https://patchfirst.co/technique/T1005/New and newly exploited CVEs that lead to ATT&CK T1005 Data from Local System, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.en-gb360Sat, 31 Oct 2026 05:11:25 GMThttps://patchfirst.co/cve/CVE-2026-111497/CVE-2026-111497#kevTue, 27 Oct 2026 00:00:00 GMTGoogle · Brotli. In CISA KEV since 2026-10-27. ENISA EUVD lists it as exploited. EPSS 82.6% (higher than 99.67% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System; T1059 Command and Scripting Interpreter; T1499.004 Application or System Exploitation. Priority 79.8 of 100.kevpublic-exploitT1190T1005T1059T1499.004https://patchfirst.co/cve/CVE-2026-102764/CVE-2026-102764#kevFri, 16 Oct 2026 00:00:00 GMTBeyondTrust · Remote Support. In CISA KEV since 2026-10-16. ENISA EUVD lists it as exploited. EPSS 18.9% (higher than 97.3% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 79.3 of 100.kevpublic-exploitT1190T1005https://patchfirst.co/cve/CVE-2026-21589/CVE-2026-21589#kevThu, 15 Oct 2026 00:00:00 GMTAtlassian · Multiple Products. In CISA KEV since 2026-10-15. ENISA EUVD lists it as exploited. EPSS 99.5% (higher than 99.94% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 78.2 of 100.kevpublic-exploitT1190T1005https://patchfirst.co/cve/CVE-2015-3306/CVE-2015-3306#kevThu, 08 Oct 2026 00:00:00 GMTProFTPD · ProFTPD. In CISA KEV since 2026-10-08. ENISA EUVD lists it as exploited. EPSS 99.5% (higher than 99.94% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 80.0 of 100.kevpublic-exploitT1190T1005https://patchfirst.co/cve/CVE-2026-85706/CVE-2026-85706Sat, 12 Sep 2026 00:00:00 GMTGitLab · Community Edition and Enterprise Edition. In CISA KEV since 2026-09-11. ENISA EUVD lists it as exploited. EPSS 97.4% (higher than 99.9% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 80.0 of 100.kevpublic-exploitT1190T1005https://patchfirst.co/cve/CVE-2026-67277/CVE-2026-67277#kevThu, 10 Sep 2026 00:00:00 GMTMikroTik · RouterOS. In CISA KEV since 2026-09-10. ENISA EUVD lists it as exploited. EPSS 1.6% (higher than 75.2% of CVEs). CVSS 8.2 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System; T1499.004 Application or System Exploitation. Priority 73.8 of 100.kevpublic-exploitT1190T1005T1499.004https://patchfirst.co/cve/CVE-2023-49105/CVE-2023-49105#kevThu, 27 Aug 2026 00:00:00 GMTownCloud · ownCloud. In CISA KEV since 2026-08-27. ENISA EUVD lists it as exploited. EPSS 43.2% (higher than 98.7% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System; T1485 Data Destruction. Priority 79.6 of 100.kevpublic-exploitT1190T1005T1485https://patchfirst.co/cve/CVE-2026-21962/CVE-2026-21962#kevMon, 24 Aug 2026 00:00:00 GMTOracle · HTTP Server and Oracle Weblogic Server Proxy Plug-in. In CISA KEV since 2026-08-24. ENISA EUVD lists it as exploited. EPSS 73.2% (higher than 99.46% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 74.9 of 100.kevpublic-exploitT1190T1005https://patchfirst.co/cve/CVE-2026-20316/CVE-2026-20316#kevWed, 29 Jul 2026 00:00:00 GMTCisco · Secure Firewall Management Center (FMC). In CISA KEV since 2026-07-29, known ransomware use. ENISA EUVD lists it as exploited. EPSS 35.1% (higher than 98.4% of CVEs). CVSS 5.3 MEDIUM. ATT&CK: T1078 Valid Accounts; T1005 Data from Local System. Named in 1 threat report. Priority 80.3 of 100.kevransomwareT1078T1005https://patchfirst.co/cve/CVE-2025-68686/CVE-2025-68686#kevMon, 27 Jul 2026 00:00:00 GMTFortinet · FortiOS. In CISA KEV since 2026-07-27. ENISA EUVD lists it as exploited. EPSS 29.5% (higher than 98.2% of CVEs). CVSS 5.9 MEDIUM. