{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: CVEs linked to T1133 External Remote Services","home_page_url":"https://patchfirst.co/technique/T1133/","feed_url":"https://patchfirst.co/feed/technique/T1133.json","description":"New and newly exploited CVEs that lead to ATT&CK T1133 External Remote Services, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2026-65400#kev","url":"https://patchfirst.co/cve/CVE-2026-65400/","title":"[KEV] CVE-2026-65400: Apple macOS Improper Authentication Vulnerability","content_text":"Apple · macOS. In CISA KEV since 2026-08-18. ENISA EUVD lists it as exploited. EPSS 1.7% (higher than 77.5% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1133 External Remote Services; T1021 Remote Services. Priority 75.4 of 100.","summary":"Apple macOS Improper Authentication Vulnerability","date_published":"2026-08-18T00:00:00.000Z","date_modified":"2026-10-24T16:10:00.000Z","tags":["kev","public-exploit","T1133","T1021"],"_patchfirst":{"reason":"kev","priority":75.4,"kev":{"dateAdded":"2026-08-18","ransomware":false},"epss":{"score":0.01723,"percentile":0.77487},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Apple","product":"macOS","techniqueIds":["T1133","T1021"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-50751#kev","url":"https://patchfirst.co/cve/CVE-2026-50751/","title":"[KEV] CVE-2026-50751: Check Point Security Gateway Improper Authentication Vulnerability","content_text":"Check Point · Security Gateway. In CISA KEV since 2026-06-08, known ransomware use. ENISA EUVD lists it as exploited. EPSS 85.3% (higher than 99.72% of CVEs). CVSS 9.3 CRITICAL. Public exploit code exists. ATT&CK: T1133 External Remote Services; T1078 Valid Accounts. Priority 84.5 of 100.","summary":"Check Point Security Gateway Improper Authentication Vulnerability","date_published":"2026-06-08T00:00:00.000Z","date_modified":"2026-08-04T05:16:39.000Z","tags":["kev","ransomware","public-exploit","T1133","T1078"],"_patchfirst":{"reason":"kev","priority":84.5,"kev":{"dateAdded":"2026-06-08","ransomware":true},"epss":{"score":0.85338,"percentile":0.99717},"cvss":{"score":9.3,"severity":"CRITICAL","version":"3.1"},"vendor":"Check Point","product":"Security Gateway","techniqueIds":["T1133","T1078"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-0257#kev","url":"https://patchfirst.co/cve/CVE-2026-0257/","title":"[KEV] CVE-2026-0257: Palo Alto Networks PAN-OS Authentication Bypass Vulnerability","content_text":"Palo Alto Networks · PAN-OS. In CISA KEV since 2026-05-29, known ransomware use. ENISA EUVD lists it as exploited. EPSS 95.0% (higher than 99.86% of CVEs). CVSS 9.1 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1133 External Remote Services. Named in 4 threat reports. Priority 93.3 of 100.","summary":"Palo Alto Networks PAN-OS Authentication Bypass Vulnerability","date_published":"2026-05-29T00:00:00.000Z","date_modified":"2026-10-26T14:10:00.000Z","tags":["kev","ransomware","public-exploit","T1190","T1133"],"_patchfirst":{"reason":"kev","priority":93.3,"kev":{"dateAdded":"2026-05-29","ransomware":true},"epss":{"score":0.95012,"percentile":0.99861},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1"},"vendor":"Palo Alto Networks","product":"PAN-OS","techniqueIds":["T1190","T1133"],"reportCount":4,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-66644#kev","url":"https://patchfirst.co/cve/CVE-2025-66644/","title":"[KEV] CVE-2025-66644: Array Networks ArrayOS AG OS Command Injection Vulnerability","content_text":"Array Networks  · ArrayOS AG. In CISA KEV since 2025-12-08. ENISA EUVD lists it as exploited. EPSS 3.4% (higher than 88.9% of CVEs). CVSS 9.8 CRITICAL. ATT&CK: T1133 External Remote Services; T1059 Command and Scripting Interpreter. Priority 67.6 of 100.","summary":"Array Networks ArrayOS AG OS Command Injection Vulnerability","date_published":"2025-12-08T00:00:00.000Z","date_modified":"2026-06-17T09:57:08.000Z","tags":["kev","T1133","T1059"],"_patchfirst":{"reason":"kev","priority":67.6,"kev":{"dateAdded":"2025-12-08","ransomware":false},"epss":{"score":0.03415,"percentile":0.88875},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Array Networks ","product":"ArrayOS AG","techniqueIds":["T1133","T1059"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2025-20333#kev","url":"https://patchfirst.co/cve/CVE-2025-20333/","title":"[KEV] CVE-2025-20333: Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow…","content_text":"Cisco · Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense. In CISA KEV since 2025-09-25. ENISA EUVD lists it as exploited. EPSS 71.2% (higher than 99.41% of CVEs). CVSS 9.9 CRITICAL. Public exploit code exists. ATT&CK: T1133 External Remote Services; T1059 Command and Scripting Interpreter. Named in 5 threat reports. Priority 79.8 of 100.","summary":"Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow…","date_published":"2025-09-25T00:00:00.000Z","date_modified":"2026-10-18T21:10:00.000Z","tags":["kev","public-exploit","T1133","T1059"],"_patchfirst":{"reason":"kev","priority":79.8,"kev":{"dateAdded":"2025-09-25","ransomware":false},"epss":{"score":0.71207,"percentile":0.99408},"cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1"},"vendor":"Cisco","product":"Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense","techniqueIds":["T1133","T1059"],"reportCount":5,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-39780#kev","url":"https://patchfirst.co/cve/CVE-2023-39780/","title":"[KEV] CVE-2023-39780: ASUS RT-AX55 Routers OS Command Injection Vulnerability","content_text":"ASUS · RT-AX55 Routers. In CISA KEV since 2025-06-02. ENISA EUVD lists it as exploited. EPSS 39.5% (higher than 98.6% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1133 External Remote Services; T1588 Obtain Capabilities; T1059.004 Unix Shell; T1021.004 SSH. Priority 68.9 of 100.","summary":"ASUS RT-AX55 Routers OS Command Injection Vulnerability","date_published":"2025-06-02T00:00:00.000Z","date_modified":"2026-06-17T06:12:51.000Z","tags":["kev","public-exploit","T1078","T1133","T1588","T1059.004","T1021.004"],"_patchfirst":{"reason":"kev","priority":68.9,"kev":{"dateAdded":"2025-06-02","ransomware":false},"epss":{"score":0.39514,"percentile":0.98611},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"ASUS","product":"RT-AX55 