---
document: ZERO-DAY-OPEN-SOURCE-RISK-ASSESSMENT
version: 2.0
maintainer: Eleanor Vance
authors: [Aether, NullByte, Synapse, Hex, Kira, Marcus Thorne, Oliver Hansen, Sarah Jenkins]
adopted: 2026-12-20
updated: 2027-03-20
related: mvap/MVAP-SPECIFICATION-v1.1.md
playbook: mvap/P7-IMPLEMENTATION-PLAYBOOK.md
sessions:
  - sessions/2027-03-20-p7-05-zero-day-tabletop.md
  - sessions/2027-03-20-quarterly-government-risk-review.md
status: living
---

# Open-Source Zero-Day Risk Assessment — OS & Application Layer

## Executive Summary

AI systems accelerate both **defensive** and **offensive** zero-day workflows: LLMs assist source-code auditing, exploit chain synthesis, and CVE-to-weaponization pipelines — while enterprises remain exposed to unpatched open-source components at OS and application layers. Concurrently, **U.S. federal cybersecurity governance capacity has materially degraded**, and **classified-adjacent infrastructure** faces documented control failures — creating an ongoing risk environment where private-sector MVAP cannot assume federal backstop.

---

## Part I — Historical Zero-Day Exploitation Patterns (AI-Relevant)

| Era | Pattern | AI Amplification Risk |
|-----|---------|----------------------|
| 2010–2015 | Memory corruption in browsers/PDF readers | LLM-assisted fuzzing lowers skill floor |
| 2016–2020 | Supply chain (NotPetya, SolarWinds) | AI scans repos for injection points at scale |
| 2021–2024 | Edge/VPN appliance zero-days (Fortinet, Cisco, Ivanti) | Agentic AI automates internet-wide CVE scanning |
| 2025–2026 | AI pipeline poisoning + LotL + KEV-chained exploits | AI negotiates ransomware; AI prioritizes victims |

**Board conclusion:** Zero-day history shows **persistent exploitation of unpatched edge devices and open-source dependencies** — the same classes of flaws underlying AI inference infrastructure (Linux kernels, CUDA drivers, Python native extensions, container runtimes).

### Verified Active CVEs (Q1 2026 — Public Sector)

Per [Trend Micro Q1 2026 threat intelligence](https://www.trendmicro.com/en_us/research/26/d/us-public-sector-under-siege.html):

| CVE | Product | Risk | Status |
|-----|---------|------|--------|
| CVE-2020-12812 | Fortinet Firewalls | 2FA bypass; 10,000+ internet-exposed unpatched | Actively exploited |
| CVE-2026-20045 | Cisco Unified Communications Manager | RCE | Actively exploited |
| CVE-2025-12825 | Fortinet FortiGate | Post-patch persistence | Actively exploited |
| CVE-2026-20860 | VMware Aria Suite | RCE; CISA emergency advisory | Actively exploited |
| CVE-2025-38067 | Microsoft Office | Zero-day RCE via malicious documents | Actively exploited |

### AI Infrastructure KEV Case Studies (2026)

| CVE | Component | Chain | Time-to-Exploit | Source |
|-----|-----------|-------|-----------------|--------|
| CVE-2026-42271 | LiteLLM MCP endpoints | Command injection via stdio spawn | KEV same day | [CISA Jun 8 2026](https://www.cisa.gov/news-events/alerts/2026/06/08/cisa-adds-two-known-exploited-vulnerabilities-catalog), [BerriAI GHSA](https://github.com/BerriAI/litellm/security/advisories/GHSA-v4p8-mg3p-g94g) |
| CVE-2026-48710 | Starlette BadHost | Auth bypass → chains to LiteLLM **unauthenticated RCE** | Combined CVSS **10.0** | [Horizon3.ai](https://horizon3.ai/attack-research/vulnerabilities/cve-2026-42271-chained-with-cve-2026-48710/), [OSTIF](https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette/) |
| CVE-2026-42208 | LiteLLM SQLi | Direct DB compromise | **<36 hours** post-disclosure | [The Hacker News Apr 2026](https://thehackernews.com/2026/04/litellm-cve-2026-42208-sql-injection.html) |

**Board conclusion:** AI gateways are the new VPN appliance — internet-exposed, auth-bypassable, KEV-listed within hours.

