{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: CVEs linked to T1543 Create or Modify System Process","home_page_url":"https://patchfirst.co/technique/T1543/","feed_url":"https://patchfirst.co/feed/technique/T1543.json","description":"New and newly exploited CVEs that lead to ATT&CK T1543 Create or Modify System Process, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2023-0386#kev","url":"https://patchfirst.co/cve/CVE-2023-0386/","title":"[KEV] CVE-2023-0386: Linux Kernel Improper Ownership Management Vulnerability","content_text":"Linux · Kernel. In CISA KEV since 2025-06-17. ENISA EUVD lists it as exploited. EPSS 7.9% (higher than 94.7% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1548.001 Setuid and Setgid; T1543 Create or Modify System Process. Priority 67.4 of 100.","summary":"Linux Kernel Improper Ownership Management Vulnerability","date_published":"2025-06-17T00:00:00.000Z","date_modified":"2026-06-17T05:25:25.000Z","tags":["kev","public-exploit","T1548.001","T1543"],"_patchfirst":{"reason":"kev","priority":67.4,"kev":{"dateAdded":"2025-06-17","ransomware":false},"epss":{"score":0.0788,"percentile":0.94701},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Linux","product":"Kernel","techniqueIds":["T1548.001","T1543"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-33053#kev","url":"https://patchfirst.co/cve/CVE-2025-33053/","title":"[KEV] CVE-2025-33053: Microsoft Windows External Control of File Name or Path Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2025-06-10. ENISA EUVD lists it as exploited. EPSS 87.0% (higher than 99.75% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1566.001 Spearphishing Attachment; T1059 Command and Scripting Interpreter; T1041 Exfiltration Over C2 Channel; T1056.001 Keylogging; T1543 Create or Modify System Process. Priority 69.1 of 100.","summary":"Microsoft Windows External Control of File Name or Path Vulnerability","date_published":"2025-06-10T00:00:00.000Z","date_modified":"2026-06-17T09:13:01.000Z","tags":["kev","public-exploit","T1566.001","T1059","T1041","T1056.001","T1543"],"_patchfirst":{"reason":"kev","priority":69.1,"kev":{"dateAdded":"2025-06-10","ransomware":false},"epss":{"score":0.87015,"percentile":0.99747},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1566.001","T1059","T1041","T1056.001","T1543"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-4428#kev","url":"https://patchfirst.co/cve/CVE-2025-4428/","title":"[KEV] CVE-2025-4428: Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability","content_text":"Ivanti · Endpoint Manager Mobile (EPMM). In CISA KEV since 2025-05-19. ENISA EUVD lists it as exploited. EPSS 88.0% (higher than 99.76% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1543 Create or Modify System Process. Priority 69.1 of 100.","summary":"Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability","date_published":"2025-05-19T00:00:00.000Z","date_modified":"2026-06-17T09:33:13.000Z","tags":["kev","public-exploit","T1190","T1059","T1543"],"_patchfirst":{"reason":"kev","priority":69.1,"kev":{"dateAdded":"2025-05-19","ransomware":false},"epss":{"score":0.88003,"percentile":0.99764},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Ivanti","product":"Endpoint Manager Mobile (EPMM)","techniqueIds":["T1190","T1059","T1543"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-32706#kev","url":"https://patchfirst.co/cve/CVE-2025-32706/","title":"[KEV] CVE-2025-32706: Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2025-05-13. ENISA EUVD lists it as exploited. EPSS 2.3% (higher than 83.5% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1059 Command and Scripting Interpreter; T1068 Exploitation for Privilege Escalation; T1003.001 LSASS Memory; T1543 Create or Modify System Process; T1608.001 Upload Malware. Priority 65.2 of 100.","summary":"Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow Vulnerability","date_published":"2025-05-13T00:00:00.000Z","date_modified":"2026-06-17T09:12:27.000Z","tags":["kev","public-exploit","T1059","T1068","T1003.001","T1543","T1608.001"],"_patchfirst":{"reason":"kev","priority":65.2,"kev":{"dateAdded":"2025-05-13","ransomware":false},"epss":{"score":0.02333,"percentile":0.83543},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1059","T1068","T1003.001","T1543","T1608.001"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-32709#kev","url":"https://patchfirst.co/cve/CVE-2025-32709/","title":"[KEV] CVE-2025-32709: Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2025-05-13. ENISA EUVD lists it as exploited. EPSS 1.8% (higher than 78.7% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1003 OS Credential Dumping; T1059 Command and Scripting Interpreter; T1543 Create or Modify System Process; T1608.001 Upload Malware. Priority 64.2 of 100.","summary":"Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability","date_published":"2025-05-13T00:00:00.000Z","date_modified":"2026-06-17T09:12:27.000Z","tags":["kev","public-exploit","T1068","T1003","T1059","T1543","T1608.001"],"_patchfirst":{"reason":"kev","priority":64.2,"kev":{"dateAdded":"2025-05-13","ransomware":false},"epss":{"score":0.01818,"percentile":0.7869},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1068","T1003","T1059","T1543","T1608.001"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-32701#kev","url":"https://patchfirst.co/cve/CVE-2025-32701/","title":"[KEV] CVE-2025-32701: Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2025-05-13. ENISA EUVD lists it as exploited. EPSS 1.4% (higher than 72.7% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1059 Command and Scripting Interpreter; T1068 Exploitation