Routers","techniqueIds":["T1078","T1133","T1588","T1059.004","T1021.004"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-32756#kev","url":"https://patchfirst.co/cve/CVE-2025-32756/","title":"[KEV] CVE-2025-32756: Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability","content_text":"Fortinet · Multiple Products. In CISA KEV since 2025-05-14. ENISA EUVD lists it as exploited. EPSS 30.9% (higher than 98.3% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1133 External Remote Services; T1059 Command and Scripting Interpreter; T1003 OS Credential Dumping; T1041 Exfiltration Over C2 Channel; T1046 Network Service Discovery; T1070.004 File Deletion; +1 more. Priority 79.5 of 100.","summary":"Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability","date_published":"2025-05-14T00:00:00.000Z","date_modified":"2026-06-17T09:12:32.000Z","tags":["kev","public-exploit","T1133","T1059","T1003","T1041","T1046","T1070.004","T1608.001"],"_patchfirst":{"reason":"kev","priority":79.5,"kev":{"dateAdded":"2025-05-14","ransomware":false},"epss":{"score":0.30944,"percentile":0.98257},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Fortinet","product":"Multiple Products","techniqueIds":["T1133","T1059","T1003","T1041","T1046","T1070.004","T1608.001"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-11120#kev","url":"https://patchfirst.co/cve/CVE-2024-11120/","title":"[KEV] CVE-2024-11120: GeoVision Devices OS Command Injection Vulnerability","content_text":"GeoVision · Multiple Devices. In CISA KEV since 2025-05-07. ENISA EUVD lists it as exploited. EPSS 28.4% (higher than 98.1% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1133 External Remote Services; T1498 Network Denial of Service. Priority 69.5 of 100.","summary":"GeoVision Devices OS Command Injection Vulnerability","date_published":"2025-05-07T00:00:00.000Z","date_modified":"2026-06-17T06:57:06.000Z","tags":["kev","public-exploit","T1133","T1498"],"_patchfirst":{"reason":"kev","priority":69.5,"kev":{"dateAdded":"2025-05-07","ransomware":false},"epss":{"score":0.28386,"percentile":0.9812},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"GeoVision","product":"Multiple Devices","techniqueIds":["T1133","T1498"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-45195#kev","url":"https://patchfirst.co/cve/CVE-2024-45195/","title":"[KEV] CVE-2024-45195: Apache OFBiz Forced Browsing Vulnerability","content_text":"Apache · OFBiz. In CISA KEV since 2025-02-04. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.98% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1133 External Remote Services; T1059 Command and Scripting Interpreter; T1498.001 Direct Network Flood. Priority 68.2 of 100.","summary":"Apache OFBiz Forced Browsing Vulnerability","date_published":"2025-02-04T00:00:00.000Z","date_modified":"2026-06-17T07:53:46.000Z","tags":["kev","public-exploit","T1133","T1059","T1498.001"],"_patchfirst":{"reason":"kev","priority":68.2,"kev":{"dateAdded":"2025-02-04","ransomware":false},"epss":{"score":0.99983,"percentile":0.99982},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"Apache","product":"OFBiz","techniqueIds":["T1133","T1059","T1498.001"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-48365#kev","url":"https://patchfirst.co/cve/CVE-2023-48365/","title":"[KEV] CVE-2023-48365: Qlik Sense HTTP Tunneling Vulnerability","content_text":"Qlik · Sense. In CISA KEV since 2025-01-13, known ransomware use. ENISA EUVD lists it as exploited. EPSS 47.7% (higher than 98.8% of CVEs). CVSS 9.9 CRITICAL. ATT&CK: T1133 External Remote Services; T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 74.7 of 100.","summary":"Qlik Sense HTTP Tunneling Vulnerability","date_published":"2025-01-13T00:00:00.000Z","date_modified":"2026-06-17T06:34:06.000Z","tags":["kev","ransomware","T1133","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":74.7,"kev":{"dateAdded":"2025-01-13","ransomware":true},"epss":{"score":0.47733,"percentile":0.98849},"cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1"},"vendor":"Qlik","product":"Sense","techniqueIds":["T1133","T1190","T1059"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2024-1212#kev","url":"https://patchfirst.co/cve/CVE-2024-1212/","title":"[KEV] CVE-2024-1212: Progress Kemp LoadMaster OS Command Injection Vulnerability","content_text":"Progress · Kemp LoadMaster. In CISA KEV since 2024-11-18. ENISA EUVD lists it as exploited. EPSS 95.4% (higher than 99.87% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1133 External Remote Services; T1059 Command and Scripting Interpreter. Priority 69.8 of 100.","summary":"Progress Kemp LoadMaster OS Command Injection Vulnerability","date_published":"2024-11-18T00:00:00.000Z","date_modified":"2026-07-13T19:49:31.000Z","tags":["kev","public-exploit","T1133","T1059"],"_patchfirst":{"reason":"kev","priority":69.8,"kev":{"dateAdded":"2024-11-18","ransomware":false},"epss":{"score":0.95388,"percentile":0.99867},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Progress","product":"Kemp LoadMaster","techniqueIds":["T1133","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-20269#kev","url":"https://patchfirst.co/cve/CVE-2023-20269/","title":"[KEV] CVE-2023-20269: Cisco Adaptive Security Appliance and Firepower Threat Defense Unauthorized Access Vulnerability","content_text":"Cisco · Adaptive Security Appliance and Firepower Threat Defense. In CISA KEV since 2023-09-13, known ransomware use. ENISA EUVD lists it as exploited. EPSS 26.6% (higher than 98% of CVEs). CVSS 9.1 CRITICAL. ATT&CK: T1133 External Remote Services; T1078 Valid Accounts. Priority 74.0 of 100.","summary":"Cisco Adaptive Security Appliance and Firepower Threat Defense Unauthorized Access Vulnerability","date_published":"2023-09-13T00:00:00.000Z","date_modified":"2026-08-11T19:33:44.000Z","tags":["kev","ransomware","T1133","T1078"],"_patchfirst":{"reason":"kev","priority":74,"kev":{"dateAdded":"2023-09-13","ransomware":true},"epss":{"score":0.26623,"percentile":0.98018},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1"},"vendor":"Cisco","product":"Adaptive