the way the Windows Common Log File System driver (clfs.sys) handles objects in memory to corrupt kernel state and escalate a low-privileged account to SYSTEM.",
+      "privileges_required": "a local low-privileged account able to run code on the host",
+      "complexity": "low to reach the driver, though no public exploit detailing the corruption primitive was found",
+      "ai_factor": "none; credited to a human researcher with no AI tooling claimed"
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Applying the September 10, 2019 update for the running build (the Monthly Rollup KB4516065/KB4516026/KB4516067/KB4516055 or Security-Only KB4516033/KB4516051/KB4516064/KB4516062, or the Windows 10 cumulative updates KB4516070, KB4516044, KB4516068, KB4516066, KB4516058, KB4512578, KB4515384) and rebooting.",
+        "was_this_required": true,
+        "framework_requiring_it": "AU-Essential-8-Patch",
+        "adequacy": "The update removes the flaw; because Microsoft's release-day active-attack flag was retracted and no public exploit followed, a routine patch cadence would have closed it well before CISA confirmed exploitation in 2021."
+      },
+      "detection": {
+        "what_would_have_worked": "Alerting on heavy or anomalous use of the CLFS API by a non-logging process, on clfs.sys bugchecks, and on a local account reaching SYSTEM shortly after CLFS container activity.",
+        "was_this_required": false,
+        "framework_requiring_it": "UK-CAF-B4",
+        "adequacy": "These are general heuristics; no public exploit was available to derive precise artifacts, so detection depends on broad kernel and process telemetry."
+      },
+      "response": {
+        "what_would_have_worked": "Prioritizing patch deployment on multi-user hosts and confirming the running build on-host, then investigating any host where a low-privileged process reached SYSTEM.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Patching closes the flaw, but a host escalated before the update may already carry attacker persistence that patching alone does not remove."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": true
+      },
+      "NIS2-Art21-patch-management": {
+        "covered": true,
+        "adequate": false
+      },
+      "UK-CAF-B4": {
+        "covered": true,
+        "adequate": false
+      },
+      "AU-Essential-8-Patch": {
+        "covered": true,
+        "adequate": true
+      },
+      "ISO-27001-2022-A.8.8": {
+        "covered": true,
+        "adequate": false
+      }
+    },
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "A KEV listing must trigger a fixed mitigation clock measured in hours, not the routine monthly patch cycle.",
+        "evidence": "CVE-2019-1214 was added to CISA KEV on 2021-11-03 with a 2022-05-03 due date. Microsoft flagged it under active attack at the September 10, 2019 release, retracted that on September 11, 2019, and its current record marks it not exploited, so the KEV listing is the durable in-the-wild signal; a KEV-anchored clock forces the September 2019 update onto any host still unpatched once CISA established exploitation.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management",
+          "AU-Essential-8-Patch"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-145",
+        "name": "ACTIVELY-EXPLOITED-OS-LPE-REMEDIATION-WINDOW-ENFORCEMENT",
+        "description": "KEV designation of an operating-system privilege-escalation flaw starts a remediation clock that ends only when the fixing update is installed, the host has rebooted into it, and the running build is confirmed on the host itself; a staged-but-not-rebooted update does not stop the clock.",
+        "evidence": "CVE-2019-1214 is a Windows CLFS-driver escalation to SYSTEM that CISA added to KEV on 2021-11-03; Microsoft's release-day active-attack flag was retracted the next day, so the KEV listing is the in-the-wild signal. The September 10, 2019 update requires a reboot, so a host that shows it staged but not rebooted stays exploitable and needs on-host verification of the running build.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "NIST-800-53-SI-2",
+          "ISO-27001-2022-A.8.8",
+          "UK-CAF-B4"
+        ]
+      }
+    ]
+  },
+  "CVE-2020-0601": {
+    "name": "Microsoft Windows CryptoAPI Spoofing Vulnerability",
+    "lesson_date": "2026-09-23",
+    "ai_discovered_zeroday": false,
+    "ai_discovery_source": "human_researcher",
+    "ai_discovery_date": null,
+    "ai_assist_factor": "none",
+    "attack_vector": {
+      "description": "An attacker crafts an elliptic-curve certificate whose public key matches a trusted CryptoAPI root while supplying a chosen generator, so the platform accepts it as chaining to that root. The certificate then signs a malicious executable, which appears to come from a trusted publisher, or authenticates a TLS server, which lets the attacker read or alter the session.",
+      "privileges_required": "none; the attacker needs only to present a certificate to the victim, by serving a signed file or terminating a TLS connection",
+      "complexity": "low once the technique is known; public tools generate the spoofed certificate in a few OpenSSL steps",
+      "ai_factor": "None. The National Security Agency reported the flaw; no AI tooling is claimed by any source."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Installing the January 2020 cumulative update for the running Windows 10 or Windows Server 2016, 2019 or Server Core 1803, 1903 or 1909 release (for example KB4534273, KB4534293, KB4528760 or KB4534271), which corrects the ECC certificate validation, followed by the required reboot",
+        "was_this_required": true,
+        "framework_requiring_it": "AU-Essential-8-Patch",
+        "adequacy": "The update fully removes the flaw. There is no configuration workaround, because the defect is in the platform validation routine itself, so patching is the only prevention."
+      },
+      "detection": {
+        "what_would_have_worked": "Alerting on Application event log Event ID 1 from source Audit-CVE after patching, and inspecting certificates for explicit ECC parameters with a non-standard generator that still chain to a trusted root",
+        "was_this_required": false,
+        "framework_requiring_it": "ISO-27001-2022-A.8.24",
+        "adequacy": "The Event ID fires only on patched hosts, so it detects attempts after the exposure is already closed; certificate inspection can catch the spoof earlier but requires trust-chain analysis that few endpoints perform."
+      },
+      "response": {
+        "what_would_have_worked": "Treating any executable or TLS session validated before patching as untrusted, and revalidating code-signing and transport-security decisions once the update is installed",
+        "was_this_required": false,
+        "framework_requiring_it": "NIST-800-53-SC-8",
+        "adequacy": "Because the flaw undermines the trust decision rather than a single asset, response has to reconsider everything the platform validated while unpatched, which is broad and often impractical after the fact."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SC-8": {
+        "covered": true,
+        "adequate": false,
+        "gap": "SC-8 assumes certificate validation works; here the platform validates a forged ECC certificate, so a TLS session it treats as protected can be read or altered."
+      },
+      "NIS2-Art21-network-security": {
+        "covered": true,
+        "adequate": false,
+        "gap": "The obligation has no working authentication or transport control to attest to while the platform trusts a spoofed certificate."
+      },
+      "UK-CAF-B4": {
+        "covered": true,
+        "adequate": false,
+        "gap": "A B4 review records TLS and code-signing controls as present while the validation code beneath them is defective, and no configuration setting closes the gap before the update."
+      },
+      "AU-Essential-8-Patch": {
+        "covered": true,
+        "adequate": false,
+        "gap": "A workstation or internal-server fleet below Maturity Level Three had a one-month window against a flaw for which working exploit code was public the day after the fix."
+      },
+      "ISO-27001-2022-A.8.24": {
+        "covered": true,
+        "adequate": false,
+        "gap": "An A.8.24 control set that mandates cryptography cannot detect that the platform's own trust decision is forged until the update is applied."
