ABCDEFGHIJKLMNOPQRSTUVWXYZAAABACADAEAFAGAHAIAJAKALAMANAOAPAQARASATAUAVAWAXAY
1
FedRAMP® Plan of Action and Milestones (POA&M)
2
CSPSystem NameImpact LevelCertification ClassPOAM Date
3
GoAnimateVyond for Government (V4G)Li-SaaSClass B5/11/2026
4
5
POAM IDControlsWeakness NameWeakness DescriptionWeakness Detector SourceWeakness Source IdentifierAsset IdentifierPoint of ContactResources RequiredOverall Remediation PlanOriginal Detection DateScheduled Completion DatePlanned MilestonesMilestone ChangesStatus DateVendor DependencyLast Vendor Check-in DateVendor Dependent Product NameOriginal Risk RatingAdjusted Risk RatingRisk AdjustmentFalse PositiveOperational RequirementDeviation RationaleSupporting DocumentsCommentsAuto-ApproveBinding Operational Directive 22-01 trackingBinding Operational Directive 22-01 Due DateCVEService Name
8
V-20240013CM-6Permissive Content Security Policy DetectedContent Security Policy (CSP) is a web security standard that helps to mitigate attacks like cross-site scripting (XSS), clickjacking or mixed content issues. CSP provides mechanisms to websites to restrict content that browsers will be allowed to load.

One or several permissive directives have been detected. See output for more details.		Tenable.io112554app.vyond-fedramp.comScott YangThe configuration of NginxTo set the required setting in the Nginx config6/11/202412/8/2024The Jira card (DO-1914) is created and all the history will be recorded within the card.(1) New 2024/6/11: Register this POAM and create the relative Jira card (DO-1914)
(2) Update 2025/2/17: Register in Deviation Request Form for OR
(3) Deviated 2025/10/7: The deviation request is approved		10/7/2025NoLowLowNoNoYesThe suggested remediation causes the function unavailable.

The remediation requires V4G to set script-src 'unsafe-eval' 'unsafe-inline' in the header, however, this setting makes the function unavailable.

For the compensating controls, V4G uses a hash nonce to verify the script to guarantee only the correct script is loaded		V-20240013-OR-01.pngNoNoNo
9
V-20240111CM-6HTTP Header Information DisclosureThe HTTP headers sent by the remote web server disclose information that can aid an attacker, such as the server version and
technologies used by the web server.		Tenable.io98618assets.vyond-fedramp.comScott YangTo set the required setting in the Nginx config9/3/20243/2/2025Complete the remediation in 180 days(1) New 2024/9/3: Register this POAM
(2) Update 2025/2/17: Register in Deviation Request Form for FP
(3) Deviated 2025/10/7: The deviation request is approved		10/7/2025NoLowLowNoYesNoThe remediation requires V4G to remove the field “Server” in the header. However, AWS CloudFront does not allow it and V4G enforces the null value, as “Server=null”, in the header to protect the information. V-20240111-FP-01.pngNoNoNo
10
V-20260002CM-6nginx 1.3.0 < 1.28.2 / 1.29.x < 1.29.5 SSL Upstream InjectionAccording to its Server response header, the installed version of nginx is 1.3.0 prior to 1.28.2, or 1.29.x prior to 1.29.5. It is, therefore, affected by the following issue :

- A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) servers. An attacker with a man-in-the-middle (MITM) position on the upstream server side--along with conditions beyond the attacker's control--may be able to inject plain text data into the response from an upstream proxied server. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
(CVE-2026-1642)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.		Tenable.io304671All EC2 hosts (39)Scott YangTo upgrade the Nginx to CVE-free version4/8/20267/7/2026Complete the remediation in 90 days(1) New 2026/4/10: Register this POAM4/10/2026NoModerateModerateNoNoNoNoNoNoCVE-2026-1642
11
V-20260003CM-6Content Security Policy Missing 'Report-To'Content Security Policy (CSP) is a web security standard that helps to mitigate attacks like cross-site scripting (XSS), clickjacking or mixed content issues. CSP provides mechanisms to websites to restrict content that browsers will be allowed to load.Tenable.io114796app.vyond-fedramp.comScott YangTo configure the HTTP security header4/16/202610/13/2026Complete the remediation in 180 days(1) New 2026/4/17: Register this POAM4/17/2026NoLowLowNoNoNoNoNoNo
12
V-20260004CM-6Logstash 8.x < 8.19.14 / 9.x < 9.2.8 / 9.3.x < 9.3.3 Path Traversal (ESA-2026-29)The version of Logstash installed on the remote host is 8.x prior to 8.19.14, 9.x prior to 9.2.8, or 9.3.x prior to 9.3.3. It is, therefore, affected by a path traversal vulnerability:

- The archive extraction utilities used by Logstash do not properly validate file paths within compressed archives.
An attacker who can serve a specially crafted archive to Logstash through a compromised or attacker-controlled update endpoint can write arbitrary files to the host filesystem with the privileges of the Logstash process. In certain configurations where automatic pipeline reloading is enabled, this can be escalated to remote code execution. (CVE-2026-33466)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.		Tenable.io305951Logstash and Wazuh Server (4)Scott YangUpgrade to Logstash version 8.19.14, 9.2.8, 9.3.3, or later.5/7/20266/6/2026Complete the remediation in 30 days(1) New 2026/5/11: Register this POAM5/11/2026NoHighHighNoNoNoNoNoNo
CVE-2026-33466
13
V-20260005CM-6Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2026-1651)It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1651 advisory.

