Patchfirst
Patchfirst
T1505Persistence

Server Software Component

Adversaries may abuse legitimate extensible development features of servers to establish persistent access to systems. Enterprise server applications may include features that allow developers to write and install software or scripts to extend the functionality of the main application. Adversaries may install malicious components to extend and abuse server applications.

attack.mitre.org ↗
CVEs2
In 2
Reports0
Sub-techniques T1505.001SQL Stored ProceduresT1505.002Transport AgentT1505.003Web Shell41T1505.004IIS ComponentsT1505.005Terminal Services DLLT1505.006vSphere Installation Bundles

Detections

1 Sigma rule tagged T1505
Server Software ComponentT15051 general rule

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

CVEs linked to Server Software Component

2 CVEs, by priority. Each link shows its badge.
  1. CVE-2025-49706Microsoft SharePoint Improper Authentication Vulnerability
    Microsoft · SharePointKEVRansomwarePublic exploitMedium · 6.5T1190Exploit Public-Facing ApplicationT1059.003Windows Command Shell+1 more · 1 report
    MITRE CTID mapping of the KEV entry · primary impact
    99.1%Top 0.07%
    81.4priority
  2. CVE-2022-29303SolarView Compact Command Injection Vulnerability
    SolarView · CompactKEVPublic exploitCritical · 9.8T1059Command and Scripting InterpreterT1505Server Software Component+1 more
    MITRE CTID mapping of the KEV entry · how it is exploited
    98.0%Top 0.09%
    69.8priority

