{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: CVEs linked to T1055 Process Injection","home_page_url":"https://patchfirst.co/technique/T1055/","feed_url":"https://patchfirst.co/feed/technique/T1055.json","description":"New and newly exploited CVEs that lead to ATT&CK T1055 Process Injection, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2026-85880#kev","url":"https://patchfirst.co/cve/CVE-2026-85880/","title":"[KEV] CVE-2026-85880: Microsoft Windows Heap-Based Buffer Overflow Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2026-09-08. ENISA EUVD lists it as exploited. EPSS 0.4% (higher than 32.8% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1068 Exploitation for Privilege Escalation; T1055 Process Injection. Priority 60.0 of 100.","summary":"Microsoft Windows Heap-Based Buffer Overflow Vulnerability","date_published":"2026-09-08T00:00:00.000Z","date_modified":"2026-09-24T23:19:20.000Z","tags":["kev","T1068","T1055"],"_patchfirst":{"reason":"kev","priority":60,"kev":{"dateAdded":"2026-09-08","ransomware":false},"epss":{"score":0.00387,"percentile":0.3281},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1068","T1055"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2025-25257#kev","url":"https://patchfirst.co/cve/CVE-2025-25257/","title":"[KEV] CVE-2025-25257: Fortinet FortiWeb SQL Injection Vulnerability","content_text":"Fortinet · FortiWeb. In CISA KEV since 2025-07-18. ENISA EUVD lists it as exploited. EPSS 99.9% (higher than 99.97% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1055 Process Injection; T1068 Exploitation for Privilege Escalation; T1190 Exploit Public-Facing Application; T1059.004 Unix Shell; T1485 Data Destruction. Priority 69.9 of 100.","summary":"Fortinet FortiWeb SQL Injection Vulnerability","date_published":"2025-07-18T00:00:00.000Z","date_modified":"2026-06-17T09:00:34.000Z","tags":["kev","public-exploit","T1055","T1068","T1190","T1059.004","T1485"],"_patchfirst":{"reason":"kev","priority":69.9,"kev":{"dateAdded":"2025-07-18","ransomware":false},"epss":{"score":0.99921,"percentile":0.99968},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Fortinet","product":"FortiWeb","techniqueIds":["T1055","T1068","T1190","T1059.004","T1485"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-21480#kev","url":"https://patchfirst.co/cve/CVE-2025-21480/","title":"[KEV] CVE-2025-21480: Qualcomm Multiple Chipsets Incorrect Authorization Vulnerability","content_text":"Qualcomm · Multiple Chipsets. In CISA KEV since 2025-06-03. ENISA EUVD lists it as exploited. EPSS 0.4% (higher than 37.1% of CVEs). CVSS 8.6 HIGH. ATT&CK: T1055 Process Injection; T1495 Firmware Corruption. Priority 51.4 of 100.","summary":"Qualcomm Multiple Chipsets Incorrect Authorization Vulnerability","date_published":"2025-06-03T00:00:00.000Z","date_modified":"2026-06-17T08:43:33.000Z","tags":["kev","T1055","T1495"],"_patchfirst":{"reason":"kev","priority":51.4,"kev":{"dateAdded":"2025-06-03","ransomware":false},"epss":{"score":0.00428,"percentile":0.37119},"cvss":{"score":8.6,"severity":"HIGH","version":"3.1"},"vendor":"Qualcomm","product":"Multiple Chipsets","techniqueIds":["T1055","T1495"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2024-56145#kev","url":"https://patchfirst.co/cve/CVE-2024-56145/","title":"[KEV] CVE-2024-56145: Craft CMS Code Injection Vulnerability","content_text":"Craft CMS · Craft CMS. In CISA KEV since 2025-06-02. ENISA EUVD lists it as exploited. EPSS 97.4% (higher than 99.9% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1055 Process Injection; T1059 Command and Scripting Interpreter. Priority 69.8 of 100.","summary":"Craft CMS Code Injection Vulnerability","date_published":"2025-06-02T00:00:00.000Z","date_modified":"2026-06-17T08:11:45.000Z","tags":["kev","public-exploit","T1055","T1059"],"_patchfirst":{"reason":"kev","priority":69.8,"kev":{"dateAdded":"2025-06-02","ransomware":false},"epss":{"score":0.97405,"percentile":0.99899},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Craft CMS","product":"Craft CMS","techniqueIds":["T1055","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-6047#kev","url":"https://patchfirst.co/cve/CVE-2024-6047/","title":"[KEV] CVE-2024-6047: