{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: CVEs linked to T1566.001 Spearphishing Attachment","home_page_url":"https://patchfirst.co/technique/T1566.001/","feed_url":"https://patchfirst.co/feed/technique/T1566.001.json","description":"New and newly exploited CVEs that lead to ATT&CK T1566.001 Spearphishing Attachment, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2025-66376#kev","url":"https://patchfirst.co/cve/CVE-2025-66376/","title":"[KEV] CVE-2025-66376: Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability","content_text":"Synacor · Zimbra Collaboration Suite (ZCS). In CISA KEV since 2026-03-18. ENISA EUVD lists it as exploited. EPSS 20.2% (higher than 97.5% of CVEs). CVSS 6.1 MEDIUM. ATT&CK: T1566.001 Spearphishing Attachment; T1059.007 JavaScript. Priority 66.8 of 100.","summary":"Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability","date_published":"2026-03-18T00:00:00.000Z","date_modified":"2026-10-07T10:10:00.000Z","tags":["kev","T1566.001","T1059.007"],"_patchfirst":{"reason":"kev","priority":66.8,"kev":{"dateAdded":"2026-03-18","ransomware":false},"epss":{"score":0.20227,"percentile":0.97463},"cvss":{"score":6.1,"severity":"MEDIUM","version":"3.1"},"vendor":"Synacor","product":"Zimbra Collaboration Suite (ZCS)","techniqueIds":["T1566.001","T1059.007"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2025-33053#kev","url":"https://patchfirst.co/cve/CVE-2025-33053/","title":"[KEV] CVE-2025-33053: Microsoft Windows External Control of File Name or Path Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2025-06-10. ENISA EUVD lists it as exploited. EPSS 87.0% (higher than 99.75% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1566.001 Spearphishing Attachment; T1059 Command and Scripting Interpreter; T1041 Exfiltration Over C2 Channel; T1056.001 Keylogging; T1543 Create or Modify System Process. Priority 69.1 of 100.","summary":"Microsoft Windows External Control of File Name or Path Vulnerability","date_published":"2025-06-10T00:00:00.000Z","date_modified":"2026-06-17T09:13:01.000Z","tags":["kev","public-exploit","T1566.001","T1059","T1041","T1056.001","T1543"],"_patchfirst":{"reason":"kev","priority":69.1,"kev":{"dateAdded":"2025-06-10","ransomware":false},"epss":{"score":0.87015,"percentile":0.99747},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1566.001","T1059","T1041","T1056.001","T1543"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-0411#kev","url":"https://patchfirst.co/cve/CVE-2025-0411/","title":"[KEV] CVE-2025-0411: 7-Zip Mark of the Web Bypass Vulnerability","content_text":"7-Zip · 7-Zip. In CISA KEV since 2025-02-06. ENISA EUVD lists it as exploited. EPSS 67.1% (higher than 99.3% of CVEs). CVSS 7.0 HIGH. Public exploit code exists. ATT&CK: T1553.005 Mark-of-the-Web Bypass; T1566.001 Spearphishing Attachment; T1588.001 Malware. Priority 67.8 of 100.","summary":"7-Zip Mark of the Web Bypass Vulnerability","date_published":"2025-02-06T00:00:00.000Z","date_modified":"2026-06-17T08:26:25.000Z","tags":["kev","public-exploit","T1553.005","T1566.001","T1588.001"],"_patchfirst":{"reason":"kev","priority":67.8,"kev":{"dateAdded":"2025-02-06","ransomware":false},"epss":{"score":0.67071,"percentile":0.99297},"cvss":{"score":7,"severity":"HIGH","version":"3.1"},"vendor":"7-Zip","product":"7-Zip","techniqueIds":["T1553.005","T1566.001","T1588.001"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-2868#kev","url":"https://patchfirst.co/cve/CVE-2023-2868/","title":"[KEV] CVE-2023-2868: Barracuda Networks ESG Appliance Improper Input Validation Vulnerability","content_text":"Barracuda Networks · Email Security Gateway (ESG) Appliance. In CISA KEV since 2023-05-26. ENISA EUVD lists it as exploited. EPSS 86.8% (higher than 99.74% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1566.001 Spearphishing Attachment; T1059 Command and Scripting Interpreter; T1041 Exfiltration Over C2 Channel; T1105 Ingress Tool Transfer. Priority 69.8 of 100.","summary":"Barracuda Networks ESG Appliance Improper Input Validation Vulnerability","date_published":"2023-05-26T00:00:00.000Z","date_modified":"2026-06-17T05:53:39.000Z","tags":["kev","public-exploit","T1566.001","T1059","T1041","T1105"],"_patchfirst":{"reason":"kev","priority":69.8,"kev":{"dateAdded":"2023-05-26","ransomware":false},"epss":{"score":0.86841,"percentile":0.99744},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Barracuda Networks","product":"Email Security Gateway (ESG) Appliance","techniqueIds":["T1566.001","T1059","T1041","T1105"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2022-41033#kev","url":"https://patchfirst.co/cve/CVE-2022-41033/","title":"[KEV] CVE-2022-41033: Microsoft