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 66.8 of 100.kevT1190T1005https://patchfirst.co/cve/CVE-2026-60137/CVE-2026-60137#kevTue, 21 Jul 2026 00:00:00 GMTWordPress · Core. In CISA KEV since 2026-07-21. ENISA EUVD lists it as exploited. EPSS 5.3% (higher than 92.6% of CVEs). CVSS 5.9 MEDIUM. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Named in 1 threat report. Priority 74.5 of 100.kevpublic-exploitT1190T1005https://patchfirst.co/cve/CVE-2026-55255/CVE-2026-55255#kevTue, 07 Jul 2026 00:00:00 GMTLangflow · Langflow. In CISA KEV since 2026-07-07. ENISA EUVD lists it as exploited. EPSS 0.9% (higher than 59.2% of CVEs). CVSS 8.4 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 65.7 of 100.kevpublic-exploitT1190T1005https://patchfirst.co/cve/CVE-2026-34909/CVE-2026-34909#kevTue, 23 Jun 2026 00:00:00 GMTUbiquiti · UniFi OS. In CISA KEV since 2026-06-23. ENISA EUVD lists it as exploited. EPSS 68.0% (higher than 99.32% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 74.9 of 100.kevpublic-exploitT1190T1005https://patchfirst.co/cve/CVE-2026-54420/CVE-2026-54420#kevMon, 15 Jun 2026 00:00:00 GMTLiteSpeed · cPanel Plugin. In CISA KEV since 2026-06-15. ENISA EUVD lists it as exploited. EPSS 1.4% (higher than 73.1% of CVEs). CVSS 8.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 68.6 of 100.kevpublic-exploitT1190T1005https://patchfirst.co/cve/CVE-2024-21182/CVE-2024-21182#kevMon, 01 Jun 2026 00:00:00 GMTOracle · WebLogic Server. In CISA KEV since 2026-06-01. ENISA EUVD lists it as exploited. EPSS 74.2% (higher than 99.48% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 73.1 of 100.kevpublic-exploitT1190T1005https://patchfirst.co/cve/CVE-2026-42208/CVE-2026-42208#kevFri, 08 May 2026 00:00:00 GMTBerriAI · LiteLLM. In CISA KEV since 2026-05-08. ENISA EUVD lists it as exploited. EPSS 89.4% (higher than 99.78% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System; T1565.001 Stored Data Manipulation. Priority 74.8 of 100.kevpublic-exploitT1190T1005T1565.001https://patchfirst.co/cve/CVE-2026-20133/CVE-2026-20133#kevMon, 20 Apr 2026 00:00:00 GMTCisco · Catalyst SD-WAN Manager. In CISA KEV since 2026-04-20. ENISA EUVD lists it as exploited. EPSS 31.5% (higher than 98.3% of CVEs). CVSS 7.5 HIGH. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 67.9 of 100.kevT1190T1005https://patchfirst.co/cve/CVE-2026-3055/CVE-2026-3055#kevMon, 30 Mar 2026 00:00:00 GMTCitrix · NetScaler. In CISA KEV since 2026-03-30. ENISA EUVD lists it as exploited. EPSS 91.5% (higher than 99.81% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 74.8 of 100.kevpublic-exploitT1190T1005https://patchfirst.co/cve/CVE-2026-1603/CVE-2026-1603#kevMon, 09 Mar 2026 00:00:00 GMTIvanti · Endpoint Manager (EPM). In CISA KEV since 2026-03-09. ENISA EUVD lists it as exploited. EPSS 88.3% (higher than 99.77% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 73.2 of 100.kevpublic-exploitT1190T1005https://patchfirst.co/cve/CVE-2021-22054/CVE-2021-22054#kevMon, 09 Mar 2026 00:00:00 GMTOmnissa · Workspace One UEM. In CISA KEV since 2026-03-09. ENISA EUVD lists it as exploited. EPSS 99.7% (higher