Linked through a sub-technique

41 more
  1. CVE-2021-44228Apache Log4j2 Remote Code Execution Vulnerability
    Apache · Log4j2KEVRansomwarePublic exploitCritical · 10.0T1608.001Upload MalwareT1190Exploit Public-Facing Application+3 more · 10 reports
    >99.9%Top 0.01%
    90.0priority
  2. CVE-2021-26855Microsoft Exchange Server Remote Code Execution Vulnerability
    Microsoft · Exchange ServerKEVRansomwarePublic exploitCritical · 9.1T1133External Remote ServicesT1505.003Web Shell+2 more · 5 reports
    >99.9%Top 0.01%
    89.4priority
  3. CVE-2019-0604Microsoft SharePoint Remote Code Execution Vulnerability
    Microsoft · SharePointKEVRansomwarePublic exploitCritical · 9.8T1608.001Upload MalwareT1190Exploit Public-Facing Application+3 more · 4 reports
    99.9%Top 0.03%
    88.8priority
  4. CVE-2025-52691SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability
    SmarterTools · SmarterMailKEVRansomwarePublic exploitCritical · 10.0T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+1 more · 1 report
    85.7%Top 0.28%
    88.8priority
  5. CVE-2024-21887Ivanti Connect Secure and Policy Secure Command Injection Vulnerability
    Ivanti · Connect Secure and Policy SecureKEVRansomwarePublic exploitCritical · 9.1T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+2 more · 4 reports
    >99.9%Top 0.01%
    88.4priority
  6. CVE-2023-46805Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability
    Ivanti · Connect Secure and Policy SecureKEVRansomwarePublic exploitHigh · 8.2T1190Exploit Public-Facing ApplicationT1078Valid Accounts+2 more · 4 reports
    >99.9%Top 0.02%
    87.7priority
  7. CVE-2021-27065Microsoft Exchange Server Remote Code Execution Vulnerability
    Microsoft · Exchange ServerKEVRansomwarePublic exploitHigh · 7.8T1505.003Web Shell4 reports
    99.9%Top 0.04%
    87.4priority
  8. CVE-2020-0688Microsoft Exchange Server Validation Key Remote Code Execution Vulnerability
    Microsoft · Exchange ServerKEVRansomwarePublic exploitHigh · 8.8T1190Exploit Public-Facing ApplicationT1505.003Web Shell+2 more · 3 reports
    >99.9%Top 0.03%
    86.9priority
  9. CVE-2021-26857Microsoft Exchange Server Remote Code Execution Vulnerability
    Microsoft · Exchange ServerKEVRansomwarePublic exploitHigh · 7.8T1505.003Web Shell3 reports
    95.8%Top 0.13%
    86.2priority
  10. CVE-2019-18935Progress Telerik UI for ASP.NET AJAX Deserialization of Untrusted Data Vulnerability
    Progress · Telerik UI for ASP.NET AJAXKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1505.003Web Shell+2 more · 1 report
    99.7%Top 0.05%
    83.7priority
  11. CVE-2021-40539Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability
    Zoho · ManageEngineKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1047Windows Management Instrumentation+11 more · 1 report
    99.0%Top 0.07%
    83.7priority
  12. CVE-2025-31324SAP NetWeaver Unrestricted File Upload Vulnerability
    SAP · NetWeaverKEVRansomwarePublic exploitCritical · 9.8T1059Command and Scripting InterpreterT1505.003Web Shell+2 more · 1 report
    99.5%Top 0.06%
    83.7priority
  13. CVE-2023-32315Ignite Realtime Openfire Path Traversal Vulnerability
    Ignite Realtime · OpenfireKEVPublic exploitHigh · 7.5T1505.003Web ShellT1202Indirect Command Execution+2 more · 1 report
    >99.9%Top 0.01%
    82.1priority
  14. CVE-2021-26858Microsoft Exchange Server Remote Code Execution Vulnerability
    Microsoft · Exchange ServerKEVRansomwareHigh · 7.8T1505.003Web Shell3 reports
    93.7%Top 0.16%
    81.2priority
  15. CVE-2022-22954VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability
    VMware · Workspace ONE Access and Identity ManagerKEVRansomwarePublic exploitCritical · 9.8T1505.003Web Shell
    >99.9%Top 0.01%
    79.9priority
  16. CVE-2022-41352Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability
    Synacor · Zimbra Collaboration Suite (ZCS)KEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1505.003Web Shell
    95.5%Top 0.13%
    79.8priority
  17. CVE-2017-12615Apache Tomcat on Windows Remote Code Execution Vulnerability
    Apache · TomcatKEVRansomwarePublic exploitHigh · 8.1T1190Exploit Public-Facing ApplicationT1505.003Web Shell
    99.7%Top 0.05%
    78.7priority
  18. CVE-2024-21893Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability
    Ivanti · Connect Secure, Policy Secure, and NeuronsKEVRansomwarePublic exploitHigh · 8.2T1190Exploit Public-Facing ApplicationT1078Valid Accounts+2 more
    >99.9%Top 0.01%
    78.7priority
  19. CVE-2022-41082Microsoft Exchange Server Remote Code Execution Vulnerability
    Microsoft · Exchange ServerKEVRansomwarePublic exploitHigh · 8.0T1078Valid AccountsT1059.001PowerShell+4 more
    >99.9%Top 0.02%
    78.6priority
  20. CVE-2025-42999SAP NetWeaver Deserialization Vulnerability
    SAP · NetWeaverKEVRansomwarePublic exploitCritical · 9.1T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+1 more
    12.9%Top 3.7%
