https://patchfirst.co/technique/T1114/New and newly exploited CVEs that lead to ATT&CK T1114 Email Collection, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.en-gb360Sat, 31 Oct 2026 05:11:25 GMThttps://patchfirst.co/cve/CVE-2024-42009/CVE-2024-42009#kevMon, 09 Jun 2025 00:00:00 GMTRoundcube · Webmail. In CISA KEV since 2025-06-09. ENISA EUVD lists it as exploited. EPSS 82.9% (higher than 99.67% of CVEs). CVSS 9.3 CRITICAL. Public exploit code exists. ATT&CK: T1566.002 Spearphishing Link; T1056 Input Capture; T1114 Email Collection. Priority 69.4 of 100.kevpublic-exploitT1566.002T1056T1114https://patchfirst.co/cve/CVE-2024-27443/CVE-2024-27443#kevMon, 19 May 2025 00:00:00 GMTSynacor · Zimbra Collaboration Suite (ZCS). In CISA KEV since 2025-05-19. ENISA EUVD lists it as exploited. EPSS 24.6% (higher than 97.9% of CVEs). CVSS 6.1 MEDIUM. Public exploit code exists. ATT&CK: T1566.002 Spearphishing Link; T1059.004 Unix Shell; T1114 Email Collection; T1041 Exfiltration Over C2 Channel. Priority 66.8 of 100.kevpublic-exploitT1566.002T1059.004T1114T1041https://patchfirst.co/cve/CVE-2020-0688/CVE-2020-0688#kevWed, 03 Nov 2021 00:00:00 GMTMicrosoft · Exchange Server. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.97% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1110 Brute Force; T1114 Email Collection; T1505.003 Web Shell. Named in 3 threat reports. Priority 86.9 of 100.kevransomwarepublic-exploitT1190T1110T1114T1505.003