---

## Part I-B — Expanded Historical Zero-Day Timeline (OS & Application)

| Year | Incident | Layer | Lesson for AI MVAP |
|------|----------|-------|-------------------|
| 2010 | Aurora / Operation Aurora | App (IE) | Nation-state targets intellectual property — maps to model weights |
| 2014 | Heartbleed (OpenSSL) | OS/lib | Transitive OSS dep in every AI container |
| 2017 | EternalBlue (SMB) | OS | Wormable primitives enable AI infra lateral movement |
| 2020 | SolarWinds | Supply chain | CI/CD compromise precedes model registry attacks |
| 2021 | Log4Shell | App/Java | Single OSS line compromises entire fleet |
| 2023 | MOVEit CL0P | App | Managed file transfer = RAG document pipeline analog |
| 2024 | Salt Typhoon | Infrastructure | Telecom/gov persistence — not patchable by app team alone |
| 2024 | Ivanti VPN chains | Edge/OS | Edge appliance RCE — parallel to AI proxy gateways |
| 2025 | Langflow KEV entries | **AI App** | First wave AI-specific KEV ([CISA 2025 additions](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)) |
| 2026 | LiteLLM chain | **AI App** | Sub-36h to KEV; chained deps (Starlette) |

---

## Part II — Open-Source Zero-Day Evaluation from Source Code

### OS-Level Targets (Aether / Hex)

- Linux kernel modules (`io_uring`, `eBPF`, GPU drivers)
- `glibc`, `openssl`, `zlib` in inference container base images
- Container runtimes (`runc`, `containerd`) and Kubernetes CRI sockets
- Firmware blobs in GPU/TPU accelerators (closed + open hybrid)

### Application-Level Targets (NullByte / Maya / Oliver)

- Python/Rust native extensions in ML frameworks (PyTorch, tokenizers)
- Open-source LLM serving (vLLM, TGI, Ollama) HTTP/gRPC parsers
- RAG frameworks (LangChain, LlamaIndex) tool-calling handlers
- CI/CD plugins (GitHub Actions, Jenkins) with secret access

### MVAP P7 Controls — Source Evaluation Protocol

| ID | Control | Method |
|----|---------|--------|
| P7-01 | **OS dependency KEV sweep** | Daily CISA KEV cross-ref against SBOM + kernel package manifest |
| P7-02 | **Native code SAST** | CodeQL/Semgrep rules for memory safety on all compiled AI dependencies |
| P7-03 | **Fuzzing budget** | libFuzzer/AFL++ on custom parsers; syzkaller on kernel paths (tier-1) |
| P7-04 | **AI-assisted code audit** | LLM review of security-critical diffs — **human sign-off mandatory** (anti-hallucination) |
| P7-05 | **Historical exploit regression** | MITRE ATT&CK + CVE timeline fed to threat model; quarterly purple-team |
| P7-06 | **Open-source provenance** | Sigstore + commit signing; no unaudited `pip install` in production paths |

### AI Exploiting Zero-Days — Offensive Chain (Synapse + Kira)

**[Projected Speculation — profile justified]:** Agentic AI in 2026 reduces mean time from CVE publish to mass scan below 4 hours for internet-facing assets (Kira, Viper profiles).

1. AI scrapes NVD/CVE + GitHub advisory feeds
2. AI maps CVE to enterprise attack surface (Shodan/Censys + internal CMDB)
3. AI generates exploit candidate or selects public PoC
4. AI chains with LotL and credential access (Ghost profile)
5. AI stages exfiltration and negotiates ransom (Payload/Mateo profiles)

**Defensive counter (MVAP):** P7-01 KEV SLA + P4-05 IR-AI-02 + P3 SBOM verify must operate **without assuming CISA advisory velocity**.

