{"id":"CVE-2024-4577","published":"2024-06-09T20:15:09Z","modified":"2026-06-17T08:02:11Z","title":"PHP-CGI OS Command Injection Vulnerability","vendor":"PHP Group","product":"PHP","tier":"core","eol":null,"description":{"text":"In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use \"Best-Fit\" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.","provenance":"source","from":"NVD"},"summary":{"text":"The PHP-CGI module in PHP versions 8.1.x before 8.1.29, 8.2.x before 8.2.20, and 8.3.x before 8.3.8 is flawed when Apache and PHP-CGI run on Windows with certain code pages configured. Windows \"Best-Fit\" character replacement in command lines passed to Win32 API functions can cause PHP-CGI to misread those characters as PHP options, which can let a remote, unauthenticated attacker pass options to the PHP binary and potentially reveal script source code or run arbitrary PHP code on the server, with no user interaction required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:53:32Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99987,"percentile":0.99984,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2024-06-12","dueDate":"2024-07-03","ransomware":true,"requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see:  https://www.php.net/ChangeLog-8.php#;   https://nvd.nist.gov/vuln/detail/CVE-2024-4577","provenance":"source"},"vulncheckKev":{"dateAdded":"2024-06-07","exploitedFirstSeen":"2024-06-07","ransomware":true,"evidence":[{"url":"https://www.imperva.com/blog/imperva-protects-against-critical-php-vulnerability-cve-2024-4577/","date":"2024-06-07"},{"url":"https://x.com/Shadowserver/status/1799053497490698548","date":"2024-06-07"},{"url":"https://infosec.exchange/@ntkramer/112582375921224782","date":"2024-06-08"},{"url":"https://isc.sans.edu/diary/Attacker%20Probing%20for%20New%20PHP%20Vulnerablity%20CVE-2024-4577/30994","date":"2024-06-09"},{"url":"https://www.imperva.com/blog/update-cve-2024-4577-quickly-weaponized-to-distribute-tellyouthepass-ransomware/","date":"2024-06-10"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-06-11&host_type=src&vulnerability=cve-2024-4577","date":"2024-06-11"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-06-12&host_type=src&vulnerability=cve-2024-4577","date":"2024-06-12"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2024-06-12"},{"url":"https://www.fortiguard.com/outbreak-alert/php-rce-attack","date":"2024-06-12"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-06-13&host_type=src&vulnerability=cve-2024-4577","date":"2024-06-13"}],"evidenceTotal":780,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"TSEC Honeypot: Exploit Attempt - Week of 2026-10-19","url":"https://otx.alienvault.com/pulse/6adbabda1387f621bb68b955","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Critical PHP Remote Code Execution Flaws Draw Early Attacks Across Millions of Exposed Web Hosts","url":"https://otx.alienvault.com/pulse/6ad9246cb03e78ec5b4c0392","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"}],"provenance":"machine"},"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2024/06/07/1","tags":["Mailing List","Third Party Advisory"]},{"url":"https://arstechnica.com/security/2024/06/php-vulnerability-allows-attackers-to-run-malicious-code-on-windows-servers/","tags":["Exploit","Press/Media Coverage","Third Party Advisory"]},{"url":"https://blog.orange.tw/2024/06/cve-2024-4577-yet-another-php-rce.html","tags":["Third Party Advisory"]},{"url":"https://cert.be/en/advisory/warning-php-remote-code-execution-patch-immediately","tags":["Third Party Advisory"]},{"url":"https://devco.re/blog/2024/06/06/security-alert-cve-2024-4577-php-cgi-argument-injection-vulnerability-en/","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/11whoami99/CVE-2024-4577","tags":["Exploit"]},{"url":"https://github.com/php/php-src/security/advisories/GHSA-3qgc-jrrr-25jv","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/rapid7/metasploit-framework/pull/19247","tags":["Exploit","Issue Tracking","Patch"]},{"url":"https://github.com/watchtowrlabs/CVE-2024-4577","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/xcanwin/CVE-2024-4577-PHP-RCE","tags":["Exploit","Third Party Advisory"]},{"url":"https://isc.sans.edu/diary/30994","tags":["Exploit","Third Party Advisory"]},{"url":"https://labs.watchtowr.com/no-way-php-strikes-again-cve-2024-4577/","tags":["Exploit","Third Party Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/","tags":["Mailing List"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/","tags":["Mailing List"]},{"url":"https://security.netapp.com/advisory/ntap-20240621-0008/","tags":["Third