https://patchfirst.co/technique/T1021/New and newly exploited CVEs that lead to ATT&CK T1021 Remote Services, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.en-gb360Sat, 31 Oct 2026 05:11:25 GMThttps://patchfirst.co/cve/CVE-2026-65400/CVE-2026-65400#kevTue, 18 Aug 2026 00:00:00 GMTApple · macOS. In CISA KEV since 2026-08-18. ENISA EUVD lists it as exploited. EPSS 1.7% (higher than 77.5% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1133 External Remote Services; T1021 Remote Services. Priority 75.4 of 100.kevpublic-exploitT1133T1021https://patchfirst.co/cve/CVE-2025-54309/CVE-2025-54309#kevTue, 22 Jul 2025 00:00:00 GMTCrushFTP · CrushFTP. In CISA KEV since 2025-07-22. ENISA EUVD lists it as exploited. EPSS 93.5% (higher than 99.84% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1567 Exfiltration Over Web Service; T1021 Remote Services. Priority 69.8 of 100.kevpublic-exploitT1068T1567T1021https://patchfirst.co/cve/CVE-2024-55591/CVE-2024-55591#kevTue, 14 Jan 2025 00:00:00 GMTFortinet · FortiOS and FortiProxy. In CISA KEV since 2025-01-14, known ransomware use. ENISA EUVD lists it as exploited. EPSS 94.3% (higher than 99.85% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1078 Valid Accounts; T1555 Credentials from Password Stores; T1021 Remote Services. Named in 1 threat report. Priority 83.7 of 100.kevransomwarepublic-exploitT1068T1078T1555T1021https://patchfirst.co/cve/CVE-2023-28252/CVE-2023-28252#kevTue, 11 Apr 2023 00:00:00 GMTMicrosoft · Windows. In CISA KEV since 2023-04-11, known ransomware use. ENISA EUVD lists it as exploited. EPSS 48.9% (higher than 98.9% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1068 Exploitation for Privilege Escalation; T1003 OS Credential Dumping; T1021 Remote Services; T1059 Command and Scripting Interpreter; T1136 Create Account; +1 more. Priority 78.2 of 100.kevransomwarepublic-exploitT1078T1068T1003T1021T1059T1136T1486https://patchfirst.co/cve/CVE-2020-1472/CVE-2020-1472#kevWed, 03 Nov 2021 00:00:00 GMTMicrosoft · Netlogon. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.4% (higher than 99.94% of CVEs). CVSS 5.5 MEDIUM. Public exploit code exists. ATT&CK: T1110 Brute Force; T1133 External Remote Services; T1021 Remote Services; T1068 Exploitation for Privilege Escalation; T1087.002 Domain Account; T1486 Data Encrypted for Impact. Named in 8 threat reports. Priority 86.8 of 100.kevransomwarepublic-exploitT1110T1133T1021T1068T1087.002T1486