+      }
+    },
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-008",
+        "name": "CRYPTO-SUBSYSTEM-CVE-DISCLOSURE",
+        "description": "When a flaw affects the platform component that validates certificates or implements a cryptographic protocol, every control that depends on that component for trust or transport protection is recorded as not compensating until the fix is running.",
+        "evidence": "CVE-2020-0601 is in Windows CryptoAPI (Crypt32.dll) elliptic-curve certificate validation, so while a Windows 10 or Server 2016 and 2019 host is unpatched, TLS server authentication and code-signing trust cannot be counted as compensating controls; CISA advisory AA20-014A states the fix ensures CryptoAPI completely validates ECC certificates.",
+        "gap_closes": [
+          "NIST-800-53-SC-8",
+          "NIS2-Art21-network-security",
+          "ISO-27001-2022-A.8.24"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-132",
+        "name": "INDEPENDENT-INTEGRITY-VERIFICATION-OF-SIGNED-VENDOR-INSTALLERS",
+        "description": "A valid code signature is not treated as proof of artifact integrity; software installed from a vendor is verified against an integrity source independent of the channel that delivered it before it runs.",
+        "evidence": "CVE-2020-0601 lets an attacker forge a code-signing certificate that chains to a trusted Microsoft ECC root, so an executable appears signed by a legitimate publisher; verifying an installer against a published per-release hash from a separate channel defeats a signature that only looks trusted.",
+        "gap_closes": [
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "A vulnerability listed in the Known Exploited Vulnerabilities catalog is remediated on an hours-scale mitigation clock rather than the routine monthly patch cycle.",
+        "evidence": "CVE-2020-0601 was added to the KEV catalog on 2021-11-03, and public exploit code (ly4k/CurveBall, kudelskisecurity/chainoffools) had been available since 2020-01-15; a workstation fleet on the Essential Eight one-month window below Maturity Level Three is far slower than the exploit availability warrants.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "UK-CAF-B4"
+        ]
+      }
+    ]
+  },
+  "CVE-2020-0986": {
+    "name": "Microsoft Windows Kernel Privilege Escalation Vulnerability",
+    "lesson_date": "2026-09-23",
+    "ai_discovered_zeroday": false,
+    "ai_discovery_source": "human_researcher",
+    "ai_discovery_date": null,
+    "ai_assist_factor": "none",
+    "attack_vector": {
+      "description": "From a low-integrity process, such as a sandboxed Internet Explorer renderer, the attacker connects to the local procedure call port of the medium-integrity splwow64.exe print host and sends a crafted request that makes it dereference an attacker-controlled pointer and write to its memory. This escalates out of the browser sandbox into the more privileged print host, from which a payload runs.",
+      "privileges_required": "low; the attacker already holds low-integrity code execution, typically from a browser exploit, and uses this flaw to escalate",
+      "complexity": "low to moderate; the technique was used in the wild chained after an Internet Explorer bug",
+      "ai_factor": "None. Reported through the Zero Day Initiative and found in the wild by Kaspersky; no AI tooling is claimed."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Applying the June 2020 update and rebooting, and then the January 2021 update (CVE-2021-1648) that corrects the incomplete June fix (for example KB4598230 for 1809 and Server 2019 or KB4598229 for 1909); Windows 10 1709 and 1903, and Windows Server, version 1803 and 1903 (Server Core installation), received no corrected update and must be upgraded",
+        "was_this_required": true,
+        "framework_requiring_it": "AU-Essential-8-Patch",
+        "adequacy": "The June update alone did not remove the primitive; only the January 2021 CVE-2021-1648 update closes it, and no corrected update shipped for Windows 10 1709 or 1903 or for Windows Server, version 1803 or 1903, so a program that stopped at June left the write reachable."
+      },
+      "detection": {
+        "what_would_have_worked": "Alerting when splwow64.exe spawns a child process or runs PowerShell, when any low-integrity process connects to the splwow64 local procedure call port, and when an Internet Explorer process writes ok.exe to a temporary folder and runs it",
+        "was_this_required": false,
+        "framework_requiring_it": "NIST-800-53-SC-39",
+        "adequacy": "These are reliable signals but require process-lineage and inter-process-communication telemetry that many endpoints do not collect; the endpoint verdict PDM:Exploit.Win32.Generic caught the observed attack."
+      },
+      "response": {
+        "what_would_have_worked": "Treating a host that ran the observed components (CreateDC.exe, PoPc.dll) or reached www[.]static-cdn1[.]com as compromised and reimaging it, and rotating credentials exposed to the escalated process",
+        "was_this_required": false,
+        "framework_requiring_it": "NIS2-Art21-vulnerability-management",
+        "adequacy": "Response is complicated by the incomplete fix: a host patched only with the June update is still exposed to the same primitive, so remediation must confirm the January 2021 CVE-2021-1648 update is present, or that an unserviced Windows 10 1709 or 1903 or Windows Server, version 1803 or 1903 host has been upgraded."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SC-39": {
+        "covered": true,
+        "adequate": false,
+        "gap": "The flaw bypasses the process-integrity boundary by making a higher-integrity print host write attacker-controlled memory on request."
+      },
+      "NIS2-Art21-vulnerability-management": {
+        "covered": true,
+        "adequate": false,
+        "gap": "An entity that recorded the item remediated on the incomplete June update left its residual risk unaccounted for until the January 2021 CVE-2021-1648 fix, which never shipped for 1709 or 1903."
+      },
+      "UK-CAF-B4": {
+        "covered": true,
+        "adequate": false,
+        "gap": "A B4 review that treated the June update as remediation missed that the write survived until the January 2021 CVE-2021-1648 update."
+      },
+      "AU-Essential-8-Patch": {
+        "covered": true,
+        "adequate": false,
+        "gap": "The flaw was exploited before the June fix, and that fix was incomplete, so meeting any window on the June update still left the primitive reachable until January 2021."
+      },
+      "ISO-27001-2022-A.8.8": {
+        "covered": true,
+        "adequate": false,
+        "gap": "An A.8.8 program that closed the item on the June update recorded remediation for a flaw that stayed reachable until January 2021, and not at all on 1709 and 1903."
+      }
+    },
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-042",
+        "name": "INCOMPLETE-PATCH-SEQUENCE-SEVERITY-MULTIPLIER",
+        "description": "A vulnerability-management program applies a severity multiplier and re-opens the item when a flaw is the next in an incomplete-fix sequence on the same primitive, treating the sequence as evidence the underlying defect is not yet understood.",
+        "evidence": "CVE-2020-0986 was a trivial variant of the earlier CVE-2019-0880 splwow64 GDI print primitive, and its own June 2020 fix was incomplete, corrected only in January 2021 as CVE-2021-1648 and never for Windows 10 1709 or 1903, so a program should have re-opened the item rather than treating the June update as terminal.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-vulnerability-management",
+          "AU-Essential-8-Patch"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-017",
+        "name": "BUG-FAMILY-MITIGATION-PERSISTENCE",
+        "description": "Interim compensating measures adopted while a flaw in a recurring bug class is unpatched stay in force for a stated period after the fix ships, because sibling defects of the same class can remain in the patched code.",
+        "evidence": "CVE-2020-0986 recurred through CVE-2019-0880 and, after its incomplete June 2020 fix, CVE-2021-1648 in the same splwow64 GdiPrinterThunk code, so any compensating control on that inter-process path should have persisted past the June 2020 fix, which itself proved incomplete.",
+        "gap_closes": [
+          "UK-CAF-B4",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      }
+    ]
+  },
+  "CVE-2020-6819": {
+    "name": "Mozilla Firefox And Thunderbird Use-After-Free Vulnerability (CVE-2020-6819)",
+    "lesson_date": "2026-09-23",
+    "ai_discovered_zeroday": false,
+    "ai_discovery_source": "human_researcher",
+    "ai_discovery_date": null,
+    "ai_assist_factor": "none",
+    "attack_vector": {
+      "description": "Web content rendered by Firefox or Thunderbird triggers a race condition in the nsDocShell destructor, causing a use-after-free as the document shell is torn down and enabling code execution in a browser or browser-like context.",
+      "privileges_required": "None beyond rendering attacker-controlled web content in an affected build.",
+      "complexity": "High; the vector is a race condition, reflected in the high attack-complexity rating, though it was used in targeted attacks.",
+      "ai_factor": "Not AI-discovered; credited to Francisco Alonso working with Javier Marcos of JMPSec, with no AI tooling claimed."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Deploying the Firefox 74.0.1, ESR 68.6.1 and Thunderbird 68.7.0 builds as an emergency release, and keeping untrusted web content away from the affected builds until then.",
+        "was_this_required": false,
+        "framework_requiring_it": "AU-Essential-8-Patch",
+        "adequacy": "The build removes the vulnerable destructor path, but because the flaw was under attack before it shipped, the update limited rather than prevented the earliest exposure."
+      },
+      "detection": {
+        "what_would_have_worked": "Collecting browser and mail content-process crash reports and alerting on a crash whose crashing frame is nsDocShell::SynchronizeLayoutHistoryState, with the nsDocShell destructor further down the stack.",
+        "was_this_required": false,
+        "framework_requiring_it": "UK-CAF-B4",
+        "adequacy": "This is a heuristic that catches failed or unstable attempts only; a successful exploit may leave no crash, and the signal appears only where content-process crash reports are collected."
