https://patchfirst.co/technique/T1106/New and newly exploited CVEs that lead to ATT&CK T1106 Native API, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.en-gb360Sat, 31 Oct 2026 05:11:25 GMThttps://patchfirst.co/cve/CVE-2025-20281/CVE-2025-20281#kevMon, 28 Jul 2025 00:00:00 GMTCisco · Identity Services Engine. In CISA KEV since 2025-07-28. ENISA EUVD lists it as exploited. EPSS 97.6% (higher than 99.9% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1106 Native API; T1059 Command and Scripting Interpreter. Priority 70.0 of 100.kevpublic-exploitT1106T1059https://patchfirst.co/cve/CVE-2025-20337/CVE-2025-20337#kevMon, 28 Jul 2025 00:00:00 GMTCisco · Identity Services Engine. In CISA KEV since 2025-07-28. ENISA EUVD lists it as exploited. EPSS 74.5% (higher than 99.49% of CVEs). CVSS 10.0 CRITICAL. ATT&CK: T1106 Native API; T1059 Command and Scripting Interpreter. Priority 64.9 of 100.kevT1106T1059https://patchfirst.co/cve/CVE-2025-31200/CVE-2025-31200#kevThu, 17 Apr 2025 00:00:00 GMTApple · Multiple Products. In CISA KEV since 2025-04-17. ENISA EUVD lists it as exploited. EPSS 20.9% (higher than 97.6% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1105 Ingress Tool Transfer; T1001 Data Obfuscation; T1059 Command and Scripting Interpreter; T1106 Native API; T1557 Adversary-in-the-Middle. Priority 69.4 of 100.kevpublic-exploitT1105T1001T1059T1106T1557https://patchfirst.co/cve/CVE-2025-31201/CVE-2025-31201#kevThu, 17 Apr 2025 00:00:00 GMTApple · Multiple Products. In CISA KEV since 2025-04-17. ENISA EUVD lists it as exploited. EPSS 14.0% (higher than 96.5% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1105 Ingress Tool Transfer; T1001 Data Obfuscation; T1059 Command and Scripting Interpreter; T1106 Native API; T1557 Adversary-in-the-Middle. Priority 69.2 of 100.kevpublic-exploitT1105T1001T1059T1106T1557https://patchfirst.co/cve/CVE-2024-20439/CVE-2024-20439#kevMon, 31 Mar 2025 00:00:00 GMTCisco · Smart Licensing Utility. In CISA KEV since 2025-03-31. ENISA EUVD lists it as exploited. EPSS 97.1% (higher than 99.89% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1552 Unsecured Credentials; T1106 Native API. Priority 69.8 of 100.kevpublic-exploitT1552T1106https://patchfirst.co/cve/CVE-2023-1389/CVE-2023-1389#kevMon, 01 May 2023 00:00:00 GMTTP-Link · Archer AX21. In CISA KEV since 2023-05-01. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1106 Native API; T1496 Resource Hijacking; T1041 Exfiltration Over C2 Channel; T1070 Indicator Removal; T1498 Network Denial of Service. Priority 69.2 of 100.kevpublic-exploitT1106T1496T1041T1070T1498https://patchfirst.co/cve/CVE-2020-8657/CVE-2020-8657#kevWed, 03 Nov 2021 00:00:00 GMTEyesOfNetwork · EyesOfNetwork. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 91.9% (higher than 99.82% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1106 Native API. Priority 69.8 of 100.kevpublic-exploitT1106