{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","kind":"record","record":{"attributes":{"category":"cyber_security","domain":["Vulnerability & Patch Management","Secure Configuration & Change Management"],"inherent_rating":"critical","taxonomy":["iso-27005-vulnerability","nist-800-30-threat-event","iso-27005-threat"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Avuln-unpatched-known-flaws","description":"Use of software with publicly known, unpatched flaws (CVEs) that adversaries readily exploit — including recently discovered vulnerabilities exploited before mitigations are in place, and internal-system vulnerability exploitation.","details":{"category":"cyber_security","impact":"high","inherent_rating":"critical","likelihood":"high","risk_id":"vuln-unpatched-known-flaws","taxonomies":["iso-27005-vulnerability","nist-800-30-threat-event","iso-27005-threat"],"treatment":"mitigate"},"id":"risk:vuln-unpatched-known-flaws","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Avuln-unpatched-known-flaws","sourceIds":["dora","gdpr","iso-27001","nist-800-53","nist-ai-tevv-athlon","nist-csf-2","nydfs-500","pci-dss","soc2"],"sourceUrl":null,"title":"Exploitation of known, unpatched vulnerabilities","type":"risk"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:22c1986ce5ae7dbc14704725bed0fba51ab942286753a2fc84ec96948798d140","properties":{"rationale":"Timely maintenance and vendor support keep systems supportable and patchable, indirectly reducing unpatched-flaw exposure; patching is the operative control.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-config-07-db5cd0ea.json","sourceId":"uc:UC-CONFIG-07","targetDetailPath":"/data/v1/records/risk-vuln-unpatched-known-flaws-c4a6b075.json","targetId":"risk:vuln-unpatched-known-flaws","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:2b7cc55fa393b275119d154303df369b20b6489b712a8b4533733ae8f33bd75a","properties":{"rationale":"Least-functionality hardening disables vulnerable services and shrinks the exploitable surface, reducing exposure to known flaws; patching is the operative control.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-config-01-8f911a32.json","sourceId":"uc:UC-CONFIG-01","targetDetailPath":"/data/v1/records/risk-vuln-unpatched-known-flaws-c4a6b075.json","targetId":"risk:vuln-unpatched-known-flaws","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:5f66fc741761e0f1d895eceb761873af0399b2dddf28bd030d7595a51c286b11","properties":{"rationale":"Anti-malware and web filtering block exploit-kit malware that leverages known unpatched flaws, a compensating layer.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-vuln-05-5870fcee.json","sourceId":"uc:UC-VULN-05","targetDetailPath":"/data/v1/records/risk-vuln-unpatched-known-flaws-c4a6b075.json","targetId":"risk:vuln-unpatched-known-flaws","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:64ca0d68b5710570f75bcd1d65bd3e24832a12dd690a53084b69966190f1249a","properties":{"rationale":"Memory-protection mitigations reduce exploit success for known memory-corruption flaws pending a patch.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-vuln-07-abfa5ce7.json","sourceId":"uc:UC-VULN-07","targetDetailPath":"/data/v1/records/risk-vuln-unpatched-known-flaws-c4a6b075.json","targetId":"risk:vuln-unpatched-known-flaws","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:76df134f9ed3e7a81b3073ab8ae40b49adcc395ff7d97641526098d03e0e95b5","properties":{"rationale":"Development-stage analysis surfaces known-vulnerable components before they reach production.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-vuln-04-d07c87cf.json","sourceId":"uc:UC-VULN-04","targetDetailPath":"/data/v1/records/risk-vuln-unpatched-known-flaws-c4a6b075.json","targetId":"risk:vuln-unpatched-known-flaws","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:83346bb04be0f35ed2436f074ad8d5a47d566991b1dd22072527a6cbc5841a57","properties":{"rationale":"Pen tests find and validate exploitable unpatched flaws and track corrective actions to verified closure.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-vuln-02-8366666b.json","sourceId":"uc:UC-VULN-02","targetDetailPath":"/data/v1/records/risk-vuln-unpatched-known-flaws-c4a6b075.json","targetId":"risk:vuln-unpatched-known-flaws","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:b4b281fb09aca979ec7f5b670a9ad8396a8dc07820cb71672ed6b30da543ebc0","properties":{"rationale":"Applying security patches within risk-based timeframes and replacing unsupported software directly mitigates exploitation of known unpatched flaws.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-config-04-ed033b30.json","sourceId":"uc:UC-CONFIG-04","targetDetailPath":"/data/v1/records/risk-vuln-unpatched-known-flaws-c4a6b075.json","targetId":"risk:vuln-unpatched-known-flaws","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:b83edced3e8642f58674a51b396c4f76804639292b0c3a41a85663d6a1de33bd","properties":{"rationale":"Installing security updates within risk-based timeframes and verifying by rescan directly defends against exploitation of known unpatched flaws.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-vuln-03-cc58f6a7.json","sourceId":"uc:UC-VULN-03","targetDetailPath":"/data/v1/records/risk-vuln-unpatched-known-flaws-c4a6b075.json","targetId":"risk:vuln-unpatched-known-flaws","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:bdeaae7b99fe45243a69fa35d702049c350cad59c9796af0a18b078eff5e1957","properties":{"rationale":"Vulnerability-disclosure/advisory intake surfaces known flaws and feeds remediation, but scanning and patching are the operative defenses against unpatched-CVE exploitation.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-asset-09-911f6a6c.json","sourceId":"uc:UC-ASSET-09","targetDetailPath":"/data/v1/records/risk-vuln-unpatched-known-flaws-c4a6b075.json","targetId":"risk:vuln-unpatched-known-flaws","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:d977b3520904eaeb456c31700f20fd95ee11885a82f3b2c4404661aba5297720","properties":{"rationale":"Scanning plus advisory subscription identifies known unpatched CVEs and tracks them to closure within severity-based timeframes.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-vuln-01-ec9a46fe.json","sourceId":"uc:UC-VULN-01","targetDetailPath":"/data/v1/records/risk-vuln-unpatched-known-flaws-c4a6b075.json","targetId":"risk:vuln-unpatched-known-flaws","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:f66a5d84c2198ce10ae46c518865b71602dfe108a6aba6146c1e13c57af60f77","properties":{"rationale":"Shared alerts on actively-exploited known vulnerabilities drive prioritized remediation.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-bcdr-16-462251f1.json","sourceId":"uc:UC-BCDR-16","targetDetailPath":"/data/v1/records/risk-vuln-unpatched-known-flaws-c4a6b075.json","targetId":"risk:vuln-unpatched-known-flaws","type":"mitigates"}],"schemaVersion":1}