    78.6priority
  21. CVE-2018-4063Sierra Wireless AirLink ALEOS Unrestricted Upload of File with Dangerous Type Vulnerability
    Sierra Wireless · AirLink ALEOSKEVPublic exploitHigh · 8.8T1190Exploit Public-Facing ApplicationT1505.003Web Shell
    27.3%Top 1.9%
    73.8priority
  22. CVE-2021-27860FatPipe WARP, IPVPN, and MPVPN Configuration Upload exploit
    FatPipe · WARP, IPVPN, and MPVPN softwareKEVPublic exploitHigh · 8.8T1505.003Web Shell1 report
    39.7%Top 1.4%
    72.8priority
  23. CVE-2017-12617Apache Tomcat Remote Code Execution Vulnerability
    Apache · TomcatKEVPublic exploitHigh · 8.1T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+1 more · 1 report
    >99.9%Top 0.02%
    72.5priority
  24. CVE-2022-22963VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability
    VMware Tanzu · Spring CloudKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059.007JavaScript+1 more
    99.9%Top 0.03%
    69.9priority
  25. CVE-2021-44077Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability
    Zoho · ManageEngine ServiceDesk Plus (SDP) / SupportCenter PlusKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1047Windows Management Instrumentation+11 more
    93.3%Top 0.16%
    69.8priority
  26. CVE-2024-11680ProjectSend Improper Authentication Vulnerability
    ProjectSend · ProjectSendKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1098Account Manipulation+1 more
    91.8%Top 0.18%
    69.8priority
  27. CVE-2023-22952Multiple SugarCRM Products Remote Code Execution Vulnerability
    SugarCRM · Multiple ProductsKEVPublic exploitHigh · 8.8T1190Exploit Public-Facing ApplicationT1078Valid Accounts+7 more
    80.1%Top 0.38%
    69.1priority
  28. CVE-2023-26360Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
    Adobe · ColdFusionKEVPublic exploitHigh · 8.6T1190Exploit Public-Facing ApplicationT1059.007JavaScript+7 more
    97.3%Top 0.1%
    69.0priority
  29. CVE-2025-4427Ivanti Endpoint Manager Mobile (EPMM) Authentication Bypass Vulnerability
    Ivanti · Endpoint Manager Mobile (EPMM)KEVPublic exploitHigh · 7.5T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+1 more
    99.9%Top 0.03%
    68.2priority
  30. CVE-2019-8394Zoho ManageEngine ServiceDesk Plus (SDP) File Upload Vulnerability
    Zoho · ManageEngineKEVPublic exploitMedium · 6.5T1190Exploit Public-Facing ApplicationT1505.003Web Shell
    63.3%Top 0.79%
    67.4priority
  31. CVE-2023-20118Cisco Small Business RV Series Routers Command Injection Vulnerability
    Cisco · Small Business RV Series RoutersKEVHigh · 7.2T1078Valid AccountsT1059Command and Scripting Interpreter+2 more
    54.1%Top 1%
    62.8priority
  32. CVE-2021-36741Trend Micro Multiple Products Improper Input Validation Vulnerability
    Trend Micro · Apex One, Apex One as a Service, and Worry-Free Business SecurityKEVHigh · 8.8T1190Exploit Public-Facing ApplicationT1505.003Web Shell
    5.0%Top 7.8%
    62.6priority
  33. CVE-2024-39717Versa Director Dangerous File Type Upload Vulnerability
    Versa · DirectorKEVHigh · 7.2T1190Exploit Public-Facing ApplicationT1505.003Web Shell
    4.0%Top 9.5%
    61.1priority
  34. CVE-2025-3928Commvault Web Server Unspecified Vulnerability
    Commvault · Web ServerKEVHigh · 8.8T1059Command and Scripting InterpreterT1505.003Web Shell
    2.5%Top 15%
    61.1priority
  35. CVE-2025-35939Craft CMS External Control of Assumed-Immutable Web Parameter Vulnerability
    Craft CMS · Craft CMSKEVMedium · 5.3T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+1 more
    1.3%Top 29%
    56.0priority
  36. CVE-2020-12029Rockwell Automation FactoryTalk View SE
    Rockwell Automation · FactoryTalk View SEPublic exploitCritical · 9.0T1133External Remote ServicesT1059Command and Scripting Interpreter+1 more
    47.0%Top 1.2%
    31.1priority
  37. CVE-2020-3240Multiple Vulnerabilities in Cisco UCS Director and Cisco UCS Director Express for Big Data
    Cisco · Cisco UCS DirectorCritical · 9.8T1133External Remote ServicesT1059Command and Scripting Interpreter+4 more
    38.7%Top 1.4%
    26.6priority
  38. CVE-2020-15189Remote Code Execution in SOY CMS
    inunosinsi · soycmsMedium · 6.8T1059Command and Scripting InterpreterT1505.003Web Shell
    2.8%Top 14%
    22.1priority
  39. CVE-2020-5297Upload whitelisted files to any directory in OctoberCMS
    octobercms · octoberPublic exploitLow · 3.4T1059Command and Scripting InterpreterT1505.003Web Shell
    1.2%Top 32%
    20.9priority
  40. CVE-2020-11010SQL injection in Tortoise ORM
    tortoise · tortoise-ormMedium · 6.3T1133External Remote ServicesT1190Exploit Public-Facing Application+5 more
    1.0%Top 36%
    17.2priority
  41. CVE-2019-18234Equinox Control Expert all versions, is vulnerable to an SQL injection attack, which may allow an attacker to remotely…
    T1133External Remote ServicesT1190Exploit Public-Facing Application+5 more
    1.9%Top 20%
    15.9priority
↑ ↓ chooseEnter openEsc close