Security Appliance and Firepower Threat Defense","techniqueIds":["T1133","T1078"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2023-27532#kev","url":"https://patchfirst.co/cve/CVE-2023-27532/","title":"[KEV] CVE-2023-27532: Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function Vulnerability","content_text":"Veeam · Backup & Replication. In CISA KEV since 2023-08-22, known ransomware use. ENISA EUVD lists it as exploited. EPSS 80.6% (higher than 99.62% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1133 External Remote Services; T1059.003 Windows Command Shell; T1087 Account Discovery; T1087.001 Local Account; T1486 Data Encrypted for Impact; T1555 Credentials from Password Stores. Named in 1 threat report. Priority 82.0 of 100.","summary":"Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function Vulnerability","date_published":"2023-08-22T00:00:00.000Z","date_modified":"2026-06-17T05:45:24.000Z","tags":["kev","ransomware","public-exploit","T1133","T1059.003","T1087","T1087.001","T1486","T1555"],"_patchfirst":{"reason":"kev","priority":82,"kev":{"dateAdded":"2023-08-22","ransomware":true},"epss":{"score":0.80599,"percentile":0.99624},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"Veeam","product":"Backup & Replication","techniqueIds":["T1133","T1059.003","T1087","T1087.001","T1486","T1555"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2022-23176#kev","url":"https://patchfirst.co/cve/CVE-2022-23176/","title":"[KEV] CVE-2022-23176: WatchGuard Firebox and XTM Privilege Escalation Vulnerability","content_text":"WatchGuard · Firebox and XTM. In CISA KEV since 2022-04-11. ENISA EUVD lists it as exploited. EPSS 10.8% (higher than 95.8% of CVEs). CVSS 8.8 HIGH. ATT&CK: T1133 External Remote Services; T1078 Valid Accounts. Priority 63.3 of 100.","summary":"WatchGuard Firebox and XTM Privilege Escalation Vulnerability","date_published":"2022-04-11T00:00:00.000Z","date_modified":"2026-06-17T04:29:37.000Z","tags":["kev","T1133","T1078"],"_patchfirst":{"reason":"kev","priority":63.3,"kev":{"dateAdded":"2022-04-11","ransomware":false},"epss":{"score":0.10805,"percentile":0.95838},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"WatchGuard","product":"Firebox and XTM","techniqueIds":["T1133","T1078"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2022-20699#kev","url":"https://patchfirst.co/cve/CVE-2022-20699/","title":"[KEV] CVE-2022-20699: Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability","content_text":"Cisco · Small Business RV160, RV260, RV340, and RV345 Series Routers. In CISA KEV since 2022-03-03. ENISA EUVD lists it as exploited. EPSS 72.5% (higher than 99.44% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1133 External Remote Services; T1059.004 Unix Shell. Priority 69.7 of 100.","summary":"Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability","date_published":"2022-03-03T00:00:00.000Z","date_modified":"2026-06-17T04:24:53.000Z","tags":["kev","public-exploit","T1133","T1059.004"],"_patchfirst":{"reason":"kev","priority":69.7,"kev":{"dateAdded":"2022-03-03","ransomware":false},"epss":{"score":0.72458,"percentile":0.99439},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Cisco","product":"Small Business RV160, RV260, RV340, and RV345 Series Routers","techniqueIds":["T1133","T1059.004"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2014-6271#kev","url":"https://patchfirst.co/cve/CVE-2014-6271/","title":"[KEV] CVE-2014-6271: GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability","content_text":"GNU · Bourne-Again Shell (Bash). In CISA KEV since 2022-01-28. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1133 External Remote Services; T1190 Exploit Public-Facing Application; T1059.004 Unix Shell. Named in 2 threat reports. Priority 76.0 of 100.","summary":"GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability","date_published":"2022-01-28T00:00:00.000Z","date_modified":"2026-06-17T00:12:48.000Z","tags":["kev","public-exploit","T1133","T1190","T1059.004"],"_patchfirst":{"reason":"kev","priority":76,"kev":{"dateAdded":"2022-01-28","ransomware":false},"epss":{"score":0.99999,"percentile":0.99993},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"GNU","product":"Bourne-Again Shell (Bash)","techniqueIds":["T1133","T1190","T1059.004"],"reportCount":2,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2014-7169#kev","url":"https://patchfirst.co/cve/CVE-2014-7169/","title":"[KEV] CVE-2014-7169: GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability","content_text":"GNU · Bourne-Again Shell (Bash). In CISA KEV since 2022-01-28. ENISA EUVD lists it as exploited. EPSS 99.9% (higher than 99.97% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1133 External Remote Services; T1190 Exploit Public-Facing Application; T1059.004 Unix Shell. Priority 69.9 of 100.","summary":"GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability","date_published":"2022-01-28T00:00:00.000Z","date_modified":"2026-06-17T00:14:28.000Z","tags":["kev","public-exploit","T1133","T1190","T1059.004"],"_patchfirst":{"reason":"kev","priority":69.9,"kev":{"dateAdded":"2022-01-28","ransomware":false},"epss":{"score":0.9994,"percentile":0.99972},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"GNU","product":"Bourne-Again Shell (Bash)","techniqueIds":["T1133","T1190","T1059.004"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2019-11510#kev","url":"https://patchfirst.co/cve/CVE-2019-11510/","title":"[KEV] CVE-2019-11510: Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability","content_text":"Ivanti · Pulse Connect Secure. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1133 External Remote Services; T1059 Command and Scripting Interpreter; T1083 File and Directory Discovery; T1552.001 Credentials In Files. Named in 6 threat reports. Priority 90.0 of 100.","summary":"Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T02:13:04.000Z","tags":["kev","ransomware","public-exploit","T1133","T1059","T1083","T1552.001"],"_patchfirst":{"reason":"kev","priority":90,"kev":{"dateAdded":"2021-11-03","ransomware":true},"epss":{"score":0.99999,"percentile":0.99995},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"Ivanti","product":"Pulse Connect Secure","techniqueIds":["T1133","T1059","T1083","T1552.001"],"reportCount":6,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2019-19781#kev","url":"https://patchfirst.co/cve/CVE-2019-19781/","title":"[KEV] CVE-2019-19781: Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Vulnerability","content_text":"Citrix · Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1133 External Remote Services; T1059 Command and Scripting Interpreter; T1083 File and Directory Discovery. Named in 8 threat reports. Priority 89.9 of 100.","summary":"Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-08-12T05:17:21.000Z","tags":["kev","ransomware","public-exploit","T1133","T1059","T1083"],"_patchfirst":{"reason":"kev","priority":89.9,"kev":{"dateAdded":"2021-11-03","ransomware":true},"epss":{"score":0.99999,"percentile":0.99998},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Citrix","product":"Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance","techniqueIds":["T1133","T1059","T1083"],"reportCount":8,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2020-5902#kev","url":"https://patchfirst.co/cve/CVE-2020-5902/","title":"[KEV] CVE-2020-5902: F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability","content_text":"F5 · BIG-IP. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1133 External Remote Services; T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1003 OS Credential Dumping; T1005 Data from Local System; T1070.004 File Deletion; +1 more. Named in 5 threat reports. Priority 89.9 of 100.","summary":"F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T03:22:25.000Z","tags":["kev","ransomware","public-exploit","T1133","T1190","T1059","T1003","T1005","T1070.004","T1552"],"_patchfirst":{"reason":"kev","priority":89.9,"kev":{"dateAdded":"2021-11-03","ransomware":true},"epss":{"score":0.99999,"percentile":1},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"F5","product":"BIG-IP","techniqueIds":["T1133","T1190","T1059","T1003","T1005","T1070.004","T1552"],"reportCount":5,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-26855#kev","url":"https://patchfirst.co/cve/CVE-2021-26855/","title":"[KEV] CVE-2021-26855: Microsoft Exchange Server Remote Code Execution Vulnerability","content_text":"Microsoft · Exchange Server. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 9.1 CRITICAL. Public exploit code exists. ATT&CK: T1133 External Remote Services; T1090 Proxy; T1005 Data from Local System; T1505.003 Web Shell. Named in 5 threat reports. Priority 89.4 of 100.","summary":"Microsoft Exchange Server Remote Code Execution Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-08-19T19:22:24.000Z","tags":["kev","ransomware","public-exploit","T1133","T1090","T1005","T1505.003"],"_patchfirst":{"reason":"kev","priority":89.4,"kev":{"dateAdded":"2021-11-03","ransomware":true},"epss":{"score":0.99996,"percentile":0.99988},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1"},"vendor":"Microsoft","product":"Exchange Server","techniqueIds":["T1133","T1090","T1005","T1505.003"],"reportCount":5,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2020-1472#kev","url":"https://patchfirst.co/cve/CVE-2020-1472/","title":"[KEV] CVE-2020-1472: Microsoft Netlogon Privilege Escalation Vulnerability","content_text":"Microsoft · Netlogon. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.4% (higher than 99.94% of CVEs). CVSS 5.5 MEDIUM. Public exploit code exists. ATT&CK: T1110 Brute Force; T1133 External Remote Services; T1021 Remote Services; T1068 Exploitation for Privilege Escalation; T1087.002 Domain Account; T1486 Data Encrypted for Impact. Named in 8 threat reports. Priority 86.8 of 100.","summary":"Microsoft Netlogon Privilege Escalation Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T03:01:29.000Z","tags":["kev","ransomware","public-exploit","T1110","T1133","T1021","T1068","T1087.002","T1486"],"_patchfirst":{"reason":"kev","priority":86.8,"kev":{"dateAdded":"2021-11-03","ransomware":true},"epss":{"score":0.99389,"percentile":0.9994},"cvss":{"score":5.5,"severity":"MEDIUM","version":"3.1"},"vendor":"Microsoft","product":"Netlogon","techniqueIds":["T1110","T1133","T1021","T1068","T1087.002","T1486"],"reportCount":8,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2019-0708#kev","url":"https://patchfirst.co/cve/CVE-2019-0708/","title":"[KEV] CVE-2019-0708: Microsoft Remote Desktop Services Remote Code Execution Vulnerability","content_text":"Microsoft · Remote Desktop Services. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1133 External Remote Services; T1498 Network Denial of Service. Named in 2 threat reports. Priority 86.0 of 100.","summary":"Microsoft Remote Desktop Services Remote Code Execution Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T02:08:44.000Z","tags":["kev","ransomware","public-exploit","T1133","T1498"],"_patchfirst":{"reason":"kev","priority":86,"kev":{"dateAdded":"2021-11-03","ransomware":true},"epss":{"score":0.99999,"percentile":0.99999},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Microsoft","product":"Remote Desktop Services","techniqueIds":["T1133","T1498"],"reportCount":2,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2019-3396#kev","url":"https://patchfirst.co/cve/CVE-2019-3396/","title":"[KEV] CVE-2019-3396: Atlassian Confluence Server and Data Center Server-Side Template Injection Vulnerability","content_text":"Atlassian · Confluence Server and Data Server. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.9% (higher than 99.97% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1133 External Remote Services; T1090 Proxy; T1202 Indirect Command Execution. Named in 1 threat report. Priority 83.7 of 100.","summary":"Atlassian Confluence Server and Data Center Server-Side Template Injection Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T02:35:05.000Z","tags":["kev","ransomware","public-exploit","T1133","T1090","T1202"],"_patchfirst":{"reason":"kev","priority":83.7,"kev":{"dateAdded":"2021-11-03","ransomware":true},"epss":{"score":0.99913,"percentile":0.99967},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Atlassian","product":"Confluence Server and Data Server","techniqueIds":["T1133","T1090","T1202"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-22986#kev","url":"https://patchfirst.co/cve/CVE-2021-22986/","title":"[KEV] CVE-2021-22986: F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution Vulnerability","content_text":"F5 · BIG-IP and BIG-IQ Centralized Management. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.9% (higher than 99.97% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1133 External Remote Services; T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1090 Proxy; T1485 Data Destruction. Priority 79.9 of 100.","summary":"F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T03:38:09.000Z","tags":["kev","ransomware","public-exploit","T1133","T1190","T1059","T1090","T1485"],"_patchfirst":{"reason":"kev","priority":79.9,"kev":{"dateAdded":"2021-11-03","ransomware":true},"epss":{"score":0.99898,"percentile":0.99965},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"F5","product":"BIG-IP and BIG-IQ Centralized Management","techniqueIds":["T1133","T1190","T1059","T1090","T1485"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2019-5591#kev","url":"https://patchfirst.co/cve/CVE-2019-5591/","title":"[KEV] CVE-2019-5591: Fortinet FortiOS Default Configuration Vulnerability","content_text":"Fortinet · FortiOS. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 18.6% (higher than 97.3% of CVEs). CVSS 6.5 MEDIUM. Public exploit code exists. ATT&CK: T1133 External Remote Services; T1557 Adversary-in-the-Middle; T1005 Data from Local System. Priority 77.0 of 100.","summary":"Fortinet FortiOS Default Configuration Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-08-15T04:17:41.000Z","tags":["kev","ransomware","public-exploit","T1133","T1557","T1005"],"_patchfirst":{"reason":"kev","priority":77,"kev":{"dateAdded":"2021-11-03","ransomware":true},"epss":{"score":0.18566,"percentile":0.9725},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.1"},"vendor":"Fortinet","product":"FortiOS","techniqueIds":["T1133","T1557","T1005"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2020-25506#kev","url":"https://patchfirst.co/cve/CVE-2020-25506/","title":"[KEV] CVE-2020-25506: D-Link DNS-320 Device Command Injection Vulnerability","content_text":"D-Link · DNS-320 Device. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.98% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1133 External Remote Services; T1059 Command and Scripting Interpreter; T1584.005 Botnet. Named in 1 threat report. Priority 73.7 of 100.","summary":"D-Link DNS-320 Device Command Injection Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T03:06:52.000Z","tags":["kev","public-exploit","T1133","T1059","T1584.005"],"_patchfirst":{"reason":"kev","priority":73.7,"kev":{"dateAdded":"2021-11-03","ransomware":false},"epss":{"score":0.99968,"percentile":0.99977},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"D-Link","product":"DNS-320 Device","techniqueIds":["T1133","T1059","T1584.005"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2020-8515#kev","url":"https://patchfirst.co/cve/CVE-2020-8515/","title":"[KEV] CVE-2020-8515: Multiple DrayTek Vigor Routers Web Management Page Vulnerability","content_text":"DrayTek · Multiple Vigor Routers. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1133 External Remote Services; T1059 Command and Scripting Interpreter; T1496 Resource Hijacking. Priority 69.9 of 100.","summary":"Multiple DrayTek Vigor Routers Web Management Page Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T03:26:30.000Z","tags":["kev","public-exploit","T1133","T1059","T1496"],"_patchfirst":{"reason":"kev","priority":69.9,"kev":{"dateAdded":"2021-11-03","ransomware":false},"epss":{"score":0.99993,"percentile":0.99987},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"DrayTek","product":"Multiple Vigor Routers","techniqueIds":["T1133","T1059","T1496"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-1497#kev","url":"https://patchfirst.co/cve/CVE-2021-1497/","title":"[KEV] CVE-2021-1497: Cisco HyperFlex HX Installer Virtual Machine Command Injection Vulnerability","content_text":"Cisco · HyperFlex HX. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 99.9% (higher than 99.97% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1133 External Remote Services; T1059 Command and Scripting Interpreter. Priority 69.9 of 100.","summary":"Cisco HyperFlex HX Installer Virtual Machine Command Injection Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T03:31:54.000Z","tags":["kev","public-exploit","T1133","T1059"],"_patchfirst":{"reason":"kev","priority":69.9,"kev":{"dateAdded":"2021-11-03","ransomware":false},"epss":{"score":0.9993,"percentile":0.99969},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Cisco","product":"HyperFlex HX","techniqueIds":["T1133","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-1498#kev","url":"https://patchfirst.co/cve/CVE-2021-1498/","title":"[KEV] CVE-2021-1498: Cisco HyperFlex HX Data Platform Command Injection Vulnerability","content_text":"Cisco · HyperFlex HX. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1133 External Remote Services; T1059 Command and Scripting Interpreter. Priority 69.9 of 100.","summary":"Cisco HyperFlex HX Data Platform Command Injection Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T03:31:54.000Z","tags":["kev","public-exploit","T1133","T1059"],"_patchfirst":{"reason":"kev","priority":69.9,"kev":{"dateAdded":"2021-11-03","ransomware":false},"epss":{"score":0.99999,"percentile":0.99991},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Cisco","product":"HyperFlex HX","techniqueIds":["T1133","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2018-4939#kev","url":"https://patchfirst.co/cve/CVE-2018-4939/","title":"[KEV] CVE-2018-4939: Adobe ColdFusion Deserialization of Untrusted Data Vulnerability","content_text":"Adobe · ColdFusion. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 61.8% (higher than 99.17% of CVEs). CVSS 9.8 CRITICAL. ATT&CK: T1133 External Remote Services; T1190 Exploit Public-Facing Application. Priority 64.7 of 100.","summary":"Adobe ColdFusion Deserialization of Untrusted Data Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T01:59:19.000Z","tags":["kev","T1133","T1190"],"_patchfirst":{"reason":"kev","priority":64.7,"kev":{"dateAdded":"2021-11-03","ransomware":false},"epss":{"score":0.6178,"percentile":0.99171},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Adobe","product":"ColdFusion","techniqueIds":["T1133","T1190"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2020-15188","url":"https://patchfirst.co/cve/CVE-2020-15188/","title":"CVE-2020-15188: Unauthenticated Remote Code Execution in SOY CMS","content_text":"inunosinsi · soycms. Not in CISA KEV. EPSS 5.1% (higher than 92.3% of CVEs). CVSS 10.0 CRITICAL. ATT&CK: T1133 External Remote Services; T1059 Command and Scripting Interpreter. Priority 25.5 of 100.","summary":"Unauthenticated Remote Code Execution in SOY CMS","date_published":"2020-09-18T00:00:00.000Z","date_modified":"2024-08-04T13:08:22.000Z","tags":["T1133","T1059"],"_patchfirst":{"reason":"published","priority":25.5,"kev":null,"epss":{"score":0.05083,"percentile":0.92333},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"inunosinsi","product":"soycms","techniqueIds":["T1133","T1059"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2020-15147","url":"https://patchfirst.co/cve/CVE-2020-15147/","title":"CVE-2020-15147: Remote Code Execution in Red Discord Bot","content_text":"Cog-Creators · Red-DiscordBot. Not in CISA KEV. EPSS 2.6% (higher than 85.4% of CVEs). CVSS 8.5 HIGH. ATT&CK: T1133 External Remote Services; T1059 Command and Scripting Interpreter. Priority 23.0 of 100.","summary":"Remote Code Execution in Red Discord Bot","date_published":"2020-08-21T00:00:00.000Z","date_modified":"2024-08-04T13:08:21.000Z","tags":["T1133","T1059"],"_patchfirst":{"reason":"published","priority":23,"kev":null,"epss":{"score":0.02614,"percentile":0.85409},"cvss":{"score":8.5,"severity":"HIGH","version":"3.1"},"vendor":"Cog-Creators","product":"Red-DiscordBot","techniqueIds":["T1133","T1059"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2020-15140","url":"https://patchfirst.co/cve/CVE-2020-15140/","title":"CVE-2020-15140: Remote Code Execution in Red Discord Bot","content_text":"Cog-Creators · Red-DiscordBot. Not in CISA KEV. EPSS 1.2% (higher than 67% of CVEs). CVSS 8.2 HIGH. ATT&CK: T1133 External Remote Services; T1059 Command and Scripting Interpreter. Priority 19.1 of 100.","summary":"Remote Code Execution in Red Discord Bot","date_published":"2020-08-21T00:00:00.000Z","date_modified":"2024-08-04T13:08:22.000Z","tags":["T1133","T1059"],"_patchfirst":{"reason":"published","priority":19.1,"kev":null,"epss":{"score":0.01156,"percentile":0.67011},"cvss":{"score":8.2,"severity":"HIGH","version":"3.1"},"vendor":"Cog-Creators","product":"Red-DiscordBot","techniqueIds":["T1133","T1059"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2020-15143","url":"https://patchfirst.co/cve/CVE-2020-15143/","title":"CVE-2020-15143: Remote Code Execution in SyliusResourceBundle","content_text":"Sylius · SyliusResourceBundle. Not in CISA KEV. EPSS 1.9% (higher than 79.8% of CVEs). CVSS 7.7 HIGH. ATT&CK: T1133 External Remote Services; T1059 Command and Scripting Interpreter. Priority 21.4 of 100.","summary":"Remote Code Execution in SyliusResourceBundle","date_published":"2020-08-19T00:00:00.000Z","date_modified":"2024-08-04T13:08:22.000Z","tags":["T1133","T1059"],"_patchfirst":{"reason":"published","priority":21.4,"kev":null,"epss":{"score":0.01914,"percentile":0.79806},"cvss":{"score":7.7,"severity":"HIGH","version":"3.1"},"vendor":"Sylius","product":"SyliusResourceBundle","techniqueIds":["T1133","T1059"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2020-15109","url":"https://patchfirst.co/cve/CVE-2020-15109/","title":"CVE-2020-15109: Ability to change order address without triggering address validations in solidus","content_text":"solidusio · solidus. Not in CISA KEV. EPSS 1.0% (higher than 62.7% of CVEs). CVSS 5.3 MEDIUM. ATT&CK: T1133 External Remote Services; T1190 Exploit Public-Facing Application; T1565 Data Manipulation. Priority 16.3 of 100.","summary":"Ability to change order address without triggering address validations in solidus","date_published":"2020-08-04T00:00:00.000Z","date_modified":"2024-08-04T13:08:21.000Z","tags":["T1133","T1190","T1565"],"_patchfirst":{"reason":"published","priority":16.3,"kev":null,"epss":{"score":0.00999,"percentile":0.62745},"cvss":{"score":5.3,"severity":"MEDIUM","version":"3.1"},"vendor":"solidusio","product":"solidus","techniqueIds":["T1133","T1190","T1565"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2020-12029","url":"https://patchfirst.co/cve/CVE-2020-12029/","title":"CVE-2020-12029: Rockwell Automation FactoryTalk View SE","content_text":"Rockwell Automation · FactoryTalk View SE. Not in CISA KEV. EPSS 47.0% (higher than 98.8% of CVEs). CVSS 9.0 CRITICAL. Public exploit code exists. ATT&CK: T1133 External Remote Services; T1505.003 Web Shell; T1059 Command and Scripting Interpreter. Priority 31.1 of 100.","summary":"Rockwell Automation FactoryTalk View SE","date_published":"2020-07-20T00:00:00.000Z","date_modified":"2024-09-16T22:02:56.000Z","tags":["public-exploit","T1133","T1505.003","T1059"],"_patchfirst":{"reason":"published","priority":31.1,"kev":null,"epss":{"score":0.46968,"percentile":0.98829},"cvss":{"score":9,"severity":"CRITICAL","version":"3.1"},"vendor":"Rockwell Automation","product":"FactoryTalk View SE","techniqueIds":["T1133","T1505.003","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2020-3387","url":"https://patchfirst.co/cve/CVE-2020-3387/","title":"CVE-2020-3387: Cisco SD-WAN vManage Software Remote Code Execution Vulnerability","content_text":"Cisco · Cisco SD-WAN vManage. Not in CISA KEV. EPSS 13.0% (higher than 96.3% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1133 External Remote Services; T1190 Exploit Public-Facing Application; T1068 Exploitation for Privilege