https://patchfirst.co/technique/T1566.002/New and newly exploited CVEs that lead to ATT&CK T1566.002 Spearphishing Link, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.en-gb360Sat, 31 Oct 2026 05:11:25 GMThttps://patchfirst.co/cve/CVE-2025-48700/CVE-2025-48700#kevMon, 20 Apr 2026 00:00:00 GMTSynacor · Zimbra Collaboration Suite (ZCS). In CISA KEV since 2026-04-20. ENISA EUVD lists it as exploited. EPSS 1.7% (higher than 77.4% of CVEs). CVSS 6.1 MEDIUM. ATT&CK: T1566.002 Spearphishing Link; T1056 Input Capture; T1059.007 JavaScript. Priority 62.7 of 100.kevT1566.002T1056T1059.007https://patchfirst.co/cve/CVE-2023-2533/CVE-2023-2533#kevMon, 28 Jul 2025 00:00:00 GMTPaperCut · NG/MF. In CISA KEV since 2025-07-28. ENISA EUVD lists it as exploited. EPSS 28.8% (higher than 98.1% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1566.002 Spearphishing Link; T1059 Command and Scripting Interpreter; T1547 Boot or Logon Autostart Execution. Priority 68.8 of 100.kevpublic-exploitT1566.002T1059T1547https://patchfirst.co/cve/CVE-2024-42009/CVE-2024-42009#kevMon, 09 Jun 2025 00:00:00 GMTRoundcube · Webmail. In CISA KEV since 2025-06-09. ENISA EUVD lists it as exploited. EPSS 82.9% (higher than 99.67% of CVEs). CVSS 9.3 CRITICAL. Public exploit code exists. ATT&CK: T1566.002 Spearphishing Link; T1056 Input Capture; T1114 Email Collection. Priority 69.4 of 100.kevpublic-exploitT1566.002T1056T1114https://patchfirst.co/cve/CVE-2024-27443/CVE-2024-27443#kevMon, 19 May 2025 00:00:00 GMTSynacor · Zimbra Collaboration Suite (ZCS). In CISA KEV since 2025-05-19. ENISA EUVD lists it as exploited. EPSS 24.6% (higher than 97.9% of CVEs). CVSS 6.1 MEDIUM. Public exploit code exists. ATT&CK: T1566.002 Spearphishing Link; T1059.004 Unix Shell; T1114 Email Collection; T1041 Exfiltration Over C2 Channel. Priority 66.8 of 100.kevpublic-exploitT1566.002T1059.004T1114T1041https://patchfirst.co/cve/CVE-2024-21413/CVE-2024-21413#kevThu, 06 Feb 2025 00:00:00 GMTMicrosoft · Office Outlook. In CISA KEV since 2025-02-06. ENISA EUVD lists it as exploited. EPSS 94.7% (higher than 99.86% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1566.002 Spearphishing Link; T1059 Command and Scripting Interpreter. Priority 69.8 of 100.kevpublic-exploitT1566.002T1059https://patchfirst.co/cve/CVE-2018-6882/CVE-2018-6882#kevTue, 19 Apr 2022 00:00:00 GMTSynacor · Zimbra Collaboration Suite (ZCS). In CISA KEV since 2022-04-19, known ransomware use. ENISA EUVD lists it as exploited. EPSS 29.8% (higher than 98.2% of CVEs). CVSS 6.1 MEDIUM. Public exploit code exists. ATT&CK: T1566.002 Spearphishing Link; T1059 Command and Scripting Interpreter. Priority 76.9 of 100.kevransomwarepublic-exploitT1566.002T1059https://patchfirst.co/cve/CVE-2015-5119/CVE-2015-5119#kevThu, 03 Mar 2022 00:00:00 GMTAdobe · Flash Player. In CISA KEV since 2022-03-03. ENISA EUVD lists it as exploited. EPSS 98.6% (higher than 99.92% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1059.007 JavaScript; T1566.002 Spearphishing Link; T1105 Ingress Tool Transfer; T1055.001 Dynamic-link Library Injection; T1071.001 Web Protocols. Named in 5 threat reports. Priority 74.8 of 100.kevpublic-exploitT1059.007T1566.002T1105T1055.001T1071.001https://patchfirst.co/cve/CVE-2020-15233/CVE-2020-15233Fri, 02 Oct 2020 00:00:00 GMTory · fosite. Not in CISA KEV. EPSS 0.8% (higher than 56.5% of CVEs). CVSS 6.1 MEDIUM. ATT&CK: T1566.002 Spearphishing Link; T1036 Masquerading. Priority 15.6 of 100.T1566.002T1036https://patchfirst.co/cve/CVE-2020-5270/CVE-2020-5270Mon, 20 Apr 2020 00:00:00 GMTPrestaShop · PrestaShop. Not in CISA KEV. EPSS 0.8% (higher than 57.6% of CVEs). CVSS 4.1 MEDIUM. ATT&CK: T1566.002 Spearphishing Link; T1005 Data from Local System; T1036 Masquerading; T1059.007 JavaScript; T1557 Adversary-in-the-Middle. Priority 14.4 of 100.T1566.002T1005T1036T1059.007T1557https://patchfirst.co/cve/CVE-2019-3788/CVE-2019-3788Thu, 25 Apr 2019 00:00:00 GMTCloud Foundry · UAA Release (OSS). Not in CISA KEV. EPSS 0.8% (higher than 57.6% of CVEs). CVSS 8.7 HIGH. ATT&CK: T1566.002 Spearphishing Link; T1036 Masquerading. Priority 17.6 of 100.T1566.002T1036https://patchfirst.co/cve/CVE-2019-3778/CVE-2019-3778Thu, 07 Mar 2019 00:00:00 GMTSpring · Spring Security OAuth. Not in CISA KEV. EPSS 16.6% (higher than 97% of CVEs). Public exploit code exists. ATT&CK: T1566.002 Spearphishing Link; T1036 Masquerading. Priority 25.5 of 100.public-exploitT1566.002T1036https://patchfirst.co/cve/CVE-2018-11067/CVE-2018-11067Mon, 26 Nov 2018 00:00:00 GMTDell EMC · Avamar. Not in CISA KEV. EPSS 1.8% (higher than 78.6% of CVEs). ATT&CK: T1566.002 Spearphishing Link; T1036 Masquerading. Priority 15.7 of 100.T1566.002T1036