+      },
+      "response": {
+        "what_would_have_worked": "Treating a confirmed hit as a targeted intrusion, isolating the endpoint and updating the affected build rather than dismissing the crash.",
+        "was_this_required": false,
+        "framework_requiring_it": "NIS2-Art21-patch-management",
+        "adequacy": "Isolation and update address the endpoint but depend on recognizing the crash as exploitation rather than instability."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false
+      },
+      "NIS2-Art21-patch-management": {
+        "covered": true,
+        "adequate": false
+      },
+      "UK-CAF-B4": {
+        "covered": true,
+        "adequate": false
+      },
+      "AU-Essential-8-Patch": {
+        "covered": true,
+        "adequate": false
+      },
+      "ISO-27001-2022-A.8.8": {
+        "covered": true,
+        "adequate": false
+      }
+    },
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "A vulnerability listed on the CISA Known Exploited Vulnerabilities catalog is mitigated or patched on an incident clock measured in hours, separate from the routine patch schedule.",
+        "evidence": "CVE-2020-6819 was placed on the CISA KEV list with a 2022-05-03 due date; Mozilla had already shipped Firefox 74.0.1, ESR 68.6.1 and Thunderbird 68.7.0 in April 2020 while the nsDocShell use-after-free was under targeted attack, so the action that meets an hours-scale clock is deploying that build.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-patch-management",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-057",
+        "name": "BROWSER-MANAGED-UPDATE-NO-DEFERRAL",
+        "description": "Security releases of web browsers and email clients reach every managed endpoint without the deferral applied to feature updates, and the installed client version is inventoried separately from the operating-system patch level.",
+        "evidence": "The fixed builds for CVE-2020-6819 were Firefox 74.0.1, ESR 68.6.1 and Thunderbird 68.7.0; an update ring that defers a security-channel Mozilla release, or a policy that lets a secondary Firefox ESR or Thunderbird lag, keeps the actively exploited build on endpoints.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8"
+        ]
+      }
+    ]
+  },
+  "CVE-2020-6820": {
+    "name": "Mozilla Firefox And Thunderbird Use-After-Free Vulnerability (CVE-2020-6820)",
+    "lesson_date": "2026-09-23",
+    "ai_discovered_zeroday": false,
+    "ai_discovery_source": "human_researcher",
+    "ai_discovery_date": null,
+    "ai_assist_factor": "none",
+    "attack_vector": {
+      "description": "Code already running in a compromised Firefox or Thunderbird content process, which the documented chain obtained through CVE-2020-6819, triggers a race condition while a ReadableStream is handled, freeing the Cache API's CacheStreamControlParent object in the parent (browser) process; the resulting use-after-free there is the sandbox escape.",
+      "privileges_required": "Code execution in a Firefox or Thunderbird content process, which the documented chain obtained through CVE-2020-6819.",
+      "complexity": "High; the vector is a race condition, reflected in the high attack-complexity rating, though it was used in targeted attacks.",
+      "ai_factor": "Not AI-discovered; credited to Francisco Alonso working with Javier Marcos of JMPSec, with no AI tooling claimed."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Deploying the Firefox 74.0.1, ESR 68.6.1 and Thunderbird 68.7.0 builds, which fix both this sandbox escape and CVE-2020-6819, as an emergency release, and keeping untrusted web content away from the affected builds until then.",
+        "was_this_required": false,
+        "framework_requiring_it": "AU-Essential-8-Patch",
+        "adequacy": "The build removes both stages of the documented chain; because the chain was used in targeted attacks before the build shipped, the update limited the exposure rather than preventing the earliest attacks."
+      },
+      "detection": {
+        "what_would_have_worked": "Collecting browser crash reports and alerting on a parent (browser) process crash on its IPDL Background thread whose crashing frame is in the DOM Cache IPC code, such as PCacheStreamControlParent::SendCloseAll.",
+        "was_this_required": false,
+        "framework_requiring_it": "UK-CAF-B4",
+        "adequacy": "This is a heuristic that catches failed or unstable attempts only; a successful sandbox escape may leave no crash, and the signal appears only where browser-process crash reports are collected."
+      },
+      "response": {
+        "what_would_have_worked": "Treating a confirmed hit as a targeted intrusion in which the browser sandbox was escaped, isolating the endpoint and updating the build rather than dismissing the crash.",
+        "was_this_required": false,
+        "framework_requiring_it": "ISO-27001-2022-A.8.8",
+        "adequacy": "Isolation and update address the endpoint but depend on recognizing the crash as exploitation rather than instability."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false
+      },
+      "NIS2-Art21-vulnerability-handling": {
+        "covered": true,
+        "adequate": false
+      },
+      "UK-CAF-B4": {
+        "covered": true,
+        "adequate": false
+      },
+      "AU-Essential-8-Patch": {
+        "covered": true,
+        "adequate": false
+      },
+      "ISO-27001-2022-A.8.8": {
+        "covered": true,
+        "adequate": false
+      }
+    },
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "A vulnerability listed on the CISA Known Exploited Vulnerabilities catalog is mitigated or patched on an incident clock measured in hours, separate from the routine patch schedule.",
+        "evidence": "CVE-2020-6820 was added to the CISA KEV list with a 2022-05-03 due date; Mozilla had shipped Firefox 74.0.1, ESR 68.6.1 and Thunderbird 68.7.0 in April 2020 while the ReadableStream use-after-free was under targeted attack, so meeting an hours-scale clock means deploying that build.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-vulnerability-handling"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-057",
+        "name": "BROWSER-MANAGED-UPDATE-NO-DEFERRAL",
+        "description": "Security releases of web browsers and email clients reach every managed endpoint without the deferral applied to feature updates, and the installed client version is inventoried separately from the operating-system patch level.",
+        "evidence": "The fixed builds for CVE-2020-6820 were Firefox 74.0.1, ESR 68.6.1 and Thunderbird 68.7.0; a managed update ring that defers a security-channel Mozilla release leaves the actively exploited build live on endpoints.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "AU-Essential-8-Patch"
+        ]
+      }
+    ]
+  },
+  "CVE-2019-15949": {
+    "name": "Nagios XI Remote Code Execution Vulnerability",
+    "lesson_date": "2026-09-23",
+    "ai_discovered_zeroday": false,
+    "ai_discovery_source": "human_researcher",
+    "ai_discovery_date": null,
+    "ai_assist_factor": "none",
+    "attack_vector": {
+      "description": "An authenticated user with plugin-modification rights, or the nagios operating-system account, replaces the monitoring plugin that getprofile.sh executes (check_ping in both public exploits; NVD calls it check_plugin); when a system profile is downloaded, getprofile.sh runs that plugin as root through a passwordless sudo entry, so the injected commands run as root.",
+      "privileges_required": "Low; either a Nagios XI web account with plugin-modification rights or shell access as the nagios user.",
+      "complexity": "Low; the upload-and-trigger steps are deterministic once access is held.",
+      "ai_factor": "Not AI-discovered; credited to Jak Gibb, with no AI tooling claimed."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Upgrading to Nagios XI 5.6.6, and independently removing the passwordless sudo entry that runs getprofile.sh as root while restricting plugin-modification rights.",
+        "was_this_required": false,
+        "framework_requiring_it": "AU-Essential-8-Patch",
+        "adequacy": "The upgrade closes the path; the sudo and plugin-rights hardening is a compensating measure available both before the upgrade and afterward."
+      },
+      "detection": {
+        "what_would_have_worked": "Alerting when check_ping or another plugin that getprofile.sh executes is modified outside a legitimate plugin deployment, and when getprofile.sh spawns an unexpected child as root.",
+        "was_this_required": false,
+        "framework_requiring_it": "ISO-27001-2022-A.8.8",
+        "adequacy": "File-integrity and process alerts are reliable but require monitoring on the server, which a monitoring appliance is often not itself subject to."