for Privilege Escalation; T1003.001 LSASS Memory; T1543 Create or Modify System Process; T1608.001 Upload Malware. Priority 58.0 of 100.","summary":"Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability","date_published":"2025-05-13T00:00:00.000Z","date_modified":"2026-06-17T09:12:26.000Z","tags":["kev","T1059","T1068","T1003.001","T1543","T1608.001"],"_patchfirst":{"reason":"kev","priority":58,"kev":{"dateAdded":"2025-05-13","ransomware":false},"epss":{"score":0.01416,"percentile":0.72729},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1059","T1068","T1003.001","T1543","T1608.001"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2023-44221#kev","url":"https://patchfirst.co/cve/CVE-2023-44221/","title":"[KEV] CVE-2023-44221: SonicWall SMA100 Appliances OS Command Injection Vulnerability","content_text":"SonicWall · SMA100 Appliances. In CISA KEV since 2025-05-01. ENISA EUVD lists it as exploited. EPSS 76.3% (higher than 99.54% of CVEs). CVSS 7.2 HIGH. ATT&CK: T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism; T1059.004 Unix Shell; T1543 Create or Modify System Process. Priority 62.9 of 100.","summary":"SonicWall SMA100 Appliances OS Command Injection Vulnerability","date_published":"2025-05-01T00:00:00.000Z","date_modified":"2026-06-17T06:27:09.000Z","tags":["kev","T1068","T1548","T1059.004","T1543"],"_patchfirst":{"reason":"kev","priority":62.9,"kev":{"dateAdded":"2025-05-01","ransomware":false},"epss":{"score":0.7625,"percentile":0.99536},"cvss":{"score":7.2,"severity":"HIGH","version":"3.1"},"vendor":"SonicWall","product":"SMA100 Appliances","techniqueIds":["T1068","T1548","T1059.004","T1543"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2024-35250#kev","url":"https://patchfirst.co/cve/CVE-2024-35250/","title":"[KEV] CVE-2024-35250: Microsoft Windows Kernel-Mode Driver Untrusted Pointer Dereference Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2024-12-16. ENISA EUVD lists it as exploited. EPSS 25.2% (higher than 97.9% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1543 Create or Modify System Process. Priority 68.0 of 100.","summary":"Microsoft Windows Kernel-Mode Driver Untrusted Pointer Dereference Vulnerability","date_published":"2024-12-16T00:00:00.000Z","date_modified":"2026-07-20T16:16:51.000Z","tags":["kev","public-exploit","T1068","T1543"],"_patchfirst":{"reason":"kev","priority":68,"kev":{"dateAdded":"2024-12-16","ransomware":false},"epss":{"score":0.25222,"percentile":0.97934},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1068","T1543"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-49138","url":"https://patchfirst.co/cve/CVE-2024-49138/","title":"CVE-2024-49138: Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2024-12-10. ENISA EUVD lists it as exploited. EPSS 26.2% (higher than 98% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1543 Create or Modify System Process. Priority 68.1 of 100.","summary":"Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow Vulnerability","date_published":"2024-12-12T00:00:00.000Z","date_modified":"2026-06-17T07:59:29.000Z","tags":["kev","public-exploit","T1068","T1543"],"_patchfirst":{"reason":"published","priority":68.1,"kev":{"dateAdded":"2024-12-10","ransomware":false},"epss":{"score":0.26215,"percentile":0.97996},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1068","T1543"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-4577#kev","url":"https://patchfirst.co/cve/CVE-2024-4577/","title":"[KEV] CVE-2024-4577: PHP-CGI OS Command Injection Vulnerability","content_text":"PHP Group · PHP. In CISA KEV since 2024-06-12, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.98% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1003 OS Credential Dumping; T1003.001 LSASS Memory; T1033 System Owner/User Discovery; T1041 Exfiltration Over C2 Channel; +6 more. Priority 79.9 of 100.","summary":"PHP-CGI OS Command Injection Vulnerability","date_published":"2024-06-12T00:00:00.000Z","date_modified":"2026-06-17T08:02:11.000Z","tags":["kev","ransomware","public-exploit","T1190","T1059","T1003","T1003.001","T1033","T1041","T1053","T1068","T1071.001","T1112","T1543","T1570"],"_patchfirst":{"reason":"kev","priority":79.9,"kev":{"dateAdded":"2024-06-12","ransomware":true},"epss":{"score":0.99987,"percentile":0.99984},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"PHP Group","product":"PHP","techniqueIds":["T1190","T1059","T1003","T1003.001","T1033","T1041","T1053","T1068","T1071.001","T1112","T1543","T1570"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-45382#kev","url":"https://patchfirst.co/cve/CVE-2021-45382/","title":"[KEV] CVE-2021-45382: D-Link Multiple Routers Remote Code Execution Vulnerability","content_text":"D-Link · Multiple Routers. In CISA KEV since 2022-04-04. ENISA EUVD lists it as exploited. EPSS 97.8% (higher than 99.91% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1070 Indicator Removal; T1071 Application Layer Protocol; T1499.002 Service Exhaustion Flood; T1543 Create or Modify System Process. Priority 69.8 of 100.","summary":"D-Link Multiple Routers Remote Code Execution Vulnerability","date_published":"2022-04-04T00:00:00.000Z","date_modified":"2026-06-17T04:13:19.000Z","tags":["kev","public-exploit","T1190","T1059","T1070","T1071","T1499.002","T1543"],"_patchfirst":{"reason":"kev","priority":69.8,"kev":{"dateAdded":"2022-04-04","ransomware":false},"epss":{"score":0.97836,"percentile":0.99907},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"D-Link","product":"Multiple Routers","techniqueIds":["T1190","T1059","T1070","T1071","T1499.002","T1543"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}}]}