https://patchfirst.co/technique/T1567/New and newly exploited CVEs that lead to ATT&CK T1567 Exfiltration Over Web Service, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.en-gb360Sat, 31 Oct 2026 05:11:25 GMThttps://patchfirst.co/cve/CVE-2025-54309/CVE-2025-54309#kevTue, 22 Jul 2025 00:00:00 GMTCrushFTP · CrushFTP. In CISA KEV since 2025-07-22. ENISA EUVD lists it as exploited. EPSS 93.5% (higher than 99.84% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1567 Exfiltration Over Web Service; T1021 Remote Services. Priority 69.8 of 100.kevpublic-exploitT1068T1567T1021https://patchfirst.co/cve/CVE-2024-11182/CVE-2024-11182#kevMon, 19 May 2025 00:00:00 GMTMDaemon · Email Server. In CISA KEV since 2025-05-19. ENISA EUVD lists it as exploited. EPSS 33.3% (higher than 98.4% of CVEs). CVSS 6.1 MEDIUM. ATT&CK: T1566 Phishing; T1059 Command and Scripting Interpreter; T1567 Exfiltration Over Web Service. Priority 61.9 of 100.kevT1566T1059T1567https://patchfirst.co/cve/CVE-2022-41082/CVE-2022-41082Mon, 03 Oct 2022 00:00:00 GMTMicrosoft · Exchange Server. In CISA KEV since 2022-09-30, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.98% of CVEs). CVSS 8.0 HIGH. Public exploit code exists. ATT&CK: T1059.001 PowerShell; T1078 Valid Accounts; T1087 Account Discovery; T1482 Domain Trust Discovery; T1505.003 Web Shell; T1567 Exfiltration Over Web Service. Priority 78.6 of 100.kevransomwarepublic-exploitT1059.001T1078T1087T1482T1505.003T1567