+      },
+      "response": {
+        "what_would_have_worked": "Rotating credentials reachable from the compromised Nagios XI host and rebuilding it, given root was obtained, rather than only upgrading the package.",
+        "was_this_required": false,
+        "framework_requiring_it": "NIST-800-53-AC-6",
+        "adequacy": "Rebuild and rotation address a root-level compromise; a package upgrade alone restores the fixed version but not trust in a host that ran attacker code as root."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-AC-6": {
+        "covered": true,
+        "adequate": false
+      },
+      "NIS2-Art21-network-security": {
+        "covered": true,
+        "adequate": false
+      },
+      "UK-CAF-B4": {
+        "covered": true,
+        "adequate": false
+      },
+      "AU-Essential-8-Patch": {
+        "covered": true,
+        "adequate": false
+      },
+      "ISO-27001-2022-A.8.8": {
+        "covered": true,
+        "adequate": false
+      }
+    },
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-135",
+        "name": "CONTROL-PANEL-PLUGIN-USER-SURFACE-MUST-NOT-REACH-ROOT-OPERATIONS",
+        "description": "A file that an unprivileged account or an application user can change is never run by a process holding root or administrative rights, and helper scripts that run through sudo execute only files that root owns and only root can write.",
+        "evidence": "On Nagios XI before 5.6.6 a plugin operator or the nagios account can rewrite the monitoring plugin that getprofile.sh runs as root via passwordless sudo (check_ping in both public exploits; NVD calls it check_plugin), so a user-facing plugin function reaches root; the fix in 5.6.6 and removing that sudo path keep the privileged operation behind its own boundary.",
+        "gap_closes": [
+          "NIST-800-53-AC-6",
+          "UK-CAF-B4",
+          "NIS2-Art21-network-security"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "A vulnerability listed on the CISA Known Exploited Vulnerabilities catalog is mitigated or patched on an incident clock measured in hours, separate from the routine patch schedule.",
+        "evidence": "CVE-2019-15949 was on the CISA KEV list with a 2022-05-03 due date while the fix, Nagios XI 5.6.6, had been available since August 2019 with a public exploit and a Metasploit module, so an hours-scale mitigation clock means upgrading or removing the passwordless sudo entry, not waiting for a routine cycle.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "ISO-27001-2022-A.8.8"
+        ]
+      }
+    ]
+  },
+  "CVE-2020-14882": {
+    "name": "Oracle WebLogic Server Remote Code Execution Vulnerability (CVE-2020-14882)",
+    "lesson_date": "2026-09-23",
+    "ai_discovered_zeroday": false,
+    "ai_discovery_source": "human_researcher",
+    "ai_discovery_date": null,
+    "ai_assist_factor": "none",
+    "attack_vector": {
+      "description": "A double-encoded path-traversal request (%252e%252e%252f) to the WebLogic administration console reaches console.portal behind its authentication filter and instantiates an attacker-named Java class through the handle parameter, giving remote code execution with the WebLogic process's privileges.",
+      "privileges_required": "none; the request is unauthenticated and needs only HTTP access to the administration console",
+      "complexity": "low; a single crafted request confirms and exploits the flaw, and public scanning reached all IPv4 space within days",
+      "ai_factor": "None. Credited to outside human researchers; no AI tooling claimed."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Restricting the administration console to a trusted management network and applying the 2020-11-01 Security Alert for CVE-2020-14750 (My Oracle Support Note 2724951.1) with a server restart, since the October 2020 update for this flaw was bypassed and only the Security Alert closes the traversal",
+        "was_this_required": true,
+        "framework_requiring_it": "AU-Essential-8-Patch",
+        "adequacy": "Network restriction removes the unauthenticated reach and the Security Alert removes the traversal. The ISM-1876 online-service window required the patch, but it runs from each release, so applying the October update inside its 48-hour window still left the console exposed until the 2020-11-01 alert."
+      },
+      "detection": {
+        "what_would_have_worked": "Alerting on console.portal requests reached through any encoded ../ traversal under /console/, in any case, and on the WebLogic process spawning a shell, matching the handle parameter against ShellSession, ClassPathXmlApplicationContext or FileSystemXmlApplicationContext rather than a single fixed string",
+        "was_this_required": false,
+        "framework_requiring_it": "NIST-800-53-AC-3",
+        "adequacy": "The signals are reliable and stable, but they require request and process inspection in front of a console that many deployments expose directly on port 7001."
+      },
+      "response": {
+        "what_would_have_worked": "Treating a confirmed hit as a server compromise, capturing evidence, then rebuilding the WebLogic host and rotating any credentials the process held",
+        "was_this_required": false,
+        "framework_requiring_it": "NIS2-Art21-vulnerability-management",
+        "adequacy": "SANS advised assuming compromise for any vulnerable server found, so a restart-and-patch response alone leaves any planted access in place."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-AC-3": {
+        "covered": true,
+        "adequate": false
+      },
+      "NIS2-Art21-vulnerability-management": {
+        "covered": true,
+        "adequate": false
+      },
+      "UK-CAF-B2": {
+        "covered": true,
+        "adequate": false
+      },
+      "ISO-27001-2022-A.5.15": {
+        "covered": true,
+        "adequate": false
+      },
+      "AU-ISM-1546": {
+        "covered": true,
+        "adequate": false
+      },
+      "AU-Essential-8-Patch": {
+        "covered": true,
+        "adequate": false
+      }
+    },
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-129",
+        "name": "ENTERPRISE-ERP-MANAGEMENT-FUNCTION-AUTHENTICATION",
+        "description": "An enterprise application server must authenticate the caller on every request path to a takeover-capable management function before it acts, including alternate and traversal-reachable paths, and must not leave any such function reachable by an unauthenticated network caller.",
+        "evidence": "For CVE-2020-14882 in Oracle WebLogic Server, a double-encoded traversal to /console/images/%252e%252e%252fconsole.portal reaches an administrative handler behind the console authentication filter, so the takeover path answers an unauthenticated caller, and the traversal is closed by the 2020-11-01 Security Alert for CVE-2020-14750 (My Oracle Support Note 2724951.1) after the October 2020 update for it was bypassed.",
+        "gap_closes": [
+          "NIST-800-53-AC-3",
+          "UK-CAF-B2",
+          "ISO-27001-2022-A.5.15",
+          "AU-ISM-1546"
+        ]
+      }
+    ]
+  },
+  "CVE-2020-14883": {
+    "name": "Oracle WebLogic Server Unspecified Vulnerability",
+    "lesson_date": "2026-09-23",
+    "ai_discovered_zeroday": false,
+    "ai_discovery_source": "human_researcher",
+    "ai_discovery_date": null,
+    "ai_assist_factor": "none",
+    "attack_vector": {
+      "description": "A request to the WebLogic administration console at console.portal invokes com.tangosol.coherence.mvel2.sh.ShellSession against the current ExecuteThread and runs an operating system command; chained with the CVE-2020-14882 traversal the command path is reached without authentication.",
+      "privileges_required": "high on its own per Oracle's rating, but none in the chain with CVE-2020-14882",
+      "complexity": "low; a single request confirms and exploits the flaw when the console is reachable",
+      "ai_factor": "None. Credited to outside human researchers; no AI tooling claimed."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Confining the administration console to a trusted management network and applying the October 2020 Critical Patch Update together with the 2020-11-01 Security Alert for CVE-2020-14750, which closes the unauthenticated chain the October fix left bypassable",
+        "was_this_required": true,
+        "framework_requiring_it": "AU-Essential-8-Patch",
+        "adequacy": "Network confinement removes the exposure, and the Security Alert closes the chain the October update alone left open. A program that prioritizes by the standalone high-privilege score can defer the fix past the window the chained, KEV-listed flaw falls under."
+      },
+      "detection": {
+        "what_would_have_worked": "Alerting on console.portal requests of either method whose handle or test_handle names a Java class such as ShellSession, ClassPathXmlApplicationContext or FileSystemXmlApplicationContext, matched case- and encoding-insensitively, and on the WebLogic process spawning a shell",
+        "was_this_required": false,
+        "framework_requiring_it": "UK-CAF-C1",
+        "adequacy": "The request signature is distinctive across methods, but it is not a monitored event where the console is reached directly on port 7001 without request inspection."
+      },
+      "response": {
+        "what_would_have_worked": "Capturing evidence, then rebuilding the WebLogic host and rotating the credentials the process held rather than only restarting the service",
+        "was_this_required": false,
+        "framework_requiring_it": "NIS2-Art21-patch-management",
+        "adequacy": "A service restart restores availability but leaves any code the command gadget planted and any stolen credential in place."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-CM-7": {
+        "covered": true,
+        "adequate": false
+      },
+      "NIS2-Art21-patch-management": {
+        "covered": true,
+        "adequate": false
+      },
+      "UK-CAF-C1": {
+        "covered": true,
+        "adequate": false
+      },
+      "ISO-27001-2022-A.8.21": {
+        "covered": true,
+        "adequate": false
+      },
+      "AU-Essential-8-Patch": {
+        "covered": true,
+        "adequate": false
+      }
+    },
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-128",
+        "name": "APPSERVER-REMOTING-PROTOCOL-RESTRICTION",
+        "description": "Application servers that expose a network-reachable administration console or binary remoting interface must restrict those interfaces to trusted hosts and apply the vendor's critical patch bundle on an accelerated clock, with a server restart taken, when a flaw in them is listed as exploited.",
+        "evidence": "For CVE-2020-14883 in Oracle WebLogic Server, the administration console command gadget is reachable over HTTP on the default port 7001, and the October 2020 Critical Patch Update with the 2020-11-01 Security Alert for CVE-2020-14750 closes it; confining the console to a management network and taking the updates rather than deferring to the next quarterly window is the remedy.",
+        "gap_closes": [
+          "NIST-800-53-CM-7",
+          "ISO-27001-2022-A.8.21",
+          "AU-Essential-8-Patch"
+        ]
+      }
+    ]
+  },
+  "CVE-2020-14750": {
+    "name": "Oracle WebLogic Server Remote Code Execution Vulnerability (CVE-2020-14750)",
+    "lesson_date": "2026-09-23",
+    "ai_discovered_zeroday": false,
+    "ai_discovery_source": "human_researcher",
+    "ai_discovery_date": null,
+    "ai_assist_factor": "none",
+    "attack_vector": {
+      "description": "A path-traversal request to console.portal that re-encodes or changes the case of the ../ segment to evade the case-sensitive blocklist the October 2020 update added invokes a ShellSession gadget that reads a request header and runs it as an operating system command, giving unauthenticated remote code execution.",
+      "privileges_required": "none; the request is unauthenticated and needs only HTTP access to the administration console",
+      "complexity": "low; a single crafted request confirms and exploits the flaw, and public exploit code was published on multiple sites",
+      "ai_factor": "None. Credited to outside human researchers; no AI tooling claimed."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Applying the Security Alert CVE-2020-14750 patch rather than treating the October 2020 update as complete, and restricting the console to a trusted management network in the interim",
+        "was_this_required": true,
+        "framework_requiring_it": "AU-Essential-8-Patch",
+        "adequacy": "The Security Alert patch removes the bypass and network restriction removes the reach, but an operator who recorded the October update as done would not apply the alert without a control that reopens a defeated fix."
