{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: CVEs linked to T1553.002 Code Signing","home_page_url":"https://patchfirst.co/technique/T1553.002/","feed_url":"https://patchfirst.co/feed/technique/T1553.002.json","description":"New and newly exploited CVEs that lead to ATT&CK T1553.002 Code Signing, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2026-8398#kev","url":"https://patchfirst.co/cve/CVE-2026-8398/","title":"[KEV] CVE-2026-8398: Daemon Tools Lite Embedded Malicious Code Vulnerability","content_text":"Daemon · Daemon Tools Lite. In CISA KEV since 2026-05-27. ENISA EUVD lists it as exploited. EPSS 1.5% (higher than 73.5% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1195.002 Compromise Software Supply Chain; T1553.002 Code Signing. Priority 69.6 of 100.","summary":"Daemon Tools Lite Embedded Malicious Code Vulnerability","date_published":"2026-05-27T00:00:00.000Z","date_modified":"2026-10-26T14:10:00.000Z","tags":["kev","public-exploit","T1195.002","T1553.002"],"_patchfirst":{"reason":"kev","priority":69.6,"kev":{"dateAdded":"2026-05-27","ransomware":false},"epss":{"score":0.01456,"percentile":0.73466},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Daemon","product":"Daemon Tools Lite","techniqueIds":["T1195.002","T1553.002"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-41991#kev","url":"https://patchfirst.co/cve/CVE-2023-41991/","title":"[KEV] CVE-2023-41991: Apple Multiple Products Improper Certificate Validation Vulnerability","content_text":"Apple · Multiple Products. In CISA KEV since 2023-09-25. ENISA EUVD lists it as exploited. EPSS 13.4% (higher than 96.4% of CVEs). CVSS 5.5 MEDIUM. Public exploit code exists. ATT&CK: T1204.002 Malicious File; T1553.002 Code Signing. Priority 66.1 of 100.","summary":"Apple Multiple Products Improper Certificate Validation Vulnerability","date_published":"2023-09-25T00:00:00.000Z","date_modified":"2026-06-17T06:23:13.000Z","tags":["kev","public-exploit","T1204.002","T1553.002"],"_patchfirst":{"reason":"kev","priority":66.1,"kev":{"dateAdded":"2023-09-25","ransomware":false},"epss":{"score":0.1338,"percentile":0.96415},"cvss":{"score":5.5,"severity":"MEDIUM","version":"3.1"},"vendor":"Apple","product":"Multiple Products","techniqueIds":["T1204.002","T1553.002"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2012-0151#kev","url":"https://patchfirst.co/cve/CVE-2012-0151/","title":"[KEV] CVE-2012-0151: Microsoft Windows Authenticode Signature Verification Remote Code Execution Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2022-06-08. ENISA EUVD lists it as exploited. EPSS 87.7% (higher than 99.76% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1204.002 Malicious File; T1553.002 Code Signing. Priority 63.4 of 100.","summary":"Microsoft Windows Authenticode Signature Verification Remote Code Execution Vulnerability","date_published":"2022-06-08T00:00:00.000Z","date_modified":"2026-06-16T23:36:47.000Z","tags":["kev","T1204.002","T1553.002"],"_patchfirst":{"reason":"kev","priority":63.4,"kev":{"dateAdded":"2022-06-08","ransomware":false},"epss":{"score":0.87658,"percentile":0.99759},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1204.002","T1553.002"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2013-3900#kev","url":"https://patchfirst.co/cve/CVE-2013-3900/","title":"[KEV] CVE-2013-3900: Microsoft WinVerifyTrust function Remote Code Execution","content_text":"Microsoft · WinVerifyTrust function. In CISA KEV since 2022-01-10. ENISA EUVD lists it as exploited. EPSS 44.6% (higher than 98.8% of CVEs). CVSS 5.5 MEDIUM. Public exploit code exists. ATT&CK: T1204.002 Malicious File; T1553.002 Code Signing. Named in 1 threat report. Priority 80.5 of 100.","summary":"Microsoft WinVerifyTrust function Remote Code Execution","date_published":"2022-01-10T00:00:00.000Z","date_modified":"2026-10-07T17:58:36.000Z","tags":["kev","public-exploit","T1204.002","T1553.002"],"_patchfirst":{"reason":"kev","priority":80.5,"kev":{"dateAdded":"2022-01-10","ransomware":false},"epss":{"score":0.44647,"percentile":0.98769},"cvss":{"score":5.5,"severity":"MEDIUM","version":"3.1"},"vendor":"Microsoft","product":"WinVerifyTrust function","techniqueIds":["T1204.002","T1553.002"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2020-0601#kev","url":"https://patchfirst.co/cve/CVE-2020-0601/","title":"[KEV] CVE-2020-0601: Microsoft Windows CryptoAPI Spoofing Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 89.1% (higher than 99.78% of CVEs). CVSS 8.1 HIGH. Public exploit code exists. ATT&CK: T1553.002 Code Signing; T1036 Masquerading. Priority 78.6 of 100.","summary":"Microsoft Windows CryptoAPI Spoofing Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T02:46:08.000Z","tags":["kev","public-exploit","T1553.002","T1036"],"_patchfirst":{"reason":"kev","priority":78.6,"kev":{"dateAdded":"2021-11-03","ransomware":false},"epss":{"score":0.89078,"percentile":0.99779},"cvss":{"score":8.1,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1553.002","T1036"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}}]}