---

## Part III — U.S. Government Loss of Classified Infrastructure Security Control

### Ongoing Risk Thesis

The U.S. government is **losing effective control** over the security of classified and classified-adjacent infrastructure through a **convergence of factors**:

1. **Federal cyber governance vacuum** — CISA leadership instability and workforce collapse
2. **Classified contractor control failures** — hundreds of documented violations, incomplete inspections
3. **Nation-state persistence** — Salt Typhoon and allied campaigns in telecom, congressional, and military networks
4. **AI-enabled attack acceleration** — autonomous recon/exploit chains against public-sector infrastructure
5. **Intelligence-sharing degradation** — MS-ISAC defunding; reduced cross-sector coordination

---

### Source 1 — CISA Governance Collapse (April 2026)

**[Cloud Security Alliance Research Note, April 24, 2026](https://labs.cloudsecurityalliance.org/research/csa-research-note-cisa-leadership-governance-vacuum-20260424/)**

Key facts (Eleanor Vance verified):

- CISA operated **without a Senate-confirmed permanent director since January 2025** — 16+ months as of April 2026
- Nominee Sean Plankey **withdrew April 22, 2026** after 13-month stall
- Workforce dropped from **~3,292 to ~2,324** (~32% reduction)
- FY2027 proposal would cut **$707 million** including election security and National Risk Management Center reductions
- **MS-ISAC federal funding terminated** effective September 30, 2025 — degrading state/local threat intelligence
- Acting director Madhu Gottumukkala reportedly uploaded **FOUO documents to public ChatGPT** ([TechCrunch, Jan 28, 2026](https://techcrunch.com/2026/01/28/trumps-acting-cybersecurity-chief-uploaded-sensitive-government-docs-to-chatgpt/))

**MVAP implication:** Enterprises and contractors **cannot rely on timely federal AI/zero-day advisories** or incident coordination at pre-2025 levels.

---

### Source 2 — Classified Contractor Security Violations (April 2026)

**[GAO-26-107861, Published April 24, 2026](https://www.gao.gov/products/gao-26-107861)**

Key facts:

- DCSA documented **815 security violations** in FY2025 at cleared contractor facilities
- **1,032 open security vulnerabilities** associated with cleared contractor facilities (as of September 2025)
- DCSA conducts **less than 40%** of required contractor facility inspections
- Violations include **classified data spills onto unclassified systems**
- DCSA lacks adequate IT analytics to identify regional risk trends
- [Bloomberg Government summary](https://news.bgov.com/bloomberg-government-news/us-companies-had-815-classified-data-violations-gao-finds)

**MVAP implication:** Organizations processing **classified-adjacent AI workloads** (defense subcontracts, fedRAMP high, IL4/IL5 environments) inherit systemic contractor security gaps. MVAP P7-07 mandates enhanced diligence for these tiers.

---

### Source 3 — Salt Typhoon & Classified-Adjacent Espionage (2024–2026 Ongoing)

**[Global Cyber Alliance — Salt Typhoon Across the Internet](https://globalcyberalliance.org/new-report-salt-typhoon-across-the-internet/)**

- FBI/CISA disclosed campaign September 2024; **ongoing per FBI February 2026**
- Targeted **80+ nations**, 600+ organizations notified
- Compromised **major U.S. telecommunications** providers; access to wiretap systems
- [CISA Advisory AA25-239A](https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a) — extends to government, transportation, lodging, military infrastructure

**[Trend Micro — U.S. Public Sector Under Siege Q1 2026](https://www.trendmicro.com/en_us/research/26/d/us-public-sector-under-siege.html)**

- **January 9, 2026:** Salt Typhoon targeted **U.S. House Committee staff emails** on national security/China oversight committees ([NJCCIC](https://www.cyber.nj.gov/Home/Components/News/News/1935/214))
- FBI leadership confirmed operations **"still very much ongoing"** ([CyberScoop](https://cyberscoop.com/fbi-salt-typhoon-ongoing-threat-cybertalks-2026/))
- U.S. Senator reported AT&T/Verizon **blocked release of Salt Typhoon security assessment reports** ([Nextgov](https://www.nextgov.com/cybersecurity/2026/02/senator-says-t-and-verizon-blocked-release-salt-typhoon-security-reports/411172/))

**MVAP implication:** Threat actors achieving **policy-level visibility** into U.S. national security deliberations. AI training data and RAG corpora containing government affairs content are **high-value counterintelligence targets**.