+      },
+      "detection": {
+        "what_would_have_worked": "Alerting on console.portal requests reached through any encoded ../ traversal, matched case-insensitively across encodings, on requests whose handle parameter names com.tangosol.coherence.mvel2.sh.ShellSession, and on the WebLogic process spawning a shell",
+        "was_this_required": false,
+        "framework_requiring_it": "NIS2-Art21-network-security",
+        "adequacy": "The bypass request is distinctive, but detecting it requires request inspection in front of a console many deployments expose directly."
+      },
+      "response": {
+        "what_would_have_worked": "Assuming compromise on a confirmed hit, capturing evidence, then rebuilding the host and rotating the credentials the WebLogic process held",
+        "was_this_required": false,
+        "framework_requiring_it": "UK-CAF-B4",
+        "adequacy": "Applying the alert patch closes the hole but does not evict access gained while the bypass was live, so response must include a compromise assessment."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false
+      },
+      "NIS2-Art21-network-security": {
+        "covered": true,
+        "adequate": false
+      },
+      "UK-CAF-B4": {
+        "covered": true,
+        "adequate": false
+      },
+      "ISO-27001-2022-A.8.8": {
+        "covered": true,
+        "adequate": false
+      },
+      "AU-Essential-8-Patch": {
+        "covered": true,
+        "adequate": false
+      }
+    },
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-042",
+        "name": "INCOMPLETE-PATCH-SEQUENCE-SEVERITY-MULTIPLIER",
+        "description": "A vulnerability-management program must apply a severity multiplier and reopen the item when a flaw is a bypass of a prior fix on the same primitive, because the earlier remediation was recorded as complete while the underlying defect remained reachable by a different path.",
+        "evidence": "For CVE-2020-14750 in Oracle WebLogic Server, the October 2020 Critical Patch Update added a case-sensitive traversal blocklist that was bypassed by re-encoding or changing the case of the traversal, and only the 2020-11-01 Security Alert for CVE-2020-14750 (My Oracle Support Note 2724951.1) closes it, so an operator who recorded the October update as remediation stayed exposed.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "ISO-27001-2022-A.8.8"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-128",
+        "name": "APPSERVER-REMOTING-PROTOCOL-RESTRICTION",
+        "description": "Application servers that expose a network-reachable administration console must restrict it to trusted hosts and apply the vendor's out-of-cycle security alert on an accelerated clock, so a console reachable from untrusted networks does not depend on the patch window alone.",
+        "evidence": "For CVE-2020-14750 in Oracle WebLogic Server, the administration console is reachable over HTTP on the default port 7001 and the bypass is closed only by the Security Alert patch, so confining the console to a management network is the interim measure while that patch is staged.",
+        "gap_closes": [
+          "NIS2-Art21-network-security",
+          "UK-CAF-B4",
+          "AU-Essential-8-Patch"
+        ]
+      }
+    ]
+  },
+  "CVE-2020-8644": {
+    "name": "PlaySMS Server-Side Template Injection Vulnerability",
+    "lesson_date": "2026-09-23",
+    "ai_discovered_zeroday": false,
+    "ai_discovery_source": "human_researcher",
+    "ai_discovery_date": null,
+    "ai_assist_factor": "none",
+    "attack_vector": {
+      "description": "The username submitted to the PlaySMS login route is stored and processed by the template engine a second time, so an unauthenticated {{ ... }} expression is concatenated into a PHP string, written to a .compiled cache file and included or evaluated, giving remote code execution as the web process.",
+      "privileges_required": "none; the payload is submitted in the login username field before authentication",
+      "complexity": "low; a single login request with a template expression confirms and exploits the flaw",
+      "ai_factor": "None. Credited to an outside human researcher at NCC Group; no AI tooling claimed."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Upgrading to PlaySMS 1.4.3 or later, which stops the double processing of the login template, and restricting the login page to trusted networks in the interim",
+        "was_this_required": true,
+        "framework_requiring_it": "AU-Essential-8-Patch",
+        "adequacy": "The 1.4.3 upgrade removes the vulnerable code path and closes the online-service patch window for an internet-facing instance, but at Maturity Level One an internal-only PlaySMS has no required patch timeframe, and a self-hosted deployment only receives the fix if the operator tracks the project's releases."
+      },
+      "detection": {
+        "what_would_have_worked": "Alerting on login POSTs whose username field contains {{ or backticks, on the PlaySMS process spawning a shell, and on new .compiled cache files containing PHP built from input",
+        "was_this_required": false,
+        "framework_requiring_it": "UK-CAF-B2",
+        "adequacy": "The payload shape and the cache-file artifact are distinctive, but they require request inspection and file monitoring that a small PlaySMS deployment rarely has."
+      },
+      "response": {
+        "what_would_have_worked": "Capturing evidence, rebuilding the PlaySMS host and rotating any credentials and gateway secrets the process held, rather than only upgrading the package",
+        "was_this_required": false,
+        "framework_requiring_it": "NIS2-Art21-vulnerability-management",
+        "adequacy": "Upgrading closes the flaw but leaves any code the injection planted and any stolen gateway credential in place."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-AC-3": {
+        "covered": true,
+        "adequate": false
+      },
+      "NIS2-Art21-vulnerability-management": {
+        "covered": true,
+        "adequate": false
+      },
+      "UK-CAF-B2": {
+        "covered": true,
+        "adequate": false
+      },
+      "ISO-27001-2022-A.5.15": {
+        "covered": true,
+        "adequate": false
+      },
+      "AU-ISM-1546": {
+        "covered": true,
+        "adequate": false
+      },
+      "AU-Essential-8-Patch": {
+        "covered": true,
+        "adequate": false
+      }
+    },
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-129",
+        "name": "ENTERPRISE-ERP-MANAGEMENT-FUNCTION-AUTHENTICATION",
+        "description": "A web application must authenticate the caller on every request path before it can invoke a takeover-capable function, so that an input field processed on an unauthenticated route cannot reach code execution ahead of any authorization decision.",
+        "evidence": "For CVE-2020-8644 in PlaySMS, the username field on the login route is processed by the template engine before authentication, so an unauthenticated request reaches remote code execution; the fix is the upgrade to PlaySMS 1.4.3.",
+        "gap_closes": [
+          "NIST-800-53-AC-3",
+          "UK-CAF-B2",
+          "ISO-27001-2022-A.5.15",
+          "AU-ISM-1546"
+        ]
+      }
+    ]
+  },
+  "CVE-2019-18935": {
+    "name": "Progress Telerik UI for ASP.NET AJAX Deserialization of Untrusted Data Vulnerability",
+    "lesson_date": "2026-09-23",
+    "ai_discovered_zeroday": false,
+    "ai_discovery_source": "human_researcher",
+    "ai_discovery_date": null,
+    "ai_assist_factor": "none",
+    "attack_vector": {
+      "description": "An attacker who knows or breaks the RadAsyncUpload encryption keys stages a crafted upload configuration to /Telerik.Web.UI.WebResource.axd with type=rau, so the .NET JavaScriptSerializer deserializes attacker-controlled data and loads a mixed-mode assembly DLL, giving remote code execution in the w3wp.exe process.",
+      "privileges_required": "none beyond knowledge of the RadAsyncUpload encryption keys, which older Telerik flaws such as CVE-2017-11317 and CVE-2017-11357 expose",
+      "complexity": "low with a public exploit and encryption-breaking helper available",
+      "ai_factor": "None. Credited to outside human researchers; no AI tooling claimed."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Upgrading Telerik.Web.UI.dll to R1 2020 (2020.1.114) or later, setting unique RadAsyncUpload encryption keys and enabling the type allowlist, and restricting the RadAsyncUpload endpoint to trusted sources",
+        "was_this_required": true,
+        "framework_requiring_it": "NIST-800-53-SI-2",
+        "adequacy": "The upgrade and settings remove the deserialization path, but they only help where the component is inventoried, and a scanner that misses the software's file path never drives the fix."