than 99.95% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 68.2 of 100.kevpublic-exploitT1190T1005https://patchfirst.co/cve/CVE-2019-19006/CVE-2019-19006#kevTue, 03 Feb 2026 00:00:00 GMTSangoma · FreePBX. In CISA KEV since 2026-02-03. ENISA EUVD lists it as exploited. EPSS 55.9% (higher than 99.05% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 69.7 of 100.kevpublic-exploitT1190T1005https://patchfirst.co/cve/CVE-2025-68645/CVE-2025-68645#kevThu, 22 Jan 2026 00:00:00 GMTSynacor · Zimbra Collaboration Suite (ZCS). In CISA KEV since 2026-01-22. ENISA EUVD lists it as exploited. EPSS 48.9% (higher than 98.9% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1005 Data from Local System. Priority 73.9 of 100.kevpublic-exploitT1005https://patchfirst.co/cve/CVE-2025-31125/CVE-2025-31125#kevThu, 22 Jan 2026 00:00:00 GMTVite · Vitejs. In CISA KEV since 2026-01-22. ENISA EUVD lists it as exploited. EPSS 74.9% (higher than 99.5% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 68.2 of 100.kevpublic-exploitT1190T1005https://patchfirst.co/cve/CVE-2025-34026/CVE-2025-34026#kevThu, 22 Jan 2026 00:00:00 GMTVersa · Concerto. In CISA KEV since 2026-01-22. ENISA EUVD lists it as exploited. EPSS 81.8% (higher than 99.64% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System; T1078 Valid Accounts. Priority 68.2 of 100.kevpublic-exploitT1190T1005T1078https://patchfirst.co/cve/CVE-2026-20805/CVE-2026-20805#kevTue, 13 Jan 2026 00:00:00 GMTMicrosoft · Windows. In CISA KEV since 2026-01-13. ENISA EUVD lists it as exploited. EPSS 7.5% (higher than 94.5% of CVEs). CVSS 5.5 MEDIUM. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1005 Data from Local System. Priority 70.7 of 100.kevpublic-exploitT1078T1005https://patchfirst.co/cve/CVE-2025-14847/CVE-2025-14847#kevMon, 29 Dec 2025 00:00:00 GMTMongoDB · MongoDB and MongoDB Server. In CISA KEV since 2025-12-29. ENISA EUVD lists it as exploited. EPSS 83.2% (higher than 99.68% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 73.2 of 100.kevpublic-exploitT1190T1005https://patchfirst.co/cve/CVE-2025-14611/CVE-2025-14611#kevMon, 15 Dec 2025 00:00:00 GMTGladinet · CentreStack and Triofox. In CISA KEV since 2025-12-15. ENISA EUVD lists it as exploited. EPSS 53.3% (higher than 99% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 74.7 of 100.kevpublic-exploitT1190T1005https://patchfirst.co/cve/CVE-2025-58360/CVE-2025-58360#kevThu, 11 Dec 2025 00:00:00 GMTOSGeo · GeoServer. In CISA KEV since 2025-12-11. ENISA EUVD lists it as exploited. EPSS 61.2% (higher than 99.16% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 74.7 of 100.kevpublic-exploitT1190T1005https://patchfirst.co/cve/CVE-2025-11371/CVE-2025-11371#kevTue, 04 Nov 2025 00:00:00 GMTGladinet · CentreStack and Triofox. In CISA KEV since 2025-11-04. ENISA EUVD lists it as exploited. EPSS 92.1% (higher than 99.82% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 78.2 of 100.kevpublic-exploitT1190T1005https://patchfirst.co/cve/CVE-2025-61884/CVE-2025-61884#kevMon, 20 Oct 2025 00:00:00 GMTOracle · E-Business Suite. In CISA KEV since 2025-10-20, known ransomware use. ENISA EUVD lists it as exploited. EPSS 95.9% (higher than 99.87% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 78.2 of 100.kevransomwarepublic-exploitT1190T1005https://patchfirst.co/cve/CVE-2021-43798/CVE-2021-43798#kevThu, 