https://patchfirst.co/technique/T1566.001/New and newly exploited CVEs that lead to ATT&CK T1566.001 Spearphishing Attachment, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.en-gb360Sat, 31 Oct 2026 05:11:25 GMThttps://patchfirst.co/cve/CVE-2025-66376/CVE-2025-66376#kevWed, 18 Mar 2026 00:00:00 GMTSynacor · Zimbra Collaboration Suite (ZCS). In CISA KEV since 2026-03-18. ENISA EUVD lists it as exploited. EPSS 20.2% (higher than 97.5% of CVEs). CVSS 6.1 MEDIUM. ATT&CK: T1566.001 Spearphishing Attachment; T1059.007 JavaScript. Priority 66.8 of 100.kevT1566.001T1059.007https://patchfirst.co/cve/CVE-2025-33053/CVE-2025-33053#kevTue, 10 Jun 2025 00:00:00 GMTMicrosoft · Windows. In CISA KEV since 2025-06-10. ENISA EUVD lists it as exploited. EPSS 87.0% (higher than 99.75% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1566.001 Spearphishing Attachment; T1059 Command and Scripting Interpreter; T1041 Exfiltration Over C2 Channel; T1056.001 Keylogging; T1543 Create or Modify System Process. Priority 69.1 of 100.kevpublic-exploitT1566.001T1059T1041T1056.001T1543https://patchfirst.co/cve/CVE-2025-0411/CVE-2025-0411#kevThu, 06 Feb 2025 00:00:00 GMT7-Zip · 7-Zip. In CISA KEV since 2025-02-06. ENISA EUVD lists it as exploited. EPSS 67.1% (higher than 99.3% of CVEs). CVSS 7.0 HIGH. Public exploit code exists. ATT&CK: T1553.005 Mark-of-the-Web Bypass; T1566.001 Spearphishing Attachment; T1588.001 Malware. Priority 67.8 of 100.kevpublic-exploitT1553.005T1566.001T1588.001https://patchfirst.co/cve/CVE-2023-2868/CVE-2023-2868#kevFri, 26 May 2023 00:00:00 GMTBarracuda Networks · Email Security Gateway (ESG) Appliance. In CISA KEV since 2023-05-26. ENISA EUVD lists it as exploited. EPSS 86.8% (higher than 99.74% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1566.001 Spearphishing Attachment; T1059 Command and Scripting Interpreter; T1041 Exfiltration Over C2 Channel; T1105 Ingress Tool Transfer. Priority 69.8 of 100.kevpublic-exploitT1566.001T1059T1041T1105https://patchfirst.co/cve/CVE-2022-41033/CVE-2022-41033#kevTue, 11 Oct 2022 00:00:00 GMTMicrosoft · Windows COM+ Event System Service. In CISA KEV since 2022-10-11. ENISA EUVD lists it as exploited. EPSS 1.9% (higher than 79.5% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1566.001 Spearphishing Attachment; T1068 Exploitation for Privilege Escalation. Priority 59.4 of 100.kevT1566.001T1068https://patchfirst.co/cve/CVE-2013-0640/CVE-2013-0640#kevThu, 03 Mar 2022 00:00:00 GMTAdobe · Reader and Acrobat. In CISA KEV since 2022-03-03. ENISA EUVD lists it as exploited. EPSS 86.9% (higher than 99.75% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1566.001 Spearphishing Attachment. Named in 1 threat report. Priority 57.3 of 100.kevpublic-exploitT1566.001https://patchfirst.co/cve/CVE-2017-11292/CVE-2017-11292#kevThu, 03 Mar 2022 00:00:00 GMTAdobe · Flash Player. In CISA KEV since 2022-03-03. ENISA EUVD lists it as exploited. EPSS 11.9% (higher than 96.1% of CVEs). CVSS 8.8 HIGH. ATT&CK: T1204.002 Malicious File; T1566.001 Spearphishing Attachment; T1105 Ingress Tool Transfer; T1005 Data from Local System. Priority 48.4 of 100.kevT1204.002T1566.001T1105T1005https://patchfirst.co/cve/CVE-2017-11882/CVE-2017-11882#kevWed, 03 Nov 2021 00:00:00 GMTMicrosoft · Office. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.9% (higher than 99.97% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1566.001 Spearphishing Attachment; T1059 Command and Scripting Interpreter. Named in 13 threat reports. Priority 88.5 of 100.kevransomwarepublic-exploitT1566.001T1059https://patchfirst.co/cve/CVE-2020-3133/CVE-2020-3133Wed, 23 Sep 2020 00:00:00 GMTCisco · Cisco Email Security Appliance (ESA). Not in CISA KEV. EPSS 1.4% (higher than 72.1% of CVEs). CVSS 5.8 MEDIUM. ATT&CK: T1566.001 Spearphishing Attachment; T1190 Exploit Public-Facing Application. Priority 18.5 of 100.T1566.001T1190