+      },
+      "detection": {
+        "what_would_have_worked": "Collecting IIS access logs for POSTs whose URI stem ends in Telerik.Web.UI.WebResource.axd with type=rau, alerting on the EventID 1309 deserialization InvalidCastException, and alerting when w3wp.exe loads a newly written DLL from any folder or from a UNC path, with logs shipped off the host",
+        "was_this_required": false,
+        "framework_requiring_it": "ISO-27001-2022-A.8.16",
+        "adequacy": "The IIS event pair and the exception signature are reliable, but the actors' malware deletes the dropped DLLs, so detection depends on logs stored where the compromise cannot reach them."
+      },
+      "response": {
+        "what_would_have_worked": "Capturing evidence, rebuilding the IIS host and rotating credentials rather than patching in place, given planted DLLs and interactive access",
+        "was_this_required": false,
+        "framework_requiring_it": "UK-CAF-D1",
+        "adequacy": "Upgrading Telerik closes the entry point but does not evict a foothold established while the server was exploited, so response must default to rebuild and credential rotation."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false
+      },
+      "NIS2-Art21-incident-handling": {
+        "covered": true,
+        "adequate": false
+      },
+      "UK-CAF-D1": {
+        "covered": true,
+        "adequate": false
+      },
+      "ISO-27001-2022-A.8.16": {
+        "covered": true,
+        "adequate": false
+      },
+      "AU-ISM-1808": {
+        "covered": true,
+        "adequate": false
+      }
+    },
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-018",
+        "name": "SCANNER-PAPER-COMPLIANCE-TEST",
+        "description": "A vulnerability scanner that reports a host clean without confirming that its coverage reached every file path the vulnerable component can occupy is paper compliance; the operational test must verify the scan examined where the software is actually installed.",
+        "evidence": "For CVE-2019-18935 in Progress Telerik UI for ASP.NET AJAX, AA23-074A records that the agency's scanner held the correct plugin but returned no finding because the software was installed in a file path it did not scan, so a compliant scan reported the host clean while the flaw was present.",
+        "gap_closes": [
+          "AU-ISM-1808",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "A network-reachable server that suffers an actively exploited remote-code-execution compromise must default its response to configuration and evidence capture, rebuild and credential rotation rather than patching in place.",
+        "evidence": "For CVE-2019-18935 in Progress Telerik UI for ASP.NET AJAX, AA23-074A shows actors loaded a mixed-mode assembly in w3wp.exe and dropped timestomped, self-deleting DLLs in C:\\Windows\\Temp\\, so patching Telerik alone would leave the foothold intact.",
+        "gap_closes": [
+          "NIS2-Art21-incident-handling",
+          "UK-CAF-D1"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-031",
+        "name": "FIREWALL-EGRESS-TELEMETRY-SEPARATE-TRUST-ZONE",
+        "description": "An internet-facing server must forward its web-server access logs and application event logs to a store in a separate trust zone, so a code-execution compromise cannot erase the record of the requests that reached it.",
+        "evidence": "For CVE-2019-18935 in Progress Telerik UI for ASP.NET AJAX, the exploitation left a two-event IIS record and an EventID 1309 deserialization exception, while the actors' malware deleted the dropped DLLs, so only off-host logs preserve the evidence.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.16"
+        ]
+      }
+    ]
+  },
+  "CVE-2015-4852": {
+    "name": "Oracle WebLogic Server Deserialization of Untrusted Data Vulnerability",
+    "lesson_date": "2026-09-24",
+    "ai_discovered_zeroday": false,
+    "ai_discovery_source": "human_researcher",
+    "ai_discovery_date": null,
+    "ai_assist_factor": "none",
+    "attack_vector": {
+      "description": "An unauthenticated request over the T3 protocol to a WebLogic listen port (7001 by default) carries a crafted serialized Java object that WebLogic's WLS Security component deserializes, reaching the Apache Commons Collections InvokerTransformer gadget on the classpath and executing arbitrary commands as the WebLogic process.",
+      "privileges_required": "none; the T3 listener answers before authentication and NVD marks the vector as network, low complexity, no privileges",
+      "complexity": "low; commodity tooling including a Metasploit module ranked Excellent is public",
+      "ai_factor": "None. Credited to human researchers (Lawrence and Frohoff for the class, Breen for the Apache Commons Collections gadget, Kaiser for the report to Oracle); no AI tooling is claimed."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Following Oracle's mitigation recommendations (MOS Note 2076338.1) and restricting the T3 and T3s protocols to trusted hosts with a WebLogic connection filter or network access controls, so that the listen port does not accept connections from untrusted networks, while the patch was pending; then applying the fixed builds: Oracle's WebLogic Server patch (tracked at MOS Note 2075927.1 and carried in the later Critical Patch Updates); StorageTek Tape Analytics SW Tool 2.2.1 or later (April 2017 Critical Patch Update); the October 2016 Critical Patch Update for MICROS XBR, Oracle Retail Clearance Optimization Engine and Oracle Retail Xstore Point of Service; the October 2017 Critical Patch Update for Oracle Communications WebRTC Session Controller and Oracle Communications Order and Service Management; and the January 2018 Critical Patch Update for Oracle Identity Manager Connector CA ACF2 and Oracle Identity Manager. Oracle names no Oracle Virtual Desktop Infrastructure fix for this CVE; VDI 3.5.3 carries the CVE-2015-7501 Apache Commons Collections fix.",
+        "was_this_required": true,
+        "framework_requiring_it": "AU-Essential-8-Patch",
+        "adequacy": "Applying the patch removes the flaw; a connection filter limits which hosts can open a T3 session but leaves the InvokerTransformer gadget reachable from any allowed host, so it is a compensating measure rather than a fix, and Oracle's mitigation recommendations were the only vendor measure available from 2015-11-10 until the patch shipped."
+      },
+      "detection": {
+        "what_would_have_worked": "Monitoring T3 traffic for the Java serialized-object bytes ac ed 00 followed by weblogic.rjvm.ClassTableEntry (Emerging Threats sid 2035204), watching for the raw AC ED 00 05 serialized-object header in the stream whatever gadget class names follow it, and alerting when the WebLogic process spawns a command interpreter.",
+        "was_this_required": false,
+        "framework_requiring_it": "UK-CAF-B4",
+        "adequacy": "Signature inspection requires visibility of the T3 stream on whatever port WebLogic listens on. T3s or any TLS-wrapped transport hides both signatures unless the traffic is decrypted, and Emerging Threats sid 2022114 matches only base64-encoded delivery, so it does not fire on raw T3 exploitation."
+      },
+      "response": {
+        "what_would_have_worked": "Treating an exposed WebLogic instance as compromised, rebuilding the host and rotating the credentials and keys the WebLogic process could reach, rather than only applying the patch.",
+        "was_this_required": false,
+        "framework_requiring_it": "NIST-800-53-SI-2",
+        "adequacy": "Credential and key rotation is the load-bearing step, because code executed as the WebLogic process can read whatever that process holds; applying the patch alone restores the fixed build while leaving any stolen secret live."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SC-7": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Until the WebLogic patch was available, Oracle offered only the mitigation recommendations at MOS Note 2076338.1, and SC-7 evidence recording a perimeter firewall does not show the T3 listen port is limited to the hosts that need it; a host still on the allow list carries the serialized object through."
+      },
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "A remediation timeframe measured from patch availability does not cover the interval from 2015-11-06, when a public exploit existed, to the later WebLogic patch, during which only Oracle's mitigation recommendations (MOS Note 2076338.1) were available."
+      },
+      "NIS2-Art21-network-security": {
+        "covered": true,
+        "adequate": false,
+        "gap": "The reasonable-time clock could not start until the WebLogic patch was available, and neither it nor the additional-measure requirement forces re-evaluation of the residual risk a network restriction on T3 leaves: delivery from any host the restriction still allows."
+      },
+      "UK-CAF-B4": {
+        "covered": true,
+        "adequate": false,
+        "gap": "B4.d asks for externally exposed vulnerabilities to be mitigated promptly, and 'promptly' is not defined against working exploit code published four days before Oracle's first measure; an outcome judged against 'mitigated (e.g. by patching)' can accept a T3 restriction that leaves allowed hosts able to deliver the object, and the now-unsupported releases have only temporary mitigation while migrating."
