{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: CVEs linked to T1078 Valid Accounts","home_page_url":"https://patchfirst.co/technique/T1078/","feed_url":"https://patchfirst.co/feed/technique/T1078.json","description":"New and newly exploited CVEs that lead to ATT&CK T1078 Valid Accounts, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2026-41709#kev","url":"https://patchfirst.co/cve/CVE-2026-41709/","title":"[KEV] CVE-2026-41709: Broadcom VMWare ESX Insufficient Logging Vulnerability","content_text":"Broadcom · VMware ESX. In CISA KEV since 2026-10-28. ENISA EUVD lists it as exploited. EPSS 0.7% (higher than 52.7% of CVEs). CVSS 2.7 LOW. ATT&CK: T1078 Valid Accounts. Priority 59.8 of 100.","summary":"Broadcom VMWare ESX Insufficient Logging Vulnerability","date_published":"2026-10-28T00:00:00.000Z","date_modified":"2026-10-29T17:29:11.000Z","tags":["kev","T1078"],"_patchfirst":{"reason":"kev","priority":59.8,"kev":{"dateAdded":"2026-10-28","ransomware":false},"epss":{"score":0.00689,"percentile":0.52718},"cvss":{"score":2.7,"severity":"LOW","version":"3.1"},"vendor":"Broadcom","product":"VMware ESX","techniqueIds":["T1078"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2026-114625#kev","url":"https://patchfirst.co/cve/CVE-2026-114625/","title":"[KEV] CVE-2026-114625: Arista VeloCloud Orchestrator SQL Injection Vulnerability","content_text":"Arista · VeloCloud Orchestrator. In CISA KEV since 2026-10-23. ENISA EUVD lists it as exploited. EPSS 1.0% (higher than 63.5% of CVEs). CVSS 9.9 CRITICAL. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1068 Exploitation for Privilege Escalation; T1190 Exploit Public-Facing Application. Priority 72.5 of 100.","summary":"Arista VeloCloud Orchestrator SQL Injection Vulnerability","date_published":"2026-10-23T00:00:00.000Z","date_modified":"2026-10-26T13:10:00.000Z","tags":["kev","public-exploit","T1078","T1068","T1190"],"_patchfirst":{"reason":"kev","priority":72.5,"kev":{"dateAdded":"2026-10-23","ransomware":false},"epss":{"score":0.01025,"percentile":0.63541},"cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1"},"vendor":"Arista","product":"VeloCloud Orchestrator","techniqueIds":["T1078","T1068","T1190"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-96656#kev","url":"https://patchfirst.co/cve/CVE-2026-96656/","title":"[KEV] CVE-2026-96656: Plex Media Server External Control of File Name or Path Vulnerability","content_text":"Plex · Media Server. In CISA KEV since 2026-10-20. ENISA EUVD lists it as exploited. EPSS 1.8% (higher than 78.3% of CVEs). CVSS 7.2 HIGH. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1059 Command and Scripting Interpreter. Priority 73.1 of 100.","summary":"Plex Media Server External Control of File Name or Path Vulnerability","date_published":"2026-10-20T00:00:00.000Z","date_modified":"2026-10-21T13:09:18.000Z","tags":["kev","public-exploit","T1078","T1059"],"_patchfirst":{"reason":"kev","priority":73.1,"kev":{"dateAdded":"2026-10-20","ransomware":false},"epss":{"score":0.01785,"percentile":0.78279},"cvss":{"score":7.2,"severity":"HIGH","version":"3.1"},"vendor":"Plex","product":"Media Server","techniqueIds":["T1078","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-110936#kev","url":"https://patchfirst.co/cve/CVE-2026-110936/","title":"[KEV] CVE-2026-110936: Siemens Software Center Uncontrolled Search Path Element Vulnerability","content_text":"Siemens · Software Center. In CISA KEV since 2026-10-20. ENISA EUVD lists it as exploited. EPSS 1.0% (higher than 61.7% of CVEs). CVSS 6.7 MEDIUM. ATT&CK: T1078 Valid Accounts; T1059 Command and Scripting Interpreter; T1574.008 Path Interception by Search Order Hijacking. Priority 65.0 of 100.","summary":"Siemens Software Center Uncontrolled Search Path Element Vulnerability","date_published":"2026-10-20T00:00:00.000Z","date_modified":"2026-10-21T13:10:11.000Z","tags":["kev","T1078","T1059","T1574.008"],"_patchfirst":{"reason":"kev","priority":65,"kev":{"dateAdded":"2026-10-20","ransomware":false},"epss":{"score":0.00967,"percentile":0.6171},"cvss":{"score":6.7,"severity":"MEDIUM","version":"3.1"},"vendor":"Siemens","product":"Software Center","techniqueIds":["T1078","T1059","T1574.008"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2026-105133#kev","url":"https://patchfirst.co/cve/CVE-2026-105133/","title":"[KEV] CVE-2026-105133: Ahsay AhsayCBS Improper Authentication Vulnerability","content_text":"Ahsay · AhsayCBS. In CISA KEV since 2026-10-14. ENISA EUVD lists it as exploited. EPSS 79.5% (higher than 99.6% of CVEs). CVSS 7.3 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts. Priority 78.0 of 100.","summary":"Ahsay AhsayCBS Improper Authentication Vulnerability","date_published":"2026-10-14T00:00:00.000Z","date_modified":"2026-10-26T18:07:09.000Z","tags":["kev","public-exploit","T1190","T1078"],"_patchfirst":{"reason":"kev","priority":78,"kev":{"dateAdded":"2026-10-14","ransomware":false},"epss":{"score":0.7947,"percentile":0.99602},"cvss":{"score":7.3,"severity":"HIGH","version":"3.1"},"vendor":"Ahsay","product":"AhsayCBS","techniqueIds":["T1190","T1078"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-0322#kev","url":"https://patchfirst.co/cve/CVE-2026-0322/","title":"[KEV] CVE-2026-0322: Palo Alto Networks PAN-OS Code Injection Vulnerability","content_text":"Palo Alto Networks · PAN-OS. In CISA KEV since 2026-10-14. ENISA EUVD lists it as exploited. EPSS 1.7% (higher than 77.7% of CVEs). CVSS 7.2 HIGH. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1059 Command and Scripting Interpreter. Priority 73.6 of 100.","summary":"Palo Alto Networks PAN-OS Code Injection Vulnerability","date_published":"2026-10-14T00:00:00.000Z","date_modified":"2026-10-15T13:47:26.000Z","tags":["kev","public-exploit","T1078","T1059"],"_patchfirst":{"reason":"kev","priority":73.6,"kev":{"dateAdded":"2026-10-14","ransomware":false},"epss":{"score":0.0174,"percentile":0.77702},"cvss":{"score":7.2,"severity":"HIGH","version":"3.1"},"vendor":"Palo Alto Networks","product":"PAN-OS","techniqueIds":["T1078","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-22894#kev","url":"https://patchfirst.co/cve/CVE-2023-22894/","title":"[KEV] CVE-2023-22894: Strapi Cleartext Storage of Sensitive Information Vulnerability","content_text":"Strapi · Strapi. In CISA KEV since 2026-10-08. ENISA EUVD lists it as exploited. EPSS 4.1% (higher than 90.8% of CVEs). CVSS 4.9 MEDIUM. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1212 Exploitation for Credential Access. Priority 74.6 of 100.","summary":"Strapi Cleartext Storage of Sensitive Information Vulnerability","date_published":"2026-10-08T00:00:00.000Z","date_modified":"2026-10-09T14:20:41.000Z","tags":["kev","public-exploit","T1078","T1212"],"_patchfirst":{"reason":"kev","priority":74.6,"kev":{"dateAdded":"2026-10-08","ransomware":false},"epss":{"score":0.04114,"percentile":0.90767},"cvss":{"score":4.9,"severity":"MEDIUM","version":"3.1"},"vendor":"Strapi","product":"Strapi","techniqueIds":["T1078","T1212"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-76504#kev","url":"https://patchfirst.co/cve/CVE-2026-76504/","title":"[KEV] CVE-2026-76504: Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability","content_text":"Cisco · Catalyst SD-WAN Manager. In CISA KEV since 2026-09-30. ENISA EUVD lists it as exploited. EPSS 38.9% (higher than 98.6% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts. Priority 79.6 of 100.","summary":"Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability","date_published":"2026-09-30T00:00:00.000Z","date_modified":"2026-10-03T00:16:39.000Z","tags":["kev","public-exploit","T1190","T1078"],"_patchfirst":{"reason":"kev","priority":79.6,"kev":{"dateAdded":"2026-09-30","ransomware":false},"epss":{"score":0.38928,"percentile":0.98587},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Cisco","product":"Catalyst SD-WAN Manager","techniqueIds":["T1190","T1078"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-5430#kev","url":"https://patchfirst.co/cve/CVE-2026-5430/","title":"[KEV] CVE-2026-5430: WSO2 Multiple Products Path Traversal Vulnerability","content_text":"WSO2 · Multiple Products. In CISA KEV since 2026-09-24. ENISA EUVD lists it as exploited. EPSS 22.4% (higher than 97.7% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts; T1550 Use Alternate Authentication Material. Priority 79.5 of 100.","summary":"WSO2 Multiple Products Path Traversal Vulnerability","date_published":"2026-09-24T00:00:00.000Z","date_modified":"2026-09-25T12:53:05.000Z","tags":["kev","public-exploit","T1190","T1078","T1550"],"_patchfirst":{"reason":"kev","priority":79.5,"kev":{"dateAdded":"2026-09-24","ransomware":false},"epss":{"score":0.2239,"percentile":0.97691},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"WSO2","product":"Multiple Products","techniqueIds":["T1190","T1078","T1550"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-87886","url":"https://patchfirst.co/cve/CVE-2026-87886/","title":"CVE-2026-87886: Acronis Backup Incorrect Default Permissions Vulnerability","content_text":"Acronis · Backup. In CISA KEV since 2026-09-16. ENISA EUVD lists it as exploited. EPSS 0.2% (higher than 14.3% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1078 Valid Accounts; T1068 Exploitation for Privilege Escalation. Priority 56.3 of 100.","summary":"Acronis Backup Incorrect Default Permissions Vulnerability","date_published":"2026-09-17T00:00:00.000Z","date_modified":"2026-09-18T19:29:35.000Z","tags":["kev","T1078","T1068"],"_patchfirst":{"reason":"published","priority":56.3,"kev":{"dateAdded":"2026-09-16","ransomware":false},"epss":{"score":0.00233,"percentile":0.14253},"cvss":{"score":7.8,"severity":"HIGH","version":"3.0"},"vendor":"Acronis","product":"Backup","techniqueIds":["T1078","T1068"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2026-76460#kev","url":"https://patchfirst.co/cve/CVE-2026-76460/","title":"[KEV] CVE-2026-76460: Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability","content_text":"Cisco · Identity Services Engine. In CISA KEV since 2026-09-16. ENISA EUVD lists it as exploited. EPSS 75.6% (higher than 99.52% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts. Priority 79.9 of 100.","summary":"Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability","date_published":"2026-09-16T00:00:00.000Z","date_modified":"2026-10-07T19:17:40.000Z","tags":["kev","public-exploit","T1190","T1078"],"_patchfirst":{"reason":"kev","priority":79.9,"kev":{"dateAdded":"2026-09-16","ransomware":false},"epss":{"score":0.75599,"percentile":0.99519},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"Cisco","product":"Identity Services Engine","techniqueIds":["T1190","T1078"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-42016#kev","url":"https://patchfirst.co/cve/CVE-2026-42016/","title":"[KEV] CVE-2026-42016: JFrog Artifactory Incorrect Authorization Vulnerability","content_text":"JFrog · Artifactory. In CISA KEV since 2026-09-11. ENISA EUVD lists it as exploited. EPSS 8.6% (higher than 95.1% of CVEs). CVSS 8.8 HIGH. ATT&CK: T1078 Valid Accounts. Priority 73.2 of 100.","summary":"JFrog Artifactory Incorrect Authorization Vulnerability","date_published":"2026-09-11T00:00:00.000Z","date_modified":"2026-10-24T13:10:00.000Z","tags":["kev","T1078"],"_patchfirst":{"reason":"kev","priority":73.2,"kev":{"dateAdded":"2026-09-11","ransomware":false},"epss":{"score":0.08643,"percentile":0.95103},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"JFrog","product":"Artifactory","techniqueIds":["T1078"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2026-84869#kev","url":"https://patchfirst.co/cve/CVE-2026-84869/","title":"[KEV] CVE-2026-84869: ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability","content_text":"ConnectWise · ScreenConnect. In CISA KEV since 2026-09-11. ENISA EUVD lists it as exploited. EPSS 