2026-09-25T0404Z-intel

Verification & coverage notes

2 new entries (vulnerability: 1 deep-dive, policy: 1), 2 updates, 1 deep dive, critical: 0. Standard-cadence window (gap 24.0h, window 26.0h), no catch-up disclosure required.

Dropped by verification (iteration 2): an ASP France ("Coup de pouce énergie" payment-notice IDOR breach) incident entry was composed in Phase 4 and survived Phase 5.5, but two independent cold-reader passes (iteration 1's low-confidence editorial flag, iteration 2's full independent re-read) both found it does not clearly clear the stricter incident/breach relevance bar: no home-region nexus (France, not Switzerland), no named actor, an IDOR is not a novel or materially evolved TTP, and the incident's scale (143,518 records) is not globally significant. Iteration 1's disposition leaned on this store's own precedent for non-home-region public-sector breaches (the AFPA and Japan Digital Agency entries); iteration 2's independent read did not find that precedent persuasive for this specific item. Dropped rather than force a marginal call past two independent challenges, quality over quantity resolves this doubt toward drop.

Mechanical KEV sweep: tools/kev_window_diff.py found 2 in-window CISA KEV additions (2026-09-24): CVE-2026-5430 (WSO2, NOT COVERED, composed as this run's deep dive) and CVE-2026-71362 (Adobe Commerce, COVERED by 2026-08-16/cve-2026-71362-adobe-commerce-customer-account-takeover, whose own cves[].status already read [exploited, patch-available] before this run; the KEV addition is bookkeeping on an already-exploited CVE per PD-13 and ships nothing).

Borderline-drop: Adobe Campaign Classic APSB26-142 revision (18 CVEs, 8 at CVSS 10.0), single-sourced (Adobe's own bulletin plus an NCSC-NL RSS mention only; no second named outlet found), no confirmed exploitation, no PoC, no exposure-forcing mechanic beyond the CVSS score itself. Routine patch-cycle per PD-11(b); does not clear the beyond-normal-cadence bar.

Borderline-drop: IBM MQ (CVE-2026-10747) + Langflow OSS (11 further CVEs, incl. 3× CVSS 9.8), both fixed, no exploitation reported, no PoC, no forcing mechanic beyond severity. Routine patch-cycle per PD-11(b).

Borderline-drop: Recorded Future Insikt Group's "Russia New Generation Warfare" hybrid-campaign update (S3), single-source analytic synthesis with forward-looking indicators; no Switzerland-specific nexus stated (Europe-wide framing only); reads as strategic-level trend/outlook content rather than technical, actionable tradecraft. The retired synthesis/outlook kinds existed for exactly this shape; declined per PD-11 and the v4.0 scope narrowing.

Not published, added to state/coverage_backlog.md: Maileva (Docaposte/La Poste dematerialised-mail brand), confirmed service disruption since 2026-09-23 after unauthorized account-access attempts, but no party names a mechanism, actor, or confirmed data theft; same blocking shape as the Ville du Tampon/Familea/Pays de l'Aigle rows already on the backlog. No evidence-bound techniques[] could be composed without inventing one.

Coverage backlog: all 9 open rows re-checked on today's facts (S1 for the VMware row, S3 for Spring Ring and the three remaining PD-11(d) research items, S4 for the six leak-site/blocked-mechanism rows); all nine: no change. One new row added (Maileva, above).

Cross-domain overlap (deliberate, resolved): S3 independently surfaced Recorded Future's Russia hybrid-warfare update and flagged it as potentially overlapping S2's home-region/policy mission; S2 did not independently surface the same story. Composed as a single disposition (borderline-drop, above) rather than two.

Deep dive: 2026-09-25/cve-2026-5430-wso2-jwt-algorithm-confusion-admin-bypass. Selected under deep-dive criterion 1 (active in-the-wild exploitation with non-trivial exposure, an admin-bypass on API-gateway infrastructure watchTowr characterises as "Lateral-Movement-as-a-Service"). No deep dive published elsewhere today; category identity-infra does not appear in the prior 30 days' rotation.

Notable sourcing finding, main-agent verified: CISA's own alert for CVE-2026-5430 titles it "WSO2 Multiple Products Path Traversal Vulnerability," matching neither WSO2's advisory nor any researcher account, all of which agree on a JWT algorithm-confusion authentication bypass. Confirmed directly against CISA's alert page; disclosed in the entry body so readers searching KEV by category are not misled. (The KEV catalog's own JSON record elaborates further with an "unrestricted file upload"/RCE description and a CWE-347 assignment, but that record is a blocked-source landing-page pattern this pipeline never cites; the entry states only what the cited alert page supports.)

Single-source entries: none. The Swiss sovereign-digital-infrastructure motion traces to the Swiss parliament's own Curia Vista OData record (primary), plus Netzwoche's March 2026 reporting of the Council of States vote and a Laux Lawyers AG legal roundup (both corroborating), genuinely multi-source, not a single first-party record standing alone.

Watchlist: products checked=0, hits=0; suppliers checked=0, hits=0, no product or supplier watchlist configured this deployment.

Coverage gaps: several S3 rotation-source listing pages (volexity, bitdefender-threat-debrief, group-ib, hunt-io, resecurity, pwn-ai) returned 200 but client-side-rendered/stale content with no drillable in-window post list, recipe gaps, not transport failures, logged in work/2026-09-25T0404Z-intel/findings.S3.yaml. S4's ico-uk and cnil-fr listing pages fetched cleanly but surfaced no on-point in-window enforcement notice through the listing alone; venarix.com is a JS-driven SPA with no working recipe. S1 did not sweep its 14-source rotation slice this run (essential-tier + the two mandatory KEV-diff priority pulls consumed the productive research budget); no gap serious enough to have missed a qualifying item, per S1's own assessment.

Essential-coverage: all essential-tier sources across all four domains fetched successfully this run (no misses to disclose).