{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: CVEs linked to T1082 System Information Discovery","home_page_url":"https://patchfirst.co/technique/T1082/","feed_url":"https://patchfirst.co/feed/technique/T1082.json","description":"New and newly exploited CVEs that lead to ATT&CK T1082 System Information Discovery, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2024-23692#kev","url":"https://patchfirst.co/cve/CVE-2024-23692/","title":"[KEV] CVE-2024-23692: Rejetto HTTP File Server Improper Neutralization of Special Elements Used in a Template Engine Vulnerability","content_text":"Rejetto · HTTP File Server. In CISA KEV since 2024-07-09, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.5% (higher than 99.94% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1082 System Information Discovery; T1005 Data from Local System; T1105 Ingress Tool Transfer; T1496 Resource Hijacking. Priority 79.8 of 100.","summary":"Rejetto HTTP File Server Improper Neutralization of Special Elements Used in a Template Engine Vulnerability","date_published":"2024-07-09T00:00:00.000Z","date_modified":"2026-08-11T04:17:15.000Z","tags":["kev","ransomware","public-exploit","T1082","T1005","T1105","T1496"],"_patchfirst":{"reason":"kev","priority":79.8,"kev":{"dateAdded":"2024-07-09","ransomware":true},"epss":{"score":0.99485,"percentile":0.99944},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Rejetto","product":"HTTP File Server","techniqueIds":["T1082","T1005","T1105","T1496"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-43770#kev","url":"https://patchfirst.co/cve/CVE-2023-43770/","title":"[KEV] CVE-2023-43770: Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability","content_text":"Roundcube · Webmail. In CISA KEV since 2024-02-12. ENISA EUVD lists it as exploited. EPSS 63.7% (higher than 99.22% of CVEs). CVSS 6.1 MEDIUM. Public exploit code exists. ATT&CK: T1189 Drive-by Compromise; T1059 Command and Scripting Interpreter; T1082 System Information Discovery. Priority 67.1 of 100.","summary":"Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability","date_published":"2024-02-12T00:00:00.000Z","date_modified":"2026-06-17T06:26:24.000Z","tags":["kev","public-exploit","T1189","T1059","T1082"],"_patchfirst":{"reason":"kev","priority":67.1,"kev":{"dateAdded":"2024-02-12","ransomware":false},"epss":{"score":0.6366,"percentile":0.99215},"cvss":{"score":6.1,"severity":"MEDIUM","version":"3.1"},"vendor":"Roundcube","product":"Webmail","techniqueIds":["T1189","T1059","T1082"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-34362#kev","url":"https://patchfirst.co/cve/CVE-2023-34362/","title":"[KEV] CVE-2023-34362: Progress MOVEit Transfer SQL Injection Vulnerability","content_text":"Progress · MOVEit Transfer. In CISA KEV since 2023-06-02, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.9% (higher than 99.97% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1005 Data from Local System; T1082 System Information Discovery; T1105 Ingress Tool Transfer; T1136 Create Account; +1 more. Named in 2 threat reports. Priority 86.0 of 100.","summary":"Progress MOVEit Transfer SQL Injection Vulnerability","date_published":"2023-06-02T00:00:00.000Z","date_modified":"2026-06-17T06:03:28.000Z","tags":["kev","ransomware","public-exploit","T1190","T1059","T1005","T1082","T1105","T1136","T1531"],"_patchfirst":{"reason":"kev","priority":86,"kev":{"dateAdded":"2023-06-02","ransomware":true},"epss":{"score":0.99934,"percentile":0.9997},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Progress","product":"MOVEit Transfer","techniqueIds":["T1190","T1059","T1005","T1082","T1105","T1136","T1531"],"reportCount":2,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-21492#kev","url":"https://patchfirst.co/cve/CVE-2023-21492/","title":"[KEV] CVE-2023-21492: Samsung Mobile Devices Insertion of Sensitive Information Into Log File Vulnerability","content_text":"Samsung · Mobile Devices. In CISA KEV since 2023-05-19. ENISA EUVD lists it as exploited. EPSS 2.6% (higher than 85% of CVEs). CVSS 4.4 MEDIUM. ATT&CK: T1078 Valid Accounts; T1082 System Information Discovery. Priority 58.1 of 100.","summary":"Samsung Mobile Devices Insertion of Sensitive Information Into Log File Vulnerability","date_published":"2023-05-19T00:00:00.000Z","date_modified":"2026-06-17T05:32:48.000Z","tags":["kev","T1078","T1082"],"_patchfirst":{"reason":"kev","priority":58.1,"kev":{"dateAdded":"2023-05-19","ransomware":false},"epss":{"score":0.02554,"percentile":0.85035},"cvss":{"score":4.4,"severity":"MEDIUM","version":"3.1"},"vendor":"Samsung","product":"Mobile Devices","techniqueIds":["T1078","T1082"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2018-19322#kev","url":"https://patchfirst.co/cve/CVE-2018-19322/","title":"[KEV] CVE-2018-19322: GIGABYTE Multiple Products Code Execution Vulnerability","content_text":"GIGABYTE · Multiple Products. In CISA KEV