{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: CVEs linked to T1003 OS Credential Dumping","home_page_url":"https://patchfirst.co/technique/T1003/","feed_url":"https://patchfirst.co/feed/technique/T1003.json","description":"New and newly exploited CVEs that lead to ATT&CK T1003 OS Credential Dumping, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2025-32756#kev","url":"https://patchfirst.co/cve/CVE-2025-32756/","title":"[KEV] CVE-2025-32756: Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability","content_text":"Fortinet · Multiple Products. In CISA KEV since 2025-05-14. ENISA EUVD lists it as exploited. EPSS 30.9% (higher than 98.3% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1133 External Remote Services; T1059 Command and Scripting Interpreter; T1003 OS Credential Dumping; T1041 Exfiltration Over C2 Channel; T1046 Network Service Discovery; T1070.004 File Deletion; +1 more. Priority 79.5 of 100.","summary":"Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability","date_published":"2025-05-14T00:00:00.000Z","date_modified":"2026-06-17T09:12:32.000Z","tags":["kev","public-exploit","T1133","T1059","T1003","T1041","T1046","T1070.004","T1608.001"],"_patchfirst":{"reason":"kev","priority":79.5,"kev":{"dateAdded":"2025-05-14","ransomware":false},"epss":{"score":0.30944,"percentile":0.98257},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Fortinet","product":"Multiple Products","techniqueIds":["T1133","T1059","T1003","T1041","T1046","T1070.004","T1608.001"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-32709#kev","url":"https://patchfirst.co/cve/CVE-2025-32709/","title":"[KEV] CVE-2025-32709: Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2025-05-13. ENISA EUVD lists it as exploited. EPSS 1.8% (higher than 78.7% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1003 OS Credential Dumping; T1059 Command and Scripting Interpreter; T1543 Create or Modify System Process; T1608.001 Upload Malware. Priority 64.2 of 100.","summary":"Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability","date_published":"2025-05-13T00:00:00.000Z","date_modified":"2026-06-17T09:12:27.000Z","tags":["kev","public-exploit","T1068","T1003","T1059","T1543","T1608.001"],"_patchfirst":{"reason":"kev","priority":64.2,"kev":{"dateAdded":"2025-05-13","ransomware":false},"epss":{"score":0.01818,"percentile":0.7869},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1068","T1003","T1059","T1543","T1608.001"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-48248#kev","url":"https://patchfirst.co/cve/CVE-2024-48248/","title":"[KEV] CVE-2024-48248: NAKIVO Backup and Replication Absolute Path Traversal Vulnerability","content_text":"NAKIVO · Backup and Replication. In CISA KEV since 2025-03-19. ENISA EUVD lists it as exploited. EPSS 94.4% (higher than 99.85% of CVEs). CVSS 8.6 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System; T1003 OS Credential Dumping. Priority 69.0 of 100.","summary":"NAKIVO Backup and Replication Absolute Path Traversal Vulnerability","date_published":"2025-03-19T00:00:00.000Z","date_modified":"2026-09-24T13:10:00.000Z","tags":["kev","public-exploit","T1190","T1005","T1003"],"_patchfirst":{"reason":"kev","priority":69,"kev":{"dateAdded":"2025-03-19","ransomware":false},"epss":{"score":0.94356,"percentile":0.99851},"cvss":{"score":8.6,"severity":"HIGH","version":"3.1"},"vendor":"NAKIVO","product":"Backup and Replication","techniqueIds":["T1190","T1005","T1003"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-57727#kev","url":"https://patchfirst.co/cve/CVE-2024-57727/","title":"[KEV] CVE-2024-57727: SimpleHelp Path Traversal Vulnerability","content_text":"SimpleHelp  · SimpleHelp. In CISA KEV since 2025-02-13, known ransomware use. ENISA EUVD lists it as exploited. EPSS 96.8% (higher than 99.89% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1003 OS Credential Dumping; T1552.001 Credentials In Files; T1552.004 Private Keys; T1059 Command and Scripting Interpreter. Priority 78.2 of 100.","summary":"SimpleHelp Path Traversal Vulnerability","date_published":"2025-02-13T00:00:00.000Z","date_modified":"2026-08-04T05:16:31.000Z","tags":["kev","ransomware","public-exploit","T1190","T1003","T1552.001","T1552.004","T1059"],"_patchfirst":{"reason":"kev","priority":78.2,"kev":{"dateAdded":"2025-02-13","ransomware":true},"epss":{"score":0.96833,"percentile":0.99887},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"SimpleHelp ","product":"SimpleHelp","techniqueIds":["T1190","T1003","T1552.001","T1552.004","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-21333#kev","url":"https://patchfirst.co/cve/CVE-2025-21333/","title":"[KEV] CVE-2025-21333: Microsoft Windows Hyper-V NT Kernel Integration VSP Heap-based Buffer Overflow Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2025-01-14. ENISA EUVD lists it as exploited. EPSS 10.1% (higher