{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: CVEs linked to T1114 Email Collection","home_page_url":"https://patchfirst.co/technique/T1114/","feed_url":"https://patchfirst.co/feed/technique/T1114.json","description":"New and newly exploited CVEs that lead to ATT&CK T1114 Email Collection, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2024-42009#kev","url":"https://patchfirst.co/cve/CVE-2024-42009/","title":"[KEV] CVE-2024-42009: RoundCube Webmail Cross-Site Scripting Vulnerability","content_text":"Roundcube · Webmail. In CISA KEV since 2025-06-09. ENISA EUVD lists it as exploited. EPSS 82.9% (higher than 99.67% of CVEs). CVSS 9.3 CRITICAL. Public exploit code exists. ATT&CK: T1566.002 Spearphishing Link; T1056 Input Capture; T1114 Email Collection. Priority 69.4 of 100.","summary":"RoundCube Webmail Cross-Site Scripting Vulnerability","date_published":"2025-06-09T00:00:00.000Z","date_modified":"2026-06-17T07:48:37.000Z","tags":["kev","public-exploit","T1566.002","T1056","T1114"],"_patchfirst":{"reason":"kev","priority":69.4,"kev":{"dateAdded":"2025-06-09","ransomware":false},"epss":{"score":0.82882,"percentile":0.99671},"cvss":{"score":9.3,"severity":"CRITICAL","version":"3.1"},"vendor":"Roundcube","product":"Webmail","techniqueIds":["T1566.002","T1056","T1114"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-27443#kev","url":"https://patchfirst.co/cve/CVE-2024-27443/","title":"[KEV] CVE-2024-27443: Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability","content_text":"Synacor · Zimbra Collaboration Suite (ZCS). In CISA KEV since 2025-05-19. ENISA EUVD lists it as exploited. EPSS 24.6% (higher than 97.9% of CVEs). CVSS 6.1 MEDIUM. Public exploit code exists. ATT&CK: T1566.002 Spearphishing Link; T1059.004 Unix Shell; T1114 Email Collection; T1041 Exfiltration Over C2 Channel. Priority 66.8 of 100.","summary":"Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability","date_published":"2025-05-19T00:00:00.000Z","date_modified":"2026-06-17T07:19:54.000Z","tags":["kev","public-exploit","T1566.002","T1059.004","T1114","T1041"],"_patchfirst":{"reason":"kev","priority":66.8,"kev":{"dateAdded":"2025-05-19","ransomware":false},"epss":{"score":0.24606,"percentile":0.97881},"cvss":{"score":6.1,"severity":"MEDIUM","version":"3.1"},"vendor":"Synacor","product":"Zimbra Collaboration Suite (ZCS)","techniqueIds":["T1566.002","T1059.004","T1114","T1041"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2020-0688#kev","url":"https://patchfirst.co/cve/CVE-2020-0688/","title":"[KEV] CVE-2020-0688: Microsoft Exchange Server Validation Key Remote Code Execution Vulnerability","content_text":"Microsoft · Exchange Server. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.97% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1110 Brute Force; T1114 Email Collection; T1505.003 Web Shell. Named in 3 threat reports. Priority 86.9 of 100.","summary":"Microsoft Exchange Server Validation Key Remote Code Execution Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T02:46:21.000Z","tags":["kev","ransomware","public-exploit","T1190","T1110","T1114","T1505.003"],"_patchfirst":{"reason":"kev","priority":86.9,"kev":{"dateAdded":"2021-11-03","ransomware":true},"epss":{"score":0.99955,"percentile":0.99974},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Exchange Server","techniqueIds":["T1190","T1110","T1114","T1505.003"],"reportCount":3,"hasPublicExploit":true,"euvdExploited":true}}]}