{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: CVEs linked to T1210 Exploitation of Remote Services","home_page_url":"https://patchfirst.co/technique/T1210/","feed_url":"https://patchfirst.co/feed/technique/T1210.json","description":"New and newly exploited CVEs that lead to ATT&CK T1210 Exploitation of Remote Services, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2026-33824#kev","url":"https://patchfirst.co/cve/CVE-2026-33824/","title":"[KEV] CVE-2026-33824: Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability","content_text":"Microsoft · Internet Key Exchange (IKE) Service Extensions. In CISA KEV since 2026-08-18. ENISA EUVD lists it as exploited. EPSS 77.1% (higher than 99.55% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1210 Exploitation of Remote Services; T1059 Command and Scripting Interpreter. Priority 74.8 of 100.","summary":"Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability","date_published":"2026-08-18T00:00:00.000Z","date_modified":"2026-09-25T18:17:25.000Z","tags":["kev","public-exploit","T1210","T1059"],"_patchfirst":{"reason":"kev","priority":74.8,"kev":{"dateAdded":"2026-08-18","ransomware":false},"epss":{"score":0.77054,"percentile":0.99551},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Microsoft","product":"Internet Key Exchange (IKE) Service Extensions","techniqueIds":["T1210","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2008-4250#kev","url":"https://patchfirst.co/cve/CVE-2008-4250/","title":"[KEV] CVE-2008-4250: Microsoft Windows Buffer Overflow Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2026-05-20. ENISA EUVD lists it as exploited. EPSS 98.8% (higher than 99.93% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1059 Command and Scripting Interpreter; T1210 Exploitation of Remote Services. Priority 69.8 of 100.","summary":"Microsoft Windows Buffer Overflow Vulnerability","date_published":"2026-05-20T00:00:00.000Z","date_modified":"2026-06-16T22:57:29.000Z","tags":["kev","public-exploit","T1059","T1210"],"_patchfirst":{"reason":"kev","priority":69.8,"kev":{"dateAdded":"2026-05-20","ransomware":false},"epss":{"score":0.98751,"percentile":0.99926},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1059","T1210"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-37079#kev","url":"https://patchfirst.co/cve/CVE-2024-37079/","title":"[KEV] CVE-2024-37079: Broadcom VMware vCenter Server Out-of-bounds Write Vulnerability","content_text":"Broadcom · VMware vCenter Server. In CISA KEV since 2026-01-23. ENISA EUVD lists it as exploited. EPSS 22.4% (higher than 97.7% of CVEs). CVSS 9.8 CRITICAL. ATT&CK: T1210 Exploitation of Remote Services; T1059 Command and Scripting Interpreter. Priority 69.4 of 100.","summary":"Broadcom VMware vCenter Server Out-of-bounds Write Vulnerability","date_published":"2026-01-23T00:00:00.000Z","date_modified":"2026-06-17T07:37:43.000Z","tags":["kev","T1210","T1059"],"_patchfirst":{"reason":"kev","priority":69.4,"kev":{"dateAdded":"2026-01-23","ransomware":false},"epss":{"score":0.22377,"percentile":0.97689},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Broadcom","product":"VMware vCenter Server","techniqueIds":["T1210","T1059"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2024-54085#kev","url":"https://patchfirst.co/cve/CVE-2024-54085/","title":"[KEV] CVE-2024-54085: AMI MegaRAC SPx Authentication Bypass by Spoofing Vulnerability","content_text":"AMI · MegaRAC SPx. In CISA KEV since 2025-06-25. ENISA EUVD lists it as exploited. EPSS 60.7% (higher than 99.15% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1210 Exploitation of Remote Services; T1495 Firmware Corruption; T1499 Endpoint Denial of Service; T1608.001 Upload Malware. Priority 69.7 of 100.","summary":"AMI MegaRAC SPx Authentication Bypass by Spoofing Vulnerability","date_published":"2025-06-25T00:00:00.000Z","date_modified":"2026-06-17T08:09:44.000Z","tags":["kev","public-exploit","T1068","T1210","T1495","T1499","T1608.001"],"_patchfirst":{"reason":"kev","priority":69.7,"kev":{"dateAdded":"2025-06-25","ransomware":false},"epss":{"score":0.60747,"percentile":0.99147},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"AMI","product":"MegaRAC