{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: CVEs linked to T1555 Credentials from Password Stores","home_page_url":"https://patchfirst.co/technique/T1555/","feed_url":"https://patchfirst.co/feed/technique/T1555.json","description":"New and newly exploited CVEs that lead to ATT&CK T1555 Credentials from Password Stores, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2025-5777#kev","url":"https://patchfirst.co/cve/CVE-2025-5777/","title":"[KEV] CVE-2025-5777: Citrix NetScaler ADC and Gateway Out-of-Bounds Read Vulnerability","content_text":"Citrix · NetScaler ADC and Gateway. In CISA KEV since 2025-07-10, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.98% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1555 Credentials from Password Stores. Named in 1 threat report. Priority 82.1 of 100.","summary":"Citrix NetScaler ADC and Gateway Out-of-Bounds Read Vulnerability","date_published":"2025-07-10T00:00:00.000Z","date_modified":"2026-10-08T10:35:53.000Z","tags":["kev","ransomware","public-exploit","T1190","T1555"],"_patchfirst":{"reason":"kev","priority":82.1,"kev":{"dateAdded":"2025-07-10","ransomware":true},"epss":{"score":0.99972,"percentile":0.99978},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"Citrix","product":"NetScaler ADC and Gateway","techniqueIds":["T1190","T1555"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-48927#kev","url":"https://patchfirst.co/cve/CVE-2025-48927/","title":"[KEV] CVE-2025-48927: TeleMessage TM SGNL Initialization of a Resource with an Insecure Default Vulnerability","content_text":"TeleMessage · TM SGNL. In CISA KEV since 2025-07-01. ENISA EUVD lists it as exploited. EPSS 11.6% (higher than 96% of CVEs). CVSS 5.3 MEDIUM. ATT&CK: T1212 Exploitation for Credential Access; T1005 Data from Local System; T1555 Credentials from Password Stores. Priority 60.9 of 100.","summary":"TeleMessage TM SGNL Initialization of a Resource with an Insecure Default Vulnerability","date_published":"2025-07-01T00:00:00.000Z","date_modified":"2026-06-17T09:30:29.000Z","tags":["kev","T1212","T1005","T1555"],"_patchfirst":{"reason":"kev","priority":60.9,"kev":{"dateAdded":"2025-07-01","ransomware":false},"epss":{"score":0.11567,"percentile":0.96029},"cvss":{"score":5.3,"severity":"MEDIUM","version":"3.1"},"vendor":"TeleMessage","product":"TM SGNL","techniqueIds":["T1212","T1005","T1555"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2025-48928#kev","url":"https://patchfirst.co/cve/CVE-2025-48928/","title":"[KEV] CVE-2025-48928: TeleMessage TM SGNL Exposure of Core Dump File to an Unauthorized Control Sphere Vulnerability","content_text":"TeleMessage · TM SGNL. In CISA KEV since 2025-07-01. ENISA EUVD lists it as exploited. EPSS 0.6% (higher than 47.5% of CVEs). CVSS 4.0 MEDIUM. ATT&CK: T1212 Exploitation for Credential Access; T1005 Data from Local System; T1555 Credentials from Password Stores. Priority 50.3 of 100.","summary":"TeleMessage TM SGNL Exposure of Core Dump File to an Unauthorized Control Sphere Vulnerability","date_published":"2025-07-01T00:00:00.000Z","date_modified":"2026-06-17T09:30:30.000Z","tags":["kev","T1212","T1005","T1555"],"_patchfirst":{"reason":"kev","priority":50.3,"kev":{"dateAdded":"2025-07-01","ransomware":false},"epss":{"score":0.00577,"percentile":0.47534},"cvss":{"score":4,"severity":"MEDIUM","version":"3.1"},"vendor":"TeleMessage","product":"TM SGNL","techniqueIds":["T1212","T1005","T1555"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2019-6693#kev","url":"https://patchfirst.co/cve/CVE-2019-6693/","title":"[KEV] CVE-2019-6693: Fortinet FortiOS Use of Hard-Coded Credentials Vulnerability","content_text":"Fortinet · FortiOS. In CISA KEV since 2025-06-25, known ransomware use. ENISA EUVD lists it as exploited. EPSS 6.6% (higher than 93.9% of CVEs). CVSS 6.5 MEDIUM. Public exploit code exists. ATT&CK: T1552 Unsecured Credentials; T1555 Credentials from Password Stores. Priority 76.3 of 100.","summary":"Fortinet FortiOS Use of Hard-Coded Credentials Vulnerability","date_published":"2025-06-25T00:00:00.000Z","date_modified":"2026-08-04T05:16:27.000Z","tags":["kev","ransomware","public-exploit","T1552","T1555"],"_patchfirst":{"reason":"kev","priority":76.3,"kev":{"dateAdded":"2025-06-25","ransomware":true},"epss":{"score":0.0664,"percentile":0.93861},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.1"},"vendor":"Fortinet","product":"FortiOS","techniqueIds":["T1552","T1555"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-24054#kev","url":"https://patchfirst.co/cve/CVE-2025-24054/","title":"[KEV] CVE-2025-24054: Microsoft Windows NTLM Hash Disclosure Spoofing Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2025-04-17. ENISA EUVD lists it as exploited. EPSS 62.3% (higher than 99.18% of CVEs). CVSS 5.4 MEDIUM. Public exploit code exists. ATT&CK: T1566 Phishing; T1555 Credentials from Password Stores. Priority 66.6 of 100.","summary":"Microsoft Windows NTLM Hash Disclosure Spoofing Vulnerability","date_published":"2025-04-17T00:00:00.000Z","date_modified":"2026-06-17T08:57:57.000Z","tags":["kev","public-exploit","T1566","T1555"],"_patchfirst":{"reason":"kev","priority":66.6,"kev":{"dateAdded":"2025-04-17","ransomware":false},"epss":{"score":0.6227,"percentile":0.99181},"cvss":{"score":5.4,"severity":"MEDIUM","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1566","T1555"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2017-12637#kev","url":"https://patchfirst.co/cve/CVE-2017-12637/","title":"[KEV] CVE-2017-12637: SAP NetWeaver Directory Traversal Vulnerability","content_text":"SAP · NetWeaver. In CISA KEV since 2025-03-19. ENISA EUVD lists it as exploited. EPSS 95.1% (higher than 99.86% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1083 File and Directory Discovery; T1555 Credentials from Password Stores; T1592 Gather Victim Host Information. Priority 68.2 of 100.","summary":"SAP NetWeaver Directory Traversal Vulnerability","date_published":"2025-03-19T00:00:00.000Z","date_modified":"2026-06-17T01:03:42.000Z","tags":["kev","public-exploit","T1190","T1083","T1555","T1592"],"_patchfirst":{"reason":"kev","priority":68.2,"kev":{"dateAdded":"2025-03-19","ransomware":false},"epss":{"score":0.95111,"percentile":0.99863},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"SAP","product":"NetWeaver","techniqueIds":["T1190","T1083","T1555","T1592"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-55591#kev","url":"https://patchfirst.co/cve/CVE-2024-55591/","title":"[KEV] CVE-2024-55591: Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability","content_text":"Fortinet · FortiOS and FortiProxy. In CISA KEV since 2025-01-14, known ransomware use. ENISA EUVD lists it as exploited. EPSS 94.3% (higher than 99.85% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1078 Valid Accounts; T1555 Credentials from Password Stores; T1021 Remote Services. Named in 1 threat report. Priority 83.7 of 100.","summary":"Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability","date_published":"2025-01-14T00:00:00.000Z","date_modified":"2026-08-05T05:16:42.000Z","tags":["kev","ransomware","public-exploit","T1068","T1078","T1555","T1021"],"_patchfirst":{"reason":"kev","priority":83.7,"kev":{"dateAdded":"2025-01-14","ransomware":true},"epss":{"score":0.9435,"percentile":0.99851},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Fortinet","product":"FortiOS and FortiProxy","techniqueIds":["T1068","T1078","T1555","T1021"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-21893#kev","url":"https://patchfirst.co/cve/CVE-2024-21893/","title":"[KEV] CVE-2024-21893: Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability","content_text":"Ivanti · Connect Secure, Policy Secure, and Neurons. In CISA KEV since 2024-01-31, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 8.2 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts; T1505.003 Web Shell; T1555 Credentials from Password Stores. Priority 78.7 of 100.","summary":"Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability","date_published":"2024-01-31T00:00:00.000Z","date_modified":"2026-08-04T05:16:30.000Z","tags":["kev","ransomware","public-exploit","T1190","T1078","T1505.003","T1555"],"_patchfirst":{"reason":"kev","priority":78.7,"kev":{"dateAdded":"2024-01-31","ransomware":true},"epss":{"score":0.99999,"percentile":0.99999},"cvss":{"score":8.2,"severity":"HIGH","version":"3.1"},"vendor":"Ivanti","product":"Connect Secure, Policy Secure, and Neurons","techniqueIds":["T1190","T1078","T1505.003","T1555"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-46805","url":"https://patchfirst.co/cve/CVE-2023-46805/","title":"CVE-2023-46805: Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability","content_text":"Ivanti · Connect Secure and Policy Secure. In CISA KEV since 2024-01-10, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.98% of CVEs). CVSS 8.2 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts; T1505.003 Web Shell; T1555 Credentials from Password Stores. Named in 4 threat reports. Priority 87.7 of 100.","summary":"Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability","date_published":"2024-01-12T00:00:00.000Z","date_modified":"2026-10-01T21:17:17.000Z","tags":["kev","ransomware","public-exploit","T1190","T1078","T1505.003","T1555"],"_patchfirst":{"reason":"published","priority":87.7,"kev":{"dateAdded":"2024-01-10","ransomware":true},"epss":{"score":0.99984,"percentile":0.99982},"cvss":{"score":8.2,"severity":"HIGH","version":"3.1"},"vendor":"Ivanti","product":"Connect Secure and Policy Secure","techniqueIds":["T1190","T1078","T1505.003","T1555"],"reportCount":4,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-27532#kev","url":"https://patchfirst.co/cve/CVE-2023-27532/","title":"[KEV] CVE-2023-27532: Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function Vulnerability","content_text":"Veeam · Backup & Replication. In CISA KEV since 2023-08-22, known ransomware use. ENISA EUVD lists it as exploited. EPSS 80.6% (higher than 99.62% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1133 External Remote Services; T1059.003 Windows Command Shell; T1087 Account Discovery; T1087.001 Local Account; T1486 Data Encrypted for Impact; T1555 Credentials from Password Stores. Named in 1 threat report. Priority 82.0 of 100.","summary":"Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function Vulnerability","date_published":"2023-08-22T00:00:00.000Z","date_modified":"2026-06-17T05:45:24.000Z","tags":["kev","ransomware","public-exploit","T1133","T1059.003","T1087","T1087.001","T1486","T1555"],"_patchfirst":{"reason":"kev","priority":82,"kev":{"dateAdded":"2023-08-22","ransomware":true},"epss":{"score":0.80599,"percentile":0.99624},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"Veeam","product":"Backup & Replication","techniqueIds":["T1133","T1059.003","T1087","T1087.001","T1486","T1555"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}}]}