0.9% (higher than 60.4% of CVEs). CVSS 9.9 CRITICAL. ATT&CK: T1078 Valid Accounts; T1059 Command and Scripting Interpreter; T1105 Ingress Tool Transfer. Priority 67.0 of 100.","summary":"ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability","date_published":"2026-09-11T00:00:00.000Z","date_modified":"2026-09-12T04:16:42.000Z","tags":["kev","T1078","T1059","T1105"],"_patchfirst":{"reason":"kev","priority":67,"kev":{"dateAdded":"2026-09-11","ransomware":false},"epss":{"score":0.00924,"percentile":0.60395},"cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1"},"vendor":"ConnectWise","product":"ScreenConnect","techniqueIds":["T1078","T1059","T1105"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2026-82329#kev","url":"https://patchfirst.co/cve/CVE-2026-82329/","title":"[KEV] CVE-2026-82329: JFrog Artifactory Improper Authentication Vulnerability","content_text":"JFrog · Artifactory. In CISA KEV since 2026-09-02. ENISA EUVD lists it as exploited. EPSS 14.4% (higher than 96.6% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts. Priority 79.2 of 100.","summary":"JFrog Artifactory Improper Authentication Vulnerability","date_published":"2026-09-02T00:00:00.000Z","date_modified":"2026-09-03T13:06:15.000Z","tags":["kev","public-exploit","T1190","T1078"],"_patchfirst":{"reason":"kev","priority":79.2,"kev":{"dateAdded":"2026-09-02","ransomware":false},"epss":{"score":0.14372,"percentile":0.96613},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"JFrog","product":"Artifactory","techniqueIds":["T1190","T1078"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-83548#kev","url":"https://patchfirst.co/cve/CVE-2026-83548/","title":"[KEV] CVE-2026-83548: SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability","content_text":"SonicWall · SMA1000 Appliances. In CISA KEV since 2026-09-02. ENISA EUVD lists it as exploited. EPSS 8.0% (higher than 94.8% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts. Priority 79.0 of 100.","summary":"SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability","date_published":"2026-09-02T00:00:00.000Z","date_modified":"2026-09-03T13:06:16.000Z","tags":["kev","public-exploit","T1190","T1078"],"_patchfirst":{"reason":"kev","priority":79,"kev":{"dateAdded":"2026-09-02","ransomware":false},"epss":{"score":0.08043,"percentile":0.94779},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"SonicWall","product":"SMA1000 Appliances","techniqueIds":["T1190","T1078"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-83549#kev","url":"https://patchfirst.co/cve/CVE-2026-83549/","title":"[KEV] CVE-2026-83549: SonicWall SMA1000 Appliances OS Command Injection Vulnerability","content_text":"SonicWall · SMA1000 Appliances. In CISA KEV since 2026-09-02. ENISA EUVD lists it as exploited. EPSS 9.9% (higher than 95.6% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1059 Command and Scripting Interpreter. Priority 77.6 of 100.","summary":"SonicWall SMA1000 Appliances OS Command Injection Vulnerability","date_published":"2026-09-02T00:00:00.000Z","date_modified":"2026-09-21T14:17:21.000Z","tags":["kev","public-exploit","T1078","T1059"],"_patchfirst":{"reason":"kev","priority":77.6,"kev":{"dateAdded":"2026-09-02","ransomware":false},"epss":{"score":0.09889,"percentile":0.95568},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"SonicWall","product":"SMA1000 Appliances","techniqueIds":["T1078","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-59822#kev","url":"https://patchfirst.co/cve/CVE-2026-59822/","title":"[KEV] CVE-2026-59822: BerriAI LiteLLM Improper Authentication Vulnerability","content_text":"BerriAI · LiteLLM. In CISA KEV since 2026-09-02. ENISA EUVD lists it as exploited. EPSS 0.8% (higher than 57.7% of CVEs). CVSS 8.2 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts. Priority 65.3 of 100.","summary":"BerriAI LiteLLM Improper Authentication Vulnerability","date_published":"2026-09-02T00:00:00.000Z","date_modified":"2026-10-25T17:10:00.000Z","tags":["kev","public-exploit","T1190","T1078"],"_patchfirst":{"reason":"kev","priority":65.3,"kev":{"dateAdded":"2026-09-02","ransomware":false},"epss":{"score":0.00836,"percentile":0.57687},"cvss":{"score":8.2,"severity":"HIGH","version":"3.1"},"vendor":"BerriAI","product":"LiteLLM","techniqueIds":["T1190","T1078"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2015-5287#kev","url":"https://patchfirst.co/cve/CVE-2015-5287/","title":"[KEV] CVE-2015-5287: Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability","content_text":"Red Hat · Automatic Bug Reporting Tool. In CISA KEV since 2026-08-26. ENISA EUVD lists it as exploited. EPSS 5.0% (higher than 92.2% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1068 Exploitation for Privilege Escalation. Priority 76.9 of 100.","summary":"Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability","date_published":"2026-08-26T00:00:00.000Z","date_modified":"2026-08-27T04:16:38.000Z","tags":["kev","public-exploit","T1078","T1068"],"_patchfirst":{"reason":"kev","priority":76.9,"kev":{"dateAdded":"2026-08-26","ransomware":false},"epss":{"score":0.05003,"percentile":0.92227},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Red Hat","product":"Automatic Bug Reporting Tool","techniqueIds":["T1078","T1068"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-55040#kev","url":"https://patchfirst.co/cve/CVE-2026-55040/","title":"[KEV] CVE-2026-55040: Microsoft SharePoint Weak Authentication Vulnerability","content_text":"Microsoft · SharePoint. In CISA KEV since 2026-08-18. ENISA EUVD lists it as exploited. EPSS 69.5% (higher than 99.36% of CVEs). CVSS 9.1 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts. Priority 79.2 of 100.","summary":"Microsoft SharePoint Weak Authentication