SPx","techniqueIds":["T1068","T1210","T1495","T1499","T1608.001"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2020-2551#kev","url":"https://patchfirst.co/cve/CVE-2020-2551/","title":"[KEV] CVE-2020-2551: Oracle Fusion Middleware Unspecified Vulnerability","content_text":"Oracle · Fusion Middleware. In CISA KEV since 2023-11-16. ENISA EUVD lists it as exploited. EPSS 92.8% (higher than 99.83% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1210 Exploitation of Remote Services. Named in 1 threat report. Priority 73.7 of 100.","summary":"Oracle Fusion Middleware Unspecified Vulnerability","date_published":"2023-11-16T00:00:00.000Z","date_modified":"2026-06-17T03:12:20.000Z","tags":["kev","public-exploit","T1190","T1210"],"_patchfirst":{"reason":"kev","priority":73.7,"kev":{"dateAdded":"2023-11-16","ransomware":false},"epss":{"score":0.92817,"percentile":0.99829},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Oracle","product":"Fusion Middleware","techniqueIds":["T1190","T1210"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2017-7494#kev","url":"https://patchfirst.co/cve/CVE-2017-7494/","title":"[KEV] CVE-2017-7494: Samba Remote Code Execution Vulnerability","content_text":"Samba · Samba. In CISA KEV since 2023-03-30, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.4% (higher than 99.94% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1210 Exploitation of Remote Services; T1059 Command and Scripting Interpreter. Priority 79.8 of 100.","summary":"Samba Remote Code Execution Vulnerability","date_published":"2023-03-30T00:00:00.000Z","date_modified":"2026-06-17T01:24:27.000Z","tags":["kev","ransomware","public-exploit","T1210","T1059"],"_patchfirst":{"reason":"kev","priority":79.8,"kev":{"dateAdded":"2023-03-30","ransomware":true},"epss":{"score":0.99448,"percentile":0.99942},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Samba","product":"Samba","techniqueIds":["T1210","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-0669#kev","url":"https://patchfirst.co/cve/CVE-2023-0669/","title":"[KEV] CVE-2023-0669: Fortra GoAnywhere MFT Remote Code Execution Vulnerability","content_text":"Fortra · GoAnywhere MFT. In CISA KEV since 2023-02-10, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 7.2 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1210 Exploitation of Remote Services; T1486 Data Encrypted for Impact. Priority 78.0 of 100.","summary":"Fortra GoAnywhere MFT Remote Code Execution Vulnerability","date_published":"2023-02-10T00:00:00.000Z","date_modified":"2026-08-06T05:16:38.000Z","tags":["kev","ransomware","public-exploit","T1190","T1210","T1486"],"_patchfirst":{"reason":"kev","priority":78,"kev":{"dateAdded":"2023-02-10","ransomware":true},"epss":{"score":0.99999,"percentile":0.99996},"cvss":{"score":7.2,"severity":"HIGH","version":"3.1"},"vendor":"Fortra","product":"GoAnywhere MFT","techniqueIds":["T1190","T1210","T1486"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2016-6366#kev","url":"https://patchfirst.co/cve/CVE-2016-6366/","title":"[KEV] CVE-2016-6366: Cisco Adaptive Security Appliance (ASA) SNMP Buffer Overflow Vulnerability","content_text":"Cisco · Adaptive Security Appliance (ASA). In CISA KEV since 2022-05-24. ENISA EUVD lists it as exploited. EPSS 87.6% (higher than 99.76% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1210 Exploitation of Remote Services; T1059 Command and Scripting Interpreter. Priority 69.1 of 100.","summary":"Cisco Adaptive Security Appliance (ASA) SNMP Buffer Overflow Vulnerability","date_published":"2022-05-24T00:00:00.000Z","date_modified":"2026-06-17T00:50:54.000Z","tags":["kev","public-exploit","T1210","T1059"],"_patchfirst":{"reason":"kev","priority":69.1,"kev":{"dateAdded":"2022-05-24","ransomware":false},"epss":{"score":0.87565,"percentile":0.99758},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Cisco","product":"Adaptive Security Appliance (ASA)","techniqueIds":["T1210","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2019-3568#kev","url":"https://patchfirst.co/cve/CVE-2019-3568/","title":"[KEV] CVE-2019-3568: WhatsApp VOIP Stack Buffer Overflow Vulnerability","content_text":"Meta Platforms · WhatsApp. In CISA KEV since 2022-04-19. ENISA EUVD lists it as exploited. EPSS 30.1% (higher than 98.2% of CVEs). CVSS 9.8 CRITICAL. ATT&CK: T1210 Exploitation of Remote Services; T1059 Command and Scripting Interpreter. Priority 64.5 of 100.","summary":"WhatsApp VOIP Stack Buffer Overflow Vulnerability","date_published":"2022-04-19T00:00:00.000Z","date_modified":"2026-06-17T02:35:14.000Z","tags":["kev","T1210","T1059"],"_patchfirst":{"reason":"kev","priority":64.5,"kev":{"dateAdded":"2022-04-19","ransomware":false},"epss":{"score":0.30076,"percentile":0.98209},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Meta Platforms","product":"WhatsApp","techniqueIds":["T1210","T1059"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2017-0148#kev","url":"https://patchfirst.co/cve/CVE-2017-0148/","title":"[KEV] CVE-2017-0148: Microsoft SMBv1 Server Remote Code Execution Vulnerability","content_text":"Microsoft · SMBv1 server. In CISA KEV since 2022-04-06, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.4% (higher than 99.94% of CVEs). CVSS 8.1 HIGH. Public exploit code exists. ATT&CK: T1210 Exploitation of Remote Services; T1059 Command and Scripting Interpreter. Priority 78.7 of 100.","summary":"Microsoft SMBv1 Server Remote Code Execution Vulnerability","date_published":"2022-04-06T00:00:00.000Z","date_modified":"2026-06-17T00:57:10.000Z","tags":["kev","ransomware","public-exploit","T1210","T1059"],"_patchfirst":{"reason":"kev","priority":78.7,"kev":{"dateAdded":"2022-04-06","ransomware":true},"epss":{"score":0.99356,"percentile":0.99939},"cvss":{"score":8.1,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"SMBv1 server","techniqueIds":["T1210","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2017-0146#kev","url":"https://patchfirst.co/cve/CVE-2017-0146/","title":"[KEV] CVE-2017-0146: Microsoft Windows SMB Remote Code Execution Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2022-03-25, known ransomware use. ENISA EUVD lists it as exploited. EPSS 89.8% (higher than 99.79% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1210 Exploitation of Remote Services; T1059 Command and Scripting Interpreter. Priority 79.1 of 100.","summary":"Microsoft Windows SMB Remote Code Execution Vulnerability","date_published":"2022-03-25T00:00:00.000Z","date_modified":"2026-06-17T00:57:09.000Z","tags":["kev","ransomware","public-exploit","T1210","T1059"],"_patchfirst":{"reason":"kev","priority":79.1,"kev":{"dateAdded":"2022-03-25","ransomware":true},"epss":{"score":0.89755,"percentile":0.99788},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1210","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2018-0167#kev","url":"https://patchfirst.co/cve/CVE-2018-0167/","title":"[KEV] CVE-2018-0167: Cisco IOS, XR, and XE Software Buffer Overflow Vulnerability","content_text":"Cisco · IOS, XR, and XE Software. In CISA KEV since 2022-03-03. ENISA EUVD lists it as exploited. EPSS 3.4% (higher than 88.7% of CVEs). CVSS 8.8 HIGH. ATT&CK: T1210 Exploitation of Remote Services; T1059 Command and Scripting Interpreter; T1499.004 Application or System Exploitation. Priority 61.9 of 100.","summary":"Cisco IOS, XR, and XE Software Buffer Overflow Vulnerability","date_published":"2022-03-03T00:00:00.000Z","date_modified":"2026-06-17T01:29:59.000Z","tags":["kev","T1210","T1059","T1499.004"],"_patchfirst":{"reason":"kev","priority":61.9,"kev":{"dateAdded":"2022-03-03","ransomware":false},"epss":{"score":0.03354,"percentile":0.88682},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Cisco","product":"IOS, XR, and XE Software","techniqueIds":["T1210","T1059","T1499.004"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2016-8562#kev","url":"https://patchfirst.co/cve/CVE-2016-8562/","title":"[KEV] CVE-2016-8562: Siemens SIMATIC CP 1543-1 Improper Privilege Management Vulnerability","content_text":"Siemens · SIMATIC CP. In CISA KEV since 2022-03-03. ENISA EUVD