than 95.6% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1003 OS Credential Dumping. Priority 67.6 of 100.","summary":"Microsoft Windows Hyper-V NT Kernel Integration VSP Heap-based Buffer Overflow Vulnerability","date_published":"2025-01-14T00:00:00.000Z","date_modified":"2026-06-17T08:43:07.000Z","tags":["kev","public-exploit","T1068","T1003"],"_patchfirst":{"reason":"kev","priority":67.6,"kev":{"dateAdded":"2025-01-14","ransomware":false},"epss":{"score":0.10066,"percentile":0.95621},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1068","T1003"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-21334#kev","url":"https://patchfirst.co/cve/CVE-2025-21334/","title":"[KEV] CVE-2025-21334: Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2025-01-14. ENISA EUVD lists it as exploited. EPSS 1.6% (higher than 75.4% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1068 Exploitation for Privilege Escalation; T1003 OS Credential Dumping. Priority 58.5 of 100.","summary":"Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free Vulnerability","date_published":"2025-01-14T00:00:00.000Z","date_modified":"2026-06-17T08:43:07.000Z","tags":["kev","T1068","T1003"],"_patchfirst":{"reason":"kev","priority":58.5,"kev":{"dateAdded":"2025-01-14","ransomware":false},"epss":{"score":0.01573,"percentile":0.75393},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1068","T1003"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2025-21335#kev","url":"https://patchfirst.co/cve/CVE-2025-21335/","title":"[KEV] CVE-2025-21335: Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2025-01-14. ENISA EUVD lists it as exploited. EPSS 1.4% (higher than 72.5% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1068 Exploitation for Privilege Escalation; T1003 OS Credential Dumping. Priority 58.0 of 100.","summary":"Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free Vulnerability","date_published":"2025-01-14T00:00:00.000Z","date_modified":"2026-09-24T13:10:00.000Z","tags":["kev","T1068","T1003"],"_patchfirst":{"reason":"kev","priority":58,"kev":{"dateAdded":"2025-01-14","ransomware":false},"epss":{"score":0.01401,"percentile":0.72484},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1068","T1003"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2025-0282#kev","url":"https://patchfirst.co/cve/CVE-2025-0282/","title":"[KEV] CVE-2025-0282: Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability","content_text":"Ivanti · Connect Secure, Policy Secure, and ZTA Gateways. In CISA KEV since 2025-01-08, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.98% of CVEs). CVSS 9.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1595 Active Scanning; T1003 OS Credential Dumping; T1055 Process Injection; T1018 Remote System Discovery; T1046 Network Service Discovery. Named in 2 threat reports. Priority 85.4 of 100.","summary":"Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability","date_published":"2025-01-08T00:00:00.000Z","date_modified":"2026-10-01T19:17:15.000Z","tags":["kev","ransomware","public-exploit","T1190","T1595","T1003","T1055","T1018","T1046"],"_patchfirst":{"reason":"kev","priority":85.4,"kev":{"dateAdded":"2025-01-08","ransomware":true},"epss":{"score":0.99981,"percentile":0.99981},"cvss":{"score":9,"severity":"CRITICAL","version":"3.1"},"vendor":"Ivanti","product":"Connect Secure, Policy Secure, and ZTA Gateways","techniqueIds":["T1190","T1595","T1003","T1055","T1018","T1046"],"reportCount":2,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-4577#kev","url":"https://patchfirst.co/cve/CVE-2024-4577/","title":"[KEV] CVE-2024-4577: PHP-CGI OS Command Injection Vulnerability","content_text":"PHP Group · PHP. In CISA KEV since 2024-06-12, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.98% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1003 OS Credential Dumping; T1003.001 LSASS Memory; T1033 System Owner/User Discovery; T1041 Exfiltration Over C2 Channel; +6 more. Priority 79.9 of 100.","summary":"PHP-CGI OS Command Injection Vulnerability","date_published":"2024-06-12T00:00:00.000Z","date_modified":"2026-06-17T08:02:11.000Z","tags":["kev","ransomware","public-exploit","T1190","T1059","T1003","T1003.001","T1033","T1041","T1053","T1068","T1071.001","T1112","T1543","T1570"],"_patchfirst":{"reason":"kev","priority":79.9,"kev":{"dateAdded":"2024-06-12","ransomware":true},"epss":{"score":0.99987,"percentile":0.99984},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"PHP Group","product":"PHP","techniqueIds":["T1190","T1059","T1003","T1003.001","T1033","T1041","T1053","T1068","T1071.001","T1112","T1543","T1570"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-28252#kev","url":"https://patchfirst.co/cve/CVE-2023-28252/","title":"[KEV] CVE-2023-28252: Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2023-04-11, known ransomware use. ENISA EUVD lists it as