Patchfirst
Patchfirst
T1133Initial AccessPersistence

External Remote Services

Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services. Services such as…

attack.mitre.org ↗
CVEs55
In 31
Reports1

Detections

20 Sigma rules tagged T1133
External Remote ServicesT113320 general rules
All 20 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

CVEs linked to External Remote Services

55 CVEs, by priority. Each link shows its badge.
  1. CVE-2026-0257Palo Alto Networks PAN-OS Authentication Bypass Vulnerability
    Palo Alto Networks · PAN-OSKEVRansomwarePublic exploitCritical · 9.1T1190Exploit Public-Facing ApplicationT1133External Remote Services4 reports
    AI mapping from the description · primary impact
    95.0%Top 0.14%
    93.3priority
  2. CVE-2019-11510Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability
    Ivanti · Pulse Connect SecureKEVRansomwarePublic exploitCritical · 10.0T1133External Remote ServicesT1059Command and Scripting Interpreter+2 more · 6 reports
    MITRE CTID mapping of the KEV entry · how it is exploited
    >99.9%Top 0.01%
    90.0priority
  3. CVE-2019-19781Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Vulnerability
    Citrix · Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP ApplianceKEVRansomwarePublic exploitCritical · 9.8T1133External Remote ServicesT1059Command and Scripting Interpreter+1 more · 8 reports
    MITRE CTID mapping of the KEV entry · how it is exploited
    >99.9%Top 0.01%
    89.9priority
  4. CVE-2020-5902F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability
    F5 · BIG-IPKEVRansomwarePublic exploitCritical · 9.8T1133External Remote ServicesT1190Exploit Public-Facing Application+5 more · 5 reports
    MITRE CTID mapping of the KEV entry · how it is exploited
    >99.9%Top 0.01%
    89.9priority
  5. CVE-2021-26855Microsoft Exchange Server Remote Code Execution Vulnerability
    Microsoft · Exchange ServerKEVRansomwarePublic exploitCritical · 9.1T1133External Remote ServicesT1505.003Web Shell+2 more · 5 reports
    MITRE CTID mapping of the KEV entry · how it is exploited
    >99.9%Top 0.01%
    89.4priority
  6. CVE-2020-1472Microsoft Netlogon Privilege Escalation Vulnerability
    Microsoft · NetlogonKEVRansomwarePublic exploitMedium · 5.5T1133External Remote ServicesT1068Exploitation for Privilege Escalation+4 more · 8 reports
    MITRE CTID mapping of the KEV entry · how it is exploited
    99.4%Top 0.06%
    86.8priority
  7. CVE-2019-0708Microsoft Remote Desktop Services Remote Code Execution Vulnerability
    Microsoft · Remote Desktop ServicesKEVRansomwarePublic exploitCritical · 9.8T1133External Remote ServicesT1498Network Denial of Service2 reports
    MITRE CTID mapping of the KEV entry · how it is exploited
    >99.9%Top 0.01%
    86.0priority
  8. CVE-2026-50751Check Point Security Gateway Improper Authentication Vulnerability
    Check Point · Security GatewayKEVRansomwarePublic exploitCritical · 9.3T1133External Remote ServicesT1078Valid Accounts
    AI mapping from the description · how it is exploited
    85.3%Top 0.28%
    84.5priority
  9. CVE-2019-3396Atlassian Confluence Server and Data Center Server-Side Template Injection Vulnerability
    Atlassian · Confluence Server and Data ServerKEVRansomwarePublic exploitCritical · 9.8T1133External Remote ServicesT1202Indirect Command Execution+1 more · 1 report
    MITRE CTID mapping of the KEV entry · how it is exploited
    99.9%Top 0.03%
    83.7priority