Vulnerability","date_published":"2026-08-18T00:00:00.000Z","date_modified":"2026-08-19T04:17:23.000Z","tags":["kev","public-exploit","T1190","T1078"],"_patchfirst":{"reason":"kev","priority":79.2,"kev":{"dateAdded":"2026-08-18","ransomware":false},"epss":{"score":0.69536,"percentile":0.99362},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1"},"vendor":"Microsoft","product":"SharePoint","techniqueIds":["T1190","T1078"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-18556#kev","url":"https://patchfirst.co/cve/CVE-2026-18556/","title":"[KEV] CVE-2026-18556: N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability","content_text":"N-able · N-central. In CISA KEV since 2026-08-04. ENISA EUVD lists it as exploited. EPSS 7.9% (higher than 94.7% of CVEs). CVSS 7.4 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts. Named in 5 threat reports. Priority 82.1 of 100.","summary":"N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability","date_published":"2026-08-04T00:00:00.000Z","date_modified":"2026-10-23T22:10:00.000Z","tags":["kev","public-exploit","T1190","T1078"],"_patchfirst":{"reason":"kev","priority":82.1,"kev":{"dateAdded":"2026-08-04","ransomware":false},"epss":{"score":0.07882,"percentile":0.94702},"cvss":{"score":7.4,"severity":"HIGH","version":"3.1"},"vendor":"N-able","product":"N-central","techniqueIds":["T1190","T1078"],"reportCount":5,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-18577#kev","url":"https://patchfirst.co/cve/CVE-2026-18577/","title":"[KEV] CVE-2026-18577: N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability","content_text":"N-able · N-central. In CISA KEV since 2026-08-03. ENISA EUVD lists it as exploited. EPSS 14.6% (higher than 96.7% of CVEs). CVSS 8.1 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts. Named in 7 threat reports. Priority 88.0 of 100.","summary":"N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability","date_published":"2026-08-03T00:00:00.000Z","date_modified":"2026-10-23T22:10:00.000Z","tags":["kev","public-exploit","T1190","T1078"],"_patchfirst":{"reason":"kev","priority":88,"kev":{"dateAdded":"2026-08-03","ransomware":false},"epss":{"score":0.14622,"percentile":0.96651},"cvss":{"score":8.1,"severity":"HIGH","version":"3.1"},"vendor":"N-able","product":"N-central","techniqueIds":["T1190","T1078"],"reportCount":7,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-20316#kev","url":"https://patchfirst.co/cve/CVE-2026-20316/","title":"[KEV] CVE-2026-20316: Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability","content_text":"Cisco · Secure Firewall Management Center (FMC). In CISA KEV since 2026-07-29, known ransomware use. ENISA EUVD lists it as exploited. EPSS 35.1% (higher than 98.4% of CVEs). CVSS 5.3 MEDIUM. ATT&CK: T1078 Valid Accounts; T1005 Data from Local System. Named in 1 threat report. Priority 80.3 of 100.","summary":"Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability","date_published":"2026-07-29T00:00:00.000Z","date_modified":"2026-10-24T13:10:00.000Z","tags":["kev","ransomware","T1078","T1005"],"_patchfirst":{"reason":"kev","priority":80.3,"kev":{"dateAdded":"2026-07-29","ransomware":true},"epss":{"score":0.35096,"percentile":0.98435},"cvss":{"score":5.3,"severity":"MEDIUM","version":"3.1"},"vendor":"Cisco","product":"Secure Firewall Management Center (FMC)","techniqueIds":["T1078","T1005"],"reportCount":1,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2026-16232#kev","url":"https://patchfirst.co/cve/CVE-2026-16232/","title":"[KEV] CVE-2026-16232: Check Point SmartConsole Improper Authentication Vulnerability","content_text":"Check Point · SmartConsole. In CISA KEV since 2026-07-22. ENISA EUVD lists it as exploited. EPSS 3.5% (higher than 89.2% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts. Named in 1 threat report. Priority 76.6 of 100.","summary":"Check Point SmartConsole Improper Authentication Vulnerability","date_published":"2026-07-22T00:00:00.000Z","date_modified":"2026-10-24T13:10:00.000Z","tags":["kev","public-exploit","T1190","T1078"],"_patchfirst":{"reason":"kev","priority":76.6,"kev":{"dateAdded":"2026-07-22","ransomware":false},"epss":{"score":0.03517,"percentile":0.89205},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Check Point","product":"SmartConsole","techniqueIds":["T1190","T1078"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-15410#kev","url":"https://patchfirst.co/cve/CVE-2026-15410/","title":"[KEV] CVE-2026-15410: SonicWall SMA1000 Appliances Code Injection Vulnerability","content_text":"SonicWall · SMA1000 Appliances. In CISA KEV since 2026-07-14, known ransomware use. ENISA EUVD lists it as exploited. EPSS 11.8% (higher than 96.1% of CVEs). CVSS 7.2 HIGH. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1059 Command and Scripting Interpreter. Named in 1 threat report. Priority 86.1 of 100.","summary":"SonicWall SMA1000 Appliances Code Injection Vulnerability","date_published":"2026-07-14T00:00:00.000Z","date_modified":"2026-10-24T21:10:00.000Z","tags":["kev","ransomware","public-exploit","T1078","T1059"],"_patchfirst":{"reason":"kev","priority":86.1,"kev":{"dateAdded":"2026-07-14","ransomware":true},"epss":{"score":0.11791,"percentile":0.96076},"cvss":{"score":7.2,"severity":"HIGH","version":"3.1"},"vendor":"SonicWall","product":"SMA1000 Appliances","techniqueIds":["T1078","T1059"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-56155#kev","url":"https://patchfirst.co/cve/CVE-2026-56155/","title":"[KEV] CVE-2026-56155: Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability","content_text":"Microsoft · Active Directory Federation Services. In CISA KEV since 2026-07-14. ENISA EUVD lists it as exploited. EPSS 0.3% (higher than 28.2% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1078 Valid Accounts; T1068 Exploitation for Privilege Escalation. Priority 54.1 of 100.","summary":"Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability","date_published":"2026-07-14T00:00:00.000Z","date_modified":"2026-07-15T14:18:24.000Z","tags":["kev","T1078","T1068"],"_patchfirst":{"reason":"kev","priority":54.1,"kev":{"dateAdded":"2026-07-14","ransomware":false},"epss":{"score":0.00346,"percentile":0.28208},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Active