+      },
+      "AU-Essential-8-Patch": {
+        "covered": true,
+        "adequate": false,
+        "gap": "The 48-hour ISM-1876 window for an online service started on 2015-11-10 with Oracle's mitigation recommendations, but the working exploit was public from 2015-11-06 before any vendor fix or mitigation, so no patch window could close that pre-mitigation exposure."
+      },
+      "ISO-27001-2022-A.8.28": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Secure-coding review of the organization's own code does not reach a third-party application server's deserialization of untrusted T3 input, so the unsafe-deserialization defect ships regardless of the attestation."
+      }
+    },
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-128",
+        "name": "APPSERVER-REMOTING-PROTOCOL-RESTRICTION",
+        "description": "Where an application server answers a binary remoting protocol on a network port, that port must accept connections only from the specific hosts that need it, enforced by a connection filter or a network access control, and a remoting-protocol flaw under active exploitation must be remediated on an accelerated schedule rather than deferred to the routine patch cycle.",
+        "evidence": "CVE-2015-4852: Oracle WebLogic Server answers the T3 remoting protocol before authentication, and an unauthenticated serialized Java object reaching the WLS Security component executes commands as the WebLogic process. Oracle's first response, the Security Alert of 2015-11-10, referred to mitigation recommendations at MOS Note 2076338.1 and stated that creation of WebLogic Server patches was in progress, with patch availability tracked at MOS Note 2075927.1. Oracle's connection-filter documentation shows a WebLogic connection filter (weblogic.security.net.ConnectionFilterImpl) rule denying t3 and t3s on a listen port, and keeping the T3 listen port off untrusted networks is the compensating control while the patch is scheduled.",
+        "gap_closes": [
+          "NIST-800-53-SC-7",
+          "NIS2-Art21-network-security",
+          "UK-CAF-B4",
+          "AU-Essential-8-Patch"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-125",
+        "name": "SERVICE-INTERNAL-PROTOCOL-DESERIALIZATION-HARDENING",
+        "description": "A network service that reads serialized objects from a peer must not turn that input into arbitrary object graphs; the decoder must accept only an allowlist of expected types, and the peer must be authenticated before any decoding takes place.",
+        "evidence": "CVE-2015-4852: the WLS Security component in Oracle WebLogic Server deserializes attacker-supplied Java objects from T3 traffic and reaches the Apache Commons Collections InvokerTransformer gadget on the classpath (oracle_common/modules/com.bea.core.apache.commons.collections.jar). CERT/CC VU#576313 records that updating Apache Commons Collections to 3.2.2 or 4.1 disables that gadget but leaves other deserialization gadgets reachable, so type-bound decoding of T3 input is the durable control.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.28"
+        ]
+      }
+    ]
+  },
+  "CVE-2020-2555": {
+    "name": "Oracle Multiple Products Remote Code Execution Vulnerability",
+    "lesson_date": "2026-09-23",
+    "ai_discovered_zeroday": false,
+    "ai_discovery_source": "human_researcher",
+    "ai_discovery_date": null,
+    "ai_assist_factor": "none",
+    "attack_vector": {
+      "description": "An unauthenticated attacker who can reach a WebLogic listen port sends a serialized Java object over T3; the public Metasploit module sends a javax.management.BadAttributeValueExpException object. Oracle Coherence deserializes it, and the attacker's code runs with the permissions of the server process. For the products that bundle Coherence, Oracle lists HTTP as the attack protocol.",
+      "privileges_required": "None. Oracle's January 2020 risk matrix marks the flaw remotely exploitable without authentication, and the CVSS vector records PR:N.",
+      "complexity": "Low. The CVSS vector records AC:L, and Exploit-DB has listed working exploits since April 2020, with the Metasploit module listed there in May 2020.",
+      "ai_factor": "Not AI-discovered. Oracle credits Jang from VNPT ISC, working with Trend Micro Zero Day Initiative, and no source describes AI tooling in the discovery or in the public exploits."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Applying Oracle's patch for each affected product from the advisory that lists it: the January 2020 Critical Patch Update for Oracle Coherence 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0, and for Coherence 3.7.1.0 after Oracle added that line on 2020-01-23; the April 2020 update on WebLogic Server 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0 hosts, which fixes the CVE-2020-2883 bypass of the January 2020 fix; the July 2020 update for Retail Assortment Planning 15.0 and 16.0 and Rapid Planning 12.1 and 12.2; the October 2020 update for the Diameter Signaling Router IDIH component 8.0.0 through 8.2.2, WebCenter Portal 12.2.1.3.0 and 12.2.1.4.0 and Healthcare Data Repository 7.0.1; the January 2021 update for Utilities Framework 4.2.0.2.0, 4.2.0.3.0, 4.3.0.1.0 through 4.3.0.6.0, 4.4.0.0.0 and 4.4.0.2.0; and the July 2021 update for Commerce Platform 11.0.0, 11.1.0, 11.2.0 and 11.3.0 through 11.3.2 and Access Manager 11.1.2.3.0. Until then, restricting T3 and IIOP on WebLogic listen ports to trusted hosts.",
+        "was_this_required": true,
+        "framework_requiring_it": "AU-Essential-8-Patch (ISM-1876 for an instance directly accessible over the internet) and NIST-800-53-SI-2",
+        "adequacy": "Each patch is the fix Oracle lists for CVE-2020-2555 in that product. The January 2020 fix is incomplete: Tenable describes CVE-2020-2883 as a bypass of CVE-2020-2555, and Oracle fixed CVE-2020-2883 for WebLogic Server in the April 2020 update, so a WebLogic Server host patched only to January 2020 remains exposed. Restricting T3 and IIOP narrows exposure for Coherence and WebLogic but leaves the bundling products open, because Oracle lists HTTP as their attack protocol, and Oracle states that blocking protocols may break application functionality."
+      },
+      "detection": {
+        "what_would_have_worked": "Alerting on T3 sessions from untrusted addresses to WebLogic listen ports, on serialized Java objects naming javax.management.BadAttributeValueExpException inside T3 traffic, and on the WebLogic or Coherence Java process starting a command interpreter.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "The content match needs a sensor that decodes T3, and a T3S session hides the object from a network sensor. The alert on the Java process starting a command interpreter works whatever the protocol, but it fires only after code execution."
+      },
+      "response": {
+        "what_would_have_worked": "Treating an internet-reachable Coherence or WebLogic instance that ran an affected version without Oracle's fix as possibly compromised: reviewing files, scheduled tasks and outbound connections of the service account, and rotating the credentials held in the WebLogic domain configuration, such as data source passwords, before returning it to service.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Patching removes the flaw but does not remove anything an attacker installed or any credential an attacker read from the domain, so the review and the rotation are needed on any host that was exposed before the patch."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "A remediation clock keyed to the installed product starts at that product's own advisory, up to 18 months after the Coherence fix."
+      },
+      "NIST-800-53-CM-7": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Restricting T3 covers Coherence and WebLogic, but the bundling products' attack protocol is HTTP, which is their required service."
+      },
+      "NIS2-Art21-patch-management": {
+        "covered": true,
+        "adequate": false,
+        "gap": "A reasonable time measured per product starts after public exploit code existed, and the additional measures for the interval are not named."
+      },
+      "UK-CAF-B4": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Vulnerability tracking by product does not match the January 2020 Coherence entry to a DSR deployment that embeds Coherence."
+      },
+      "AU-Essential-8-Patch": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Each bundling product's window starts at Oracle's release for that product, after public exploit code for the Coherence flaw was listed."
+      },
+      "AU-ISM-1546": {
+        "covered": true,
+        "adequate": false,
+        "gap": "The serialized object is processed without an authentication decision, so authenticated application access does not stop the attack."
+      },
+      "ISO-27001-2022-A.8.8": {
+        "covered": true,
+        "adequate": false,
+        "gap": "An asset register without embedded Coherence versions cannot match the bundling products to the January 2020 advisory."