GeoVision Devices OS Command Injection Vulnerability","content_text":"GeoVision · Multiple Devices. In CISA KEV since 2025-05-07. ENISA EUVD lists it as exploited. EPSS 10.1% (higher than 95.6% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1055 Process Injection; T1059 Command and Scripting Interpreter. Priority 69.0 of 100.","summary":"GeoVision Devices OS Command Injection Vulnerability","date_published":"2025-05-07T00:00:00.000Z","date_modified":"2026-06-17T08:17:10.000Z","tags":["kev","public-exploit","T1055","T1059"],"_patchfirst":{"reason":"kev","priority":69,"kev":{"dateAdded":"2025-05-07","ransomware":false},"epss":{"score":0.10072,"percentile":0.95624},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"GeoVision","product":"Multiple Devices","techniqueIds":["T1055","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-58136#kev","url":"https://patchfirst.co/cve/CVE-2024-58136/","title":"[KEV] CVE-2024-58136: Yiiframework Yii Improper Protection of Alternate Path Vulnerability","content_text":"Yiiframework · Yii. In CISA KEV since 2025-05-02. ENISA EUVD lists it as exploited. EPSS 87.8% (higher than 99.76% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1055 Process Injection; T1059 Command and Scripting Interpreter. Priority 69.8 of 100.","summary":"Yiiframework Yii Improper Protection of Alternate Path Vulnerability","date_published":"2025-05-02T00:00:00.000Z","date_modified":"2026-06-17T08:14:41.000Z","tags":["kev","public-exploit","T1055","T1059"],"_patchfirst":{"reason":"kev","priority":69.8,"kev":{"dateAdded":"2025-05-02","ransomware":false},"epss":{"score":0.87757,"percentile":0.9976},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Yiiframework","product":"Yii","techniqueIds":["T1055","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-31324#kev","url":"https://patchfirst.co/cve/CVE-2025-31324/","title":"[KEV] CVE-2025-31324: SAP NetWeaver Unrestricted File Upload Vulnerability","content_text":"SAP · NetWeaver. In CISA KEV since 2025-04-29, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.5% (higher than 99.94% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1055 Process Injection; T1505.003 Web Shell; T1059 Command and Scripting Interpreter; T1602 Data from Configuration Repository. Named in 1 threat report. Priority 83.7 of 100.","summary":"SAP NetWeaver Unrestricted File Upload Vulnerability","date_published":"2025-04-29T00:00:00.000Z","date_modified":"2026-08-04T05:16:34.000Z","tags":["kev","ransomware","public-exploit","T1055","T1505.003","T1059","T1602"],"_patchfirst":{"reason":"kev","priority":83.7,"kev":{"dateAdded":"2025-04-29","ransomware":true},"epss":{"score":0.99486,"percentile":0.99944},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"SAP","product":"NetWeaver","techniqueIds":["T1055","T1505.003","T1059","T1602"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-1316#kev","url":"https://patchfirst.co/cve/CVE-2025-1316/","title":"[KEV] CVE-2025-1316: Edimax IC-7100 IP Camera OS Command Injection Vulnerability","content_text":"Edimax · IC-7100 IP Camera. In CISA KEV since 2025-03-19. ENISA EUVD lists it as exploited. EPSS 74.5% (higher than 99.49% of CVEs). CVSS 9.8 CRITICAL. ATT&CK: T1190 Exploit Public-Facing Application; T1055 Process Injection. Priority 64.8 of 100.","summary":"Edimax IC-7100 IP Camera OS Command Injection Vulnerability","date_published":"2025-03-19T00:00:00.000Z","date_modified":"2026-06-17T08:38:54.000Z","tags":["kev","T1190","T1055"],"_patchfirst":{"reason":"kev","priority":64.8,"kev":{"dateAdded":"2025-03-19","ransomware":false},"epss":{"score":0.74482,"percentile":0.99494},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Edimax","product":"IC-7100 IP Camera","techniqueIds":["T1190","T1055"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2025-24993#kev","url":"https://patchfirst.co/cve/CVE-2025-24993/","title":"[KEV] CVE-2025-24993: Microsoft Windows NTFS Heap-Based Buffer Overflow Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2025-03-11. ENISA EUVD lists it as exploited. EPSS 2.2% (higher than 