{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: CVEs linked to T1083 File and Directory Discovery","home_page_url":"https://patchfirst.co/technique/T1083/","feed_url":"https://patchfirst.co/feed/technique/T1083.json","description":"New and newly exploited CVEs that lead to ATT&CK T1083 File and Directory Discovery, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2017-12637#kev","url":"https://patchfirst.co/cve/CVE-2017-12637/","title":"[KEV] CVE-2017-12637: SAP NetWeaver Directory Traversal Vulnerability","content_text":"SAP · NetWeaver. In CISA KEV since 2025-03-19. ENISA EUVD lists it as exploited. EPSS 95.1% (higher than 99.86% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1083 File and Directory Discovery; T1555 Credentials from Password Stores; T1592 Gather Victim Host Information. Priority 68.2 of 100.","summary":"SAP NetWeaver Directory Traversal Vulnerability","date_published":"2025-03-19T00:00:00.000Z","date_modified":"2026-06-17T01:03:42.000Z","tags":["kev","public-exploit","T1190","T1083","T1555","T1592"],"_patchfirst":{"reason":"kev","priority":68.2,"kev":{"dateAdded":"2025-03-19","ransomware":false},"epss":{"score":0.95111,"percentile":0.99863},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"SAP","product":"NetWeaver","techniqueIds":["T1190","T1083","T1555","T1592"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-53704#kev","url":"https://patchfirst.co/cve/CVE-2024-53704/","title":"[KEV] CVE-2024-53704: SonicWall SonicOS SSLVPN Improper Authentication Vulnerability","content_text":"SonicWall · SonicOS. In CISA KEV since 2025-02-18, known ransomware use. ENISA EUVD lists it as exploited. EPSS 95.3% (higher than 99.87% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1199 Trusted Relationship; T1212 Exploitation for Credential Access; T1078.004 Cloud Accounts; T1083 File and Directory Discovery. Priority 79.8 of 100.","summary":"SonicWall SonicOS SSLVPN Improper Authentication Vulnerability","date_published":"2025-02-18T00:00:00.000Z","date_modified":"2026-08-04T05:16:31.000Z","tags":["kev","ransomware","public-exploit","T1199","T1212","T1078.004","T1083"],"_patchfirst":{"reason":"kev","priority":79.8,"kev":{"dateAdded":"2025-02-18","ransomware":true},"epss":{"score":0.95314,"percentile":0.99865},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"SonicWall","product":"SonicOS","techniqueIds":["T1199","T1212","T1078.004","T1083"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-28461#kev","url":"https://patchfirst.co/cve/CVE-2023-28461/","title":"[KEV] CVE-2023-28461: Array Networks AG and vxAG ArrayOS Missing Authentication for Critical Function Vulnerability","content_text":"Array Networks  · AG/vxAG ArrayOS. In CISA KEV since 2024-11-25, known ransomware use. ENISA EUVD lists it as exploited. EPSS 68.1% (higher than 99.32% of CVEs). CVSS 9.8 CRITICAL. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1083 File and Directory Discovery. Named in 1 threat report. Priority 78.6 of 100.","summary":"Array Networks AG and vxAG ArrayOS Missing Authentication for Critical Function Vulnerability","date_published":"2024-11-25T00:00:00.000Z","date_modified":"2026-08-05T05:16:37.000Z","tags":["kev","ransomware","T1190","T1059","T1083"],"_patchfirst":{"reason":"kev","priority":78.6,"kev":{"dateAdded":"2024-11-25","ransomware":true},"epss":{"score":0.68079,"percentile":0.99324},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Array Networks ","product":"AG/vxAG ArrayOS","techniqueIds":["T1190","T1059","T1083"],"reportCount":1,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2023-22952#kev","url":"https://patchfirst.co/cve/CVE-2023-22952/","title":"[KEV] CVE-2023-22952: Multiple SugarCRM Products Remote Code Execution Vulnerability","content_text":"SugarCRM · Multiple Products. In CISA KEV since 2023-02-02. ENISA EUVD lists it as exploited. EPSS 80.1% (higher than 99.62% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1021.001 Remote Desktop Protocol; T1070.004 File Deletion; T1078 Valid Accounts; T1083 File and Directory