CVE-2026-86830

PR.IR-01's segmentation + zero-trust rules directly enforce minimum-necessary access at network boundaries, removing most instances of overly broad policy; CWE-1220 can still exist in application-layer or intra-segment controls that this single outcome does not address.

A.5.15 directly requires determining access needs, defining/enforcing topic-specific access control policy and rules (including need-to-know, privilege restrictions, segregation, formal authorization, role-based mapping, and consistency with classification), which stops most incorrect privilege assignments from being exploitable; the bounded remainder is incorrect assignments that arise from flawed implementation of those rules rather than from their absence.

A.5.18's provisioning, review, revocation and SoD rules (esp. a,b,c,f,i,j) directly stop most incorrect privilege assignments from being granted or persisting, with a bounded remainder in flawed implementation of the authorization step itself (see 5.9/5.15 dependency)

A.8.2 directly controls the identification, allocation, review, expiry, and temporary nature of privileged rights per policy, which stops most incorrect assignments from creating an exploitable sphere of control; the bounded remainder is incorrect privilege semantics inside code that the authorization process never sees.

A.8.3 mandates configuration mechanisms, per-user/group rights, isolation, and dynamic access management that directly supply the missing granularity for this weakness; well-implemented, the flaw (over-broad policy) stops being present in the product, with only a bounded remainder (e.g. certain physical or non-dynamic edge cases) left over.