https://patchfirst.co/technique/T1059.004/New and newly exploited CVEs that lead to ATT&CK T1059.004 Unix Shell, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.en-gb360Sat, 31 Oct 2026 05:11:25 GMThttps://patchfirst.co/cve/CVE-2026-48907/CVE-2026-48907#kevTue, 16 Jun 2026 00:00:00 GMTWidget Factory · Joomla Content Editor . In CISA KEV since 2026-06-16. ENISA EUVD lists it as exploited. EPSS 85.4% (higher than 99.72% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059.004 Unix Shell. Priority 74.8 of 100.kevpublic-exploitT1190T1059.004https://patchfirst.co/cve/CVE-2014-6278/CVE-2014-6278#kevThu, 02 Oct 2025 00:00:00 GMTGNU · GNU Bash. In CISA KEV since 2025-10-02. ENISA EUVD lists it as exploited. EPSS 99.7% (higher than 99.95% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1059.004 Unix Shell. Named in 1 threat report. Priority 73.0 of 100.kevpublic-exploitT1059.004https://patchfirst.co/cve/CVE-2025-25257/CVE-2025-25257#kevFri, 18 Jul 2025 00:00:00 GMTFortinet · FortiWeb. In CISA KEV since 2025-07-18. ENISA EUVD lists it as exploited. EPSS 99.9% (higher than 99.97% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1055 Process Injection; T1068 Exploitation for Privilege Escalation; T1190 Exploit Public-Facing Application; T1059.004 Unix Shell; T1485 Data Destruction. Priority 69.9 of 100.kevpublic-exploitT1055T1068T1190T1059.004T1485https://patchfirst.co/cve/CVE-2016-10033/CVE-2016-10033#kevMon, 07 Jul 2025 00:00:00 GMTPHP · PHPMailer. In CISA KEV since 2025-07-07. ENISA EUVD lists it as exploited. EPSS 99.7% (higher than 99.95% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059.004 Unix Shell. Priority 69.9 of 100.kevpublic-exploitT1190T1059.004https://patchfirst.co/cve/CVE-2023-39780/CVE-2023-39780#kevMon, 02 Jun 2025 00:00:00 GMTASUS · RT-AX55 Routers. In CISA KEV since 2025-06-02. ENISA EUVD lists it as exploited. EPSS 39.5% (higher than 98.6% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1133 External Remote Services; T1588 Obtain Capabilities; T1059.004 Unix Shell; T1021.004 SSH. Priority 68.9 of 100.kevpublic-exploitT1078T1133T1588T1059.004T1021.004https://patchfirst.co/cve/CVE-2024-27443/CVE-2024-27443#kevMon, 19 May 2025 00:00:00 GMTSynacor · Zimbra Collaboration Suite (ZCS). In CISA KEV since 2025-05-19. ENISA EUVD lists it as exploited. EPSS 24.6% (higher than 97.9% of CVEs). CVSS 6.1 MEDIUM. Public exploit code exists. ATT&CK: T1566.002 Spearphishing Link; T1059.004 Unix Shell; T1114 Email Collection; T1041 Exfiltration Over C2 Channel. Priority 66.8 of 100.kevpublic-exploitT1566.002T1059.004T1114T1041https://patchfirst.co/cve/CVE-2023-44221/CVE-2023-44221#kevThu, 01 May 2025 00:00:00 GMTSonicWall · SMA100 Appliances. In CISA KEV since 2025-05-01. ENISA EUVD lists it as exploited. EPSS 76.3% (higher than 99.54% of CVEs). CVSS 7.2 HIGH. ATT&CK: T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism; T1059.004 Unix Shell; T1543 Create or Modify System Process. Priority 62.9 of 100.kevT1068T1548T1059.004T1543https://patchfirst.co/cve/CVE-2024-51378/CVE-2024-51378#kevWed, 04 Dec 2024 00:00:00 GMTCyberPersons · CyberPanel. In CISA KEV since 2024-12-04, known ransomware use. ENISA EUVD lists it as exploited. EPSS 94.7% (higher than 99.86% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059.004 Unix Shell. Priority 79.8 of 