Directory Federation Services","techniqueIds":["T1078","T1068"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2026-48558#kev","url":"https://patchfirst.co/cve/CVE-2026-48558/","title":"[KEV] CVE-2026-48558: SimpleHelp Authentication Bypass Vulnerability","content_text":"SimpleHelp  · SimpleHelp. In CISA KEV since 2026-06-29. ENISA EUVD lists it as exploited. EPSS 77.7% (higher than 99.56% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts. Priority 74.9 of 100.","summary":"SimpleHelp Authentication Bypass Vulnerability","date_published":"2026-06-29T00:00:00.000Z","date_modified":"2026-10-07T20:17:12.000Z","tags":["kev","public-exploit","T1190","T1078"],"_patchfirst":{"reason":"kev","priority":74.9,"kev":{"dateAdded":"2026-06-29","ransomware":false},"epss":{"score":0.77659,"percentile":0.99563},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"SimpleHelp ","product":"SimpleHelp","techniqueIds":["T1190","T1078"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-35273#kev","url":"https://patchfirst.co/cve/CVE-2026-35273/","title":"[KEV] CVE-2026-35273: Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability","content_text":"Oracle ·  PeopleSoft Enterprise PeopleTools. In CISA KEV since 2026-06-12, known ransomware use. ENISA EUVD lists it as exploited. EPSS 96.7% (higher than 99.88% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts. Priority 84.8 of 100.","summary":"Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability","date_published":"2026-06-12T00:00:00.000Z","date_modified":"2026-07-23T09:10:00.000Z","tags":["kev","ransomware","public-exploit","T1190","T1078"],"_patchfirst":{"reason":"kev","priority":84.8,"kev":{"dateAdded":"2026-06-12","ransomware":true},"epss":{"score":0.96678,"percentile":0.99884},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Oracle","product":" PeopleSoft Enterprise PeopleTools","techniqueIds":["T1190","T1078"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-50751#kev","url":"https://patchfirst.co/cve/CVE-2026-50751/","title":"[KEV] CVE-2026-50751: Check Point Security Gateway Improper Authentication Vulnerability","content_text":"Check Point · Security Gateway. In CISA KEV since 2026-06-08, known ransomware use. ENISA EUVD lists it as exploited. EPSS 85.3% (higher than 99.72% of CVEs). CVSS 9.3 CRITICAL. Public exploit code exists. ATT&CK: T1133 External Remote Services; T1078 Valid Accounts. Priority 84.5 of 100.","summary":"Check Point Security Gateway Improper Authentication Vulnerability","date_published":"2026-06-08T00:00:00.000Z","date_modified":"2026-08-04T05:16:39.000Z","tags":["kev","ransomware","public-exploit","T1133","T1078"],"_patchfirst":{"reason":"kev","priority":84.5,"kev":{"dateAdded":"2026-06-08","ransomware":true},"epss":{"score":0.85338,"percentile":0.99717},"cvss":{"score":9.3,"severity":"CRITICAL","version":"3.1"},"vendor":"Check Point","product":"Security Gateway","techniqueIds":["T1133","T1078"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-34926#kev","url":"https://patchfirst.co/cve/CVE-2026-34926/","title":"[KEV] CVE-2026-34926: Trend Micro Apex One (On-Premise) Directory Traversal Vulnerability","content_text":"Trend Micro · Apex One. In CISA KEV since 2026-05-21. ENISA EUVD lists it as exploited. EPSS 13.4% (higher than 96.4% of CVEs). CVSS 6.7 MEDIUM. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1059 Command and Scripting Interpreter. Priority 72.0 of 100.","summary":"Trend Micro Apex One (On-Premise) Directory Traversal Vulnerability","date_published":"2026-05-21T00:00:00.000Z","date_modified":"2026-07-23T16:10:00.000Z","tags":["kev","public-exploit","T1078","T1059"],"_patchfirst":{"reason":"kev","priority":72,"kev":{"dateAdded":"2026-05-21","ransomware":false},"epss":{"score":0.1342,"percentile":0.9642},"cvss":{"score":6.7,"severity":"MEDIUM","version":"3.1"},"vendor":"Trend Micro","product":"Apex One","techniqueIds":["T1078","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-6973#kev","url":"https://patchfirst.co/cve/CVE-2026-6973/","title":"[KEV] CVE-2026-6973: Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability","content_text":"Ivanti · Endpoint Manager Mobile (EPMM). In CISA KEV since 2026-05-07. ENISA EUVD lists it as exploited. EPSS 34.5% (higher than 98.4% of CVEs). CVSS 7.2 HIGH. ATT&CK: T1078 Valid Accounts; T1059 Command and Scripting Interpreter. Priority 67.7 of 100.","summary":"Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability","date_published":"2026-05-07T00:00:00.000Z","date_modified":"2026-10-26T20:10:00.000Z","tags":["kev","T1078","T1059"],"_patchfirst":{"reason":"kev","priority":67.7,"kev":{"dateAdded":"2026-05-07","ransomware":false},"epss":{"score":0.34454,"percentile":0.98412},"cvss":{"score":7.2,"severity":"HIGH","version":"3.1"},"vendor":"Ivanti","product":"Endpoint Manager Mobile (EPMM)","techniqueIds":["T1078","T1059"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2026-41940#kev","url":"https://patchfirst.co/cve/CVE-2026-41940/","title":"[KEV] CVE-2026-41940: WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability","content_text":"WebPros · cPanel & WHM and WP2 (WordPress Squared). In CISA KEV since 2026-04-30, known ransomware use. ENISA EUVD lists it as exploited. EPSS 98.5% (higher than 99.92% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts. Priority 84.8 of 100.","summary":"WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability","date_published":"2026-04-30T00:00:00.000Z","date_modified":"2026-10-26T20:10:00.000Z","tags":["kev","ransomware","public-exploit","T1190","T1078"],"_patchfirst":{"reason":"kev","priority":84.8,"kev":{"dateAdded":"2026-04-30","ransomware":true},"epss":{"score":0.98527,"percentile":0.99921},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"WebPros","product":"cPanel & WHM and WP2 (WordPress Squared)","techniqueIds":["T1190","T1078"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-57726#kev","url":"https://patchfirst.co/cve/CVE-2024-57726/","title":"[KEV] CVE-2024-57726: SimpleHelp Missing Authorization Vulnerability","content_text":"SimpleHelp  · SimpleHelp. In CISA KEV since 2026-04-24, known ransomware use. ENISA EUVD lists it as exploited. EPSS 66.4% (higher than 99.28% of CVEs). CVSS 9.9 CRITICAL. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1068 Exploitation for Privilege Escalation. Priority 79.8 of 100.","summary":"SimpleHelp Missing Authorization Vulnerability","date_published":"2026-04-24T00:00:00.000Z","date_modified":"2026-06-17T08:13:58.000Z","tags":["kev","ransomware","public-exploit","T1078","T1068"],"_patchfirst":{"reason":"kev","priority":79.8,"kev":{"dateAdded":"2026-04-24","ransomware":true},"epss":{"score":0.66414,"percentile":0.99281},"cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1"},"vendor":"SimpleHelp ","product":"SimpleHelp","techniqueIds":["T1078","T1068"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-33825#kev","url":"https://patchfirst.co/cve/CVE-2026-33825/","title":"[KEV] CVE-2026-33825: Microsoft Defender Insufficient Granularity of Access Control Vulnerability","content_text":"Microsoft · Defender. In CISA KEV since 2026-04-22, known ransomware use. ENISA EUVD lists it as exploited. EPSS 6.7% (higher than 94% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1068 Exploitation for Privilege Escalation. Priority 82.3 of 100.","summary":"Microsoft Defender Insufficient Granularity of Access Control Vulnerability","date_published":"2026-04-22T00:00:00.000Z","date_modified":"2026-07-24T22:10:00.000Z","tags":["kev","ransomware","public-exploit","T1078","T1068"],"_patchfirst":{"reason":"kev","priority":82.3,"kev":{"dateAdded":"2026-04-22","ransomware":true},"epss":{"score":0.06749,"percentile":0.93957},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Defender","techniqueIds":["T1078","T1068"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-27351#kev","url":"https://patchfirst.co/cve/CVE-2023-27351/","title":"[KEV] CVE-2023-27351: PaperCut NG/MF Improper Authentication Vulnerability","content_text":"PaperCut · NG/MF. In CISA KEV since 2026-04-20, known ransomware use. ENISA EUVD lists it as exploited. EPSS 78.1% (higher than 99.58% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts. Priority 78.2 of 100.","summary":"PaperCut NG/MF Improper Authentication Vulnerability","date_published":"2026-04-20T00:00:00.000Z","date_modified":"2026-10-01T19:17:14.000Z","tags":["kev","ransomware","public-exploit","T1190","T1078"],"_patchfirst":{"reason":"kev","priority":78.2,"kev":{"dateAdded":"2026-04-20","ransomware":true},"epss":{"score":0.78052,"percentile":0.99575},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"PaperCut","product":"NG/MF","techniqueIds":["T1190","T1078"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-27199#kev","url":"https://patchfirst.co/cve/CVE-2024-27199/","title":"[KEV] CVE-2024-27199: JetBrains TeamCity Relative Path Traversal Vulnerability","content_text":"JetBrains · TeamCity. In CISA KEV since 2026-04-20, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.98% of CVEs). CVSS 7.3 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts. Priority 78.1 of 100.","summary":"JetBrains TeamCity Relative Path Traversal Vulnerability","date_published":"2026-04-20T00:00:00.000Z","date_modified":"2026-06-17T07:19:25.000Z","tags":["kev","ransomware","public-exploit","T1190","T1078"],"_patchfirst":{"reason":"kev","priority":78.1,"kev":{"dateAdded":"2026-04-20","ransomware":true},"epss":{"score":0.99991,"percentile":0.99985},"cvss":{"score":7.3,"severity":"HIGH","version":"3.1"},"vendor":"JetBrains","product":"TeamCity","techniqueIds":["T1190","T1078"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-32975#kev","url":"https://patchfirst.co/cve/CVE-2025-32975/","title":"[KEV] CVE-2025-32975: Quest KACE Systems Management Appliance (SMA) Improper Authentication Vulnerability","content_text":"Quest · KACE Systems Management Appliance (SMA). In CISA KEV since 2026-04-20. ENISA EUVD lists it as exploited. EPSS 2.5% (higher than 84.6% of CVEs). CVSS 10.0 CRITICAL. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts. Priority 66.9 of 100.","summary":"Quest KACE Systems Management Appliance (SMA) Improper Authentication Vulnerability","date_published":"2026-04-20T00:00:00.000Z","date_modified":"2026-06-17T09:12:53.000Z","tags":["kev","T1190","T1078"],"_patchfirst":{"reason":"kev","priority":66.9,"kev":{"dateAdded":"2026-04-20","ransomware":false},"epss":{"score":0.02487,"percentile":0.84605},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"Quest","product":"KACE Systems Management Appliance (SMA)","techniqueIds":["T1190","T1078"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2025-68613#kev","url":"https://patchfirst.co/cve/CVE-2025-68613/","title":"[KEV] CVE-2025-68613: n8n Improper Control of Dynamically-Managed Code Resources Vulnerability","content_text":"n8n · n8n. In CISA KEV since 2026-03-11. ENISA EUVD lists it as exploited. EPSS 99.0% (higher than 99.93% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1059 Command and Scripting Interpreter. Named in 1 threat report. Priority 78.0 of 100.","summary":"n8n Improper Control of Dynamically-Managed Code Resources Vulnerability","date_published":"2026-03-11T00:00:00.000Z","date_modified":"2026-10-13T11:10:00.000Z","tags":["kev","public-exploit","T1078","T1059"],"_patchfirst":{"reason":"kev","priority":78,"kev":{"dateAdded":"2026-03-11","ransomware":false},"epss":{"score":0.98994,"percentile":0.9993},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"n8n","product":"n8n","techniqueIds":["T1078","T1059"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-22681#kev","url":"https://patchfirst.co/cve/CVE-2021-22681/","title":"[KEV] CVE-2021-22681: Rockwell Multiple Products