Party Advisory"]},{"url":"https://www.imperva.com/blog/imperva-protects-against-critical-php-vulnerability-cve-2024-4577/","tags":["Third Party Advisory"]},{"url":"https://www.php.net/ChangeLog-8.php#8.1.29","tags":["Release Notes"]},{"url":"https://www.php.net/ChangeLog-8.php#8.2.20","tags":["Release Notes"]},{"url":"https://www.php.net/ChangeLog-8.php#8.3.8","tags":["Release Notes"]},{"url":"http://www.openwall.com/lists/oss-security/2024/06/07/1","tags":["Mailing List","Third Party Advisory"]},{"url":"https://arstechnica.com/security/2024/06/php-vulnerability-allows-attackers-to-run-malicious-code-on-windows-servers/","tags":["Exploit","Press/Media Coverage","Third Party Advisory"]},{"url":"https://blog.orange.tw/2024/06/cve-2024-4577-yet-another-php-rce.html","tags":["Third Party Advisory"]},{"url":"https://blog.talosintelligence.com/new-persistent-attacks-japan/","tags":["Exploit","Third Party Advisory"]},{"url":"https://cert.be/en/advisory/warning-php-remote-code-execution-patch-immediately","tags":["Third Party Advisory"]},{"url":"https://devco.re/blog/2024/06/06/security-alert-cve-2024-4577-php-cgi-argument-injection-vulnerability-en/","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/11whoami99/CVE-2024-4577","tags":["Exploit"]},{"url":"https://github.com/php/php-src/security/advisories/GHSA-3qgc-jrrr-25jv","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/rapid7/metasploit-framework/pull/19247","tags":["Exploit","Issue Tracking","Patch"]},{"url":"https://github.com/watchtowrlabs/CVE-2024-4577","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/xcanwin/CVE-2024-4577-PHP-RCE","tags":["Exploit","Third Party Advisory"]},{"url":"https://isc.sans.edu/diary/30994","tags":["Exploit","Third Party Advisory"]},{"url":"https://labs.watchtowr.com/no-way-php-strikes-again-cve-2024-4577/","tags":["Exploit","Third Party Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/","tags":["Mailing List"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/","tags":["Mailing List"]},{"url":"https://security.netapp.com/advisory/ntap-20240621-0008/","tags":["Third Party Advisory"]},{"url":"https://www.imperva.com/blog/imperva-protects-against-critical-php-vulnerability-cve-2024-4577/","tags":["Third Party Advisory"]},{"url":"https://www.php.net/ChangeLog-8.php#8.1.29","tags":["Release Notes"]},{"url":"https://www.php.net/ChangeLog-8.php#8.2.20","tags":["Release Notes"]},{"url":"https://www.php.net/ChangeLog-8.php#8.3.8","tags":["Release Notes"]},{"url":"https://www.vicarius.io/vsociety/posts/php-cgi-argument-injection-to-rce-cve-2024-4577","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.vicarius.io/vsociety/posts/php-cgi-os-command-injection-vulnerability-cve-2024-4577","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-4577","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Command Injection","mappingType":"exploitation_technique","evidence":[],"comment":"CVE-2024-4577 is a PHP argument injection vulnerability that allows an adversary to execute arbitrary php commands. Threat actors have been observed utilizing Cobalt Strike and the TaoWu toolkit for post-exploitation activities, such as conducting reconnaisance, establishing persistence, escalating privileges to SYSTEM level, and harvesting credentials.","confidence":"high"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Command Injection","mappingType":"primary_impact","evidence":[],"comment":"CVE-2024-4577 is a PHP argument injection vulnerability that allows an adversary to execute arbitrary php commands. Threat actors have been observed utilizing Cobalt Strike and the TaoWu toolkit for post-exploitation activities, such as conducting reconnaisance, establishing persistence, escalating privileges to SYSTEM level, and harvesting credentials.","confidence":"high"},{"id":"T1003","name":"OS Credential Dumping","tactics":["credential-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Command Injection","mappingType":"secondary_impact","evidence":[],"comment":"CVE-2024-4577 is a PHP argument injection vulnerability that allows an adversary to execute arbitrary php commands. Threat actors have been observed utilizing Cobalt Strike and the TaoWu toolkit for post-exploitation activities, such as conducting reconnaisance, establishing persistence, escalating privileges to SYSTEM level, and harvesting credentials.","confidence":"high"},{"id":"T1003.001","name":"LSASS Memory","tactics":["credential-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Command Injection","mappingType":"secondary_impact","evidence":[],"comment":"CVE-2024-4577 