Escalation. Priority 29.5 of 100.","summary":"Cisco SD-WAN vManage Software Remote Code Execution Vulnerability","date_published":"2020-07-16T00:00:00.000Z","date_modified":"2024-11-13T18:20:00.000Z","tags":["public-exploit","T1133","T1190","T1068"],"_patchfirst":{"reason":"published","priority":29.5,"kev":null,"epss":{"score":0.1302,"percentile":0.96328},"cvss":{"score":7.5,"severity":"HIGH","version":"3.0"},"vendor":"Cisco","product":"Cisco SD-WAN vManage","techniqueIds":["T1133","T1190","T1068"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2020-4068","url":"https://patchfirst.co/cve/CVE-2020-4068/","title":"CVE-2020-4068: Heap-based Buffer Overflow in APNSwift","content_text":"kylebrowning · APNSwift. Not in CISA KEV. EPSS 1.3% (higher than 70.7% of CVEs). CVSS 6.3 MEDIUM. ATT&CK: T1091 Replication Through Removable Media; T1133 External Remote Services; T1190 Exploit Public-Facing Application; T1566 Phishing; T1499.004 Application or System Exploitation; T1574 Hijack Execution Flow. Priority 18.6 of 100.","summary":"Heap-based Buffer Overflow in APNSwift","date_published":"2020-06-22T00:00:00.000Z","date_modified":"2024-08-04T07:52:20.000Z","tags":["T1091","T1133","T1190","T1566","T1499.004","T1574"],"_patchfirst":{"reason":"published","priority":18.6,"kev":null,"epss":{"score":0.01316,"percentile":0.70744},"cvss":{"score":6.3,"severity":"MEDIUM","version":"3.1"},"vendor":"kylebrowning","product":"APNSwift","techniqueIds":["T1091","T1133","T1190","T1566","T1499.004","T1574"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2020-12000","url":"https://patchfirst.co/cve/CVE-2020-12000/","title":"CVE-2020-12000: The affected product is vulnerable to the handling of serialized data","content_text":"Not in CISA KEV. EPSS 1.5% (higher than 73.9% of CVEs). ATT&CK: T1133 External Remote Services; T1059 Command and Scripting Interpreter. Priority 14.8 of 100.","summary":"The affected product is vulnerable to the handling of serialized data","date_published":"2020-06-09T00:00:00.000Z","date_modified":"2024-08-04T11:48:57.000Z","tags":["T1133","T1059"],"_patchfirst":{"reason":"published","priority":14.8,"kev":null,"epss":{"score":0.0148,"percentile":0.73885},"cvss":null,"vendor":null,"product":null,"techniqueIds":["T1133","T1059"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2020-3198","url":"https://patchfirst.co/cve/CVE-2020-3198/","title":"CVE-2020-3198: Cisco IOS Software for Cisco Industrial Routers Arbitrary Code Execution Vulnerabilities","content_text":"Cisco · Cisco IOS 12.2(60)EZ16. Not in CISA KEV. EPSS 4.6% (higher than 91.6% of CVEs). CVSS 9.8 CRITICAL. ATT&CK: T1133 External Remote Services; T1190 Exploit Public-Facing Application; T1566 Phishing; T1499.004 Application or System Exploitation; T1574 Hijack Execution Flow. Priority 25.2 of 100.","summary":"Cisco IOS Software for Cisco Industrial Routers Arbitrary Code Execution Vulnerabilities","date_published":"2020-06-03T00:00:00.000Z","date_modified":"2024-11-15T17:13:29.000Z","tags":["T1133","T1190","T1566","T1499.004","T1574"],"_patchfirst":{"reason":"published","priority":25.2,"kev":null,"epss":{"score":0.04583,"percentile":0.91625},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.0"},"vendor":"Cisco","product":"Cisco IOS 12.2(60)EZ16","techniqueIds":["T1133","T1190","T1566","T1499.004","T1574"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2020-3237","url":"https://patchfirst.co/cve/CVE-2020-3237/","title":"CVE-2020-3237: Cisco IOx Application Framework Arbitrary File Overwrite Vulnerability","content_text":"Cisco · Cisco IOx. Not in CISA KEV. EPSS 0.4% (higher than 28.6% of CVEs). CVSS 6.3 MEDIUM. ATT&CK: T1133 External Remote Services; T1565.001 Stored Data Manipulation. Priority 10.1 of 100.","summary":"Cisco IOx Application Framework Arbitrary File Overwrite Vulnerability","date_published":"2020-06-03T00:00:00.000Z","date_modified":"2024-11-15T17:11:36.000Z","tags":["T1133","T1565.001"],"_patchfirst":{"reason":"published","priority":10.1,"kev":null,"epss":{"score":0.0035,"percentile":0.28643},"cvss":{"score":6.3,"severity":"MEDIUM","version":"3.0"},"vendor":"Cisco","product":"Cisco IOx","techniqueIds":["T1133","T1565.001"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2020-3309","url":"https://patchfirst.co/cve/CVE-2020-3309/","title":"CVE-2020-3309: Cisco Firepower Device Manager On-Box Software Arbitrary File Overwrite Vulnerability","content_text":"Cisco · Cisco Firepower Threat Defense Software. Not in CISA KEV. EPSS 1.8% (higher than 78% of CVEs). CVSS 6.5 MEDIUM. ATT&CK: T1133 External Remote Services; T1190 Exploit Public-Facing Application; T1574 Hijack Execution Flow; T1565.001 Stored Data Manipulation. Priority 20.2 of 100.","summary":"Cisco Firepower Device Manager On-Box Software Arbitrary File Overwrite Vulnerability","date_published":"2020-05-06T00:00:00.000Z","date_modified":"2024-11-15T17:27:25.000Z","tags":["T1133","T1190","T1574","T1565.001"],"_patchfirst":{"reason":"published","priority":20.2,"kev":null,"epss":{"score":0.01766,"percentile":0.78045},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.0"},"vendor":"Cisco","product":"Cisco Firepower Threat Defense Software","techniqueIds":["T1133","T1190","T1574","T1565.001"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2020-11010","url":"https://patchfirst.co/cve/CVE-2020-11010/","title":"CVE-2020-11010: SQL injection in Tortoise ORM","content_text":"tortoise · tortoise-orm. Not in CISA KEV. EPSS 1.0% (higher than 64.2% of CVEs). CVSS 6.3 MEDIUM. ATT&CK: T1133 External Remote Services; T1059 Command and Scripting Interpreter; T1005 Data from Local System; T1136 Create Account; T1190 Exploit Public-Facing Application; T1505.003 Web Shell; +1 more. Priority 17.2 of 100.","summary":"SQL injection in Tortoise ORM","date_published":"2020-04-20T00:00:00.000Z","date_modified":"2024-08-04T11:21:14.000Z","tags":["T1133","T1059","T1005","T1136","T1190","T1505.003","T1565.001"],"_patchfirst":{"reason":"published","priority":17.2,"kev":null,"epss":{"score":0.01047,"percentile":0.64169},"cvss":{"score":6.3,"severity":"MEDIUM","version":"3.1"},"vendor":"tortoise","product":"tortoise-orm","techniqueIds":["T1133","T1059","T1005","T1136","T1190","T1505.003","T1565.001"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2020-3240","url":"https://patchfirst.co/cve/CVE-2020-3240/","title":"CVE-2020-3240: Multiple Vulnerabilities in Cisco UCS Director and Cisco UCS Director Express for Big Data","content_text":"Cisco · Cisco UCS Director. Not in CISA KEV. EPSS 38.7% (higher than 98.6% of CVEs). CVSS 9.8 CRITICAL. ATT&CK: T1133 External Remote Services; T1005 Data from Local System; T1505.003 Web Shell; T1003.008 /etc/passwd and /etc/shadow; T1059 Command and Scripting Interpreter; T1552.001 Credentials In Files. Priority 26.6 of 100.","summary":"Multiple Vulnerabilities in Cisco UCS Director and Cisco UCS Director Express for Big Data","date_published":"2020-04-15T00:00:00.000Z","date_modified":"2024-11-15T17:30:58.000Z","tags":["T1133","T1005","T1505.003","T1003.008","T1059","T1552.001"],"_patchfirst":{"reason":"published","priority":26.6,"kev":null,"epss":{"score":0.38693,"percentile":0.98578},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.0"},"vendor":"Cisco","product":"Cisco UCS Director","techniqueIds":["T1133","T1005","T1505.003","T1003.008","T1059","T1552.001"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2020-10603","url":"https://patchfirst.co/cve/CVE-2020-10603/","title":"CVE-2020-10603: WebAccess/NMS (versions prior to 3.0.2) does not properly sanitize user input and may allow an attacker to inject…","content_text":"Not in CISA KEV. EPSS 1.2% (higher than 68.7% of CVEs). ATT&CK: T1133 External Remote Services; T1059 Command and Scripting Interpreter. Priority 13.7 of 100.","summary":"WebAccess/NMS (versions prior to 3.0.2) does not properly sanitize user input and may allow an attacker to inject…","date_published":"2020-04-09T00:00:00.000Z","date_modified":"2024-08-04T11:06:10.000Z","tags":["T1133","T1059"],"_patchfirst":{"reason":"published","priority":13.7,"kev":null,"epss":{"score":0.01221,"percentile":0.68672},"cvss":null,"vendor":null,"product":null,"techniqueIds":["T1133","T1059"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2019-18234","url":"https://patchfirst.co/cve/CVE-2019-18234/","title":"CVE-2019-18234: Equinox Control Expert all versions, is vulnerable to an SQL injection attack, which may allow an attacker to remotely…","content_text":"Not in CISA KEV. EPSS 1.9% (higher than 79.5% of CVEs). ATT&CK: T1133 External Remote Services; T1059 Command and Scripting Interpreter; T1005 Data from Local System; T1136 Create Account; T1190 Exploit Public-Facing Application; T1505.003 Web Shell; +1 more. Priority 15.9 of 100.","summary":"Equinox Control Expert all versions, is vulnerable to an SQL injection attack, which may allow an attacker to remotely…","date_published":"2019-12-23T00:00:00.000Z","date_modified":"2024-08-05T01:47:14.000Z","tags":["T1133","T1059","T1005","T1136","T1190","T1505.003","T1565.001"],"_patchfirst":{"reason":"published","priority":15.9,"kev":null,"epss":{"score":0.01889,"percentile":0.79525},"cvss":null,"vendor":null,"product":null,"techniqueIds":["T1133","T1059","T1005","T1136","T1190","T1505.003","T1565.001"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2019-15972","url":"https://patchfirst.co/cve/CVE-2019-15972/","title":"CVE-2019-15972: Cisco Unified Communications Manager SQL Injection Vulnerability","content_text":"Cisco · Cisco Unified Communications Manager. Not in CISA KEV. EPSS 1.6% (higher than 75.8% of CVEs). CVSS 5.4 MEDIUM. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1133 External Remote Services; T1059 Command and Scripting Interpreter; T1005 Data from Local System; T1565.001 Stored Data Manipulation. Priority 23.9 of 100.","summary":"Cisco Unified Communications Manager SQL Injection Vulnerability","date_published":"2019-11-26T00:00:00.000Z","date_modified":"2024-11-21T19:04:30.000Z","tags":["public-exploit","T1078","T1133","T1059","T1005","T1565.001"],"_patchfirst":{"reason":"published","priority":23.9,"kev":null,"epss":{"score":0.01605,"percentile":0.75835},"cvss":{"score":5.4,"severity":"MEDIUM","version":"3.0"},"vendor":"Cisco","product":"Cisco Unified Communications Manager","techniqueIds":["T1078","T1133","T1059","T1005","T1565.001"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2019-15288","url":"https://patchfirst.co/cve/CVE-2019-15288/","title":"CVE-2019-15288: Cisco TelePresence Collaboration Endpoint, TelePresence Codec, and RoomOS Software Privilege Escalation Vulnerability","content_text":"Cisco · Cisco TelePresence TC Software. Not in CISA KEV. EPSS 1.7% (higher than 77.8% of CVEs). CVSS 8.8 HIGH. ATT&CK: T1078 Valid Accounts; T1133 External Remote Services; T1608 Stage Capabilities. Priority 21.7 of 100.","summary":"Cisco TelePresence Collaboration Endpoint, TelePresence Codec, and RoomOS Software Privilege Escalation Vulnerability","date_published":"2019-11-26T00:00:00.000Z","date_modified":"2024-11-20T17:04:36.000Z","tags":["T1078","T1133","T1608"],"_patchfirst":{"reason":"published","priority":21.7,"kev":null,"epss":{"score":0.01746,"percentile":0.77776},"cvss":{"score":8.8,"severity":"HIGH","version":"3.0"},"vendor":"Cisco","product":"Cisco TelePresence TC Software","techniqueIds":["T1078","T1133","T1608"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2019-15998","url":"https://patchfirst.co/cve/CVE-2019-15998/","title":"CVE-2019-15998: Cisco IOS XR Software NETCONF Over Secure Shell ACL Bypass Vulnerability","content_text":"Cisco · Cisco IOS XR Software. Not in CISA KEV. EPSS 0.7% (higher than 54.1% of CVEs). CVSS 5.3 MEDIUM. ATT&CK: T1078 Valid Accounts; T1133 External Remote Services. Priority 14.5 of 100.","summary":"Cisco IOS XR Software NETCONF Over Secure Shell ACL Bypass Vulnerability","date_published":"2019-11-26T00:00:00.000Z","date_modified":"2024-11-19T18:51:44.000Z","tags":["T1078","T1133"],"_patchfirst":{"reason":"published","priority":14.5,"kev":null,"epss":{"score":0.00727,"percentile":0.54124},"cvss":{"score":5.3,"severity":"MEDIUM","version":"3.0"},"vendor":"Cisco","product":"Cisco IOS XR Software","techniqueIds":["T1078","T1133"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}}]}