https://patchfirst.co/technique/T1486/New and newly exploited CVEs that lead to ATT&CK T1486 Data Encrypted for Impact, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.en-gb360Sat, 31 Oct 2026 05:11:25 GMThttps://patchfirst.co/cve/CVE-2023-38831/CVE-2023-38831#kevThu, 24 Aug 2023 00:00:00 GMTRARLAB · WinRAR. In CISA KEV since 2023-08-24, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.8% (higher than 99.96% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1204 User Execution; T1005 Data from Local System; T1041 Exfiltration Over C2 Channel; T1053 Scheduled Task/Job; T1105 Ingress Tool Transfer; T1112 Modify Registry; +1 more. Named in 1 threat report. Priority 82.3 of 100.kevransomwarepublic-exploitT1204T1005T1041T1053T1105T1112T1486https://patchfirst.co/cve/CVE-2023-27532/CVE-2023-27532#kevTue, 22 Aug 2023 00:00:00 GMTVeeam · Backup & Replication. In CISA KEV since 2023-08-22, known ransomware use. ENISA EUVD lists it as exploited. EPSS 80.6% (higher than 99.62% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1133 External Remote Services; T1059.003 Windows Command Shell; T1087 Account Discovery; T1087.001 Local Account; T1486 Data Encrypted for Impact; T1555 Credentials from Password Stores. Named in 1 threat report. Priority 82.0 of 100.kevransomwarepublic-exploitT1133T1059.003T1087T1087.001T1486T1555https://patchfirst.co/cve/CVE-2023-36884/CVE-2023-36884#kevMon, 17 Jul 2023 00:00:00 GMTMicrosoft · Windows. In CISA KEV since 2023-07-17, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.4% (higher than 99.94% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1566 Phishing; T1204.002 Malicious File; T1005 Data from Local System; T1486 Data Encrypted for Impact; T1489 Service Stop; T1490 Inhibit System Recovery; +1 more. Priority 78.2 of 100.kevransomwarepublic-exploitT1566T1204.002T1005T1486T1489T1490T1553.005https://patchfirst.co/cve/CVE-2021-45046/CVE-2021-45046#kevMon, 01 May 2023 00:00:00 GMTApache · Log4j2. In CISA KEV since 2023-05-01, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.98% of CVEs). CVSS 9.0 CRITICAL. Public exploit code exists. ATT&CK: T1059 Command and Scripting Interpreter; T1486 Data Encrypted for Impact. Named in 2 threat reports. Priority 85.4 of 100.kevransomwarepublic-exploitT1059T1486https://patchfirst.co/cve/CVE-2023-28252/CVE-2023-28252#kevTue, 11 Apr 2023 00:00:00 GMTMicrosoft · Windows. In CISA KEV since 2023-04-11, known ransomware use. ENISA EUVD lists it as exploited. EPSS 48.9% (higher than 98.9% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1068 Exploitation for Privilege Escalation; T1003 OS Credential Dumping; T1021 Remote Services; T1059 Command and Scripting Interpreter; T1136 Create Account; +1 more. Priority 78.2 of 100.kevransomwarepublic-exploitT1078T1068T1003T1021T1059T1136T1486https://patchfirst.co/cve/CVE-2023-0669/CVE-2023-0669#kevFri, 10 Feb 2023 00:00:00 GMTFortra · GoAnywhere MFT. In CISA KEV since 2023-02-10, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 7.2 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1210 Exploitation of Remote Services; T1486 Data Encrypted for Impact. Priority 78.0 of 100.kevransomwarepublic-exploitT1190T1210T1486https://patchfirst.co/cve/CVE-2015-8651/CVE-2015-8651#kevWed, 25 May 2022 00:00:00 GMTAdobe · Flash Player. In CISA KEV since 2022-05-25. ENISA EUVD lists it as exploited. EPSS 67.7% (higher than 99.31% of CVEs). CVSS 8.8 HIGH. ATT&CK: T1189 Drive-by Compromise; T1105 Ingress Tool Transfer; T1486 Data