Insufficient Protected Credentials Vulnerability","content_text":"Rockwell · Multiple Products. In CISA KEV since 2026-03-05. ENISA EUVD lists it as exploited. EPSS 63.6% (higher than 99.21% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts. Priority 74.7 of 100.","summary":"Rockwell Multiple Products Insufficient Protected Credentials Vulnerability","date_published":"2026-03-05T00:00:00.000Z","date_modified":"2026-06-17T03:37:34.000Z","tags":["kev","public-exploit","T1190","T1078"],"_patchfirst":{"reason":"kev","priority":74.7,"kev":{"dateAdded":"2026-03-05","ransomware":false},"epss":{"score":0.6363,"percentile":0.99214},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Rockwell","product":"Multiple Products","techniqueIds":["T1190","T1078"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2017-7921#kev","url":"https://patchfirst.co/cve/CVE-2017-7921/","title":"[KEV] CVE-2017-7921: Hikvision Multiple Products Improper Authentication Vulnerability","content_text":"Hikvision · Multiple Products. In CISA KEV since 2026-03-05. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts. Priority 69.9 of 100.","summary":"Hikvision Multiple Products Improper Authentication Vulnerability","date_published":"2026-03-05T00:00:00.000Z","date_modified":"2026-06-17T01:25:28.000Z","tags":["kev","public-exploit","T1190","T1078"],"_patchfirst":{"reason":"kev","priority":69.9,"kev":{"dateAdded":"2026-03-05","ransomware":false},"epss":{"score":0.99998,"percentile":0.9999},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Hikvision","product":"Multiple Products","techniqueIds":["T1190","T1078"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-20127#kev","url":"https://patchfirst.co/cve/CVE-2026-20127/","title":"[KEV] CVE-2026-20127: Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability","content_text":"Cisco · Catalyst SD-WAN Controller and Manager. In CISA KEV since 2026-02-25. ENISA EUVD lists it as exploited. EPSS 89.3% (higher than 99.78% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts; T1098 Account Manipulation. Priority 75.0 of 100.","summary":"Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability","date_published":"2026-02-25T00:00:00.000Z","date_modified":"2026-06-17T15:06:12.000Z","tags":["kev","public-exploit","T1190","T1078","T1098"],"_patchfirst":{"reason":"kev","priority":75,"kev":{"dateAdded":"2026-02-25","ransomware":false},"epss":{"score":0.89294,"percentile":0.99782},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"Cisco","product":"Catalyst SD-WAN Controller and Manager","techniqueIds":["T1190","T1078","T1098"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-22769#kev","url":"https://patchfirst.co/cve/CVE-2026-22769/","title":"[KEV] CVE-2026-22769: Dell RecoverPoint for Virtual Machines (RP4VMs) Use of Hard-coded Credentials Vulnerability","content_text":"Dell · RecoverPoint for Virtual Machines (RP4VMs). In CISA KEV since 2026-02-18. ENISA EUVD lists it as exploited. EPSS 13.5% (higher than 96.4% of CVEs). CVSS 10.0 CRITICAL. ATT&CK: T1078 Valid Accounts; T1068 Exploitation for Privilege Escalation. Priority 69.3 of 100.","summary":"Dell RecoverPoint for Virtual Machines (RP4VMs) Use of Hard-coded Credentials Vulnerability","date_published":"2026-02-18T00:00:00.000Z","date_modified":"2026-06-17T10:20:23.000Z","tags":["kev","T1078","T1068"],"_patchfirst":{"reason":"kev","priority":69.3,"kev":{"dateAdded":"2026-02-18","ransomware":false},"epss":{"score":0.13525,"percentile":0.96448},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"Dell","product":"RecoverPoint for Virtual Machines (RP4VMs)","techniqueIds":["T1078","T1068"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2025-40536#kev","url":"https://patchfirst.co/cve/CVE-2025-40536/","title":"[KEV] CVE-2025-40536: SolarWinds Web Help Desk Security Control Bypass Vulnerability","content_text":"SolarWinds · Web Help Desk. In CISA KEV since 2026-02-12. ENISA EUVD lists it as exploited. EPSS 73.6% (higher than 99.47% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts. Priority 74.8 of 100.","summary":"SolarWinds Web Help Desk Security Control Bypass Vulnerability","date_published":"2026-02-12T00:00:00.000Z","date_modified":"2026-06-17T09:21:43.000Z","tags":["kev","public-exploit","T1190","T1078"],"_patchfirst":{"reason":"kev","priority":74.8,"kev":{"dateAdded":"2026-02-12","ransomware":false},"epss":{"score":0.73562,"percentile":0.99466},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"SolarWinds","product":"Web Help Desk","techniqueIds":["T1190","T1078"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-24858#kev","url":"https://patchfirst.co/cve/CVE-2026-24858/","title":"[KEV] CVE-2026-24858: Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability","content_text":"Fortinet · Multiple Products. In CISA KEV since 2026-01-27. ENISA EUVD lists it as exploited. EPSS 86.6% (higher than 99.74% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts. Priority 74.8 of 100.","summary":"Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability","date_published":"2026-01-27T00:00:00.000Z","date_modified":"2026-06-17T10:23:43.000Z","tags":["kev","public-exploit","T1190","T1078"],"_patchfirst":{"reason":"kev","priority":74.8,"kev":{"dateAdded":"2026-01-27","ransomware":false},"epss":{"score":0.86592,"percentile":0.99739},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Fortinet","product":"Multiple Products","techniqueIds":["T1190","T1078"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-23760#kev","url":"https://patchfirst.co/cve/CVE-2026-23760/","title":"[KEV] CVE-2026-23760: SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability","content_text":"SmarterTools · SmarterMail. In CISA KEV since 2026-01-26, known ransomware use. ENISA EUVD lists it as exploited. EPSS 96.4% (higher than 99.88% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1078 Valid Accounts. Priority 84.8 of 