S0094RS3-T14-S0094-Z · Full risk code

Unpatched Container Image Vulnerabilities

容器映像漏洞未修補

Deployment
Risk Description

When an organization's inference service runs on an image built a year earlier and not included in periodic scanning; due to unmitigated control gaps, only after scanning is introduced does the organization discover multiple high-risk vulnerabilities in the image, which has already been deployed across several environments, triggering compliance exposure and operational reputational costs.

Framework Mappings

NIST CSF 2.0PR.PS
ISO/IEC 27001Annex A 8.8
MITRE ATLASAML.T0010
NIST AI 600-1Information Security
ISO/IEC 5338部署

Risk Treatment & Implementation Guidance

Scan container images regularly with patching deadlines for high-risk findings; Minimize images to reduce attack surface; Set image-rebuild cycles prohibiting long-lived stale images