https://patchfirst.co/technique/T1202/New and newly exploited CVEs that lead to ATT&CK T1202 Indirect Command Execution, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.en-gb360Sat, 31 Oct 2026 05:11:25 GMThttps://patchfirst.co/cve/CVE-2024-24919/CVE-2024-24919#kevThu, 30 May 2024 00:00:00 GMTCheck Point · Quantum Security Gateways. In CISA KEV since 2024-05-30, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.98% of CVEs). CVSS 8.6 HIGH. Public exploit code exists. ATT&CK: T1202 Indirect Command Execution; T1005 Data from Local System; T1003.003 NTDS; T1003.008 /etc/passwd and /etc/shadow; T1059.004 Unix Shell. Priority 79.0 of 100.kevransomwarepublic-exploitT1202T1005T1003.003T1003.008T1059.004https://patchfirst.co/cve/CVE-2023-40044/CVE-2023-40044#kevThu, 05 Oct 2023 00:00:00 GMTProgress · WS_FTP Server. In CISA KEV since 2023-10-05, known ransomware use. ENISA EUVD lists it as exploited. EPSS 90.4% (higher than 99.8% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1059 Command and Scripting Interpreter; T1071.002 File Transfer Protocols; T1202 Indirect Command Execution. Priority 79.1 of 100.kevransomwarepublic-exploitT1059T1071.002T1202https://patchfirst.co/cve/CVE-2023-32315/CVE-2023-32315#kevThu, 24 Aug 2023 00:00:00 GMTIgnite Realtime · Openfire. In CISA KEV since 2023-08-24. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1202 Indirect Command Execution; T1505.003 Web Shell; T1087.002 Domain Account; T1496 Resource Hijacking. Named in 1 threat report. Priority 82.1 of 100.kevpublic-exploitT1202T1505.003T1087.002T1496https://patchfirst.co/cve/CVE-2022-29464/CVE-2022-29464#kevMon, 25 Apr 2022 00:00:00 GMTWSO2 · Multiple Products. In CISA KEV since 2022-04-25, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1202 Indirect Command Execution; T1496 Resource Hijacking. Priority 79.9 of 100.kevransomwarepublic-exploitT1190T1202T1496https://patchfirst.co/cve/CVE-2013-0629/CVE-2013-0629#kevMon, 07 Mar 2022 00:00:00 GMTAdobe · ColdFusion. In CISA KEV since 2022-03-07. ENISA EUVD lists it as exploited. EPSS 65.8% (higher than 99.27% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1202 Indirect Command Execution; T1005 Data from Local System. Priority 68.1 of 100.kevpublic-exploitT1190T1202T1005https://patchfirst.co/cve/CVE-2019-3396/CVE-2019-3396#kevWed, 03 Nov 2021 00:00:00 GMTAtlassian · Confluence Server and Data Server. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.9% (higher than 99.97% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1133 External Remote Services; T1090 Proxy; T1202 Indirect Command Execution. Named in 1 threat report. Priority 83.7 of 100.kevransomwarepublic-exploitT1133T1090T1202https://patchfirst.co/cve/CVE-2019-3398/CVE-2019-3398#kevWed, 03 Nov 2021 00:00:00 GMTAtlassian · Confluence Server and Data Center. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 97.0% (higher than 99.89% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1202 Indirect Command Execution; T1059 Command and Scripting Interpreter. Priority 69.1 of 100.kevpublic-exploitT1202T1059https://patchfirst.co/cve/CVE-2019-1270/CVE-2019-1270Wed, 11 Sep 2019 00:00:00 GMTMicrosoft · Windows. Not in CISA KEV. EPSS 0.9% (higher than 59.6% of CVEs). ATT&CK: T1202 Indirect Command Execution; T1485 Data Destruction; T1565 Data Manipulation. Priority 11.9 of 100.T1202T1485T1565https://patchfirst.co/cve/CVE-2018-17934/CVE-2018-17934Tue, 27 Nov 2018 00:00:00 GMTNot in CISA KEV. EPSS 19.7% (higher than 97.4% of CVEs). Public exploit code exists. ATT&CK: T1202 Indirect Command Execution; T1005 Data from Local System; T1036 Masquerading; T1203 Exploitation for Client Execution. Priority 24.5 of 100.public-exploitT1202T1005T1036T1203https://patchfirst.co/cve/CVE-2018-10589/CVE-2018-10589Tue, 15 May 2018 00:00:00 GMTAdvantech · WebAccess. Not in CISA KEV. EPSS 3.9% (higher than 90.4% of CVEs). ATT&CK: T1202 Indirect Command Execution. Priority 18.1 of 100.T1202