100.","summary":"SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability","date_published":"2026-01-26T00:00:00.000Z","date_modified":"2026-08-04T05:16:38.000Z","tags":["kev","ransomware","public-exploit","T1190","T1059","T1078"],"_patchfirst":{"reason":"kev","priority":84.8,"kev":{"dateAdded":"2026-01-26","ransomware":true},"epss":{"score":0.96432,"percentile":0.99881},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"SmarterTools","product":"SmarterMail","techniqueIds":["T1190","T1059","T1078"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-24061#kev","url":"https://patchfirst.co/cve/CVE-2026-24061/","title":"[KEV] CVE-2026-24061: GNU InetUtils Argument Injection Vulnerability","content_text":"GNU · InetUtils. In CISA KEV since 2026-01-26. ENISA EUVD lists it as exploited. EPSS 99.0% (higher than 99.93% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts. Priority 84.8 of 100.","summary":"GNU InetUtils Argument Injection Vulnerability","date_published":"2026-01-26T00:00:00.000Z","date_modified":"2026-09-30T11:47:02.000Z","tags":["kev","public-exploit","T1190","T1078"],"_patchfirst":{"reason":"kev","priority":84.8,"kev":{"dateAdded":"2026-01-26","ransomware":false},"epss":{"score":0.98984,"percentile":0.9993},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"GNU","product":"InetUtils","techniqueIds":["T1190","T1078"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-34026#kev","url":"https://patchfirst.co/cve/CVE-2025-34026/","title":"[KEV] CVE-2025-34026: Versa Concerto Improper Authentication Vulnerability","content_text":"Versa · Concerto. In CISA KEV since 2026-01-22. ENISA EUVD lists it as exploited. EPSS 81.8% (higher than 99.64% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System; T1078 Valid Accounts. Priority 68.2 of 100.","summary":"Versa Concerto Improper Authentication Vulnerability","date_published":"2026-01-22T00:00:00.000Z","date_modified":"2026-06-17T09:13:19.000Z","tags":["kev","public-exploit","T1190","T1005","T1078"],"_patchfirst":{"reason":"kev","priority":68.2,"kev":{"dateAdded":"2026-01-22","ransomware":false},"epss":{"score":0.8178,"percentile":0.99645},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"Versa","product":"Concerto","techniqueIds":["T1190","T1005","T1078"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-20805#kev","url":"https://patchfirst.co/cve/CVE-2026-20805/","title":"[KEV] CVE-2026-20805: Microsoft Windows Information Disclosure Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2026-01-13. ENISA EUVD lists it as exploited. EPSS 7.5% (higher than 94.5% of CVEs). CVSS 5.5 MEDIUM. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1005 Data from Local System. Priority 70.7 of 100.","summary":"Microsoft Windows Information Disclosure Vulnerability","date_published":"2026-01-13T00:00:00.000Z","date_modified":"2026-07-30T21:16:56.000Z","tags":["kev","public-exploit","T1078","T1005"],"_patchfirst":{"reason":"kev","priority":70.7,"kev":{"dateAdded":"2026-01-13","ransomware":false},"epss":{"score":0.07463,"percentile":0.94456},"cvss":{"score":5.5,"severity":"MEDIUM","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1078","T1005"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-40602","url":"https://patchfirst.co/cve/CVE-2025-40602/","title":"CVE-2025-40602: SonicWall SMA1000 Missing Authorization Vulnerability","content_text":"SonicWall · SMA1000 appliance. In CISA KEV since 2025-12-17. ENISA EUVD lists it as exploited. EPSS 2.8% (higher than 86.2% of CVEs). CVSS 6.6 MEDIUM. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1078 Valid Accounts. Priority 79.9 of 100.","summary":"SonicWall SMA1000 Missing Authorization Vulnerability","date_published":"2025-12-18T00:00:00.000Z","date_modified":"2026-06-17T09:21:49.000Z","tags":["kev","public-exploit","T1068","T1078"],"_patchfirst":{"reason":"published","priority":79.9,"kev":{"dateAdded":"2025-12-17","ransomware":false},"epss":{"score":0.02756,"percentile":0.86228},"cvss":{"score":6.6,"severity":"MEDIUM","version":"3.1"},"vendor":"SonicWall","product":"SMA1000 appliance","techniqueIds":["T1068","T1078"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-59718#kev","url":"https://patchfirst.co/cve/CVE-2025-59718/","title":"[KEV] CVE-2025-59718: Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability","content_text":"Fortinet · Multiple Products. In CISA KEV since 2025-12-16. ENISA EUVD lists it as exploited. EPSS 68.3% (higher than 99.33% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts. Priority 84.7 of 100.","summary":"Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability","date_published":"2025-12-16T00:00:00.000Z","date_modified":"2026-06-17T09:46:35.000Z","tags":["kev","public-exploit","T1190","T1078"],"_patchfirst":{"reason":"kev","priority":84.7,"kev":{"dateAdded":"2025-12-16","ransomware":false},"epss":{"score":0.68293,"percentile":0.9933},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Fortinet","product":"Multiple Products","techniqueIds":["T1190","T1078"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-48633","url":"https://patchfirst.co/cve/CVE-2025-48633/","title":"CVE-2025-48633: Android Framework Information Disclosure Vulnerability","content_text":"Android · Framework. In CISA KEV since 2025-12-02. ENISA EUVD lists it as exploited. EPSS 0.3% (higher than 18% of CVEs). CVSS 5.5 MEDIUM. ATT&CK: T1078 Valid Accounts; T1068 Exploitation for Privilege Escalation. Priority 50.5 of 100.","summary":"Android Framework Information Disclosure Vulnerability","date_published":"2025-12-08T00:00:00.000Z","date_modified":"2026-10-07T20:10:01.000Z","tags":["kev","T1078","T1068"],"_patchfirst":{"reason":"published","priority":50.5,"kev":{"dateAdded":"2025-12-02","ransomware":false},"epss":{"score":0.00262,"percentile":0.18043},"cvss":{"score":5.5,"severity":"MEDIUM","version":"3.1"},"vendor":"Android","product":"Framework","techniqueIds":["T1078","T1068"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}}]}