Cyber Resilience

NIST 800-53 r5 · Controls catalogue · Family SC

SC-44Detonation Chambers

Employ a detonation chamber capability within {{ insert: param, sc-44_odp }}.

Last updated: 22 August 2026 14:14 UTC

Implementations targeting this control (0)

ATT&CK techniques this control mitigates (22)

Weaknesses this control addresses (6)AI-assisted

CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.

CWE Name CVEs Why this control addresses it
CWE-94Improper Control of Generation of Code ('Code Injection')7,300+Dynamically generated code can be produced and executed inside the isolated chamber, preventing host compromise from code-injection payloads.
CWE-434Unrestricted Upload of File with Dangerous Type5,100+Dangerous file uploads can be detonated in the chamber to determine malice before any production write or execution occurs.
CWE-502Deserialization of Untrusted Data3,600+Untrusted serialized data can be deserialized and observed inside the chamber, blocking gadget-chain exploitation outside the sandbox.
CWE-829Inclusion of Functionality from Untrusted Control Sphere300+Isolated execution prevents functionality from an untrusted sphere from affecting the real environment, allowing safe behavioral inspection.
CWE-506Embedded Malicious Code99Detonation chambers directly detect and analyze embedded malicious code by executing it in isolation before it reaches production systems.
CWE-470Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')94Externally controlled class or code selection can be resolved and invoked inside the chamber, surfacing unsafe reflection without system impact.

Top CVEs where this control is the strongest mitigation

CVE Risk CVSS EPSS Match
CVE-2024-3094 10.010.00.8597good
CVE-2025-59374 KEV9.99.80.0117good
CVE-2026-8398 KEV 9.99.80.0146good
CVE-2026-48027 KEV 9.99.80.0185good
CVE-2026-45321 KEV 9.49.60.0234good
CVE-2026-33634 KEV9.28.80.5916good
CVE-2025-30066 KEV 8.88.60.6979good
CVE-2025-30154 KEV 8.88.60.0239good
CVE-2024-4978 KEV 8.68.40.2694good
CVE-2025-54313 KEV 8.17.50.0415good
CVE-2026-464127.410.00.0042good
CVE-2026-180727.49.80.0059good
CVE-2026-667477.49.80.0058good
CVE-2026-319767.39.80.0050good
CVE-2026-344247.39.80.0055good
CVE-2026-64437.39.80.0050good
CVE-2026-44484 7.39.80.0039good
CVE-2026-735327.39.80.0046good
CVE-2026-735337.39.80.0045good
CVE-2026-776497.39.80.0043good
CVE-2026-776507.39.80.0043good
CVE-2026-776517.39.80.0043good
CVE-2025-32965 7.09.30.0090good
CVE-2025-59039 7.09.30.0033good
CVE-2017-20201 7.09.30.0049good

Other controls in family SC

SC-1 SC-10 SC-11 SC-12 SC-13 SC-14 SC-15 SC-16 SC-17 SC-18 SC-19 SC-2 SC-20 SC-21 SC-22 SC-23 SC-24 SC-25 SC-26 SC-27 SC-28 SC-29 SC-3 SC-30 SC-31 SC-32 SC-33 SC-34 SC-35 SC-36 SC-37 SC-38 SC-39 SC-4 SC-40 SC-41 SC-42 SC-43 SC-45 SC-46 SC-47 SC-48 SC-49 SC-5 SC-50 SC-51 SC-6 SC-7 SC-8 SC-9