  10. CVE-2023-27532Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function Vulnerability
    Veeam · Backup & ReplicationKEVRansomwarePublic exploitHigh · 7.5T1133External Remote ServicesT1059.003Windows Command Shell+4 more · 1 report
    MITRE CTID mapping of the KEV entry · how it is exploited
    80.6%Top 0.38%
    82.0priority
  11. CVE-2021-22986F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution Vulnerability
    F5 · BIG-IP and BIG-IQ Centralized ManagementKEVRansomwarePublic exploitCritical · 9.8T1133External Remote ServicesT1190Exploit Public-Facing Application+3 more
    MITRE CTID mapping of the KEV entry · how it is exploited
    99.9%Top 0.03%
    79.9priority
  12. CVE-2025-20333Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow…
    Cisco · Secure Firewall Adaptive Security Appliance and Secure Firewall Threat DefenseKEVPublic exploitCritical · 9.9T1133External Remote ServicesT1059Command and Scripting Interpreter5 reports
    AI mapping from the description · how it is exploited
    71.2%Top 0.59%
    79.8priority
  13. CVE-2025-32756Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability
    Fortinet · Multiple ProductsKEVPublic exploitCritical · 9.8T1608.001Upload MalwareT1133External Remote Services+5 more
    MITRE CTID mapping of the KEV entry · how it is exploited
    30.9%Top 1.7%
    79.5priority
  14. CVE-2019-5591Fortinet FortiOS Default Configuration Vulnerability
    Fortinet · FortiOSKEVRansomwarePublic exploitMedium · 6.5T1133External Remote ServicesT1557Adversary-in-the-Middle+1 more
    MITRE CTID mapping of the KEV entry · how it is exploited
    18.6%Top 2.7%
    77.0priority
  15. CVE-2014-6271GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
    GNU · Bourne-Again Shell (Bash)KEVPublic exploitCritical · 9.8T1133External Remote ServicesT1190Exploit Public-Facing Application+1 more · 2 reports
    MITRE CTID mapping of the KEV entry · how it is exploited
    >99.9%Top 0.01%
    76.0priority
  16. CVE-2026-65400Apple macOS Improper Authentication Vulnerability
    Apple · macOSKEVPublic exploitCritical · 9.8T1133External Remote ServicesT1021Remote Services
    AI mapping from the description · how it is exploited
    1.7%Top 23%
    75.4priority
  17. CVE-2023-48365Qlik Sense HTTP Tunneling Vulnerability
    Qlik · SenseKEVRansomwareCritical · 9.9T1133External Remote ServicesT1190Exploit Public-Facing Application+1 more
    MITRE CTID mapping of the KEV entry · how it is exploited
    47.7%Top 1.2%
    74.7priority
  18. CVE-2023-20269Cisco Adaptive Security Appliance and Firepower Threat Defense Unauthorized Access Vulnerability
    Cisco · Adaptive Security Appliance and Firepower Threat DefenseKEVRansomwareCritical · 9.1T1133External Remote ServicesT1078Valid Accounts
    MITRE CTID mapping of the KEV entry · how it is exploited
    26.6%Top 2%
    74.0priority
  19. CVE-2020-25506D-Link DNS-320 Device Command Injection Vulnerability
    D-Link · DNS-320 DeviceKEVPublic exploitCritical · 9.8T1584.005BotnetT1133External Remote Services+1 more · 1 report
    MITRE CTID mapping of the KEV entry · how it is exploited
    >99.9%Top 0.02%
    73.7priority
  20. CVE-2014-7169GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
    GNU · Bourne-Again Shell (Bash)KEVPublic exploitCritical · 9.8T1133External Remote ServicesT1190Exploit Public-Facing Application+1 more
    MITRE CTID mapping of the KEV entry · how it is exploited
    99.9%Top 0.03%