+      }
+    },
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-021",
+        "name": "TIER-3-DEPENDENCY-INVENTORY",
+        "description": "Software inventory must record the middleware components that vendor products bundle, with their versions, so that an advisory for a component is matched to every installed product that carries it.",
+        "evidence": "CVE-2020-2555: Oracle's January 2020 Critical Patch Update lists the flaw only under Oracle Coherence, for 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0 at its release on 2020-01-14 and for the 3.7.1 line from 2020-01-23. Oracle later listed the same CVE for the Coherence bundled in Retail Assortment Planning and Rapid Planning (July 2020), the Diameter Signaling Router IDIH component, WebCenter Portal and Healthcare Data Repository (October 2020), Utilities Framework (January 2021), and Commerce Platform and Access Manager (July 2021).",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "UK-CAF-B4",
+          "NIS2-Art21-patch-management",
+          "AU-Essential-8-Patch"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-128",
+        "name": "APPSERVER-REMOTING-PROTOCOL-RESTRICTION",
+        "description": "Application servers that accept binary remoting protocols must accept them only from named trusted hosts, and connection attempts on those protocols from any other network must be dropped and logged.",
+        "evidence": "CVE-2020-2555: Oracle's January 2020 risk matrix lists T3 as the attack protocol for Oracle Coherence, and the Rapid7 listing of the Metasploit module describes unauthenticated code execution by sending a serialized BadAttributeValueExpException object over T3 to vulnerable WebLogic servers. Oracle's advisory suggests blocking the protocols an attack requires until the patch is applied.",
+        "gap_closes": [
+          "NIST-800-53-CM-7",
+          "AU-ISM-1546"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-125",
+        "name": "SERVICE-INTERNAL-PROTOCOL-DESERIALIZATION-HARDENING",
+        "description": "A server that accepts serialized objects from the network must decode them only into an allowlist of expected types and must reject any other class before it is instantiated, whether or not the sender has authenticated.",
+        "evidence": "CVE-2020-2555 (CWE-502): Oracle Coherence deserializes an object an unauthenticated sender supplies over T3, or over HTTP in the bundling products Oracle lists, and the Metasploit module listed by Rapid7 delivers a javax.management.BadAttributeValueExpException object. Oracle's January 2020 risk matrix marks the flaw remotely exploitable without authentication.",
+        "gap_closes": [
+          "AU-ISM-1546"
+        ]
+      }
+    ]
+  },
+  "CVE-2021-38648": {
+    "name": "Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability (CVE-2021-38648)",
+    "lesson_date": "2026-09-23",
+    "ai_discovered_zeroday": false,
+    "ai_discovery_source": "human_researcher",
+    "ai_discovery_date": null,
+    "ai_assist_factor": "none",
+    "attack_vector": {
+      "description": "A local, low-privileged user connects to the OMI front end, omiengine, over /var/opt/omi/run/omiserver.sock and sends a recorded command-execution request with the authentication exchange left out. omiengine forwards it to omiserver with an AuthInfo structure still set to uid 0 and gid 0, and omiserver runs the command as root.",
+      "privileges_required": "A local account of any privilege level on a Linux or UNIX host running OMI below 1.6.8-1.",
+      "complexity": "Low. Wiz describes the steps as recording a legitimate command-execution request from omicli, omitting the authentication part and reissuing it.",
+      "ai_factor": "None. The Wiz Research Team reported the flaw to Microsoft, and no source mentions AI tooling."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Installing OMI 1.6.8-1, or the fixed extension build (OMS Agent for Linux GA v1.13.40-0; Azure Diagnostics (LAD) v4.0.15 or v3.0.135; Linux DSC Agent 2.71.1.25, 2.70.0.30 or 3.0.0.3; on Azure Stack Hub, Azure Monitor, Update and Configuration Management 1.14.02 and Microsoft Azure Diagnostic Extension for Linux Virtual Machines 3.1.135; the Container Monitoring Solution image sha256:12b7682d8f9a2f67752bf121029e315abcae89bc0c34a0e05f07baec72280707), on every host that carries OMI, including the on-premises, System Center Operations Manager and HDInsight hosts that Microsoft did not update automatically.",
+        "was_this_required": true,
+        "framework_requiring_it": "AU-Essential-8-Patch (ISM-1693, from Maturity Level Two)",
+        "adequacy": "The update removes the flaw. It works only where the organization knows OMI is installed: Azure services deploy it silently, so the update depends on finding the omi package on each host first."
+      },
+      "detection": {
+        "what_would_have_worked": "Raising SCX logging with /opt/microsoft/scx/bin/tools/scxadmin -log-set all verbose and alerting on Invoke_ExecuteCommand, Invoke_ExecuteShellCommand and Invoke_ExecuteScript in /var/opt/microsoft/scx/log/scx.log, and collecting auditd execve records for commands run from /var/opt/microsoft/scx/tmp and for scripts with the scx prefix run from /etc/opt/microsoft/scx/conf/tmpdir/.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Microsoft's blog guidance names only the ExecuteShellCommand method, so a rule built from it alone misses commands and scripts run through ExecuteCommand and ExecuteScript. The SCX log records these calls only when verbose logging was enabled before the activity, and the auditd signal needs execve collection already in place."
+      },
+      "response": {
+        "what_would_have_worked": "Treating a host that ran OMI below 1.6.8-1 alongside untrusted local accounts as possibly compromised at root: reviewing scx.log and auditd records where they exist, and rotating credentials stored on the host before returning it to service.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "The update closes the flaw but does not undo anything a local user did as root before it was installed, and SCX command logging has to be enabled with scxadmin before it records anything."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "A remediation period set from Microsoft's Important rating and 'Exploited: No' record is not shortened by the KEV listing, because the vendor record was never revised."
+      },
+      "NIST-800-53-AC-6": {
+        "covered": true,
+        "adequate": false,
+        "gap": "The omi-user front end and root back end pass a least-privilege review while the back end trusts an identity that defaults to root."
+      },
+      "NIS2-Art21-patch-management": {
+        "covered": true,
+        "adequate": false,
+        "gap": "No timeframe is set, and nothing requires finding the OMI package that an extension or management product installed on on-premises hosts."
+      },
+      "UK-CAF-B2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "A privileged-account review undercounts root-equivalent access on a host where every local account can have omiserver run commands as root."
+      },
+      "AU-Essential-8-Patch": {
+        "covered": true,
+        "adequate": false,
+        "gap": "The Log Analytics, Azure Diagnostics, Azure Automation and Update Management installs of OMI, and OMI instances with remote management enabled that are reachable only from internal networks, such as on-premises System Center Operations Manager and Desired State Configuration hosts, are other applications with no patch window at Maturity Level One; at Maturity Level Two the one-month window closed before the KEV listing."
+      },
+      "ISO-27001-2022-A.8.8": {
+        "covered": true,
+        "adequate": false,
+        "gap": "A register that lists the Azure extension but not the bundled omi package cannot evaluate the 1.6.8-1 boundary."
+      }
+    },
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-021",
+        "name": "TIER-3-DEPENDENCY-INVENTORY",
+        "description": "The software inventory records every component that a platform agent or management extension installs on a host, with the component's own version, so that a flaw in the bundled component is matched and patched even when the installing product reports only its own version.",
+        "evidence": "Wiz reports that Azure services deploy OMI silently on Linux VMs and that its use there is almost completely undocumented. Microsoft's guidance for CVE-2021-38648 lists the Log Analytics Agent, Azure Diagnostics (LAD), Azure Automation, Update Management, Azure Security Center, Azure Sentinel, the Container Monitoring Solution, Azure Stack Hub and HDInsight as carrying the vulnerable OMI framework, and states fixed builds per extension (OMS Agent for Linux GA v1.13.40-0, LAD v4.0.15 and v3.0.135) as well as for OMI itself (1.6.8-1).",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "AU-Essential-8-Patch",
+          "NIS2-Art21-patch-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-135",
+        "name": "CONTROL-PANEL-PLUGIN-USER-SURFACE-MUST-NOT-REACH-ROOT-OPERATIONS",
+        "description": "A privileged back-end service acts on a request from an unprivileged front end only after the caller's identity has been established by authentication, and an identity field that authentication has not set is treated as no identity rather than as the most privileged account.",
+        "evidence": "Wiz found that OMI's omiserver, which runs as root, trusts the AuthInfo structure forwarded by omiengine, which runs as the omi user. The structure starts at uid 0 and gid 0, and omiengine forwards a command-execution request that arrives before authentication, so on OMI below 1.6.8-1 any local user who connects to /var/opt/omi/run/omiserver.sock runs commands as root (CVE-2021-38648).",
+        "gap_closes": [
+          "NIST-800-53-AC-6",
+          "UK-CAF-B2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "A listing in the CISA Known Exploited Vulnerabilities catalog starts a response clock measured in hours, whatever severity and exploitability rating the vendor gave the flaw, and the listing is checked against every installed copy of the affected component.",
+        "evidence": "Microsoft rated CVE-2021-38648 Important and 'Exploitation Less Likely', and its update guide record, last revised on 2021-09-20, still reads 'Exploited: No'. CISA added the flaw to KEV on 2021-11-03 with a 2021-11-17 due date, so the KEV listing, not the vendor record, is what tells an organization that the OMI 1.6.8-1 update closes an exploited flaw.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-patch-management"
+        ]
+      }
+    ]
   }
 }