https://patchfirst.co/technique/T1003.001/New and newly exploited CVEs that lead to ATT&CK T1003.001 LSASS Memory, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.en-gb360Sat, 31 Oct 2026 05:11:25 GMThttps://patchfirst.co/cve/CVE-2025-32706/CVE-2025-32706#kevTue, 13 May 2025 00:00:00 GMTMicrosoft · Windows. In CISA KEV since 2025-05-13. ENISA EUVD lists it as exploited. EPSS 2.3% (higher than 83.5% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1059 Command and Scripting Interpreter; T1068 Exploitation for Privilege Escalation; T1003.001 LSASS Memory; T1543 Create or Modify System Process; T1608.001 Upload Malware. Priority 65.2 of 100.kevpublic-exploitT1059T1068T1003.001T1543T1608.001https://patchfirst.co/cve/CVE-2025-32701/CVE-2025-32701#kevTue, 13 May 2025 00:00:00 GMTMicrosoft · Windows. In CISA KEV since 2025-05-13. ENISA EUVD lists it as exploited. EPSS 1.4% (higher than 72.7% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1059 Command and Scripting Interpreter; T1068 Exploitation for Privilege Escalation; T1003.001 LSASS Memory; T1543 Create or Modify System Process; T1608.001 Upload Malware. Priority 58.0 of 100.kevT1059T1068T1003.001T1543T1608.001https://patchfirst.co/cve/CVE-2024-4577/CVE-2024-4577#kevWed, 12 Jun 2024 00:00:00 GMTPHP Group · PHP. In CISA KEV since 2024-06-12, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.98% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1003 OS Credential Dumping; T1003.001 LSASS Memory; T1033 System Owner/User Discovery; T1041 Exfiltration Over C2 Channel; +6 more. Priority 79.9 of 100.kevransomwarepublic-exploitT1190T1059T1003T1003.001T1033T1041T1053T1068T1071.001T1112T1543T1570https://patchfirst.co/cve/CVE-2023-26360/CVE-2023-26360Thu, 23 Mar 2023 00:00:00 GMTAdobe · ColdFusion. In CISA KEV since 2023-03-15. ENISA EUVD lists it as exploited. EPSS 97.3% (higher than 99.9% of CVEs). CVSS 8.6 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059.007 JavaScript; T1003.001 LSASS Memory; T1036.005 Match Legitimate Resource Name or Location; T1046 Network Service Discovery; T1071.001 Web Protocols; +3 more. Priority 69.0 of 100.kevpublic-exploitT1190T1059.007T1003.001T1036.005T1046T1071.001T1105T1484.001T1505.003