is a PHP argument injection vulnerability that allows an adversary to execute arbitrary php commands. Threat actors have been observed utilizing Cobalt Strike and the TaoWu toolkit for post-exploitation activities, such as conducting reconnaisance, establishing persistence, escalating privileges to SYSTEM level, and harvesting credentials.","confidence":"high"},{"id":"T1033","name":"System Owner/User Discovery","tactics":["discovery"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Command Injection","mappingType":"secondary_impact","evidence":[],"comment":"CVE-2024-4577 is a PHP argument injection vulnerability that allows an adversary to execute arbitrary php commands. Threat actors have been observed utilizing Cobalt Strike and the TaoWu toolkit for post-exploitation activities, such as conducting reconnaisance, establishing persistence, escalating privileges to SYSTEM level, and harvesting credentials.","confidence":"high"},{"id":"T1041","name":"Exfiltration Over C2 Channel","tactics":["exfiltration"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Command Injection","mappingType":"secondary_impact","evidence":[],"comment":"CVE-2024-4577 is a PHP argument injection vulnerability that allows an adversary to execute arbitrary php commands. Threat actors have been observed utilizing Cobalt Strike and the TaoWu toolkit for post-exploitation activities, such as conducting reconnaisance, establishing persistence, escalating privileges to SYSTEM level, and harvesting credentials.","confidence":"high"},{"id":"T1053","name":"Scheduled Task/Job","tactics":["execution","persistence","privilege-escalation"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Command Injection","mappingType":"secondary_impact","evidence":[],"comment":"CVE-2024-4577 is a PHP argument injection vulnerability that allows an adversary to execute arbitrary php commands. Threat actors have been observed utilizing Cobalt Strike and the TaoWu toolkit for post-exploitation activities, such as conducting reconnaisance, establishing persistence, escalating privileges to SYSTEM level, and harvesting credentials.","confidence":"high"},{"id":"T1068","name":"Exploitation for Privilege Escalation","tactics":["privilege-escalation"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Command Injection","mappingType":"secondary_impact","evidence":[],"comment":"CVE-2024-4577 is a PHP argument injection vulnerability that allows an adversary to execute arbitrary php commands. Threat actors have been observed utilizing Cobalt Strike and the TaoWu toolkit for post-exploitation activities, such as conducting reconnaisance, establishing persistence, escalating privileges to SYSTEM level, and harvesting credentials.","confidence":"high"},{"id":"T1071.001","name":"Web Protocols","tactics":["command-and-control"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Command Injection","mappingType":"secondary_impact","evidence":[],"comment":"CVE-2024-4577 is a PHP argument injection vulnerability that allows an adversary to execute arbitrary php commands. Threat actors have been observed utilizing Cobalt Strike and the TaoWu toolkit for post-exploitation activities, such as conducting reconnaisance, establishing persistence, escalating privileges to SYSTEM level, and harvesting credentials.","confidence":"high"},{"id":"T1112","name":"Modify Registry","tactics":["defense-impairment","persistence"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Command Injection","mappingType":"secondary_impact","evidence":[],"comment":"CVE-2024-4577 is a PHP argument injection vulnerability that allows an adversary to execute arbitrary php commands. Threat actors have been observed utilizing Cobalt Strike and the TaoWu toolkit for post-exploitation activities, such as conducting reconnaisance, establishing persistence, escalating privileges to SYSTEM level, and harvesting credentials.","confidence":"high"},{"id":"T1543","name":"Create or Modify System Process","tactics":["persistence","privilege-escalation"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Command Injection","mappingType":"secondary_impact","evidence":[],"comment":"CVE-2024-4577 is a PHP argument injection vulnerability that allows an adversary to execute arbitrary php commands. Threat actors have been observed utilizing Cobalt Strike and the TaoWu toolkit for post-exploitation activities, such as conducting reconnaisance, establishing persistence, escalating privileges to SYSTEM level, and harvesting credentials.","confidence":"high"},{"id":"T1570","name":"Lateral Tool