In the Linux kernel, the following vulnerability has been resolved:crypto: algif_aead - Revert to operating out-of-place

To mitigate this issue, we recommend that customers disable loading of the algif_aead module by running the following commands:

echo install algif_aead /bin/false > /etc/modprobe.d/disable-algif.conf

rmmod algif_aead 2>/dev/null || true

This issue requires local authenticated access as a prerequisite; remote unauthenticated activity is not possible. (CVE-2026-31431)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.		Tenable.io312155All EC2 hosts (39)Scott YangRun 'dnf update kernel --releasever 2023.11.20260505' or or 'dnf update --advisory ALAS2023-2026-1651 --releasever 2023.11.20260505' to update your system.
5/7/20266/6/2026Complete the remediation in 30 days(1) New 2026/5/11: Register this POAM5/11/2026NoHighHighNoNoNoNoNoNo
CVE-2026-31431
14
V-20260006CM-6Apache Log4j 2.21.0 < 2.25.4 Rfc5424Layout Log Injection (CVE-2026-34478)The version of Apache Log4j on the remote host is 2.21.0 through 2.25.3. It is, therefore, affected by a vulnerability:

- The Rfc5424Layout is vulnerable to log injection via CRLF sequences due to undocumented renames of security-relevant configuration attributes. The newLineEscape attribute was silently renamed, disabling newline escaping for TCP framing. The useTlsMessageFormat attribute was also renamed, causing TLS framing users to be silently downgraded to unframed TCP. (CVE-2026-34478)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.		Tenable.io306548Logstash and Wazuh Server (4)Scott YangUpgrade to Apache Log4j version 2.25.4 or later.5/7/20266/6/2026Complete the remediation in 30 days(1) New 2026/5/11: Register this POAM5/11/2026NoHighHighNoNoNoNoNoNoCVE-2026-34478
15
V-20260007CM-6Apache Log4j 2.0-alpha1 < 2.25.4 XmlLayout Invalid XML Output (CVE-2026-34480)The version of Apache Log4j on the remote host is 2.0-alpha1 through 2.25.3. It is, therefore, affected by a vulnerability:

- The XmlLayout fails to sanitize characters forbidden by the XML 1.0 specification, producing invalid XML output whenever a log message or MDC value contains such characters. Depending on the StAX implementation, this causes either malformed XML or exceptions during logging. (CVE-2026-34480)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.		Tenable.io306549Logstash and Wazuh Server (4)Scott YangUpgrade to Apache Log4j version 2.25.4 or later.5/7/20266/6/2026Complete the remediation in 30 days(1) New 2026/5/11: Register this POAM5/11/2026NoHighHighNoNoNoNoNoNo
CVE-2026-34480
16
V-20260008CM-6OpenJDK 8 <= 8u482 / 11.0.0 <= 11.0.30 / 17.0.0 <= 17.0.18 / 21.0.0 <= 21.0.10 / 25.0.0 <= 25.0.2 / 26.0.0 <= 26.0.0 Multiple Vulnerabilities (2026-04-21)The version of OpenJDK installed on the remote host is 8 prior to 8u482 / 11.0.0 prior to 11.0.30 / 17.0.0 prior to 17.0.18 / 21.0.0 prior to 21.0.10 / 25.0.0 prior to 25.0.2 / 26.0.0 prior to 26.0.0. It is, therefore, affected by multiple vulnerabilities as referenced in the 2026-04-21 advisory.Tenable.io310406DSM (2)Scott YangUpgrade to an OpenJDK version greater than 8u482 / 11.0.30 / 17.0.18 / 21.0.10 / 25.0.2 / 26.0.05/7/20266/6/2026Complete the remediation in 30 days(1) New 2026/5/11: Register this POAM5/11/2026NoHighHighNoNoNoNoNoNo
CVE-2026-34282,
CVE-2026-34268,
CVE-2026-23865,
CVE-2026-22021,
CVE-2026-22018,
CVE-2026-22016,
CVE-2026-22013,
CVE-2026-22008,
CVE-2026-22007
17
V-20260009CM-6Apache Log4j 2.12.0 < 2.25.4 SSL Hostname Verification Bypass (CVE-2026-34477)The version of Apache Log4j on the remote host is 2.12.0 through 2.25.3. It is, therefore, affected by a vulnerability:

- The verifyHostName configuration attribute of the Ssl element was silently ignored in all versions through 2.25.3, leaving TLS connections vulnerable to interception via man-in-the-middle attacks when using SMTP, Socket, or Syslog appenders. (CVE-2026-34477)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.		Tenable.io306550Logstash and Wazuh Server (4)Scott YangUpgrade to Apache Log4j version 2.25.4 or later.5/7/20268/5/2026Complete the remediation in 90 days(1) New 2026/5/11: Register this POAM5/11/2026NoModerateModerateNoNoNoNoNoNo
CVE-2026-34477
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102