    69.9priority
  21. CVE-2020-8515Multiple DrayTek Vigor Routers Web Management Page Vulnerability
    DrayTek · Multiple Vigor RoutersKEVPublic exploitCritical · 9.8T1133External Remote ServicesT1059Command and Scripting Interpreter+1 more
    MITRE CTID mapping of the KEV entry · how it is exploited
    >99.9%Top 0.01%
    69.9priority
  22. CVE-2021-1497Cisco HyperFlex HX Installer Virtual Machine Command Injection Vulnerability
    Cisco · HyperFlex HXKEVPublic exploitCritical · 9.8T1133External Remote ServicesT1059Command and Scripting Interpreter
    MITRE CTID mapping of the KEV entry · how it is exploited
    99.9%Top 0.03%
    69.9priority
  23. CVE-2021-1498Cisco HyperFlex HX Data Platform Command Injection Vulnerability
    Cisco · HyperFlex HXKEVPublic exploitCritical · 9.8T1133External Remote ServicesT1059Command and Scripting Interpreter
    MITRE CTID mapping of the KEV entry · how it is exploited
    >99.9%Top 0.01%
    69.9priority
  24. CVE-2024-1212Progress Kemp LoadMaster OS Command Injection Vulnerability
    Progress · Kemp LoadMasterKEVPublic exploitCritical · 9.8T1133External Remote ServicesT1059Command and Scripting Interpreter
    AI mapping from the description · how it is exploited
    95.4%Top 0.13%
    69.8priority
  25. CVE-2022-20699Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability
    Cisco · Small Business RV160, RV260, RV340, and RV345 Series RoutersKEVPublic exploitCritical · 9.8T1133External Remote ServicesT1059.004Unix Shell
    MITRE CTID mapping of the KEV entry · how it is exploited
    72.5%Top 0.56%
    69.7priority
  26. CVE-2024-11120GeoVision Devices OS Command Injection Vulnerability
    GeoVision · Multiple DevicesKEVPublic exploitCritical · 9.8T1133External Remote ServicesT1498Network Denial of Service
    MITRE CTID mapping of the KEV entry · how it is exploited
    28.4%Top 1.9%
    69.5priority
  27. CVE-2023-39780ASUS RT-AX55 Routers OS Command Injection Vulnerability
    ASUS · RT-AX55 RoutersKEVPublic exploitHigh · 8.8T1588Obtain CapabilitiesT1078Valid Accounts+3 more
    MITRE CTID mapping of the KEV entry · how it is exploited
    39.5%Top 1.4%
    68.9priority
  28. CVE-2024-45195Apache OFBiz Forced Browsing Vulnerability
    Apache · OFBizKEVPublic exploitHigh · 7.5T1133External Remote ServicesT1059Command and Scripting Interpreter+1 more
    MITRE CTID mapping of the KEV entry · how it is exploited
    >99.9%Top 0.02%
    68.2priority
  29. CVE-2025-66644Array Networks ArrayOS AG OS Command Injection Vulnerability
    Array Networks · ArrayOS AGKEVCritical · 9.8T1133External Remote ServicesT1059Command and Scripting Interpreter
    AI mapping from the description · how it is exploited
    3.4%Top 11%
    67.6priority
  30. CVE-2018-4939Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
    Adobe · ColdFusionKEVCritical · 9.8T1133External Remote ServicesT1190Exploit Public-Facing Application
    MITRE CTID mapping of the KEV entry · primary impact
    61.8%Top 0.83%
    64.7priority
  31. CVE-2022-23176WatchGuard Firebox and XTM Privilege Escalation Vulnerability
    WatchGuard · Firebox and XTMKEVHigh · 8.8T1133External Remote ServicesT1078Valid Accounts
    AI mapping from the description · how it is exploited
    10.8%Top 4.2%
    63.3priority
  32. CVE-2020-12029Rockwell Automation FactoryTalk View SE
    Rockwell Automation · FactoryTalk View SEPublic exploitCritical · 9.0T1133External Remote ServicesT1059Command and Scripting Interpreter+1 more
