{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: CVEs linked to T1040 Network Sniffing","home_page_url":"https://patchfirst.co/technique/T1040/","feed_url":"https://patchfirst.co/feed/technique/T1040.json","description":"New and newly exploited CVEs that lead to ATT&CK T1040 Network Sniffing, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2026-34486#kev","url":"https://patchfirst.co/cve/CVE-2026-34486/","title":"[KEV] CVE-2026-34486: Apache Tomcat Missing Encryption of Sensitive Data Vulnerability","content_text":"Apache · Tomcat. In CISA KEV since 2026-08-04. ENISA EUVD lists it as exploited. EPSS 98.5% (higher than 99.92% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1040 Network Sniffing; T1557 Adversary-in-the-Middle. Priority 73.2 of 100.","summary":"Apache Tomcat Missing Encryption of Sensitive Data Vulnerability","date_published":"2026-08-04T00:00:00.000Z","date_modified":"2026-10-26T22:10:00.000Z","tags":["kev","public-exploit","T1040","T1557"],"_patchfirst":{"reason":"kev","priority":73.2,"kev":{"dateAdded":"2026-08-04","ransomware":false},"epss":{"score":0.98503,"percentile":0.9992},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"Apache","product":"Tomcat","techniqueIds":["T1040","T1557"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-32030#kev","url":"https://patchfirst.co/cve/CVE-2021-32030/","title":"[KEV] CVE-2021-32030: ASUS Routers Improper Authentication Vulnerability","content_text":"ASUS · Routers. In CISA KEV since 2025-06-02. ENISA EUVD lists it as exploited. EPSS 99.4% (higher than 99.94% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1040 Network Sniffing; T1098 Account Manipulation. Priority 69.8 of 100.","summary":"ASUS Routers Improper Authentication Vulnerability","date_published":"2025-06-02T00:00:00.000Z","date_modified":"2026-06-17T03:52:42.000Z","tags":["kev","public-exploit","T1068","T1040","T1098"],"_patchfirst":{"reason":"kev","priority":69.8,"kev":{"dateAdded":"2025-06-02","ransomware":false},"epss":{"score":0.99393,"percentile":0.9994},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"ASUS","product":"Routers","techniqueIds":["T1068","T1040","T1098"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2022-1040#kev","url":"https://patchfirst.co/cve/CVE-2022-1040/","title":"[KEV] CVE-2022-1040: Sophos Firewall Authentication Bypass Vulnerability","content_text":"Sophos · Firewall. In CISA KEV since 2022-03-31. ENISA EUVD lists it as exploited. EPSS 99.8% (higher than 99.96% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1040 Network Sniffing; T1078 Valid Accounts; T1557 Adversary-in-the-Middle; T1574 Hijack Execution Flow. Priority 79.9 of 100.","summary":"Sophos Firewall Authentication Bypass Vulnerability","date_published":"2022-03-31T00:00:00.000Z","date_modified":"2026-06-17T04:21:42.000Z","tags":["kev","public-exploit","T1190","T1059","T1040","T1078","T1557","T1574"],"_patchfirst":{"reason":"kev","priority":79.9,"kev":{"dateAdded":"2022-03-31","ransomware":false},"epss":{"score":0.99796,"percentile":0.99957},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Sophos","product":"Firewall","techniqueIds":["T1190","T1059","T1040","T1078","T1557","T1574"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2018-18325#kev","url":"https://patchfirst.co/cve/CVE-2018-18325/","title":"[KEV] CVE-2018-18325: DotNetNuke (DNN) Inadequate Encryption Strength Vulnerability","content_text":"DotNetNuke (DNN) · DotNetNuke (DNN). In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 74.0% (higher than 99.48% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1040 Network Sniffing. Priority 68.1 of 100.","summary":"DotNetNuke (DNN) Inadequate Encryption Strength Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T01:47:00.000Z","tags":["kev","public-exploit","T1190","T1040"],"_patchfirst":{"reason":"kev","priority":68.1,"kev":{"dateAdded":"2021-11-03","ransomware":false},"epss":{"score":0.74048,"percentile":0.99483},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"DotNetNuke (DNN)","product":"DotNetNuke (DNN)","techniqueIds":["T1190","T1040"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2020-15094","url":"https://patchfirst.co/cve/CVE-2020-15094/","title":"CVE-2020-15094: RCE in Symfony","content_text":"symfony · symfony. Not in CISA KEV. EPSS 3.0% (higher than 87.5% of CVEs). CVSS 8.0 HIGH. ATT&CK: T1040 Network Sniffing; T1059 Command and Scripting Interpreter. Priority 23.1 of 100.","summary":"RCE in Symfony","date_published":"2020-09-02T00:00:00.000Z","date_modified":"2024-08-04T13:08:22.000Z","tags":["T1040","T1059"],"_patchfirst":{"reason":"published","priority":23.1,"kev":null,"epss":{"score":0.03043,"percentile":0.87513},"cvss":{"score":8,"severity":"HIGH","version":"3.1"},"vendor":"symfony","product":"symfony","techniqueIds":["T1040","T1059"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2020-15093","url":"https://patchfirst.co/cve/CVE-2020-15093/","title":"CVE-2020-15093: Improper verification of signature threshold in tough","content_text":"awslabs · tough. Not in CISA KEV. EPSS 1.4% (higher than 71.6% of CVEs). CVSS 8.6 HIGH. ATT&CK: T1110 Brute Force; T1040 Network Sniffing; T1078 Valid Accounts; T1557 Adversary-in-the-Middle. Priority 20.3 of 100.","summary":"Improper verification of signature threshold in tough","date_published":"2020-07-09T00:00:00.000Z","date_modified":"2024-08-04T13:08:21.000Z","tags":["T1110","T1040","T1078","T1557"],"_patchfirst":{"reason":"published","priority":20.3,"kev":null,"epss":{"score":0.01357,"percentile":0.71634},"cvss":{"score":8.6,"severity":"HIGH","version":"3.1"},"vendor":"awslabs","product":"tough","techniqueIds":["T1110","T1040","T1078","T1557"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2020-11035","url":"https://patchfirst.co/cve/CVE-2020-11035/","title":"CVE-2020-11035: weak CSRF tokens in GLPI","content_text":"glpi-project · GLPI. Not in CISA KEV. EPSS 0.9% (higher than 59.6% of CVEs). CVSS 7.5 HIGH. ATT&CK: T1110 Brute Force; T1040 Network Sniffing; T1078 Valid Accounts; T1557 Adversary-in-the-Middle. Priority 17.2 of 100.","summary":"weak CSRF tokens in GLPI","date_published":"2020-05-05T00:00:00.000Z","date_modified":"2024-08-04T11:21:14.000Z","tags":["T1110","T1040","T1078","T1557"],"_patchfirst":{"reason":"published","priority":17.2,"kev":null,"epss":{"score":0.00898,"percentile":0.59574},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"glpi-project","product":"GLPI","techniqueIds":["T1110","T1040","T1078","T1557"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2020-5261","url":"https://patchfirst.co/cve/CVE-2020-5261/","title":"CVE-2020-5261: Missing Token Replay Detection","content_text":"Sustainsys · Saml2. Not in CISA KEV. EPSS 1.5% (higher than 74.2% of CVEs). CVSS 8.2 HIGH. ATT&CK: T1040 Network Sniffing; T1190 Exploit Public-Facing Application. Priority 20.6 of 100.","summary":"Missing Token Replay Detection","date_published":"2020-03-25T00:00:00.000Z","date_modified":"2024-08-04T08:22:09.000Z","tags":["T1040","T1190"],"_patchfirst":{"reason":"published","priority":20.6,"kev":null,"epss":{"score":0.01496,"percentile":0.74161},"cvss":{"score":8.2,"severity":"HIGH","version":"3.1"},"vendor":"Sustainsys","product":"Saml2","techniqueIds":["T1040","T1190"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2020-0884","url":"https://patchfirst.co/cve/CVE-2020-0884/","title":"CVE-2020-0884: A spoofing vulnerability exists in Microsoft Visual Studio as it includes a reply URL that is not secured by SSL, aka…","content_text":"Microsoft · Microsoft Visual Studio 2017 version 15.9 (includes 15.1 - 15.8). Not in CISA KEV. EPSS 1.7% (higher than 76.8% of CVEs). ATT&CK: T1040 Network Sniffing; T1528 Steal Application Access Token. Priority 15.4 of 100.","summary":"A spoofing vulnerability exists in Microsoft Visual Studio as it includes a reply URL that is not secured by SSL, aka…","date_published":"2020-03-12T00:00:00.000Z","date_modified":"2024-08-04T06:18:03.000Z","tags":["T1040","T1528"],"_patchfirst":{"reason":"published","priority":15.4,"kev":null,"epss":{"score":0.01671,"percentile":0.76773},"cvss":null,"vendor":"Microsoft","product":"Microsoft Visual Studio 2017 version 15.9 (includes 15.1 - 15.8)","techniqueIds":["T1040","T1528"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2019-1715","url":"https://patchfirst.co/cve/CVE-2019-1715/","title":"CVE-2019-1715: Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Low-Entropy Keys Vulnerability","content_text":"Cisco · Cisco Adaptive Security Appliance (ASA) Software. Not in CISA KEV. EPSS 1.7% (higher than 77.5% of CVEs). CVSS 5.3 MEDIUM. ATT&CK: T1110 Brute Force; T1040 Network Sniffing; T1078 Valid Accounts; T1557 Adversary-in-the-Middle. Priority 19.2 of 100.","summary":"Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Low-Entropy Keys Vulnerability","date_published":"2019-05-03T00:00:00.000Z","date_modified":"2024-11-19T19:08:18.000Z","tags":["T1110","T1040","T1078","T1557"],"_patchfirst":{"reason":"published","priority":19.2,"kev":null,"epss":{"score":0.01726,"percentile":0.77525},"cvss":{"score":5.3,"severity":"MEDIUM","version":"3.0"},"vendor":"Cisco","product":"Cisco Adaptive Security Appliance (ASA) Software","techniqueIds":["T1110","T1040","T1078","T1557"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2018-14781","url":"https://patchfirst.co/cve/CVE-2018-14781/","title":"CVE-2018-14781: Medtronic MiniMed MMT-500/MMT-503 Remote Controllers Authentication Bypass by Capture-replay","content_text":"Medtronic · MMT- 508 - MiniMed pump. Not in CISA KEV. EPSS 0.7% (higher than 53.6% of CVEs). CVSS 5.3 MEDIUM. ATT&CK: T1040 Network Sniffing; T1190 Exploit Public-Facing Application. Priority 14.4 of 100.","summary":"Medtronic MiniMed MMT-500/MMT-503 Remote Controllers Authentication Bypass by Capture-replay","date_published":"2018-08-13T00:00:00.000Z","date_modified":"2025-05-22T16:33:08.000Z","tags":["T1040","T1190"],"_patchfirst":{"reason":"published","priority":14.4,"kev":null,"epss":{"score":0.00712,"percentile":0.53594},"cvss":{"score":5.3,"severity":"MEDIUM","version":"3.1"},"vendor":"Medtronic","product":"MMT- 508 - MiniMed pump","techniqueIds":["T1040","T1190"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}}]}