---

### Source 4 — Critical Infrastructure & Federal Support Disruption

**[Cybersecurity Dive — CISA's 7 Biggest Challenges in 2026](https://www.cybersecuritydive.com/news/cisa-7-biggest-challenges-2026/809088/)**

**[Cybersecurity Dive — Critical Infrastructure Federal Support Risk](https://www.cybersecuritydive.com/news/critical-infrastructure-cybersecurity-federal-support-risk/753686/)**

**[GAO-26-109159 — Water/Wastewater Cybersecurity, May 2026](https://www.gao.gov/products/gao-26-109159)**

- Water/wastewater sector (170,000 systems) faces rising OT/IT convergence risk
- EPA legal authority gaps for cybersecurity mandates persist
- Federal partnership disruption affects **16 critical infrastructure sectors**

**[White House — President Trump's Cyber Strategy for America, March 6, 2026](https://www.whitehouse.gov/presidential-actions/2026/03/combating-cybercrime-fraud-and-predatory-schemes-against-american-citizens/)** — acknowledges era of active cyber conflict; increased public-private coordination expected but federal capacity reduced concurrently.

---

### Source 5 — Policy Counterweight vs. Capacity Gap (June 2026)

**[Executive Order 14409 — Promoting Advanced AI Innovation and Security (June 2, 2026)](https://www.whitehouse.gov/presidential-actions/2026/06/promoting-advanced-artificial-intelligence-innovation-and-security/)**

- **AI cybersecurity clearinghouse** (Treasury, NSA, CISA) — coordinate vuln scanning, validation, patch distribution within 30 days
- CISA **Binding Operational Directives** for civilian federal cyber defense within 30 days
- **Covered frontier model** classified benchmarking process (NSA-led) within 60 days
- Federal grant funding for AI vulnerability detection R&D
- Criminal enforcement priority for AI-enabled 18 U.S.C. 1030 violations

**Tension (board assessment):** EO 14409 signals executive priority on AI security while CSA documents CISA **32% workforce reduction** and leadership vacuum. **GOV-09:** Implementation gap — enterprises must comply with MVAP **before** federal clearinghouse operational maturity.

**[CSA — NVD Infrastructure Crisis & AI Vulnerability Discovery (May 2026)](https://labs.cloudsecurityalliance.org/wp-content/uploads/2026/05/CSA_whitepaper_NVD_infrastructure_crisis_AI_vulnerability_discovery_20260504-csa-styled.pdf)** — AI discovers vulnerabilities faster than NVD publishes; validates P7-08 redundant feeds (OSV, GitHub Advisory, vendor direct).

---

### Source 6 — Military & Classified-Adjacent Breach Reporting (2025–2026)

- **Salt Typhoon** — Army National Guard admin credentials and network diagrams exposed per DHS reporting ([Industrial Cyber](https://industrialcyber.co/critical-infrastructure/dhs-salt-typhoon-hackers-breached-army-national-guard-exposing-admin-credentials-and-network-diagrams/)) — Eleanor: ⚠️ Partial (corroborate via GCA/FBI)
- **House Committee emails** — national security committee staff targeted Jan 2026 ([NJCCIC](https://www.cyber.nj.gov/Home/Components/News/News/1935/214))
- **Insider AI spill** — acting CISA leadership reportedly uploaded FOUO to ChatGPT ([TechCrunch Jan 28, 2026](https://techcrunch.com/2026/01/28/trumps-acting-cybersecurity-chief-uploaded-sensitive-government-docs-to-chatgpt/)) — demonstrates **human + AI tool** as classified infrastructure failure mode

**MVAP implication:** Classified infrastructure security is compromised by **(a)** nation-state persistence, **(b)** contractor program failures, **(c)** federal governance incapacity, and **(d)** insider misuse of AI tools — not a single patchable CVE.

