Security Resilience

NIST 800-53 r5 · Controls catalogue · Family SC

SC-44Detonation Chambers

Employ a detonation chamber capability within {{ insert: param, sc-44_odp }}.

Last updated: 14 October 2026 20:41 UTC

Implementations targeting this control (0)

ATT&CK techniques this control mitigates (22)

Weaknesses this control addresses (6)AI-assisted

CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.

CWE Name CVEs Why this control addresses it
CWE-94Improper Control of Generation of Code ('Code Injection')7,800+Dynamically generated code can be produced and executed inside the isolated chamber, preventing host compromise from code-injection payloads.
CWE-434Unrestricted Upload of File with Dangerous Type5,300+Dangerous file uploads can be detonated in the chamber to determine malice before any production write or execution occurs.
CWE-502Deserialization of Untrusted Data4,000+Untrusted serialized data can be deserialized and observed inside the chamber, blocking gadget-chain exploitation outside the sandbox.
CWE-829Inclusion of Functionality from Untrusted Control Sphere300+Isolated execution prevents functionality from an untrusted sphere from affecting the real environment, allowing safe behavioral inspection.
CWE-470Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')100+Externally controlled class or code selection can be resolved and invoked inside the chamber, surfacing unsafe reflection without system impact.
CWE-506Embedded Malicious Code100+Detonation chambers directly detect and analyze embedded malicious code by executing it in isolation before it reaches production systems.

Top CVEs where this control is the strongest mitigation

CVE Risk CVSS EPSS Match
CVE-2024-3094 10.010.00.9046good
CVE-2025-59374 KEV 9.99.80.0120good
CVE-2026-8398 KEV 9.99.80.0096good
CVE-2026-48027 KEV 9.99.80.0134good
CVE-2026-45321 KEV 9.49.60.0105good
CVE-2026-33634 KEV9.28.80.0168good
CVE-2025-30066 KEV 8.88.60.7209good
CVE-2025-30154 KEV 8.88.60.0249good
CVE-2024-4978 KEV 8.68.40.2694good
CVE-2025-54313 KEV 8.17.50.0493good
CVE-2026-180727.89.80.0298good
CVE-2026-319767.59.80.0086good
CVE-2026-344247.59.80.0097good
CVE-2026-464127.510.00.0076good
CVE-2026-64437.49.80.0065good
CVE-2026-44484 7.49.80.0067good
CVE-2026-66747 7.49.80.0079good
CVE-2026-73532 7.49.80.0067good
CVE-2026-73533 7.49.80.0065good
CVE-2026-77649 7.49.80.0080good
CVE-2026-77650 7.49.80.0080good
CVE-2026-77651 7.49.80.0080good
CVE-2026-972307.19.80.0024partial
CVE-2025-32965 7.09.30.0091good
CVE-2025-59039 7.09.30.0034good

Other controls in family SC

SC-1 SC-10 SC-11 SC-12 SC-13 SC-14 SC-15 SC-16 SC-17 SC-18 SC-19 SC-2 SC-20 SC-21 SC-22 SC-23 SC-24 SC-25 SC-26 SC-27 SC-28 SC-29 SC-3 SC-30 SC-31 SC-32 SC-33 SC-34 SC-35 SC-36 SC-37 SC-38 SC-39 SC-4 SC-40 SC-41 SC-42 SC-43 SC-45 SC-46 SC-47 SC-48 SC-49 SC-5 SC-50 SC-51 SC-6 SC-7 SC-8 SC-9