lists it as exploited. EPSS 3.6% (higher than 89.5% of CVEs). CVSS 7.5 HIGH. ATT&CK: T1210 Exploitation of Remote Services; T1499.004 Application or System Exploitation. Priority 61.1 of 100.","summary":"Siemens SIMATIC CP 1543-1 Improper Privilege Management Vulnerability","date_published":"2022-03-03T00:00:00.000Z","date_modified":"2026-06-17T00:54:31.000Z","tags":["kev","T1210","T1499.004"],"_patchfirst":{"reason":"kev","priority":61.1,"kev":{"dateAdded":"2022-03-03","ransomware":false},"epss":{"score":0.0361,"percentile":0.89471},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"Siemens","product":"SIMATIC CP","techniqueIds":["T1210","T1499.004"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2017-6663#kev","url":"https://patchfirst.co/cve/CVE-2017-6663/","title":"[KEV] CVE-2017-6663: Cisco IOS Software and Cisco IOS XE Software Denial-of-Service Vulnerability","content_text":"Cisco · IOS and IOS XE Software. In CISA KEV since 2022-03-03. ENISA EUVD lists it as exploited. EPSS 2.1% (higher than 81.8% of CVEs). CVSS 6.5 MEDIUM. ATT&CK: T1210 Exploitation of Remote Services; T1499.004 Application or System Exploitation. Priority 58.9 of 100.","summary":"Cisco IOS Software and Cisco IOS XE Software Denial-of-Service Vulnerability","date_published":"2022-03-03T00:00:00.000Z","date_modified":"2026-06-17T01:22:45.000Z","tags":["kev","T1210","T1499.004"],"_patchfirst":{"reason":"kev","priority":58.9,"kev":{"dateAdded":"2022-03-03","ransomware":false},"epss":{"score":0.02117,"percentile":0.81823},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.1"},"vendor":"Cisco","product":"IOS and IOS XE Software","techniqueIds":["T1210","T1499.004"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2017-0144#kev","url":"https://patchfirst.co/cve/CVE-2017-0144/","title":"[KEV] CVE-2017-0144: Microsoft SMBv1 Remote Code Execution Vulnerability","content_text":"Microsoft · SMBv1. In CISA KEV since 2022-02-10, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.2% (higher than 99.94% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1210 Exploitation of Remote Services; T1059 Command and Scripting Interpreter. Named in 3 threat reports. Priority 86.9 of 100.","summary":"Microsoft SMBv1 Remote Code Execution Vulnerability","date_published":"2022-02-10T00:00:00.000Z","date_modified":"2026-08-14T05:16:53.000Z","tags":["kev","ransomware","public-exploit","T1210","T1059"],"_patchfirst":{"reason":"kev","priority":86.9,"kev":{"dateAdded":"2022-02-10","ransomware":true},"epss":{"score":0.9923,"percentile":0.99936},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"SMBv1","techniqueIds":["T1210","T1059"],"reportCount":3,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2017-0145#kev","url":"https://patchfirst.co/cve/CVE-2017-0145/","title":"[KEV] CVE-2017-0145: Microsoft SMBv1 Remote Code Execution Vulnerability","content_text":"Microsoft · SMBv1. In CISA KEV since 2022-02-10, known ransomware use. ENISA EUVD lists it as exploited. EPSS 89.8% (higher than 99.79% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1210 Exploitation of Remote Services; T1059 Command and Scripting Interpreter. Priority 79.1 of 100.","summary":"Microsoft SMBv1 Remote Code Execution Vulnerability","date_published":"2022-02-10T00:00:00.000Z","date_modified":"2026-08-14T05:16:54.000Z","tags":["kev","ransomware","public-exploit","T1210","T1059"],"_patchfirst":{"reason":"kev","priority":79.1,"kev":{"dateAdded":"2022-02-10","ransomware":true},"epss":{"score":0.8985,"percentile":0.9979},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"SMBv1","techniqueIds":["T1210","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-42013#kev","url":"https://patchfirst.co/cve/CVE-2021-42013/","title":"[KEV] CVE-2021-42013: Apache HTTP Server Path Traversal Vulnerability","content_text":"Apache · HTTP Server. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.98% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1210 Exploitation of Remote Services; T1059 Command and Scripting Interpreter. Named in 1 threat report. Priority 83.7 of 100.","summary":"Apache HTTP Server Path Traversal Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T04:09:09.000Z","tags":["kev","ransomware","public-exploit","T1210","T1059"],"_patchfirst":{"reason":"kev","priority":83.7,"kev":{"dateAdded":"2021-11-03","ransomware":true},"epss":{"score":0.99964,"percentile":0.99976},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Apache","product":"HTTP Server","techniqueIds":["T1210","T1059"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-41773#kev","url":"https://patchfirst.co/cve/CVE-2021-41773/","title":"[KEV] CVE-2021-41773: Apache HTTP Server Path Traversal Vulnerability","content_text":"Apache · HTTP Server. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1210 Exploitation of Remote Services; T1059 Command and Scripting Interpreter. Priority 79.9 of 100.","summary":"Apache HTTP Server Path Traversal Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T04:08:53.000Z","tags":["kev","ransomware","public-exploit","T1210","T1059"],"_patchfirst":{"reason":"kev","priority":79.9,"kev":{"dateAdded":"2021-11-03","ransomware":true},"epss":{"score":0.99992,"percentile":0.99986},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Apache","product":"HTTP Server","techniqueIds":["T1210","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2020-3992#kev","url":"https://patchfirst.co/cve/CVE-2020-3992/","title":"[KEV] CVE-2020-3992: VMware ESXi OpenSLP Use-After-Free Vulnerability","content_text":"VMware · ESXi. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 83.0% (higher than 99.67% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1210 Exploitation of Remote Services. Priority 79.8 of 100.","summary":"VMware ESXi OpenSLP Use-After-Free Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-08-12T05:17:31.000Z","tags":["kev","ransomware","public-exploit","T1210"],"_patchfirst":{"reason":"kev","priority":79.8,"kev":{"dateAdded":"2021-11-03","ransomware":true},"epss":{"score":0.83015,"percentile":0.99673},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"VMware","product":"ESXi","techniqueIds":["T1210"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2018-0171#kev","url":"https://patchfirst.co/cve/CVE-2018-0171/","title":"[KEV] CVE-2018-0171: Cisco IOS and IOS XE Software Smart Install Remote Code Execution Vulnerability","content_text":"Cisco · IOS and IOS XE. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 99.5% (higher than 99.94% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1210 Exploitation of Remote Services; T1059 Command and Scripting Interpreter; T1499.004 Application or System Exploitation. Named in 2 threat reports. Priority 76.0 of 100.","summary":"Cisco IOS and IOS XE Software Smart Install Remote Code Execution Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T01:29:59.000Z","tags":["kev","public-exploit","T1210","T1059","T1499.004"],"_patchfirst":{"reason":"kev","priority":76,"kev":{"dateAdded":"2021-11-03","ransomware":false},"epss":{"score":0.99479,"percentile":0.99944},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Cisco","product":"IOS and IOS XE","techniqueIds":["T1210","T1059","T1499.004"],"reportCount":2,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2020-3118#kev","url":"https://patchfirst.co/cve/CVE-2020-3118/","title":"[KEV] CVE-2020-3118: Cisco IOS XR Software Discovery Protocol Format String Vulnerability","content_text":"Cisco · IOS XR. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 11.7% (higher than 96.1% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1210 Exploitation of Remote Services; T1059 Command and Scripting Interpreter. Priority 68.4 of 100.","summary":"Cisco IOS XR Software Discovery Protocol Format String Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T03:17:23.000Z","tags":["kev","public-exploit","T1210","T1059"],"_patchfirst":{"reason":"kev","priority":68.4,"kev":{"dateAdded":"2021-11-03","ransomware":false},"epss":{"score":0.11685,"percentile":0.96054},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Cisco","product":"IOS XR","techniqueIds":["T1210","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}}]}