09 Oct 2025 00:00:00 GMTGrafana Labs · Grafana. In CISA KEV since 2025-10-09. ENISA EUVD lists it as exploited. EPSS 88.5% (higher than 99.77% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 68.2 of 100.kevpublic-exploitT1190T1005https://patchfirst.co/cve/CVE-2020-25078/CVE-2020-25078#kevTue, 05 Aug 2025 00:00:00 GMTD-Link · DCS-2530L and DCS-2670L Devices. In CISA KEV since 2025-08-05. ENISA EUVD lists it as exploited. EPSS 97.5% (higher than 99.9% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 68.2 of 100.kevpublic-exploitT1190T1005https://patchfirst.co/cve/CVE-2025-2776/CVE-2025-2776#kevTue, 22 Jul 2025 00:00:00 GMTSysAid · SysAid On-Prem. In CISA KEV since 2025-07-22. ENISA EUVD lists it as exploited. EPSS 64.7% (higher than 99.24% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 69.7 of 100.kevpublic-exploitT1190T1005https://patchfirst.co/cve/CVE-2025-2775/CVE-2025-2775#kevTue, 22 Jul 2025 00:00:00 GMTSysAid · SysAid On-Prem. In CISA KEV since 2025-07-22. ENISA EUVD lists it as exploited. EPSS 42.6% (higher than 98.7% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 68.0 of 100.kevpublic-exploitT1190T1005https://patchfirst.co/cve/CVE-2019-5418/CVE-2019-5418#kevMon, 07 Jul 2025 00:00:00 GMTRails · Ruby on Rails. In CISA KEV since 2025-07-07. ENISA EUVD lists it as exploited. EPSS 98.5% (higher than 99.92% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 68.2 of 100.kevpublic-exploitT1190T1005https://patchfirst.co/cve/CVE-2025-48927/CVE-2025-48927#kevTue, 01 Jul 2025 00:00:00 GMTTeleMessage · TM SGNL. In CISA KEV since 2025-07-01. ENISA EUVD lists it as exploited. EPSS 11.6% (higher than 96% of CVEs). CVSS 5.3 MEDIUM. ATT&CK: T1212 Exploitation for Credential Access; T1005 Data from Local System; T1555 Credentials from Password Stores. Priority 60.9 of 100.kevT1212T1005T1555https://patchfirst.co/cve/CVE-2025-48928/CVE-2025-48928#kevTue, 01 Jul 2025 00:00:00 GMTTeleMessage · TM SGNL. In CISA KEV since 2025-07-01. ENISA EUVD lists it as exploited. EPSS 0.6% (higher than 47.5% of CVEs). CVSS 4.0 MEDIUM. ATT&CK: T1212 Exploitation for Credential Access; T1005 Data from Local System; T1555 Credentials from Password Stores. Priority 50.3 of 100.kevT1212T1005T1555https://patchfirst.co/cve/CVE-2024-0769/CVE-2024-0769#kevWed, 25 Jun 2025 00:00:00 GMTD-Link · DIR-859 Router. In CISA KEV since 2025-06-25. ENISA EUVD lists it as exploited. EPSS 82.7% (higher than 99.67% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 69.8 of 100.kevpublic-exploitT1190T1005https://patchfirst.co/cve/CVE-2025-43200/CVE-2025-43200#kevMon, 16 Jun 2025 00:00:00 GMTApple · Multiple Products. In CISA KEV since 2025-06-16. ENISA EUVD lists it as exploited. EPSS 1.2% (higher than 67.9% of CVEs). CVSS 4.2 MEDIUM. ATT&CK: T1203 Exploitation for Client Execution; T1105 Ingress Tool Transfer; T1005 Data from Local System. Priority 54.5 of 100.kevT1203T1105T1005https://patchfirst.co/cve/CVE-2023-38950/CVE-2023-38950#kevMon, 19 May 2025 00:00:00 GMTZKTeco · BioTime. In CISA KEV since 2025-05-19. ENISA EUVD lists it as exploited. EPSS 92.5% (higher than 99.83% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 68.2 of 100.kevpublic-exploitT1190T1005https://patchfirst.co/cve/CVE-2025-27920/CVE-2025-27920#kevMon, 19 May 2025 00:00:00 GMTSrimax · Output Messenger. In CISA KEV since 2025-05-19. ENISA EUVD lists it as exploited. EPSS 1.9% (higher than 79.3% of CVEs). CVSS 8.8 HIGH. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 60.0 of 100.kevT1190T1005https://patchfirst.co/cve/CVE-2025-47729/CVE-2025-47729#kevMon, 12 May 2025 00:00:00 GMTTeleMessage · TM SGNL. In CISA KEV since 2025-05-12. ENISA EUVD lists it as exploited. EPSS 0.4% (higher than 38.9% of CVEs). CVSS 4.9 MEDIUM. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 49.2 of 100.kevT1190T1005https://patchfirst.co/cve/CVE-2024-38475/CVE-2024-38475#kevThu, 01 May 2025 00:00:00 GMTApache · HTTP Server. In CISA KEV since 2025-05-01. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.98% of CVEs). CVSS 9.1 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System; T1059 Command and Scripting Interpreter; T1528 Steal Application Access Token. Priority 69.4 of 100.kevpublic-exploitT1190T1005T1059T1528https://patchfirst.co/cve/CVE-2024-53150/CVE-2024-53150#kevWed, 09 Apr 2025 00:00:00 GMTLinux · Kernel. In CISA KEV since 2025-04-09. ENISA EUVD lists it as exploited. EPSS 1.4% (higher than 71.6% of CVEs). CVSS 7.1 HIGH. ATT&CK: T1005 Data from Local System; T1011 Exfiltration Over Other Network Medium. Priority 57.3 of 100.kevT1005T1011https://patchfirst.co/cve/CVE-2025-24813/CVE-2025-24813#kevTue, 01 Apr 2025 00:00:00 GMTApache · Tomcat. In CISA KEV since 2025-04-01. ENISA EUVD lists it as exploited. EPSS 99.9% (higher than 99.97% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System; T1059 Command and Scripting Interpreter. Priority 69.9 of 100.kevpublic-exploitT1190T1005T1059https://patchfirst.co/cve/CVE-2024-48248/CVE-2024-48248#kevWed, 19 Mar 2025 00:00:00 GMTNAKIVO · Backup and Replication. In CISA KEV since 2025-03-19. ENISA EUVD lists it as exploited. EPSS 94.4% (higher than 99.85% of CVEs). CVSS 8.6 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System; T1003 OS Credential Dumping. Priority 69.0 of 100.kevpublic-exploitT1190T1005T1003https://patchfirst.co/cve/CVE-2025-24991/CVE-2025-24991#kevTue, 11 Mar 2025 00:00:00 GMTMicrosoft · Windows. In CISA KEV since 2025-03-11. ENISA EUVD lists it as exploited. EPSS 2.0% (higher than 80.9% of CVEs). CVSS 5.5 MEDIUM. ATT&CK: T1091 Replication Through Removable Media; T1005 Data from Local System. Priority 58.0 of 100.kevT1091T1005https://patchfirst.co/cve/CVE-2025-24984/CVE-2025-24984#kevTue, 11 Mar 2025 00:00:00 GMTMicrosoft · Windows. In CISA KEV since 2025-03-11. ENISA EUVD lists it as exploited. EPSS 2.0% (higher than 80.7% of CVEs). CVSS 4.6 MEDIUM. ATT&CK: T1200 Hardware Additions; T1005 Data from Local System. Priority 57.4 of 100.kevT1200T1005https://patchfirst.co/cve/CVE-2025-22226/CVE-2025-22226#kevTue, 04 Mar 2025 00:00:00 GMTVMware · ESXi, Workstation, and Fusion. In CISA KEV since 2025-03-04. ENISA EUVD lists it as exploited. EPSS 1.6% (higher than 76.2% of CVEs). CVSS 6.0 MEDIUM. ATT&CK: T1005 Data from Local System; T1611 Escape to Host. Priority 67.4 of 100.kevT1005T1611https://patchfirst.co/cve/CVE-2024-50302/CVE-2024-50302#kevTue, 04 Mar 2025 00:00:00 GMTLinux · Kernel. In CISA KEV since 2025-03-04. ENISA EUVD lists it as exploited. EPSS 0.8% (higher than 56.9% of CVEs). CVSS 5.5 MEDIUM. ATT&CK: T1005 Data from Local System; T1011 Exfiltration Over Other Network Medium. Priority 53.2 of 100.kevT1005T1011