{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: CVEs linked to T1059.003 Windows Command Shell","home_page_url":"https://patchfirst.co/technique/T1059.003/","feed_url":"https://patchfirst.co/feed/technique/T1059.003.json","description":"New and newly exploited CVEs that lead to ATT&CK T1059.003 Windows Command Shell, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2025-49704#kev","url":"https://patchfirst.co/cve/CVE-2025-49704/","title":"[KEV] CVE-2025-49704: Microsoft SharePoint Code Injection Vulnerability","content_text":"Microsoft · SharePoint. In CISA KEV since 2025-07-22, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059.003 Windows Command Shell. Named in 1 threat report. Priority 83.0 of 100.","summary":"Microsoft SharePoint Code Injection Vulnerability","date_published":"2025-07-22T00:00:00.000Z","date_modified":"2026-06-17T09:31:46.000Z","tags":["kev","ransomware","public-exploit","T1190","T1059.003"],"_patchfirst":{"reason":"kev","priority":83,"kev":{"dateAdded":"2025-07-22","ransomware":true},"epss":{"score":0.99995,"percentile":0.99988},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"SharePoint","techniqueIds":["T1190","T1059.003"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-49706#kev","url":"https://patchfirst.co/cve/CVE-2025-49706/","title":"[KEV] CVE-2025-49706: Microsoft SharePoint Improper Authentication Vulnerability","content_text":"Microsoft · SharePoint. In CISA KEV since 2025-07-22, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.1% (higher than 99.93% of CVEs). CVSS 6.5 MEDIUM. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1505 Server Software Component; T1059.003 Windows Command Shell. Named in 1 threat report. Priority 81.4 of 100.","summary":"Microsoft SharePoint Improper Authentication Vulnerability","date_published":"2025-07-22T00:00:00.000Z","date_modified":"2026-08-04T05:16:34.000Z","tags":["kev","ransomware","public-exploit","T1190","T1505","T1059.003"],"_patchfirst":{"reason":"kev","priority":81.4,"kev":{"dateAdded":"2025-07-22","ransomware":true},"epss":{"score":0.99057,"percentile":0.99931},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.1"},"vendor":"Microsoft","product":"SharePoint","techniqueIds":["T1190","T1505","T1059.003"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-42793#kev","url":"https://patchfirst.co/cve/CVE-2023-42793/","title":"[KEV] CVE-2023-42793: JetBrains TeamCity Authentication Bypass Vulnerability","content_text":"JetBrains · TeamCity. In CISA KEV since 2023-10-04, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.98% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059.003 Windows Command Shell. Priority 79.9 of 100.","summary":"JetBrains TeamCity Authentication Bypass Vulnerability","date_published":"2023-10-04T00:00:00.000Z","date_modified":"2026-06-17T06:24:31.000Z","tags":["kev","ransomware","public-exploit","T1190","T1059.003"],"_patchfirst":{"reason":"kev","priority":79.9,"kev":{"dateAdded":"2023-10-04","ransomware":true},"epss":{"score":0.99987,"percentile":0.99983},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"JetBrains","product":"TeamCity","techniqueIds":["T1190","T1059.003"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-27532#kev","url":"https://patchfirst.co/cve/CVE-2023-27532/","title":"[KEV] CVE-2023-27532: Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function Vulnerability","content_text":"Veeam · Backup & Replication. In CISA KEV since 2023-08-22, known ransomware use. ENISA EUVD lists it as exploited. EPSS 80.6% (higher than 99.62% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1133 External Remote Services; T1059.003 Windows Command Shell; T1087 Account Discovery; T1087.001 Local Account; T1486 Data Encrypted for Impact; T1555 Credentials from Password Stores. Named in 1 threat report. Priority 82.0 of 100.","summary":"Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function Vulnerability","date_published":"2023-08-22T00:00:00.000Z","date_modified":"2026-06-17T05:45:24.000Z","tags":["kev","ransomware","public-exploit","T1133","T1059.003","T1087","T1087.001","T1486","T1555"],"_patchfirst":{"reason":"kev","priority":82,"kev":{"dateAdded":"2023-08-22","ransomware":true},"epss":{"score":0.80599,"percentile":0.99624},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"Veeam","product":"Backup & Replication","techniqueIds":["T1133","T1059.003","T1087","T1087.001","T1486","T1555"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-40449#kev","url":"https://patchfirst.co/cve/CVE-2021-40449/","title":"[KEV] CVE-2021-40449: Microsoft Windows Win32k Privilege Escalation Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2021-11-17, known ransomware use. ENISA EUVD lists it as exploited. EPSS 81.9% (higher than 99.65% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1566 Phishing; T1068 Exploitation for Privilege Escalation; T1016 System Network Configuration Discovery; T1027 Obfuscated Files or Information; T1059.003 Windows Command Shell; T1071.001 Web Protocols; +2 more. Priority 78.4 of 100.","summary":"Microsoft Windows Win32k Privilege Escalation Vulnerability","date_published":"2021-11-17T00:00:00.000Z","date_modified":"2026-06-17T04:06:56.000Z","tags":["kev","ransomware","public-exploit","T1566","T1068","T1016","T1027","T1059.003","T1071.001","T1082","T1573.001"],"_patchfirst":{"reason":"kev","priority":78.4,"kev":{"dateAdded":"2021-11-17","ransomware":true},"epss":{"score":0.81936,"percentile":0.9965},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1566","T1068","T1016","T1027","T1059.003","T1071.001","T1082","T1573.001"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}}]}