NIST 800-53 r5 · Controls catalogue · Family SA
SA-22Unsupported System Components
Replace system components when support for the components is no longer available from the developer, vendor, or manufacturer; or Provide the following options for alternative sources for continued support for unsupported components {{ insert: param, sa-22_odp.01 }}.
Last updated: 04 July 2026 00:28 UTC
Cumulative inbound coverage
How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.
Collective: mostly · 4 mapping(s) from 3 framework(s): ASVS 5.0 2 (partial) · CSF 2.0 1 (mostly) · OWASP-Web 1 (partial)
Implementations targeting this control (0)
- No implementations targeting this control yet.
ATT&CK techniques this control mitigates (6)
- T1189 Drive-by Compromise Initial Access
- T1195 Supply Chain Compromise Initial Access
- T1195.001 Compromise Software Dependencies and Development Tools Initial Access
- T1195.002 Compromise Software Supply Chain Initial Access
- T1543 Create or Modify System Process Persistence, Privilege Escalation
- T1543.002 Systemd Service Persistence, Privilege Escalation
Weaknesses this control addresses (2)AI
CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.
| CWE | Name | CVEs | Why this control addresses it |
|---|---|---|---|
CWE-1104 | Use of Unmaintained Third Party Components | 21 | Directly prevents continued use of components that receive no further security updates or patches from the vendor. |
CWE-477 | Use of Obsolete Function | 16 | Eliminates reliance on functions or components explicitly declared obsolete and unsupported by their maintainers. |
Top CVEs where this control is the strongest mitigation
| CVE | Risk | CVSS | EPSS | Match |
|---|---|---|---|---|
CVE-2025-59374 KEV | 10.0 | 9.8 | 0.0108 | good |
CVE-2024-3273 KEV UPD | 10.0 | 7.3 | 1.0000 | good |
CVE-2024-3272 KEV UPD | 10.0 | 9.8 | 0.9804 | good |
CVE-2024-23692 KEV | 10.0 | 9.8 | 0.9949 | good |
CVE-2024-11120 KEV | 10.0 | 9.8 | 0.2855 | good |
CVE-2024-0769 KEV | 10.0 | 5.3 | 0.8271 | good |
CVE-2021-45382 KEV | 10.0 | 9.8 | 0.9784 | good |
CVE-2020-9377 KEV | 10.0 | 8.8 | 0.2134 | good |
CVE-2023-32007 | 8.0 | 8.8 | 0.7579 | good |
CVE-2022-23302 | 8.0 | 8.8 | 0.6179 | good |
CVE-2026-3485 | 7.0 | 9.8 | 0.0466 | good |
CVE-2025-15471 | 7.0 | 9.8 | 0.1211 | good |
CVE-2016-15057 | 7.0 | 9.9 | 0.0373 | good |
CVE-2025-0982 | 7.0 | 10.0 | 0.0024 | good |
CVE-2025-2619 | 7.0 | 9.8 | 0.0185 | good |
CVE-2026-4184 | 7.0 | 9.8 | 0.0118 | good |
CVE-2026-4183 | 7.0 | 9.8 | 0.0118 | good |
CVE-2025-13188 | 7.0 | 9.8 | 0.0224 | good |
CVE-2025-2618 | 7.0 | 9.8 | 0.0185 | good |
CVE-2026-4182 | 7.0 | 9.8 | 0.0108 | good |
CVE-2026-4181 | 7.0 | 9.8 | 0.0118 | good |
CVE-2025-2621 | 7.0 | 9.8 | 0.0191 | good |
CVE-2025-15194 | 7.0 | 9.8 | 0.0104 | good |
CVE-2026-41873 | 7.0 | 9.8 | 0.0044 | good |
CVE-2026-42374 UPD | 7.0 | 9.8 | 0.0047 | good |