Transfer","tactics":["lateral-movement"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Command Injection","mappingType":"secondary_impact","evidence":[],"comment":"CVE-2024-4577 is a PHP argument injection vulnerability that allows an adversary to execute arbitrary php commands. Threat actors have been observed utilizing Cobalt Strike and the TaoWu toolkit for post-exploitation activities, such as conducting reconnaisance, establishing persistence, escalating privileges to SYSTEM level, and harvesting credentials.","confidence":"high"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2024-44188","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-44188","exploited":true,"exploitedSince":"2024-06-12","provenance":"source"},"exploits":[{"id":52331,"url":"https://www.exploit-db.com/exploits/52331","title":"PHP CGI Module 8.3.4 - Remote Code Execution (RCE)","type":"webapps","platform":"php","date":"2025-06-15","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2025-06-15"},"pocGithub":{"count":57,"skipped":14,"earliest":"2024-06-07","earliestUrl":"https://github.com/TAM-K592/CVE-2024-4577","repos":[{"name":"watchtowrlabs/CVE-2024-4577","url":"https://github.com/watchtowrlabs/CVE-2024-4577","stars":325,"created":"2024-06-07"},{"name":"xcanwin/CVE-2024-4577-PHP-RCE","url":"https://github.com/xcanwin/CVE-2024-4577-PHP-RCE","stars":161,"created":"2024-06-08"},{"name":"TAM-K592/CVE-2024-4577","url":"https://github.com/TAM-K592/CVE-2024-4577","stars":75,"created":"2024-06-07"},{"name":"Night-have-dreams/php-cgi-Injector","url":"https://github.com/Night-have-dreams/php-cgi-Injector","stars":52,"created":"2025-03-15"},{"name":"11whoami99/CVE-2024-4577","url":"https://github.com/11whoami99/CVE-2024-4577","stars":43,"created":"2024-06-07"}]},"metasploit":[{"name":"PHP CGI Argument Injection Remote Code Execution","module":"exploit/windows/http/php_cgi_arg_injection_rce_cve_2024_4577","type":"exploit","disclosureDate":"2024-06-06","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/php_cgi_arg_injection_rce_cve_2024_4577.rb"}],"nuclei":[{"id":"CVE-2024-4577","name":"PHP CGI - Argument Injection","severity":"critical","path":"http/cves/2024/CVE-2024-4577.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-4577.yaml"}],"first":{"date":"2024-06-06","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/php_cgi_arg_injection_rce_cve_2024_4577.rb"},"provenance":"source"},"exploitRefs":["https://arstechnica.com/security/2024/06/php-vulnerability-allows-attackers-to-run-malicious-code-on-windows-servers/","https://devco.re/blog/2024/06/06/security-alert-cve-2024-4577-php-cgi-argument-injection-vulnerability-en/","https://github.com/11whoami99/CVE-2024-4577","https://github.com/php/php-src/security/advisories/GHSA-3qgc-jrrr-25jv","https://github.com/rapid7/metasploit-framework/pull/19247","https://github.com/watchtowrlabs/CVE-2024-4577","https://github.com/xcanwin/CVE-2024-4577-PHP-RCE","https://isc.sans.edu/diary/30994","https://labs.watchtowr.com/no-way-php-strikes-again-cve-2024-4577/","https://blog.talosintelligence.com/new-persistent-attacks-japan/","https://www.vicarius.io/vsociety/posts/php-cgi-argument-injection-to-rce-cve-2024-4577","https://www.vicarius.io/vsociety/posts/php-cgi-os-command-injection-vulnerability-cve-2024-4577"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"source"},{"stage":"primary","techniques":["T1059"],"provenance":"source"},{"stage":"secondary","techniques":["T1053","T1112","T1543","T1068","T1003","T1003.001","T1033","T1570","T1071.001","T1041"],"provenance":"source"}],"timeline":[{"date":"2024-06-06","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2024-06-07, Exploit-DB 2025-06-15","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/php_cgi_arg_injection_rce_cve_2024_4577.rb","provenance":"source"},{"date":"2024-06-07","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.imperva.com/blog/imperva-protects-against-critical-php-vulnerability-cve-2024-4577/","provenance":"source"},{"date":"2024-06-09","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-4577","provenance":"source"},{"date":"2024-06-12","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2024-06-12","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-44188","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":3},"priority":{"score":79.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 876 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":20.0,"detail":"percentile 0.9998"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"12 NVD references tagged Exploit; 1 Exploit-DB entry; 57 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}