TITAN AI · CONDUIT Agent

CONDUIT TICKET REPORT

CHG0030109

TICKET

TICKET Azure High Assigned

Opened by TITAN AI · CONDUIT · Scanner found the finding, CONDUIT forwarded this ticket via CONDUIT generic-API layer, assigned security_engineering, populated every ticket field, The ticket is routed and awaiting team approval — CONDUIT will update it after TITAN FORGE applies the fix.

Finding Summary

Short description: [TITAN] High — legacy_eol on app-websphere-claims-gateway
Severity: High
Priority: 2 - High
Resource: app-websphere-claims-gateway
Resource type: Microsoft.Web/sites
Cloud: Azure
Subscription / Account: 4f29d094-1079-44c9-acb0-4d73a7a2dd34
Resource group / Project: rg-legacy-prod

The Security Finding

WebSphere 8.0 on Windows Server 2012 R2 — both past end-of-life. WebSphere 8.0 EOL 2018-04-30, Windows 2012 R2 EOL 2023-10-10 (ESU available until 2026-10-13 but not enrolled). Fails HIPAA 164.308(a)(1)(ii)(D), PCI DSS 6.2, SOC 2 CC7.1, NIST 800-53 SI-2.

ITIL Change Management Fields

Justification

High: WebSphere 8.0 on Windows Server 2012 R2 — both past end-of-life. WebSphere 8.0 EOL 2018-04-30, Windows 2012 R2 EOL 2023-10-10 (ESU available until 2026-10-13 but not enrolled). Fails HIPAA 164.308(a)(1)(ii)(D), PCI DSS 6.2, SOC 2 CC7.1, NIST 800-53 SI-2.

Implementation Plan

1. Pre-change snapshot captured by TITAN (auto-rollback available).
2. Execute fix command:
   Migrate claims gateway to IBM WebSphere Liberty 23.x on RHEL 9 or rewrite as Azure App Service. Enroll Windows 2012 R2 ESU as stop-gap ($ per core). Compensating: WAF, MFA on admin, tamper-evident logs.
3. TITAN FORGE verifies the fix was applied.
4. Post-change rescan by TITAN SCOUT — finding must no longer appear.
5. Close ticket with Successful close_code.

Risk & Impact Analysis

Risk level: MEDIUM-HIGH risk — misconfiguration with realistic exploit path.
Business impact if unremediated: Increases attack surface; auditor finding likely.
Scope: single resource (app-websphere-claims-gateway).
Blast radius: change is idempotent; pre-change snapshot captured by TITAN; auto-rollback available if rescan fails.
Finding detail: WebSphere 8.0 on Windows Server 2012 R2 — both past end-of-life. WebSphere 8.0 EOL 2018-04-30, Windows 2012 R2 EOL 2023-10-10 (ESU available until 2026-10-13 but not enrolled). Fails HIPAA 164.308(a)(

Backout / Rollback Plan

1. TITAN auto-captured snapshot of app-websphere-claims-gateway before change (baseline: titan-legacy-demo-20260422T201927Z).
2. If post-change rescan still shows the finding OR a new issue appears within 15 min:
   a. TITAN FORGE fires rollback automatically using stored snapshot.
   b. Incident reopens and escalates to on-call.
3. Manual rollback command path (human override) is documented in close notes.

Test Plan

1. TITAN SCOUT rescans app-websphere-claims-gateway immediately after FORGE applies the change.
2. PASS criteria: the specific finding no longer appears in SCOUT results.
3. PASS criteria: no new CRITICAL or HIGH findings introduced by the change.
4. Automated compliance check: HIPAA/PCI/SOC2 controls re-evaluated.
5. If any check fails, backout plan fires automatically.

Recommended Fix

Migrate claims gateway to IBM WebSphere Liberty 23.x on RHEL 9 or rewrite as Azure App Service. Enroll Windows 2012 R2 ESU as stop-gap ($ per core). Compensating: WAF, MFA on admin, tamper-evident logs.

Compliance Mapping

CIS BenchmarkSOC 2 CC6.1

Routing Metadata

Assignment group: security_engineering
Change type: Normal
Approval required: Yes
Planned start: 2026-04-22 19:39:27
Planned end: 2026-04-22 21:39:27
Scan ID: titan-legacy-demo-20260422T201927Z
Generated at: 2026-04-22T19:25:27+00:00
Opened: 2026-04-22 19:25:27
Closed: 2026-04-22 19:25:27
Close code: —

Attached Security Ticket

SERVICENOW · TICKET

SEC-1905 · [TITAN] High — legacy_eol on app-websphere-claims-gateway

Priority: High TICKET Azure

Ticket Description

WebSphere 8.0 on Windows Server 2012 R2 — both past end-of-life. WebSphere 8.0 EOL 2018-04-30, Windows 2012 R2 EOL 2023-10-10 (ESU available until 2026-10-13 but not enrolled). Fails HIPAA 164.308(a)(1)(ii)(D), PCI DSS 6.2, SOC 2 CC7.1, NIST 800-53 SI-2.

Recommended Fix: Migrate claims gateway to IBM WebSphere Liberty 23.x on RHEL 9 or rewrite as Azure App Service. Enroll Windows 2012 R2 ESU as stop-gap ($ per core). Compensating: WAF, MFA on admin, tamper-evident logs.

AI Close Notes

TITAN CONDUIT opened this high legacy_eol ticket and assigned it to the security_engineering group for review. STATE: ASSIGNED — awaiting human action. Per TITAN AI policy, configuration changes are NEVER auto-applied and tickets are NEVER auto-closed by TITAN. The assigned group reviews the recommended fix, schedules an approved maintenance window, applies the fix manually, validates via SCOUT rescan, and closes this ticket themselves. TITAN documents and routes — the human owns the change from here.