    MITRE CTID mapping of the CVE · how it is exploited
    47.0%Top 1.2%
    31.1priority
  33. CVE-2020-3387Cisco SD-WAN vManage Software Remote Code Execution Vulnerability
    Cisco · Cisco SD-WAN vManagePublic exploitHigh · 7.5T1133External Remote ServicesT1190Exploit Public-Facing Application+1 more
    MITRE CTID mapping of the CVE · how it is exploited
    13.0%Top 3.7%
    29.5priority
  34. CVE-2020-3240Multiple Vulnerabilities in Cisco UCS Director and Cisco UCS Director Express for Big Data
    Cisco · Cisco UCS DirectorCritical · 9.8T1133External Remote ServicesT1059Command and Scripting Interpreter+4 more
    MITRE CTID mapping of the CVE · how it is exploited
    38.7%Top 1.4%
    26.6priority
  35. CVE-2020-15188Unauthenticated Remote Code Execution in SOY CMS
    inunosinsi · soycmsCritical · 10.0T1133External Remote ServicesT1059Command and Scripting Interpreter
    MITRE CTID mapping of the CVE · how it is exploited
    5.1%Top 7.7%
    25.5priority
  36. CVE-2020-3198Cisco IOS Software for Cisco Industrial Routers Arbitrary Code Execution Vulnerabilities
    Cisco · Cisco IOS 12.2(60)EZ16Critical · 9.8T1133External Remote ServicesT1190Exploit Public-Facing Application+3 more
    MITRE CTID mapping of the CVE · how it is exploited
    4.6%Top 8.4%
    25.2priority
  37. CVE-2019-15972Cisco Unified Communications Manager SQL Injection Vulnerability
    Cisco · Cisco Unified Communications ManagerPublic exploitMedium · 5.4T1078Valid AccountsT1133External Remote Services+3 more
    MITRE CTID mapping of the CVE · how it is exploited
    1.6%Top 24%
    23.9priority
  38. CVE-2020-15147Remote Code Execution in Red Discord Bot
    Cog-Creators · Red-DiscordBotHigh · 8.5T1133External Remote ServicesT1059Command and Scripting Interpreter
    MITRE CTID mapping of the CVE · how it is exploited
    2.6%Top 15%
    23.0priority
  39. CVE-2019-15288Cisco TelePresence Collaboration Endpoint, TelePresence Codec, and RoomOS Software Privilege Escalation Vulnerability
    Cisco · Cisco TelePresence TC SoftwareHigh · 8.8T1608Stage CapabilitiesT1078Valid Accounts+1 more
    MITRE CTID mapping of the CVE · how it is exploited
    1.7%Top 22%
    21.7priority
  40. CVE-2020-15143Remote Code Execution in SyliusResourceBundle
    Sylius · SyliusResourceBundleHigh · 7.7T1133External Remote ServicesT1059Command and Scripting Interpreter
    MITRE CTID mapping of the CVE · how it is exploited
    1.9%Top 20%
    21.4priority
  41. CVE-2020-3309Cisco Firepower Device Manager On-Box Software Arbitrary File Overwrite Vulnerability
    Cisco · Cisco Firepower Threat Defense SoftwareMedium · 6.5T1133External Remote ServicesT1190Exploit Public-Facing Application+2 more
    MITRE CTID mapping of the CVE · how it is exploited
    1.8%Top 22%
    20.2priority
  42. CVE-2020-15140Remote Code Execution in Red Discord Bot
    Cog-Creators · Red-DiscordBotHigh · 8.2T1133External Remote ServicesT1059Command and Scripting Interpreter
    MITRE CTID mapping of the CVE · how it is exploited
    1.2%Top 33%
    19.1priority
  43. CVE-2020-4068Heap-based Buffer Overflow in APNSwift
    kylebrowning · APNSwiftMedium · 6.3T1091Replication Through Removable MediaT1133External Remote Services+4 more
    MITRE CTID mapping of the CVE · how it is exploited
    1.3%Top 29%
    18.6priority
  44. CVE-2018-19007In Geutebrueck GmbH E2 Camera Series versions prior to 1.12.0.25 the DDNS configuration (in the Network Configuration…