82.6% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1068 Exploitation for Privilege Escalation; T1203 Exploitation for Client Execution; T1204 User Execution; T1055 Process Injection; T1565 Data Manipulation. Priority 60.0 of 100.","summary":"Microsoft Windows NTFS Heap-Based Buffer Overflow Vulnerability","date_published":"2025-03-11T00:00:00.000Z","date_modified":"2026-09-24T13:10:00.000Z","tags":["kev","T1068","T1203","T1204","T1055","T1565"],"_patchfirst":{"reason":"kev","priority":60,"kev":{"dateAdded":"2025-03-11","ransomware":false},"epss":{"score":0.02216,"percentile":0.82616},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1068","T1203","T1204","T1055","T1565"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2025-25181#kev","url":"https://patchfirst.co/cve/CVE-2025-25181/","title":"[KEV] CVE-2025-25181: Advantive VeraCore SQL Injection Vulnerability","content_text":"Advantive · VeraCore. In CISA KEV since 2025-03-10. ENISA EUVD lists it as exploited. EPSS 55.5% (higher than 99.04% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1055 Process Injection; T1068 Exploitation for Privilege Escalation; T1485 Data Destruction. Priority 68.1 of 100.","summary":"Advantive VeraCore SQL Injection Vulnerability","date_published":"2025-03-10T00:00:00.000Z","date_modified":"2026-06-17T09:00:26.000Z","tags":["kev","public-exploit","T1055","T1068","T1485"],"_patchfirst":{"reason":"kev","priority":68.1,"kev":{"dateAdded":"2025-03-10","ransomware":false},"epss":{"score":0.55549,"percentile":0.99036},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"Advantive","product":"VeraCore","techniqueIds":["T1055","T1068","T1485"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-22224#kev","url":"https://patchfirst.co/cve/CVE-2025-22224/","title":"[KEV] CVE-2025-22224: VMware ESXi and Workstation TOCTOU Race Condition Vulnerability","content_text":"VMware · ESXi and Workstation. In CISA KEV since 2025-03-04. ENISA EUVD lists it as exploited. EPSS 1.6% (higher than 75.2% of CVEs). CVSS 8.2 HIGH. ATT&CK: T1055 Process Injection; T1611 Escape to Host. Priority 68.8 of 100.","summary":"VMware ESXi and Workstation TOCTOU Race Condition Vulnerability","date_published":"2025-03-04T00:00:00.000Z","date_modified":"2026-06-17T08:45:43.000Z","tags":["kev","T1055","T1611"],"_patchfirst":{"reason":"kev","priority":68.8,"kev":{"dateAdded":"2025-03-04","ransomware":false},"epss":{"score":0.01561,"percentile":0.75213},"cvss":{"score":8.2,"severity":"HIGH","version":"3.1"},"vendor":"VMware","product":"ESXi and Workstation","techniqueIds":["T1055","T1611"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2023-34192#kev","url":"https://patchfirst.co/cve/CVE-2023-34192/","title":"[KEV] CVE-2023-34192: Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability","content_text":"Synacor · Zimbra Collaboration Suite (ZCS). In CISA KEV since 2025-02-25. ENISA EUVD lists it as exploited. EPSS 77.3% (higher than 99.56% of CVEs). CVSS 9.0 CRITICAL. Public exploit code exists. ATT&CK: T1055 Process Injection; T1059 Command and Scripting Interpreter; T1185 Browser Session Hijacking. Priority 69.2 of 100.","summary":"Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability","date_published":"2025-02-25T00:00:00.000Z","date_modified":"2026-06-17T06:03:05.000Z","tags":["kev","public-exploit","T1055","T1059","T1185"],"_patchfirst":{"reason":"kev","priority":69.2,"kev":{"dateAdded":"2025-02-25","ransomware":false},"epss":{"score":0.77266,"percentile":0.99555},"cvss":{"score":9,"severity":"CRITICAL","version":"3.1"},"vendor":"Synacor","product":"Zimbra Collaboration Suite (ZCS)","techniqueIds":["T1055","T1059","T1185"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-0108#kev","url":"https://patchfirst.co/cve/CVE-2025-0108/","title":"[KEV] CVE-2025-0108: Palo Alto Networks PAN-OS Authentication Bypass Vulnerability","content_text":"Palo Alto Networks · PAN-OS. In CISA KEV since 2025-02-18. ENISA EUVD lists it as exploited. EPSS 98.1% (higher than 99.91% of CVEs). CVSS 9.1 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1055 Process Injection; T1565.001 Stored Data Manipulation. Priority 69.4 of 