Discovery; +3 more. Priority 69.1 of 100.","summary":"Multiple SugarCRM Products Remote Code Execution Vulnerability","date_published":"2023-02-02T00:00:00.000Z","date_modified":"2026-06-17T05:36:30.000Z","tags":["kev","public-exploit","T1190","T1059","T1021.001","T1070.004","T1078","T1083","T1482","T1505.003","T1530"],"_patchfirst":{"reason":"kev","priority":69.1,"kev":{"dateAdded":"2023-02-02","ransomware":false},"epss":{"score":0.80139,"percentile":0.99616},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"SugarCRM","product":"Multiple Products","techniqueIds":["T1190","T1059","T1021.001","T1070.004","T1078","T1083","T1482","T1505.003","T1530"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2016-3298#kev","url":"https://patchfirst.co/cve/CVE-2016-3298/","title":"[KEV] CVE-2016-3298: Microsoft Internet Explorer Messaging API Information Disclosure Vulnerability","content_text":"Microsoft · Internet Explorer. In CISA KEV since 2022-05-24. ENISA EUVD lists it as exploited. EPSS 33.3% (higher than 98.4% of CVEs). CVSS 6.5 MEDIUM. ATT&CK: T1083 File and Directory Discovery; T1189 Drive-by Compromise. Priority 57.2 of 100.","summary":"Microsoft Internet Explorer Messaging API Information Disclosure Vulnerability","date_published":"2022-05-24T00:00:00.000Z","date_modified":"2026-06-17T00:45:27.000Z","tags":["kev","T1083","T1189"],"_patchfirst":{"reason":"kev","priority":57.2,"kev":{"dateAdded":"2022-05-24","ransomware":false},"epss":{"score":0.33332,"percentile":0.9837},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.1"},"vendor":"Microsoft","product":"Internet Explorer","techniqueIds":["T1083","T1189"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2016-0162#kev","url":"https://patchfirst.co/cve/CVE-2016-0162/","title":"[KEV] CVE-2016-0162: Microsoft Internet Explorer Information Disclosure Vulnerability","content_text":"Microsoft · Internet Explorer. In CISA KEV since 2022-05-24. ENISA EUVD lists it as exploited. EPSS 21.9% (higher than 97.7% of CVEs). CVSS 4.3 MEDIUM. ATT&CK: T1189 Drive-by Compromise; T1083 File and Directory Discovery. Priority 45.5 of 100.","summary":"Microsoft Internet Explorer Information Disclosure Vulnerability","date_published":"2022-05-24T00:00:00.000Z","date_modified":"2026-06-17T00:37:02.000Z","tags":["kev","T1189","T1083"],"_patchfirst":{"reason":"kev","priority":45.5,"kev":{"dateAdded":"2022-05-24","ransomware":false},"epss":{"score":0.21932,"percentile":0.9765},"cvss":{"score":4.3,"severity":"MEDIUM","version":"3.1"},"vendor":"Microsoft","product":"Internet Explorer","techniqueIds":["T1189","T1083"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2019-0676#kev","url":"https://patchfirst.co/cve/CVE-2019-0676/","title":"[KEV] CVE-2019-0676: Microsoft Internet Explorer Information Disclosure Vulnerability","content_text":"Microsoft · Internet Explorer. In CISA KEV since 2022-05-23. ENISA EUVD lists it as exploited. EPSS 8.1% (higher than 94.8% of CVEs). CVSS 6.5 MEDIUM. ATT&CK: T1189 Drive-by Compromise; T1083 File and Directory Discovery. Priority 46.5 of 100.","summary":"Microsoft Internet Explorer Information Disclosure Vulnerability","date_published":"2022-05-23T00:00:00.000Z","date_modified":"2026-06-17T02:08:40.000Z","tags":["kev","T1189","T1083"],"_patchfirst":{"reason":"kev","priority":46.5,"kev":{"dateAdded":"2022-05-23","ransomware":false},"epss":{"score":0.0811,"percentile":0.94819},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.1"},"vendor":"Microsoft","product":"Internet Explorer","techniqueIds":["T1189","T1083"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2019-7483#kev","url":"https://patchfirst.co/cve/CVE-2019-7483/","title":"[KEV] CVE-2019-7483: SonicWall SMA100 Directory Traversal Vulnerability","content_text":"SonicWall · SMA100. In CISA KEV since 2022-03-28. ENISA EUVD lists it as exploited. EPSS 4.0% (higher than 90.5% of CVEs). CVSS 7.5 HIGH. ATT&CK: T1190 Exploit Public-Facing Application; T1083 File and Directory Discovery. Priority 61.4 of 100.","summary":"SonicWall SMA100 Directory Traversal