Windows COM+ Event System Service Privilege Escalation Vulnerability","content_text":"Microsoft · Windows COM+ Event System Service. In CISA KEV since 2022-10-11. ENISA EUVD lists it as exploited. EPSS 1.9% (higher than 79.5% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1566.001 Spearphishing Attachment; T1068 Exploitation for Privilege Escalation. Priority 59.4 of 100.","summary":"Microsoft Windows COM+ Event System Service Privilege Escalation Vulnerability","date_published":"2022-10-11T00:00:00.000Z","date_modified":"2026-06-17T05:02:27.000Z","tags":["kev","T1566.001","T1068"],"_patchfirst":{"reason":"kev","priority":59.4,"kev":{"dateAdded":"2022-10-11","ransomware":false},"epss":{"score":0.01886,"percentile":0.79491},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Windows COM+ Event System Service","techniqueIds":["T1566.001","T1068"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2013-0640#kev","url":"https://patchfirst.co/cve/CVE-2013-0640/","title":"[KEV] CVE-2013-0640: Adobe Reader and Acrobat Memory Corruption Vulnerability","content_text":"Adobe · Reader and Acrobat. In CISA KEV since 2022-03-03. ENISA EUVD lists it as exploited. EPSS 86.9% (higher than 99.75% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1566.001 Spearphishing Attachment. Named in 1 threat report. Priority 57.3 of 100.","summary":"Adobe Reader and Acrobat Memory Corruption Vulnerability","date_published":"2022-03-03T00:00:00.000Z","date_modified":"2026-06-16T23:49:49.000Z","tags":["kev","public-exploit","T1566.001"],"_patchfirst":{"reason":"kev","priority":57.3,"kev":{"dateAdded":"2022-03-03","ransomware":false},"epss":{"score":0.86927,"percentile":0.99746},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Adobe","product":"Reader and Acrobat","techniqueIds":["T1566.001"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2017-11292#kev","url":"https://patchfirst.co/cve/CVE-2017-11292/","title":"[KEV] CVE-2017-11292: Adobe Flash Player Type Confusion Vulnerability","content_text":"Adobe · Flash Player. In CISA KEV since 2022-03-03. ENISA EUVD lists it as exploited. EPSS 11.9% (higher than 96.1% of CVEs). CVSS 8.8 HIGH. ATT&CK: T1204.002 Malicious File; T1566.001 Spearphishing Attachment; T1105 Ingress Tool Transfer; T1005 Data from Local System. Priority 48.4 of 100.","summary":"Adobe Flash Player Type Confusion Vulnerability","date_published":"2022-03-03T00:00:00.000Z","date_modified":"2026-06-17T01:01:33.000Z","tags":["kev","T1204.002","T1566.001","T1105","T1005"],"_patchfirst":{"reason":"kev","priority":48.4,"kev":{"dateAdded":"2022-03-03","ransomware":false},"epss":{"score":0.11885,"percentile":0.96096},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Adobe","product":"Flash Player","techniqueIds":["T1204.002","T1566.001","T1105","T1005"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2017-11882#kev","url":"https://patchfirst.co/cve/CVE-2017-11882/","title":"[KEV] CVE-2017-11882: Microsoft Office Memory Corruption Vulnerability","content_text":"Microsoft · Office. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.9% (higher than 99.97% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1566.001 Spearphishing Attachment; T1059 Command and Scripting Interpreter. Named in 13 threat reports. Priority 88.5 of 100.","summary":"Microsoft Office Memory Corruption Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T01:02:31.000Z","tags":["kev","ransomware","public-exploit","T1566.001","T1059"],"_patchfirst":{"reason":"kev","priority":88.5,"kev":{"dateAdded":"2021-11-03","ransomware":true},"epss":{"score":0.99945,"percentile":0.99973},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Office","techniqueIds":["T1566.001","T1059"],"reportCount":13,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2020-3133","url":"https://patchfirst.co/cve/CVE-2020-3133/","title":"CVE-2020-3133: Cisco Email Security Appliance Content Filter Bypass Vulnerability","content_text":"Cisco · Cisco Email Security Appliance (ESA). Not in CISA KEV. EPSS 1.4% (higher than 72.1% of CVEs). CVSS 5.8 MEDIUM. ATT&CK: T1566.001 Spearphishing Attachment; T1190 Exploit Public-Facing Application. Priority 18.5 of 100.","summary":"Cisco Email Security Appliance Content Filter Bypass Vulnerability","date_published":"2020-09-23T00:00:00.000Z","date_modified":"2024-11-13T18:06:30.000Z","tags":["T1566.001","T1190"],"_patchfirst":{"reason":"published","priority":18.5,"kev":null,"epss":{"score":0.01378,"percentile":0.72067},"cvss":{"score":5.8,"severity":"MEDIUM","version":"3.0"},"vendor":"Cisco","product":"Cisco Email Security Appliance (ESA)","techniqueIds":["T1566.001","T1190"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}}]}