100.","summary":"Palo Alto Networks PAN-OS Authentication Bypass Vulnerability","date_published":"2025-02-18T00:00:00.000Z","date_modified":"2026-09-24T13:10:00.000Z","tags":["kev","public-exploit","T1190","T1055","T1565.001"],"_patchfirst":{"reason":"kev","priority":69.4,"kev":{"dateAdded":"2025-02-18","ransomware":false},"epss":{"score":0.98141,"percentile":0.99913},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1"},"vendor":"Palo Alto Networks","product":"PAN-OS","techniqueIds":["T1190","T1055","T1565.001"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-40891#kev","url":"https://patchfirst.co/cve/CVE-2024-40891/","title":"[KEV] CVE-2024-40891: Zyxel DSL CPE OS Command Injection Vulnerability","content_text":"Zyxel · DSL CPE Devices. In CISA KEV since 2025-02-11. ENISA EUVD lists it as exploited. EPSS 22.9% (higher than 97.7% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1055 Process Injection; T1011 Exfiltration Over Other Network Medium. Priority 68.7 of 100.","summary":"Zyxel DSL CPE OS Command Injection Vulnerability","date_published":"2025-02-11T00:00:00.000Z","date_modified":"2026-06-17T07:46:48.000Z","tags":["kev","public-exploit","T1055","T1011"],"_patchfirst":{"reason":"kev","priority":68.7,"kev":{"dateAdded":"2025-02-11","ransomware":false},"epss":{"score":0.22888,"percentile":0.97737},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Zyxel","product":"DSL CPE Devices","techniqueIds":["T1055","T1011"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-40890#kev","url":"https://patchfirst.co/cve/CVE-2024-40890/","title":"[KEV] CVE-2024-40890: Zyxel DSL CPE OS Command Injection Vulnerability","content_text":"Zyxel · DSL CPE Devices. In CISA KEV since 2025-02-11. ENISA EUVD lists it as exploited. EPSS 20.7% (higher than 97.5% of CVEs). CVSS 8.8 HIGH. ATT&CK: T1055 Process Injection; T1011 Exfiltration Over Other Network Medium. Priority 63.7 of 100.","summary":"Zyxel DSL CPE OS Command Injection Vulnerability","date_published":"2025-02-11T00:00:00.000Z","date_modified":"2026-06-17T07:46:48.000Z","tags":["kev","T1055","T1011"],"_patchfirst":{"reason":"kev","priority":63.7,"kev":{"dateAdded":"2025-02-11","ransomware":false},"epss":{"score":0.20703,"percentile":0.97529},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Zyxel","product":"DSL CPE Devices","techniqueIds":["T1055","T1011"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2025-21418#kev","url":"https://patchfirst.co/cve/CVE-2025-21418/","title":"[KEV] CVE-2025-21418: Microsoft Windows Ancillary Function Driver for WinSock Heap-Based Buffer Overflow Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2025-02-11. ENISA EUVD lists it as exploited. EPSS 2.1% (higher than 82% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1068 Exploitation for Privilege Escalation; T1005 Data from Local System; T1055 Process Injection. Priority 59.9 of 100.","summary":"Microsoft Windows Ancillary Function Driver for WinSock Heap-Based Buffer Overflow Vulnerability","date_published":"2025-02-11T00:00:00.000Z","date_modified":"2026-06-17T08:43:19.000Z","tags":["kev","T1068","T1005","T1055"],"_patchfirst":{"reason":"kev","priority":59.9,"kev":{"dateAdded":"2025-02-11","ransomware":false},"epss":{"score":0.02132,"percentile":0.81955},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1068","T1005","T1055"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2020-29574#kev","url":"https://patchfirst.co/cve/CVE-2020-29574/","title":"[KEV] CVE-2020-29574: CyberoamOS (CROS) SQL Injection Vulnerability","content_text":"Sophos · CyberoamOS. In CISA KEV since 2025-02-06, known ransomware use. ENISA EUVD lists it as exploited. EPSS 4.7% (higher than 91.8% of CVEs). CVSS 9.8 CRITICAL. ATT&CK: T1055 Process Injection; T1059 Command and Scripting Interpreter. Priority 73.2 of 100.","summary":"CyberoamOS (CROS) SQL Injection Vulnerability","date_published":"2025-02-06T00:00:00.000Z","date_modified":"2026-08-15T04:17:56.000Z","tags":["kev","ransomware","T1055","T1059"],"_patchfirst":{"reason":"kev","priority":73.2,"kev":{"dateAdded":"2025-02-06","ransomware":true},"epss":{"score":0.04696,"percentile":0.91787},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Sophos","product":"CyberoamOS","techniqueIds":["T1055","T1059"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2024-50603#kev","url":"https://patchfirst.co/cve/CVE-2024-50603/","title":"[KEV] CVE-2024-50603: Aviatrix Controllers OS Command Injection Vulnerability","content_text":"Aviatrix · Controllers. In CISA KEV since 2025-01-16. ENISA EUVD lists it as exploited. EPSS 98.5% (higher than 99.92% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1055 Process Injection; T1059 Command and Scripting Interpreter. Priority 69.8 of 100.","summary":"Aviatrix Controllers OS Command Injection Vulnerability","date_published":"2025-01-16T00:00:00.000Z","date_modified":"2026-06-17T08:04:47.000Z","tags":["kev","public-exploit","T1055","T1059"],"_patchfirst":{"reason":"kev","priority":69.8,"kev":{"dateAdded":"2025-01-16","ransomware":false},"epss":{"score":0.98518,"percentile":0.99921},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Aviatrix","product":"Controllers","techniqueIds":["T1055","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-0282#kev","url":"https://patchfirst.co/cve/CVE-2025-0282/","title":"[KEV] CVE-2025-0282: Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability","content_text":"Ivanti · Connect Secure, Policy Secure, and ZTA Gateways. In CISA KEV since 2025-01-08, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.98% of CVEs). CVSS 9.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1595 Active Scanning; T1003 OS Credential Dumping; T1055 Process Injection; T1018 Remote System Discovery; T1046 Network Service Discovery. Named in 2 threat reports. Priority 85.4 of 100.","summary":"Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability","date_published":"2025-01-08T00:00:00.000Z","date_modified":"2026-10-01T19:17:15.000Z","tags":["kev","ransomware","public-exploit","T1190","T1595","T1003","T1055","T1018","T1046"],"_patchfirst":{"reason":"kev","priority":85.4,"kev":{"dateAdded":"2025-01-08","ransomware":true},"epss":{"score":0.99981,"percentile":0.99981},"cvss":{"score":9,"severity":"CRITICAL","version":"3.1"},"vendor":"Ivanti","product":"Connect Secure, Policy Secure, and ZTA Gateways","techniqueIds":["T1190","T1595","T1003","T1055","T1018","T1046"],"reportCount":2,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2017-1000253#kev","url":"https://patchfirst.co/cve/CVE-2017-1000253/","title":"[KEV] CVE-2017-1000253: Linux Kernel PIE Stack Buffer Corruption Vulnerability","content_text":"Linux · Kernel. In CISA KEV since 2024-09-09, known ransomware use. ENISA EUVD lists it as exploited. EPSS 10.7% (higher than 95.8% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1055 Process Injection. Priority 77.6 of 100.","summary":"Linux Kernel PIE Stack Buffer Corruption Vulnerability","date_published":"2024-09-09T00:00:00.000Z","date_modified":"2026-06-17T00:58:59.000Z","tags":["kev","ransomware","public-exploit","T1055"],"_patchfirst":{"reason":"kev","priority":77.6,"kev":{"dateAdded":"2024-09-09","ransomware":true},"epss":{"score":0.10695,"percentile":0.95806},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Linux","product":"Kernel","techniqueIds":["T1055"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-6548#kev","url":"https://patchfirst.co/cve/CVE-2023-6548/","title":"[KEV] CVE-2023-6548: Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability","content_text":"Citrix · NetScaler ADC and NetScaler Gateway. In CISA KEV since 2024-01-17. ENISA EUVD lists it as exploited. EPSS 3.2% (higher than 88.1% of CVEs). CVSS 8.8 HIGH. ATT&CK: T1055 Process Injection. Priority 61.8 of 100.","summary":"Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability","date_published":"2024-01-17T00:00:00.000Z","date_modified":"2026-06-17T06:50:58.000Z","tags":["kev","T1055"],"_patchfirst":{"reason":"kev","priority":61.8,"kev":{"dateAdded":"2024-01-17","ransomware":false},"epss":{"score":0.03191,"percentile":0.88083},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Citrix","product":"NetScaler ADC and NetScaler Gateway","techniqueIds":["T1055"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}}]}