Vulnerability","date_published":"2022-03-28T00:00:00.000Z","date_modified":"2026-06-17T02:40:39.000Z","tags":["kev","T1190","T1083"],"_patchfirst":{"reason":"kev","priority":61.4,"kev":{"dateAdded":"2022-03-28","ransomware":false},"epss":{"score":0.0401,"percentile":0.9054},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"SonicWall","product":"SMA100","techniqueIds":["T1190","T1083"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2019-11510#kev","url":"https://patchfirst.co/cve/CVE-2019-11510/","title":"[KEV] CVE-2019-11510: Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability","content_text":"Ivanti · Pulse Connect Secure. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1133 External Remote Services; T1059 Command and Scripting Interpreter; T1083 File and Directory Discovery; T1552.001 Credentials In Files. Named in 6 threat reports. Priority 90.0 of 100.","summary":"Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T02:13:04.000Z","tags":["kev","ransomware","public-exploit","T1133","T1059","T1083","T1552.001"],"_patchfirst":{"reason":"kev","priority":90,"kev":{"dateAdded":"2021-11-03","ransomware":true},"epss":{"score":0.99999,"percentile":0.99995},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"Ivanti","product":"Pulse Connect Secure","techniqueIds":["T1133","T1059","T1083","T1552.001"],"reportCount":6,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2019-19781#kev","url":"https://patchfirst.co/cve/CVE-2019-19781/","title":"[KEV] CVE-2019-19781: Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Vulnerability","content_text":"Citrix · Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1133 External Remote Services; T1059 Command and Scripting Interpreter; T1083 File and Directory Discovery. Named in 8 threat reports. Priority 89.9 of 100.","summary":"Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-08-12T05:17:21.000Z","tags":["kev","ransomware","public-exploit","T1133","T1059","T1083"],"_patchfirst":{"reason":"kev","priority":89.9,"kev":{"dateAdded":"2021-11-03","ransomware":true},"epss":{"score":0.99999,"percentile":0.99998},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Citrix","product":"Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance","techniqueIds":["T1133","T1059","T1083"],"reportCount":8,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2018-10590","url":"https://patchfirst.co/cve/CVE-2018-10590/","title":"CVE-2018-10590: In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard…","content_text":"Advantech · WebAccess. Not in CISA KEV. EPSS 1.6% (higher than 76.2% of CVEs). ATT&CK: T1190 Exploit Public-Facing Application; T1083 File and Directory Discovery. Priority 15.2 of 100.","summary":"In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard…","date_published":"2018-05-15T00:00:00.000Z","date_modified":"2024-09-16T22:45:05.000Z","tags":["T1190","T1083"],"_patchfirst":{"reason":"published","priority":15.2,"kev":null,"epss":{"score":0.01633,"percentile":0.76236},"cvss":null,"vendor":"Advantech","product":"WebAccess","techniqueIds":["T1190","T1083"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2008-6508","url":"https://patchfirst.co/cve/CVE-2008-6508/","title":"CVE-2008-6508: Directory traversal vulnerability in the AuthCheck filter in the Admin Console in Openfire 3.6.0a and earlier allows…","content_text":"Not in CISA KEV. EPSS 83.7% (higher than 99.69% of CVEs). Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1083 File and Directory Discovery. Named in 1 threat report. Priority 29.9 of 100.","summary":"Directory traversal vulnerability in the AuthCheck filter in the Admin Console in Openfire 3.6.0a and earlier allows…","date_published":"2009-03-23T00:00:00.000Z","date_modified":"2024-08-07T11:34:47.000Z","tags":["public-exploit","T1190","T1083"],"_patchfirst":{"reason":"published","priority":29.9,"kev":null,"epss":{"score":0.83664,"percentile":0.99687},"cvss":null,"vendor":null,"product":null,"techniqueIds":["T1190","T1083"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":false}}]}