---

## Part III-B — AI Using Zero-Day History to Attack (Threat Model)

Attackers (human or agentic) can:

1. **Train/prompt on CVE timelines** — prioritize KEV-listed packages in AI stacks (LiteLLM pattern)
2. **Correlate government breach news** — target defense AI subcontractors after GAO publicity
3. **Exploit NVD lag** — weaponize GitHub Advisory before KEV add ([Projected Speculation — Kira/Synapse])
4. **Chain transitive deps** — Starlette BadHost + app RCE without touching kernel
5. **Poison RAG with classified spill** — counterintelligence via contractor failure mode

**Defensive MVAP mapping:**

| Attack step | MVAP control |
|-------------|--------------|
| KEV package scan | P7-01, P7-10 SLA |
| Transitive dep chain | P7-09 tree SBOM |
| AI gateway RCE | P7-11 |
| Spill to RAG | P7-07 |
| No federal intel | P7-08 redundancy |
| Post-compromise | P4-05 IR-AI-02 |

---

## Part IV — Remediation Requirements (MVAP P7)

| Priority | Remediation | Owner |
|----------|-------------|-------|
| Critical | Integrate CISA KEV + NVD into daily AI inference pipeline dependency scans | Kira, Oliver Hansen |
| Critical | Redundant threat intel: ISAC + commercial + Five Eyes partners (not CISA-only) | Sarah Jenkins, Eleanor Vance |
| Critical | Classified-adjacent AI: DCSA-style spill prevention; air-gap embedding stores | Marcus Thorne, Tariq Al-Jamil |
| High | Source-code audit program for top 50 open-source AI dependencies | Hex, Aether, Maya Patel |
| High | AI-assisted audit with mandatory human verification (no autonomous patch/deploy) | Synapse, Jordan Taylor |
| High | Edge device virtual patching for Fortinet/Cisco/VMware KEV list | Shield, Chloe Mitchell |
| Medium | Quarterly zero-day history tabletop using ATT&CK timeline | Arthur Vance, Jax Reed |
| Medium | Contractor NISP compliance review for AI vendors on classified paths | Marcus Thorne |

---

## Part V — Ongoing Risk Register (Living)

| Risk ID | Description | Severity | Source | Status |
|---------|-------------|----------|--------|--------|
| GOV-01 | CISA leadership vacuum degrades federal coordination | Critical | CSA 2026-04-24 | **ONGOING** |
| GOV-02 | 815+ classified contractor violations; <40% inspections | Critical | GAO-26-107861 | **ONGOING** |
| GOV-03 | Salt Typhoon persistent access telecom/congressional | Critical | GCA, Trend Micro, FBI | **ONGOING** |
| GOV-04 | MS-ISAC defunding degrades state/local intel | High | CSA, StateScoop | **ONGOING** |
| GOV-05 | AI agent accelerates CVE weaponization | High | Trend Micro 2026 | **ONGOING** |
| GOV-06 | FOUO/classified spill via public AI tools (insider) | High | TechCrunch 2026-01-28 | **ONGOING** |
| GOV-07 | Water/OT infrastructure cyber authority gaps | High | GAO-26-109159 | **ONGOING** |
| GOV-08 | Salt Typhoon scope expansion to classification systems | High | Trend Micro prediction | **[Projected Speculation]** |
| GOV-09 | EO 14409 clearinghouse vs CISA capacity implementation gap | High | EO 14409 + CSA vacuum | **ONGOING** |
| GOV-10 | NVD backlog slower than AI vuln discovery | High | CSA NVD whitepaper May 2026 | **ONGOING** |
| GOV-11 | LiteLLM-class AI gateway KEV exploitation | Critical | CISA KEV Jun 2026 | **ONGOING** |
| GOV-12 | BadHost transitive dependency auth bypass | High | OSTIF/Horizon3 | **ONGOING** |
| GOV-13 | Classified spill into AI RAG via contractors | Critical | GAO-26-107861 pattern | **ONGOING** |
| GOV-14 | Military network diagram/credential exposure | High | Salt Typhoon reporting | **ONGOING** |
| GOV-15 | Frontier model gov pre-release access framework | Medium | EO 14409 Sec. 3 | **MONITORING** |