exploited. EPSS 48.9% (higher than 98.9% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1068 Exploitation for Privilege Escalation; T1003 OS Credential Dumping; T1021 Remote Services; T1059 Command and Scripting Interpreter; T1136 Create Account; +1 more. Priority 78.2 of 100.","summary":"Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability","date_published":"2023-04-11T00:00:00.000Z","date_modified":"2026-06-17T05:47:14.000Z","tags":["kev","ransomware","public-exploit","T1078","T1068","T1003","T1021","T1059","T1136","T1486"],"_patchfirst":{"reason":"kev","priority":78.2,"kev":{"dateAdded":"2023-04-11","ransomware":true},"epss":{"score":0.48892,"percentile":0.98877},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1078","T1068","T1003","T1021","T1059","T1136","T1486"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-44515","url":"https://patchfirst.co/cve/CVE-2021-44515/","title":"CVE-2021-44515: Zoho Desktop Central Authentication Bypass Vulnerability","content_text":"Zoho · Desktop Central. In CISA KEV since 2021-12-10. ENISA EUVD lists it as exploited. EPSS 99.9% (higher than 99.96% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1105 Ingress Tool Transfer; T1003 OS Credential Dumping; T1069 Permission Groups Discovery; T1087 Account Discovery. Priority 69.9 of 100.","summary":"Zoho Desktop Central Authentication Bypass Vulnerability","date_published":"2021-12-12T00:00:00.000Z","date_modified":"2026-06-17T04:12:29.000Z","tags":["kev","public-exploit","T1190","T1105","T1003","T1069","T1087"],"_patchfirst":{"reason":"published","priority":69.9,"kev":{"dateAdded":"2021-12-10","ransomware":false},"epss":{"score":0.99871,"percentile":0.99963},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Zoho","product":"Desktop Central","techniqueIds":["T1190","T1105","T1003","T1069","T1087"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-44077#kev","url":"https://patchfirst.co/cve/CVE-2021-44077/","title":"[KEV] CVE-2021-44077: Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability","content_text":"Zoho · ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus. In CISA KEV since 2021-12-01. ENISA EUVD lists it as exploited. EPSS 93.3% (higher than 99.84% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1505.003 Web Shell; T1003 OS Credential Dumping; T1003.003 NTDS; T1027 Obfuscated Files or Information; T1047 Windows Management Instrumentation; +7 more. Priority 69.8 of 100.","summary":"Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability","date_published":"2021-12-01T00:00:00.000Z","date_modified":"2026-06-17T04:11:52.000Z","tags":["kev","public-exploit","T1190","T1505.003","T1003","T1003.003","T1027","T1047","T1070.004","T1087.002","T1136","T1140","T1218","T1560.001","T1573.001"],"_patchfirst":{"reason":"kev","priority":69.8,"kev":{"dateAdded":"2021-12-01","ransomware":false},"epss":{"score":0.93298,"percentile":0.99836},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Zoho","product":"ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus","techniqueIds":["T1190","T1505.003","T1003","T1003.003","T1027","T1047","T1070.004","T1087.002","T1136","T1140","T1218","T1560.001","T1573.001"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2020-5902#kev","url":"https://patchfirst.co/cve/CVE-2020-5902/","title":"[KEV] CVE-2020-5902: F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability","content_text":"F5 · BIG-IP. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1133 External Remote Services; T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1003 OS Credential Dumping; T1005 Data from Local System; T1070.004 File Deletion; +1 more. Named in 5 threat reports. Priority 89.9 of 100.","summary":"F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T03:22:25.000Z","tags":["kev","ransomware","public-exploit","T1133","T1190","T1059","T1003","T1005","T1070.004","T1552"],"_patchfirst":{"reason":"kev","priority":89.9,"kev":{"dateAdded":"2021-11-03","ransomware":true},"epss":{"score":0.99999,"percentile":1},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"F5","product":"BIG-IP","techniqueIds":["T1133","T1190","T1059","T1003","T1005","T1070.004","T1552"],"reportCount":5,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2019-0604#kev","url":"https://patchfirst.co/cve/CVE-2019-0604/","title":"[KEV] CVE-2019-0604: Microsoft SharePoint Remote Code Execution Vulnerability","content_text":"Microsoft · SharePoint. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.9% (higher than 99.97% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1041 Exfiltration Over C2 Channel; T1505.003 Web Shell; T1608.001 Upload Malware; T1003 OS Credential Dumping. Named in 4 threat reports. Priority 88.8 of 100.","summary":"Microsoft SharePoint Remote Code Execution Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T02:08:31.000Z","tags":["kev","ransomware","public-exploit","T1190","T1041","T1505.003","T1608.001","T1003"],"_patchfirst":{"reason":"kev","priority":88.8,"kev":{"dateAdded":"2021-11-03","ransomware":true},"epss":{"score":0.99913,"percentile":0.99968},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Microsoft","product":"SharePoint","techniqueIds":["T1190","T1041","T1505.003","T1608.001","T1003"],"reportCount":4,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-40539#kev","url":"https://patchfirst.co/cve/CVE-2021-40539/","title":"[KEV] CVE-2021-40539: Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability","content_text":"Zoho · ManageEngine. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.0% (higher than 99.93% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1505.003 Web Shell; T1003 OS Credential Dumping; T1003.003 NTDS; T1027 Obfuscated Files or Information; T1047 Windows Management Instrumentation; +7 more. Named in 1 threat report. Priority 83.7 of 100.","summary":"Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T04:07:06.000Z","tags":["kev","ransomware","public-exploit","T1190","T1505.003","T1003","T1003.003","T1027","T1047","T1070.004","T1087.002","T1136","T1140","T1218","T1560.001","T1573.001"],"_patchfirst":{"reason":"kev","priority":83.7,"kev":{"dateAdded":"2021-11-03","ransomware":true},"epss":{"score":0.9896,"percentile":0.99929},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Zoho","product":"ManageEngine","techniqueIds":["T1190","T1505.003","T1003","T1003.003","T1027","T1047","T1070.004","T1087.002","T1136","T1140","T1218","T1560.001","T1573.001"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-22893#kev","url":"https://patchfirst.co/cve/CVE-2021-22893/","title":"[KEV] CVE-2021-22893: Ivanti Pulse Connect Secure Use-After-Free Vulnerability","content_text":"Ivanti · Pulse Connect Secure. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 47.2% (higher than 98.8% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1003 OS Credential Dumping. Named in 1 threat report. Priority 83.6 of 100.","summary":"Ivanti Pulse Connect Secure Use-After-Free Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-08-12T05:17:37.000Z","tags":["kev","ransomware","public-exploit","T1190","T1059","T1003"],"_patchfirst":{"reason":"kev","priority":83.6,"kev":{"dateAdded":"2021-11-03","ransomware":true},"epss":{"score":0.47172,"percentile":0.98834},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"Ivanti","product":"Pulse Connect Secure","techniqueIds":["T1190","T1059","T1003"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2019-13608#kev","url":"https://patchfirst.co/cve/CVE-2019-13608/","title":"[KEV] CVE-2019-13608: Citrix StoreFront Server XML External Entity (XXE) Processing Vulnerability","content_text":"Citrix · StoreFront Server. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 30.0% (higher than 98.2% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1059 Command and Scripting Interpreter; T1003 OS Credential Dumping; T1005 Data from Local System; T1046 Network Service Discovery; T1078 Valid Accounts. Priority 77.9 of 100.","summary":"Citrix StoreFront Server XML External Entity (XXE) Processing Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T02:17:04.000Z","tags":["kev","ransomware","public-exploit","T1059","T1003","T1005","T1046","T1078"],"_patchfirst":{"reason":"kev","priority":77.9,"kev":{"dateAdded":"2021-11-03","ransomware":true},"epss":{"score":0.30041,"percentile":0.98206},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"Citrix","product":"StoreFront Server","techniqueIds":["T1059","T1003","T1005","T1046","T1078"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2019-11634#kev","url":"https://patchfirst.co/cve/CVE-2019-11634/","title":"[KEV] CVE-2019-11634: Citrix Workspace Application and Receiver for Windows Remote Code Execution Vulnerability","content_text":"Citrix · Workspace Application and Receiver for Windows. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 8.1% (higher than 94.8% of CVEs). CVSS 9.8 CRITICAL. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1003 OS Credential Dumping; T1005 Data from Local System; T1046 Network Service Discovery; T1078 Valid Accounts; +1 more. Named in 1 threat report. Priority 77.7 of 100.","summary":"Citrix Workspace Application and Receiver for Windows Remote Code Execution Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-08-12T05:17:21.000Z","tags":["kev","ransomware","T1190","T1059","T1003","T1005","T1046","T1078","T1486"],"_patchfirst":{"reason":"kev","priority":77.7,"kev":{"dateAdded":"2021-11-03","ransomware":true},"epss":{"score":0.08091,"percentile":0.94808},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Citrix","product":"Workspace Application and Receiver for Windows","techniqueIds":["T1190","T1059","T1003","T1005","T1046","T1078","T1486"],"reportCount":1,"hasPublicExploit":false,"euvdExploited":true}}]}