since 2022-10-24, known ransomware use. ENISA EUVD lists it as exploited. EPSS 1.8% (higher than 78.7% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1082 System Information Discovery. Priority 74.2 of 100.","summary":"GIGABYTE Multiple Products Code Execution Vulnerability","date_published":"2022-10-24T00:00:00.000Z","date_modified":"2026-08-13T05:17:16.000Z","tags":["kev","ransomware","public-exploit","T1068","T1082"],"_patchfirst":{"reason":"kev","priority":74.2,"kev":{"dateAdded":"2022-10-24","ransomware":true},"epss":{"score":0.01816,"percentile":0.78667},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"GIGABYTE","product":"Multiple Products","techniqueIds":["T1068","T1082"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-40449#kev","url":"https://patchfirst.co/cve/CVE-2021-40449/","title":"[KEV] CVE-2021-40449: Microsoft Windows Win32k Privilege Escalation Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2021-11-17, known ransomware use. ENISA EUVD lists it as exploited. EPSS 81.9% (higher than 99.65% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1566 Phishing; T1068 Exploitation for Privilege Escalation; T1016 System Network Configuration Discovery; T1027 Obfuscated Files or Information; T1059.003 Windows Command Shell; T1071.001 Web Protocols; +2 more. Priority 78.4 of 100.","summary":"Microsoft Windows Win32k Privilege Escalation Vulnerability","date_published":"2021-11-17T00:00:00.000Z","date_modified":"2026-06-17T04:06:56.000Z","tags":["kev","ransomware","public-exploit","T1566","T1068","T1016","T1027","T1059.003","T1071.001","T1082","T1573.001"],"_patchfirst":{"reason":"kev","priority":78.4,"kev":{"dateAdded":"2021-11-17","ransomware":true},"epss":{"score":0.81936,"percentile":0.9965},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1566","T1068","T1016","T1027","T1059.003","T1071.001","T1082","T1573.001"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2020-8195#kev","url":"https://patchfirst.co/cve/CVE-2020-8195/","title":"[KEV] CVE-2020-8195: Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability","content_text":"Citrix · Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 33.0% (higher than 98.4% of CVEs). CVSS 6.5 MEDIUM. Public exploit code exists. ATT&CK: T1056 Input Capture; T1005 Data from Local System; T1082 System Information Discovery. Priority 77.2 of 100.","summary":"Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T03:26:01.000Z","tags":["kev","public-exploit","T1056","T1005","T1082"],"_patchfirst":{"reason":"kev","priority":77.2,"kev":{"dateAdded":"2021-11-03","ransomware":false},"epss":{"score":0.33029,"percentile":0.98359},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.1"},"vendor":"Citrix","product":"Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance","techniqueIds":["T1056","T1005","T1082"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2020-8196#kev","url":"https://patchfirst.co/cve/CVE-2020-8196/","title":"[KEV] CVE-2020-8196: Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability","content_text":"Citrix · Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 26.3% (higher than 98% of CVEs). CVSS 4.3 MEDIUM. Public exploit code exists. ATT&CK: T1056 Input Capture; T1082 System Information Discovery; T1005 Data from Local System. Priority 75.6 of 100.","summary":"Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T03:26:02.000Z","tags":["kev","public-exploit","T1056","T1082","T1005"],"_patchfirst":{"reason":"kev","priority":75.6,"kev":{"dateAdded":"2021-11-03","ransomware":false},"epss":{"score":0.26333,"percentile":0.98003},"cvss":{"score":4.3,"severity":"MEDIUM","version":"3.1"},"vendor":"Citrix","product":"Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance","techniqueIds":["T1056","T1082","T1005"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2019-1653#kev","url":"https://patchfirst.co/cve/CVE-2019-1653/","title":"[KEV] CVE-2019-1653: Cisco Small Business RV320 and RV325 Routers Information Disclosure Vulnerability","content_text":"Cisco · Small Business RV320 and RV325 Routers. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 99.9% (higher than 99.96% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1082 System Information Discovery; T1005 Data from Local System; T1007 System Service Discovery. Named in 1 threat report. Priority 72.1 of 100.","summary":"Cisco Small Business RV320 and RV325 Routers Information Disclosure Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T02:28:58.000Z","tags":["kev","public-exploit","T1190","T1082","T1005","T1007"],"_patchfirst":{"reason":"kev","priority":72.1,"kev":{"dateAdded":"2021-11-03","ransomware":false},"epss":{"score":0.99876,"percentile":0.99964},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"Cisco","product":"Small Business RV320 and RV325 Routers","techniqueIds":["T1190","T1082","T1005","T1007"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}}]}