{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: CVEs linked to T1041 Exfiltration Over C2 Channel","home_page_url":"https://patchfirst.co/technique/T1041/","feed_url":"https://patchfirst.co/feed/technique/T1041.json","description":"New and newly exploited CVEs that lead to ATT&CK T1041 Exfiltration Over C2 Channel, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2025-33053#kev","url":"https://patchfirst.co/cve/CVE-2025-33053/","title":"[KEV] CVE-2025-33053: Microsoft Windows External Control of File Name or Path Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2025-06-10. ENISA EUVD lists it as exploited. EPSS 87.0% (higher than 99.75% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1566.001 Spearphishing Attachment; T1059 Command and Scripting Interpreter; T1041 Exfiltration Over C2 Channel; T1056.001 Keylogging; T1543 Create or Modify System Process. Priority 69.1 of 100.","summary":"Microsoft Windows External Control of File Name or Path Vulnerability","date_published":"2025-06-10T00:00:00.000Z","date_modified":"2026-06-17T09:13:01.000Z","tags":["kev","public-exploit","T1566.001","T1059","T1041","T1056.001","T1543"],"_patchfirst":{"reason":"kev","priority":69.1,"kev":{"dateAdded":"2025-06-10","ransomware":false},"epss":{"score":0.87015,"percentile":0.99747},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1566.001","T1059","T1041","T1056.001","T1543"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-27443#kev","url":"https://patchfirst.co/cve/CVE-2024-27443/","title":"[KEV] CVE-2024-27443: Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability","content_text":"Synacor · Zimbra Collaboration Suite (ZCS). In CISA KEV since 2025-05-19. ENISA EUVD lists it as exploited. EPSS 24.6% (higher than 97.9% of CVEs). CVSS 6.1 MEDIUM. Public exploit code exists. ATT&CK: T1566.002 Spearphishing Link; T1059.004 Unix Shell; T1114 Email Collection; T1041 Exfiltration Over C2 Channel. Priority 66.8 of 100.","summary":"Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability","date_published":"2025-05-19T00:00:00.000Z","date_modified":"2026-06-17T07:19:54.000Z","tags":["kev","public-exploit","T1566.002","T1059.004","T1114","T1041"],"_patchfirst":{"reason":"kev","priority":66.8,"kev":{"dateAdded":"2025-05-19","ransomware":false},"epss":{"score":0.24606,"percentile":0.97881},"cvss":{"score":6.1,"severity":"MEDIUM","version":"3.1"},"vendor":"Synacor","product":"Zimbra Collaboration Suite (ZCS)","techniqueIds":["T1566.002","T1059.004","T1114","T1041"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-32756#kev","url":"https://patchfirst.co/cve/CVE-2025-32756/","title":"[KEV] CVE-2025-32756: Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability","content_text":"Fortinet · Multiple Products. In CISA KEV since 2025-05-14. ENISA EUVD lists it as exploited. EPSS 30.9% (higher than 98.3% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1133 External Remote Services; T1059 Command and Scripting Interpreter; T1003 OS Credential Dumping; T1041 Exfiltration Over C2 Channel; T1046 Network Service Discovery; T1070.004 File Deletion; +1 more. Priority 79.5 of 100.","summary":"Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability","date_published":"2025-05-14T00:00:00.000Z","date_modified":"2026-06-17T09:12:32.000Z","tags":["kev","public-exploit","T1133","T1059","T1003","T1041","T1046","T1070.004","T1608.001"],"_patchfirst":{"reason":"kev","priority":79.5,"kev":{"dateAdded":"2025-05-14","ransomware":false},"epss":{"score":0.30944,"percentile":0.98257},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Fortinet","product":"Multiple Products","techniqueIds":["T1133","T1059","T1003","T1041","T1046","T1070.004","T1608.001"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-55550#kev","url":"https://patchfirst.co/cve/CVE-2024-55550/","title":"[KEV] CVE-2024-55550: Mitel MiCollab Path Traversal Vulnerability","content_text":"Mitel · MiCollab. In CISA KEV since 2025-01-07, known ransomware use. ENISA EUVD lists it as exploited. EPSS 38.2% (higher than 98.6% of CVEs). CVSS 2.7 LOW. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System; T1041 Exfiltration Over C2 Channel. Priority 74.6 of 100.","summary":"Mitel MiCollab Path Traversal Vulnerability","date_published":"2025-01-07T00:00:00.000Z","date_modified":"2026-08-04T05:16:31.000Z","tags":["kev","ransomware","public-exploit","T1190","T1005","T1041"],"_patchfirst":{"reason":"kev","priority":74.6,"kev":{"dateAdded":"2025-01-07","ransomware":true},"epss":{"score":0.38155,"percentile":0.98557},"cvss":{"score":2.7,"severity":"LOW","version":"3.1"},"vendor":"Mitel","product":"MiCollab","techniqueIds":["T1190","T1005","T1041"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-4577#kev","url":"https://patchfirst.co/cve/CVE-2024-4577/","title":"[KEV] CVE-2024-4577: PHP-CGI OS Command Injection Vulnerability","content_text":"PHP Group · PHP. In CISA KEV since 2024-06-12, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.98% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1003 OS Credential Dumping; T1003.001 LSASS Memory; T1033 System Owner/User Discovery; T1041 Exfiltration Over C2 Channel; +6 more. Priority 79.9 of 100.","summary":"PHP-CGI OS Command Injection Vulnerability","date_published":"2024-06-12T00:00:00.000Z","date_modified":"2026-06-17T08:02:11.000Z","tags":["kev","ransomware","public-exploit","T1190","T1059","T1003","T1003.001","T1033","T1041","T1053","T1068","T1071.001","T1112","T1543","T1570"],"_patchfirst":{"reason":"kev","priority":79.9,"kev":{"dateAdded":"2024-06-12","ransomware":true},"epss":{"score":0.99987,"percentile":0.99984},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"PHP Group","product":"PHP","techniqueIds":["T1190","T1059","T1003","T1003.001","T1033","T1041","T1053","T1068","T1071.001","T1112","T1543","T1570"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-5631#kev","url":"https://patchfirst.co/cve/CVE-2023-5631/","title":"[KEV] CVE-2023-5631: Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability","content_text":"Roundcube · Webmail. In CISA KEV since 2023-10-26. ENISA EUVD lists it as exploited. EPSS 76.3% (higher than 99.54% of CVEs). CVSS 5.4 MEDIUM. Public exploit code exists. ATT&CK: T1204.001 Malicious Link; T1059.007 JavaScript; T1041 Exfiltration Over C2 Channel. Priority 66.7 of 100.","summary":"Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability","date_published":"2023-10-26T00:00:00.000Z","date_modified":"2026-06-17T06:48:58.000Z","tags":["kev","public-exploit","T1204.001","T1059.007","T1041"],"_patchfirst":{"reason":"kev","priority":66.7,"kev":{"dateAdded":"2023-10-26","ransomware":false},"epss":{"score":0.76337,"percentile":0.99538},"cvss":{"score":5.4,"severity":"MEDIUM","version":"3.1"},"vendor":"Roundcube","product":"Webmail","techniqueIds":["T1204.001","T1059.007","T1041"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-38831#kev","url":"https://patchfirst.co/cve/CVE-2023-38831/","title":"[KEV] CVE-2023-38831: RARLAB WinRAR Code Execution Vulnerability","content_text":"RARLAB · WinRAR. In CISA KEV since 2023-08-24, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.8% (higher than 99.96% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1204 User Execution; T1005 Data from Local System; T1041 Exfiltration Over C2 Channel; T1053 Scheduled Task/Job; T1105 Ingress Tool Transfer; T1112 Modify Registry; +1 more. Named in 1 threat report. Priority 82.3 of 100.","summary":"RARLAB WinRAR Code Execution Vulnerability","date_published":"2023-08-24T00:00:00.000Z","date_modified":"2026-08-05T05:16:38.000Z","tags":["kev","ransomware","public-exploit","T1204","T1005","T1041","T1053","T1105","T1112","T1486"],"_patchfirst":{"reason":"kev","priority":82.3,"kev":{"dateAdded":"2023-08-24","ransomware":true},"epss":{"score":0.99815,"percentile":0.99959},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"RARLAB","product":"WinRAR","techniqueIds":["T1204","T1005","T1041","T1053","T1105","T1112","T1486"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-2868#kev","url":"https://patchfirst.co/cve/CVE-2023-2868/","title":"[KEV] CVE-2023-2868: Barracuda Networks ESG Appliance Improper Input Validation Vulnerability","content_text":"Barracuda Networks · Email Security Gateway (ESG) Appliance. In CISA KEV since 2023-05-26. ENISA EUVD lists it as exploited. EPSS 86.8% (higher than 99.74% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1566.001 Spearphishing Attachment; T1059 Command and Scripting Interpreter; T1041 Exfiltration Over C2 Channel; T1105 Ingress Tool Transfer. Priority 69.8 of 100.","summary":"Barracuda Networks ESG Appliance Improper Input Validation Vulnerability","date_published":"2023-05-26T00:00:00.000Z","date_modified":"2026-06-17T05:53:39.000Z","tags":["kev","public-exploit","T1566.001","T1059","T1041","T1105"],"_patchfirst":{"reason":"kev","priority":69.8,"kev":{"dateAdded":"2023-05-26","ransomware":false},"epss":{"score":0.86841,"percentile":0.99744},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Barracuda Networks","product":"Email Security Gateway (ESG) Appliance","techniqueIds":["T1566.001","T1059","T1041","T1105"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-1389#kev","url":"https://patchfirst.co/cve/CVE-2023-1389/","title":"[KEV] CVE-2023-1389: TP-Link Archer AX-21 Command Injection Vulnerability","content_text":"TP-Link · Archer AX21. In CISA KEV since 2023-05-01. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1106 Native API; T1496 Resource Hijacking; T1041 Exfiltration Over C2 Channel; T1070 Indicator Removal; T1498 Network Denial of Service. Priority 69.2 of 100.","summary":"TP-Link Archer AX-21 Command Injection Vulnerability","date_published":"2023-05-01T00:00:00.000Z","date_modified":"2026-06-17T05:27:50.000Z","tags":["kev","public-exploit","T1106","T1496","T1041","T1070","T1498"],"_patchfirst":{"reason":"kev","priority":69.2,"kev":{"dateAdded":"2023-05-01","ransomware":false},"epss":{"score":0.99999,"percentile":0.99992},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"TP-Link","product":"Archer AX21","techniqueIds":["T1106","T1496","T1041","T1070","T1498"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2019-0604#kev","url":"https://patchfirst.co/cve/CVE-2019-0604/","title":"[KEV] CVE-2019-0604: Microsoft SharePoint Remote Code Execution Vulnerability","content_text":"Microsoft · SharePoint. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.9% (higher than 99.97% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1041 Exfiltration Over C2 Channel; T1505.003 Web Shell; T1608.001 Upload Malware; T1003 OS Credential Dumping. Named in 4 threat reports. Priority 88.8 of 100.","summary":"Microsoft SharePoint Remote Code Execution Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T02:08:31.000Z","tags":["kev","ransomware","public-exploit","T1190","T1041","T1505.003","T1608.001","T1003"],"_patchfirst":{"reason":"kev","priority":88.8,"kev":{"dateAdded":"2021-11-03","ransomware":true},"epss":{"score":0.99913,"percentile":0.99968},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Microsoft","product":"SharePoint","techniqueIds":["T1190","T1041","T1505.003","T1608.001","T1003"],"reportCount":4,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2019-18935#kev","url":"https://patchfirst.co/cve/CVE-2019-18935/","title":"[KEV] CVE-2019-18935: Progress Telerik UI for ASP.NET AJAX Deserialization of Untrusted Data Vulnerability","content_text":"Progress · Telerik UI for ASP.NET AJAX. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.7% (higher than 99.95% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1041 Exfiltration Over C2 Channel; T1496 Resource Hijacking; T1505.003 Web Shell. Named in 1 threat report. Priority 83.7 of 100.","summary":"Progress Telerik UI for ASP.NET AJAX Deserialization of Untrusted Data Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T02:25:36.000Z","tags":["kev","ransomware","public-exploit","T1190","T1041","T1496","T1505.003"],"_patchfirst":{"reason":"kev","priority":83.7,"kev":{"dateAdded":"2021-11-03","ransomware":true},"epss":{"score":0.99737,"percentile":0.99954},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Progress","product":"Telerik UI for ASP.NET AJAX","techniqueIds":["T1190","T1041","T1496","T1505.003"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2018-4878#kev","url":"https://patchfirst.co/cve/CVE-2018-4878/","title":"[KEV] CVE-2018-4878: Adobe Flash Player Use-After-Free Vulnerability","content_text":"Adobe · Flash Player. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 90.3% (higher than 99.8% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1204.002 Malicious File; T1219 Remote Access Tools; T1041 Exfiltration Over C2 Channel. Named in 1 threat report. Priority 67.3 of 100.","summary":"Adobe Flash Player Use-After-Free Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T01:59:12.000Z","tags":["kev","ransomware","public-exploit","T1204.002","T1219","T1041"],"_patchfirst":{"reason":"kev","priority":67.3,"kev":{"dateAdded":"2021-11-03","ransomware":true},"epss":{"score":0.9028,"percentile":0.99797},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Adobe","product":"Flash Player","techniqueIds":["T1204.002","T1219","T1041"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}}]}