Encrypted for Impact. Named in 3 threat reports. Priority 81.8 of 100.kevT1189T1105T1486https://patchfirst.co/cve/CVE-2022-22947/CVE-2022-22947#kevMon, 16 May 2022 00:00:00 GMTVMware · Spring Cloud Gateway. In CISA KEV since 2022-05-16. ENISA EUVD lists it as exploited. EPSS 98.3% (higher than 99.92% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1486 Data Encrypted for Impact. Priority 70.0 of 100.kevpublic-exploitT1190T1059T1486https://patchfirst.co/cve/CVE-2009-3960/CVE-2009-3960#kevMon, 07 Mar 2022 00:00:00 GMTAdobe · BlazeDS. In CISA KEV since 2022-03-07, known ransomware use. ENISA EUVD lists it as exploited. EPSS 90.1% (higher than 99.8% of CVEs). CVSS 6.5 MEDIUM. Public exploit code exists. ATT&CK: T1486 Data Encrypted for Impact. Priority 77.5 of 100.kevransomwarepublic-exploitT1486https://patchfirst.co/cve/CVE-2016-1019/CVE-2016-1019#kevThu, 03 Mar 2022 00:00:00 GMTAdobe · Flash Player. In CISA KEV since 2022-03-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 22.3% (higher than 97.7% of CVEs). CVSS 9.8 CRITICAL. ATT&CK: T1105 Ingress Tool Transfer; T1486 Data Encrypted for Impact. Named in 4 threat reports. Priority 83.4 of 100.kevransomwareT1105T1486https://patchfirst.co/cve/CVE-2021-44228/CVE-2021-44228#kevFri, 10 Dec 2021 00:00:00 GMTApache · Log4j2. In CISA KEV since 2021-12-10, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1486 Data Encrypted for Impact; T1496 Resource Hijacking; T1505.003 Web Shell; T1608.001 Upload Malware. Named in 10 threat reports. Priority 90.0 of 100.kevransomwarepublic-exploitT1190T1486T1496T1505.003T1608.001https://patchfirst.co/cve/CVE-2021-34473/CVE-2021-34473#kevWed, 03 Nov 2021 00:00:00 GMTMicrosoft · Exchange Server. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 9.1 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1053.005 Scheduled Task; T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol; T1136 Create Account; T1486 Data Encrypted for Impact. Named in 9 threat reports. Priority 89.4 of 100.kevransomwarepublic-exploitT1190T1053.005T1048.003T1136T1486https://patchfirst.co/cve/CVE-2020-1472/CVE-2020-1472#kevWed, 03 Nov 2021 00:00:00 GMTMicrosoft · Netlogon. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.4% (higher than 99.94% of CVEs). CVSS 5.5 MEDIUM. Public exploit code exists. ATT&CK: T1110 Brute Force; T1133 External Remote Services; T1021 Remote Services; T1068 Exploitation for Privilege Escalation; T1087.002 Domain Account; T1486 Data Encrypted for Impact. Named in 8 threat reports. Priority 86.8 of 100.kevransomwarepublic-exploitT1110T1133T1021T1068T1087.002T1486https://patchfirst.co/cve/CVE-2021-42258/CVE-2021-42258#kevWed, 03 Nov 2021 00:00:00 GMTBQE · BillQuick Web Suite. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 75.2% (higher than 99.51% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1059 Command and Scripting Interpreter; T1486 Data Encrypted for Impact. Priority 79.8 of 100.kevransomwarepublic-exploitT1059T1486https://patchfirst.co/cve/CVE-2019-11634/CVE-2019-11634#kevWed, 03 Nov 2021 00:00:00 GMTCitrix · Workspace Application and Receiver for Windows. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 8.1% (higher than 94.8% of CVEs). CVSS 9.8 CRITICAL. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1003 OS Credential Dumping; T1005 Data from Local System; T1046 Network Service Discovery; T1078 Valid Accounts; +1 more. Named in 1 threat report. Priority 77.7 of 100.kevransomwareT1190T1059T1003T1005T1046T1078T1486