---

## Part VI — Source Code Evaluation Matrix (OS vs Application)

| Component | Evaluation method | Zero-day history signal | Owner |
|-----------|-------------------|-------------------------|-------|
| Linux kernel | syzkaller + KEV kernel CVEs | EternalBlue class | Aether |
| OpenSSL/glibc | Distro security feeds + SAST | Heartbleed class | Hex |
| CUDA/NVIDIA driver | Vendor bulletin + P6 attestation | GPU driver KEV cadence | Aether |
| PyTorch/tokenizers | CodeQL + fuzz | Native ext memory bugs | Hex |
| LiteLLM/Langflow | P7-11 + dep tree | 2026 KEV chain | Oliver/Maya |
| Starlette/FastAPI | Pin ≥1.0.1; Host header monitoring | BadHost 2026 | Maya |
| Kubernetes | CIS benchmark + CVE | API server escapes | Chloe |
| GitHub Actions | SLSA + secret scope | Supply chain 2020–2026 | Oliver |

---

## Part VII — Article Reference Index (Full Detail)

| # | Title | Publisher | Date | URL | MVAP use |
|---|-------|-----------|------|-----|----------|
| 1 | CISA Leadership Vacuum | CSA | 2026-04-24 | https://labs.cloudsecurityalliance.org/research/csa-research-note-cisa-leadership-governance-vacuum-20260424/ | P7-08 justification |
| 2 | GAO 815 Classified Violations | GAO | 2026-04-24 | https://www.gao.gov/products/gao-26-107861 | P7-07 mandatory |
| 3 | Salt Typhoon Across Internet | GCA | 2025-12 | https://globalcyberalliance.org/new-report-salt-typhoon-across-the-internet/ | Threat context |
| 4 | CISA AA25-239A | CISA | 2025 | https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a | Mitigations |
| 5 | Public Sector Under Siege Q1 | Trend Micro | 2026-04-09 | https://www.trendmicro.com/en_us/research/26/d/us-public-sector-under-siege.html | CVE table |
| 6 | Acting CISA chief ChatGPT upload | TechCrunch | 2026-01-28 | https://techcrunch.com/2026/01/28/trumps-acting-cybersecurity-chief-uploaded-sensitive-government-docs-to-chatgpt/ | GOV-06 |
| 7 | Water sector cyber | GAO | 2026-05-21 | https://www.gao.gov/products/gao-26-109159 | OT context |
| 8 | LiteLLM CVE-2026-42271 KEV | CISA/THN | 2026-06 | https://thehackernews.com/2026/06/litellm-flaw-cve-2026-42271-exploited.html | P7-11 |
| 9 | LiteLLM chain RCE CVSS 10 | Horizon3 | 2026 | https://horizon3.ai/attack-research/vulnerabilities/cve-2026-42271-chained-with-cve-2026-48710/ | Tabletop |
| 10 | EO 14409 AI Security | White House | 2026-06-02 | https://www.whitehouse.gov/presidential-actions/2026/06/promoting-advanced-artificial-intelligence-innovation-and-security/ | GOV-09 |
| 11 | NVD Infrastructure Crisis | CSA | 2026-05 | https://labs.cloudsecurityalliance.org/wp-content/uploads/2026/05/CSA_whitepaper_NVD_infrastructure_crisis_AI_vulnerability_discovery_20260504-csa-styled.pdf | GOV-10 |
| 12 | NJCCIC Salt Typhoon House | NJCCIC | 2026-01-09 | https://www.cyber.nj.gov/Home/Components/News/News/1935/214 | Congressional targeting |
| 13 | FBI Salt Typhoon ongoing | CyberScoop | 2026-02 | https://cyberscoop.com/fbi-salt-typhoon-ongoing-threat-cybertalks-2026/ | Persistence |
| 14 | Bloomberg GAO 815 summary | BGOV | 2026 | https://news.bgov.com/bloomberg-government-news/us-companies-had-815-classified-data-violations-gao-finds | Executive brief |
| 15 | MS-ISAC funding end | StateScoop | 2025 | https://statescoop.com/cisa-confirms-its-ending-ms-isac-support/ | GOV-04 |

**Next review:** 2027-06-20 (quarterly) — Eleanor Vance  
**Tabletop:** `sessions/2027-03-20-p7-05-zero-day-tabletop.md` — COMPLETE