https://patchfirst.co/technique/T1212/New and newly exploited CVEs that lead to ATT&CK T1212 Exploitation for Credential Access, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.en-gb360Sat, 31 Oct 2026 05:11:25 GMThttps://patchfirst.co/cve/CVE-2023-22894/CVE-2023-22894#kevThu, 08 Oct 2026 00:00:00 GMTStrapi · Strapi. In CISA KEV since 2026-10-08. ENISA EUVD lists it as exploited. EPSS 4.1% (higher than 90.8% of CVEs). CVSS 4.9 MEDIUM. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1212 Exploitation for Credential Access. Priority 74.6 of 100.kevpublic-exploitT1078T1212https://patchfirst.co/cve/CVE-2025-48927/CVE-2025-48927#kevTue, 01 Jul 2025 00:00:00 GMTTeleMessage · TM SGNL. In CISA KEV since 2025-07-01. ENISA EUVD lists it as exploited. EPSS 11.6% (higher than 96% of CVEs). CVSS 5.3 MEDIUM. ATT&CK: T1212 Exploitation for Credential Access; T1005 Data from Local System; T1555 Credentials from Password Stores. Priority 60.9 of 100.kevT1212T1005T1555https://patchfirst.co/cve/CVE-2025-48928/CVE-2025-48928#kevTue, 01 Jul 2025 00:00:00 GMTTeleMessage · TM SGNL. In CISA KEV since 2025-07-01. ENISA EUVD lists it as exploited. EPSS 0.6% (higher than 47.5% of CVEs). CVSS 4.0 MEDIUM. ATT&CK: T1212 Exploitation for Credential Access; T1005 Data from Local System; T1555 Credentials from Password Stores. Priority 50.3 of 100.kevT1212T1005T1555https://patchfirst.co/cve/CVE-2024-53704/CVE-2024-53704#kevTue, 18 Feb 2025 00:00:00 GMTSonicWall · SonicOS. In CISA KEV since 2025-02-18, known ransomware use. ENISA EUVD lists it as exploited. EPSS 95.3% (higher than 99.87% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1199 Trusted Relationship; T1212 Exploitation for Credential Access; T1078.004 Cloud Accounts; T1083 File and Directory Discovery. Priority 79.8 of 100.kevransomwarepublic-exploitT1199T1212T1078.004T1083https://patchfirst.co/cve/CVE-2022-22948/CVE-2022-22948#kevWed, 17 Jul 2024 00:00:00 GMTVMware · vCenter Server. In CISA KEV since 2024-07-17. ENISA EUVD lists it as exploited. EPSS 13.3% (higher than 96.4% of CVEs). CVSS 6.5 MEDIUM. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1212 Exploitation for Credential Access; T1068 Exploitation for Privilege Escalation. Named in 2 threat reports. Priority 73.0 of 100.kevpublic-exploitT1078T1212T1068