CVE-2026-88778

Engineering principles require cryptographically secure RNGs whose outputs cannot be predicted from prior values.

Key establishment depends on non-predictable random values, directly blocking the weakness when done correctly.

Mandates appropriate cryptography whose implementations must employ unpredictable random sources.

Secure SDLC practices directly require cryptographically secure, non-predictable value generation and thereby prevent this weakness.

Cryptographic controls require use of approved, unpredictable RNGs, directly mitigating predictable-value weaknesses.

A.8.25 requires a secure SDLC process with checkpoints, secure coding, testing and training; it does not itself stop prediction of exact values from prior outputs, which is a design/algorithm flaw that can still be exploited if present.

A.8.26 only requires that predictable-value requirements be identified during requirements gathering; it performs no act that stops exploitation of a predictable value that is present in the delivered application.

A.8.27 mandates establishing and applying secure engineering principles (including least privilege, security by design, distrust external input, and hardening) during the SDLC; this does not stop a predictable-value generator from being exploitable once written into the product.

Secure coding standards prohibit predictable random-value generation.