https://patchfirst.co/technique/T1611/New and newly exploited CVEs that lead to ATT&CK T1611 Escape to Host, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.en-gb360Sat, 31 Oct 2026 13:00:36 GMThttps://patchfirst.co/cve/CVE-2022-0492/CVE-2022-0492#kevTue, 02 Jun 2026 00:00:00 GMTLinux · Kernel. In CISA KEV since 2026-06-02. ENISA EUVD lists it as exploited. EPSS 5.5% (higher than 92.8% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1611 Escape to Host. Priority 72.0 of 100.kevpublic-exploitT1068T1611https://patchfirst.co/cve/CVE-2025-22224/CVE-2025-22224#kevTue, 04 Mar 2025 00:00:00 GMTVMware · ESXi and Workstation. In CISA KEV since 2025-03-04. ENISA EUVD lists it as exploited. EPSS 1.6% (higher than 75.2% of CVEs). CVSS 8.2 HIGH. ATT&CK: T1055 Process Injection; T1611 Escape to Host. Priority 68.8 of 100.kevT1055T1611https://patchfirst.co/cve/CVE-2025-22226/CVE-2025-22226#kevTue, 04 Mar 2025 00:00:00 GMTVMware · ESXi, Workstation, and Fusion. In CISA KEV since 2025-03-04. ENISA EUVD lists it as exploited. EPSS 1.6% (higher than 76.2% of CVEs). CVSS 6.0 MEDIUM. ATT&CK: T1005 Data from Local System; T1611 Escape to Host. Priority 67.4 of 100.kevT1005T1611https://patchfirst.co/cve/CVE-2025-22225/CVE-2025-22225#kevTue, 04 Mar 2025 00:00:00 GMTVMware · ESXi. In CISA KEV since 2025-03-04, known ransomware use. ENISA EUVD lists it as exploited. EPSS 1.0% (higher than 63.3% of CVEs). CVSS 8.2 HIGH. ATT&CK: T1068 Exploitation for Privilege Escalation; T1611 Escape to Host. Priority 66.4 of 100.kevransomwareT1068T1611https://patchfirst.co/cve/CVE-2020-16017/CVE-2020-16017#kevWed, 03 Nov 2021 00:00:00 GMTGoogle · Chrome. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 2.7% (higher than 86.1% of CVEs). CVSS 9.6 CRITICAL. ATT&CK: T1189 Drive-by Compromise; T1611 Escape to Host. Priority 61.9 of 100.kevT1189T1611https://patchfirst.co/cve/CVE-2019-5736/CVE-2019-5736Mon, 11 Feb 2019 00:00:00 GMTNot in CISA KEV. EPSS 98.5% (higher than 99.92% of CVEs). Public exploit code exists. ATT&CK: T1610 Deploy Container; T1611 Escape to Host. Named in 1 threat report. Priority 66.2 of 100.public-exploitT1610T1611