100.kevransomwarepublic-exploitT1190T1059.004https://patchfirst.co/cve/CVE-2024-24919/CVE-2024-24919#kevThu, 30 May 2024 00:00:00 GMTCheck Point · Quantum Security Gateways. In CISA KEV since 2024-05-30, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.98% of CVEs). CVSS 8.6 HIGH. Public exploit code exists. ATT&CK: T1202 Indirect Command Execution; T1005 Data from Local System; T1003.003 NTDS; T1003.008 /etc/passwd and /etc/shadow; T1059.004 Unix Shell. Priority 79.0 of 100.kevransomwarepublic-exploitT1202T1005T1003.003T1003.008T1059.004https://patchfirst.co/cve/CVE-2021-36380/CVE-2021-36380#kevTue, 05 Mar 2024 00:00:00 GMTSunhillo · SureLine. In CISA KEV since 2024-03-05. ENISA EUVD lists it as exploited. EPSS 97.8% (higher than 99.91% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059.004 Unix Shell. Priority 69.8 of 100.kevpublic-exploitT1190T1059.004https://patchfirst.co/cve/CVE-2023-46604/CVE-2023-46604#kevThu, 02 Nov 2023 00:00:00 GMTApache · ActiveMQ. In CISA KEV since 2023-11-02, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059.004 Unix Shell; T1053.005 Scheduled Task. Priority 79.9 of 100.kevransomwarepublic-exploitT1190T1059.004T1053.005https://patchfirst.co/cve/CVE-2022-33891/CVE-2022-33891#kevTue, 07 Mar 2023 00:00:00 GMTApache · Spark. In CISA KEV since 2023-03-07. ENISA EUVD lists it as exploited. EPSS 93.2% (higher than 99.83% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059.004 Unix Shell. Named in 1 threat report. Priority 73.0 of 100.kevpublic-exploitT1190T1059.004https://patchfirst.co/cve/CVE-2022-44877/CVE-2022-44877#kevTue, 17 Jan 2023 00:00:00 GMTCWP · Control Web Panel. In CISA KEV since 2023-01-17. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059.004 Unix Shell. Priority 69.9 of 100.kevpublic-exploitT1190T1059.004https://patchfirst.co/cve/CVE-2022-20699/CVE-2022-20699#kevThu, 03 Mar 2022 00:00:00 GMTCisco · Small Business RV160, RV260, RV340, and RV345 Series Routers. In CISA KEV since 2022-03-03. ENISA EUVD lists it as exploited. EPSS 72.5% (higher than 99.44% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1133 External Remote Services; T1059.004 Unix Shell. Priority 69.7 of 100.kevpublic-exploitT1133T1059.004https://patchfirst.co/cve/CVE-2022-20700/CVE-2022-20700#kevThu, 03 Mar 2022 00:00:00 GMTCisco · Small Business RV160, RV260, RV340, and RV345 Series Routers. In CISA KEV since 2022-03-03. ENISA EUVD lists it as exploited. EPSS 5.7% (higher than 93% of CVEs). CVSS 9.8 CRITICAL. ATT&CK: T1190 Exploit Public-Facing Application; T1059.004 Unix Shell. Priority 63.5 of 100.kevT1190T1059.004https://patchfirst.co/cve/CVE-2014-6271/CVE-2014-6271#kevFri, 28 Jan 2022 00:00:00 GMTGNU · Bourne-Again Shell (Bash). In CISA KEV since 2022-01-28. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1133 External Remote Services; T1190 Exploit Public-Facing Application; T1059.004 Unix Shell. Named in 2 threat reports. Priority 76.0 of 100.kevpublic-exploitT1133T1190T1059.004https://patchfirst.co/cve/CVE-2014-7169/CVE-2014-7169#kevFri, 28 Jan 2022 00:00:00 GMTGNU · Bourne-Again Shell (Bash). In CISA KEV since 2022-01-28. ENISA EUVD lists it as exploited. EPSS 99.9% (higher than 99.97% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1133 External Remote Services; T1190 Exploit Public-Facing Application; T1059.004 Unix Shell. Priority 69.9 of 100.kevpublic-exploitT1133T1190T1059.004