{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: CVEs linked to T1090 Proxy","home_page_url":"https://patchfirst.co/technique/T1090/","feed_url":"https://patchfirst.co/feed/technique/T1090.json","description":"New and newly exploited CVEs that lead to ATT&CK T1090 Proxy, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2026-96652#kev","url":"https://patchfirst.co/cve/CVE-2026-96652/","title":"[KEV] CVE-2026-96652: Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability","content_text":"Plex · Media Server. In CISA KEV since 2026-10-20. ENISA EUVD lists it as exploited. EPSS 1.8% (higher than 78.7% of CVEs). CVSS 4.3 MEDIUM. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1090 Proxy. Priority 71.2 of 100.","summary":"Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability","date_published":"2026-10-20T00:00:00.000Z","date_modified":"2026-10-21T13:09:44.000Z","tags":["kev","public-exploit","T1190","T1090"],"_patchfirst":{"reason":"kev","priority":71.2,"kev":{"dateAdded":"2026-10-20","ransomware":false},"epss":{"score":0.01821,"percentile":0.78731},"cvss":{"score":4.3,"severity":"MEDIUM","version":"3.1"},"vendor":"Plex","product":"Media Server","techniqueIds":["T1190","T1090"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-96655#kev","url":"https://patchfirst.co/cve/CVE-2026-96655/","title":"[KEV] CVE-2026-96655: Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability","content_text":"Plex · Media Server. In CISA KEV since 2026-10-20. ENISA EUVD lists it as exploited. EPSS 1.6% (higher than 76.3% of CVEs). CVSS 4.3 MEDIUM. ATT&CK: T1190 Exploit Public-Facing Application; T1090 Proxy. Priority 65.7 of 100.","summary":"Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability","date_published":"2026-10-20T00:00:00.000Z","date_modified":"2026-10-21T13:09:29.000Z","tags":["kev","T1190","T1090"],"_patchfirst":{"reason":"kev","priority":65.7,"kev":{"dateAdded":"2026-10-20","ransomware":false},"epss":{"score":0.01637,"percentile":0.7631},"cvss":{"score":4.3,"severity":"MEDIUM","version":"3.1"},"vendor":"Plex","product":"Media Server","techniqueIds":["T1190","T1090"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2026-64849#kev","url":"https://patchfirst.co/cve/CVE-2026-64849/","title":"[KEV] CVE-2026-64849: MLflow Server-Side Request Forgery Vulnerability","content_text":"MLflow · MLflow. In CISA KEV since 2026-08-19. ENISA EUVD lists it as exploited. EPSS 10.0% (higher than 95.6% of CVEs). CVSS 9.3 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1090 Proxy. Priority 78.6 of 100.","summary":"MLflow Server-Side Request Forgery Vulnerability","date_published":"2026-08-19T00:00:00.000Z","date_modified":"2026-10-26T13:10:00.000Z","tags":["kev","public-exploit","T1190","T1090"],"_patchfirst":{"reason":"kev","priority":78.6,"kev":{"dateAdded":"2026-08-19","ransomware":false},"epss":{"score":0.10017,"percentile":0.95608},"cvss":{"score":9.3,"severity":"CRITICAL","version":"3.1"},"vendor":"MLflow","product":"MLflow","techniqueIds":["T1190","T1090"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-15409#kev","url":"https://patchfirst.co/cve/CVE-2026-15409/","title":"[KEV] CVE-2026-15409: SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability","content_text":"SonicWall · SMA1000 Appliances. In CISA KEV since 2026-07-14, known ransomware use. ENISA EUVD lists it as exploited. EPSS 6.8% (higher than 94% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1090 Proxy. Named in 1 threat report. Priority 87.7 of 100.","summary":"SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability","date_published":"2026-07-14T00:00:00.000Z","date_modified":"2026-10-24T21:10:00.000Z","tags":["kev","ransomware","public-exploit","T1190","T1090"],"_patchfirst":{"reason":"kev","priority":87.7,"kev":{"dateAdded":"2026-07-14","ransomware":true},"epss":{"score":0.06795,"percentile":0.93991},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"SonicWall","product":"SMA1000 Appliances","techniqueIds":["T1190","T1090"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-22175#kev","url":"https://patchfirst.co/cve/CVE-2021-22175/","title":"[KEV] CVE-2021-22175: GitLab Server-Side Request Forgery (SSRF) Vulnerability","content_text":"GitLab · GitLab. In CISA KEV since 2026-02-18. ENISA EUVD lists it as exploited. EPSS 53.4% (higher than 99% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1090 Proxy. Priority 69.7 of 100.","summary":"GitLab Server-Side Request Forgery (SSRF) Vulnerability","date_published":"2026-02-18T00:00:00.000Z","date_modified":"2026-10-01T19:17:14.000Z","tags":["kev","public-exploit","T1190","T1090"],"_patchfirst":{"reason":"kev","priority":69.7,"kev":{"dateAdded":"2026-02-18","ransomware":false},"epss":{"score":0.53372,"percentile":0.98986},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"GitLab","product":"GitLab","techniqueIds":["T1190","T1090"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2020-7796#kev","url":"https://patchfirst.co/cve/CVE-2020-7796/","title":"[KEV] CVE-2020-7796: Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery Vulnerability","content_text":"Synacor · Zimbra Collaboration Suite. In CISA KEV since 2026-02-17. ENISA EUVD lists it as exploited. EPSS 93.6% (higher than 99.84% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1090 Proxy. Priority 69.8 of 100.","summary":"Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery Vulnerability","date_published":"2026-02-17T00:00:00.000Z","date_modified":"2026-06-17T03:25:27.000Z","tags":["kev","public-exploit","T1190","T1090"],"_patchfirst":{"reason":"kev","priority":69.8,"kev":{"dateAdded":"2026-02-17","ransomware":false},"epss":{"score":0.93592,"percentile":0.99841},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Synacor","product":"Zimbra Collaboration Suite","techniqueIds":["T1190","T1090"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-21311#kev","url":"https://patchfirst.co/cve/CVE-2021-21311/","title":"[KEV] CVE-2021-21311: Adminer Server-Side Request Forgery Vulnerability","content_text":"Adminer · Adminer. In CISA KEV since 2025-09-29. ENISA EUVD lists it as exploited. EPSS 98.5% (higher than 99.92% of CVEs). CVSS 7.2 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1090 Proxy. Priority 68.0 of 100.","summary":"Adminer Server-Side Request Forgery Vulnerability","date_published":"2025-09-29T00:00:00.000Z","date_modified":"2026-06-17T03:35:16.000Z","tags":["kev","public-exploit","T1190","T1090"],"_patchfirst":{"reason":"kev","priority":68,"kev":{"dateAdded":"2025-09-29","ransomware":false},"epss":{"score":0.98464,"percentile":0.99919},"cvss":{"score":7.2,"severity":"HIGH","version":"3.1"},"vendor":"Adminer","product":"Adminer","techniqueIds":["T1190","T1090"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2019-9621#kev","url":"https://patchfirst.co/cve/CVE-2019-9621/","title":"[KEV] CVE-2019-9621: Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery (SSRF) Vulnerability","content_text":"Synacor · Zimbra Collaboration Suite (ZCS). In CISA KEV since 2025-07-07. ENISA EUVD lists it as exploited. EPSS 81.0% (higher than 99.63% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1090 Proxy. Priority 68.2 of 100.","summary":"Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery (SSRF) Vulnerability","date_published":"2025-07-07T00:00:00.000Z","date_modified":"2026-06-17T02:44:03.000Z","tags":["kev","public-exploit","T1190","T1090"],"_patchfirst":{"reason":"kev","priority":68.2,"kev":{"dateAdded":"2025-07-07","ransomware":false},"epss":{"score":0.81037,"percentile":0.99631},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"Synacor","product":"Zimbra Collaboration Suite (ZCS)","techniqueIds":["T1190","T1090"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-40438#kev","url":"https://patchfirst.co/cve/CVE-2021-40438/","title":"[KEV] CVE-2021-40438: Apache HTTP Server-Side Request Forgery (SSRF)","content_text":"Apache · Apache. In CISA KEV since 2021-12-01, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 9.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1090 Proxy. Priority 79.3 of 100.","summary":"Apache HTTP Server-Side Request Forgery (SSRF)","date_published":"2021-12-01T00:00:00.000Z","date_modified":"2026-08-06T05:16:35.000Z","tags":["kev","ransomware","public-exploit","T1190","T1090"],"_patchfirst":{"reason":"kev","priority":79.3,"kev":{"dateAdded":"2021-12-01","ransomware":true},"epss":{"score":0.99999,"percentile":0.99997},"cvss":{"score":9,"severity":"CRITICAL","version":"3.1"},"vendor":"Apache","product":"Apache","techniqueIds":["T1190","T1090"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-26855#kev","url":"https://patchfirst.co/cve/CVE-2021-26855/","title":"[KEV] CVE-2021-26855: Microsoft Exchange Server Remote Code Execution Vulnerability","content_text":"Microsoft · Exchange Server. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 9.1 CRITICAL. Public exploit code exists. ATT&CK: T1133 External Remote Services; T1090 Proxy; T1005 Data from Local System; T1505.003 Web Shell. Named in 5 threat reports. Priority 89.4 of 100.","summary":"Microsoft Exchange Server Remote Code Execution Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-08-19T19:22:24.000Z","tags":["kev","ransomware","public-exploit","T1133","T1090","T1005","T1505.003"],"_patchfirst":{"reason":"kev","priority":89.4,"kev":{"dateAdded":"2021-11-03","ransomware":true},"epss":{"score":0.99996,"percentile":0.99988},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1"},"vendor":"Microsoft","product":"Exchange Server","techniqueIds":["T1133","T1090","T1005","T1505.003"],"reportCount":5,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2019-3396#kev","url":"https://patchfirst.co/cve/CVE-2019-3396/","title":"[KEV] CVE-2019-3396: Atlassian Confluence Server and Data Center Server-Side Template Injection Vulnerability","content_text":"Atlassian · Confluence Server and Data Server. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.9% (higher than 99.97% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1133 External Remote Services; T1090 Proxy; T1202 Indirect Command Execution. Named in 1 threat report. Priority 83.7 of 100.","summary":"Atlassian Confluence Server and Data Center Server-Side Template Injection Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T02:35:05.000Z","tags":["kev","ransomware","public-exploit","T1133","T1090","T1202"],"_patchfirst":{"reason":"kev","priority":83.7,"kev":{"dateAdded":"2021-11-03","ransomware":true},"epss":{"score":0.99913,"percentile":0.99967},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Atlassian","product":"Confluence Server and Data Server","techniqueIds":["T1133","T1090","T1202"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-22986#kev","url":"https://patchfirst.co/cve/CVE-2021-22986/","title":"[KEV] CVE-2021-22986: F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution Vulnerability","content_text":"F5 · BIG-IP and BIG-IQ Centralized Management. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.9% (higher than 99.97% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1133 External Remote Services; T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1090 Proxy; T1485 Data Destruction. Priority 79.9 of 100.","summary":"F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T03:38:09.000Z","tags":["kev","ransomware","public-exploit","T1133","T1190","T1059","T1090","T1485"],"_patchfirst":{"reason":"kev","priority":79.9,"kev":{"dateAdded":"2021-11-03","ransomware":true},"epss":{"score":0.99898,"percentile":0.99965},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"F5","product":"BIG-IP and BIG-IQ Centralized Management","techniqueIds":["T1133","T1190","T1059","T1090","T1485"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2016-3718#kev","url":"https://patchfirst.co/cve/CVE-2016-3718/","title":"[KEV] CVE-2016-3718: ImageMagick Server-Side Request Forgery (SSRF) Vulnerability","content_text":"ImageMagick · ImageMagick. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 75.6% (higher than 99.52% of CVEs). CVSS 5.5 MEDIUM. Public exploit code exists. ATT&CK: T1090 Proxy. Priority 66.8 of 100.","summary":"ImageMagick Server-Side Request Forgery (SSRF) Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T00:46:15.000Z","tags":["kev","public-exploit","T1090"],"_patchfirst":{"reason":"kev","priority":66.8,"kev":{"dateAdded":"2021-11-03","ransomware":false},"epss":{"score":0.7565,"percentile":0.9952},"cvss":{"score":5.5,"severity":"MEDIUM","version":"3.1"},"vendor":"ImageMagick","product":"ImageMagick","techniqueIds":["T1090"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}}]}