    T1133External Remote ServicesT1059Command and Scripting Interpreter
    MITRE CTID mapping of the CVE · how it is exploited
    3.9%Top 9.8%
    18.0priority
  45. CVE-2020-11010SQL injection in Tortoise ORM
    tortoise · tortoise-ormMedium · 6.3T1133External Remote ServicesT1190Exploit Public-Facing Application+5 more
    MITRE CTID mapping of the CVE · how it is exploited
    1.0%Top 36%
    17.2priority
  46. CVE-2019-1942Cisco Identity Services Engine Blind SQL Injection Vulnerability
    Cisco · Cisco Identity Services Engine SoftwareMedium · 4.3T1078Valid AccountsT1133External Remote Services+3 more
    MITRE CTID mapping of the CVE · how it is exploited
    1.2%Top 31%
    16.8priority
  47. CVE-2018-11048Dell EMC Data Protection Advisor, versions 6.2, 6,3, 6.4, 6.5 and Dell EMC Integrated Data Protection Appliance (IDPA)…
    Dell EMC · Data Protection AdvisorT1133External Remote ServicesT1059Command and Scripting Interpreter+2 more
    MITRE CTID mapping of the CVE · how it is exploited
    2.1%Top 19%
    16.3priority
  48. CVE-2020-15109Ability to change order address without triggering address validations in solidus
    solidusio · solidusMedium · 5.3T1133External Remote ServicesT1190Exploit Public-Facing Application+1 more
    MITRE CTID mapping of the CVE · how it is exploited
    1.0%Top 37%
    16.3priority
  49. CVE-2019-18234Equinox Control Expert all versions, is vulnerable to an SQL injection attack, which may allow an attacker to remotely…
    T1133External Remote ServicesT1190Exploit Public-Facing Application+5 more
    MITRE CTID mapping of the CVE · how it is exploited
    1.9%Top 20%
    15.9priority
  50. CVE-2020-12000The affected product is vulnerable to the handling of serialized data
    T1133External Remote ServicesT1059Command and Scripting Interpreter
    MITRE CTID mapping of the CVE · how it is exploited
    1.5%Top 26%
    14.8priority
  51. CVE-2019-15998Cisco IOS XR Software NETCONF Over Secure Shell ACL Bypass Vulnerability
    Cisco · Cisco IOS XR SoftwareMedium · 5.3T1078Valid AccountsT1133External Remote Services
    MITRE CTID mapping of the CVE · primary impact
    0.7%Top 46%
    14.5priority
  52. CVE-2020-10603WebAccess/NMS (versions prior to 3.0.2) does not properly sanitize user input and may allow an attacker to inject…
    T1133External Remote ServicesT1059Command and Scripting Interpreter
    MITRE CTID mapping of the CVE · how it is exploited
    1.2%Top 31%
    13.7priority
  53. CVE-2019-1836Cisco Nexus 9000 Series Fabric Switches Application Centric Infrastructure Mode Symbolic Link Path Traversal…
    Cisco · Cisco NX-OS Software for Nexus 9000 Series Fabric Switches ACI ModeMedium · 5.5T1133External Remote ServicesT1565.001Stored Data Manipulation
    MITRE CTID mapping of the CVE · how it is exploited
    0.4%Top 62%
    12.8priority
  54. CVE-2019-1612Cisco NX-OS Software CLI Command Injection Vulnerability (CVE-2019-1612)
    Cisco · Nexus 3000 Series SwitchesMedium · 4.2T1078Valid AccountsT1133External Remote Services+2 more
    MITRE CTID mapping of the CVE · how it is exploited
    0.5%Top 60%
    12.2priority
  55. CVE-2020-3237Cisco IOx Application Framework Arbitrary File Overwrite Vulnerability
    Cisco · Cisco IOxMedium · 6.3T1133External Remote ServicesT1565.001Stored Data Manipulation
    MITRE CTID mapping of the CVE · how it is exploited
    0.4%Top 71%
    10.1priority

Passages that support these links

↑ ↓ chooseEnter openEsc close