{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: CVEs linked to T1036 Masquerading","home_page_url":"https://patchfirst.co/technique/T1036/","feed_url":"https://patchfirst.co/feed/technique/T1036.json","description":"New and newly exploited CVEs that lead to ATT&CK T1036 Masquerading, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2026-32202#kev","url":"https://patchfirst.co/cve/CVE-2026-32202/","title":"[KEV] CVE-2026-32202: Microsoft Windows Protection Mechanism Failure Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2026-04-28. ENISA EUVD lists it as exploited. EPSS 70.9% (higher than 99.4% of CVEs). CVSS 4.3 MEDIUM. Public exploit code exists. ATT&CK: T1204.002 Malicious File; T1036 Masquerading. Priority 70.9 of 100.","summary":"Microsoft Windows Protection Mechanism Failure Vulnerability","date_published":"2026-04-28T00:00:00.000Z","date_modified":"2026-10-26T21:10:00.000Z","tags":["kev","public-exploit","T1204.002","T1036"],"_patchfirst":{"reason":"kev","priority":70.9,"kev":{"dateAdded":"2026-04-28","ransomware":false},"epss":{"score":0.70902,"percentile":0.99399},"cvss":{"score":4.3,"severity":"MEDIUM","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1204.002","T1036"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-43573#kev","url":"https://patchfirst.co/cve/CVE-2024-43573/","title":"[KEV] CVE-2024-43573: Microsoft Windows MSHTML Platform Spoofing Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2024-10-08. ENISA EUVD lists it as exploited. EPSS 46.1% (higher than 98.8% of CVEs). CVSS 8.1 HIGH. ATT&CK: T1204.002 Malicious File; T1036 Masquerading. Priority 63.4 of 100.","summary":"Microsoft Windows MSHTML Platform Spoofing Vulnerability","date_published":"2024-10-08T00:00:00.000Z","date_modified":"2026-06-17T07:51:19.000Z","tags":["kev","T1204.002","T1036"],"_patchfirst":{"reason":"kev","priority":63.4,"kev":{"dateAdded":"2024-10-08","ransomware":false},"epss":{"score":0.46109,"percentile":0.98809},"cvss":{"score":8.1,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1204.002","T1036"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2022-26501#kev","url":"https://patchfirst.co/cve/CVE-2022-26501/","title":"[KEV] CVE-2022-26501: Veeam Backup & Replication Remote Code Execution Vulnerability","content_text":"Veeam · Backup & Replication. In CISA KEV since 2022-12-13, known ransomware use. ENISA EUVD lists it as exploited. EPSS 4.1% (higher than 90.7% of CVEs). CVSS 9.8 CRITICAL. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1036 Masquerading; T1048 Exfiltration Over Alternative Protocol. Priority 73.0 of 100.","summary":"Veeam Backup & Replication Remote Code Execution Vulnerability","date_published":"2022-12-13T00:00:00.000Z","date_modified":"2026-06-17T04:35:18.000Z","tags":["kev","ransomware","T1190","T1059","T1036","T1048"],"_patchfirst":{"reason":"kev","priority":73,"kev":{"dateAdded":"2022-12-13","ransomware":true},"epss":{"score":0.04104,"percentile":0.90746},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Veeam","product":"Backup & Replication","techniqueIds":["T1190","T1059","T1036","T1048"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2022-26500#kev","url":"https://patchfirst.co/cve/CVE-2022-26500/","title":"[KEV] CVE-2022-26500: Veeam Backup & Replication Remote Code Execution Vulnerability","content_text":"Veeam · Backup & Replication. In CISA KEV since 2022-12-13, known ransomware use. ENISA EUVD lists it as exploited. EPSS 5.8% (higher than 93.1% of CVEs). CVSS 8.8 HIGH. ATT&CK: T1078 Valid Accounts; T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1036 Masquerading; T1048 Exfiltration Over Alternative Protocol. Priority 72.8 of 100.","summary":"Veeam Backup & Replication Remote Code Execution Vulnerability","date_published":"2022-12-13T00:00:00.000Z","date_modified":"2026-06-17T04:35:18.000Z","tags":["kev","ransomware","T1078","T1190","T1059","T1036","T1048"],"_patchfirst":{"reason":"kev","priority":72.8,"kev":{"dateAdded":"2022-12-13","ransomware":true},"epss":{"score":0.05828,"percentile":0.93146},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Veeam","product":"Backup & Replication","techniqueIds":["T1078","T1190","T1059","T1036","T1048"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2020-3153#kev","url":"https://patchfirst.co/cve/CVE-2020-3153/","title":"[KEV] CVE-2020-3153: Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability","content_text":"Cisco · AnyConnect Secure. In CISA KEV since 2022-10-24, known ransomware use. ENISA EUVD lists it as exploited. EPSS 28.5% (higher than 98.1% of CVEs). CVSS 6.5 MEDIUM. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1036 Masquerading; T1574.001 DLL. Priority 77.2 of 100.","summary":"Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability","date_published":"2022-10-24T00:00:00.000Z","date_modified":"2026-08-12T05:17:29.000Z","tags":["kev","ransomware","public-exploit","T1078","T1036","T1574.001"],"_patchfirst":{"reason":"kev","priority":77.2,"kev":{"dateAdded":"2022-10-24","ransomware":true},"epss":{"score":0.28515,"percentile":0.98127},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.1"},"vendor":"Cisco","product":"AnyConnect Secure","techniqueIds":["T1078","T1036","T1574.001"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2018-20250#kev","url":"https://patchfirst.co/cve/CVE-2018-20250/","title":"[KEV] CVE-2018-20250: WinRAR Absolute Path Traversal Vulnerability","content_text":"RARLAB · WinRAR. In CISA KEV since 2022-02-15, known ransomware use. ENISA EUVD lists it as exploited. EPSS 96.0% (higher than 99.88% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1036 Masquerading; T1204.002 Malicious File. Named in 3 threat reports. Priority 86.2 of 100.","summary":"WinRAR Absolute Path Traversal Vulnerability","date_published":"2022-02-15T00:00:00.000Z","date_modified":"2026-08-13T05:17:17.000Z","tags":["kev","ransomware","public-exploit","T1036","T1204.002"],"_patchfirst":{"reason":"kev","priority":86.2,"kev":{"dateAdded":"2022-02-15","ransomware":true},"epss":{"score":0.96004,"percentile":0.99876},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"RARLAB","product":"WinRAR","techniqueIds":["T1036","T1204.002"],"reportCount":3,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2020-0601#kev","url":"https://patchfirst.co/cve/CVE-2020-0601/","title":"[KEV] CVE-2020-0601: Microsoft Windows CryptoAPI Spoofing Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 89.1% (higher than 99.78% of CVEs). CVSS 8.1 HIGH. Public exploit code exists. ATT&CK: T1553.002 Code Signing; T1036 Masquerading. Priority 78.6 of 100.","summary":"Microsoft Windows CryptoAPI Spoofing Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T02:46:08.000Z","tags":["kev","public-exploit","T1553.002","T1036"],"_patchfirst":{"reason":"kev","priority":78.6,"kev":{"dateAdded":"2021-11-03","ransomware":false},"epss":{"score":0.89078,"percentile":0.99779},"cvss":{"score":8.1,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1553.002","T1036"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2020-15233","url":"https://patchfirst.co/cve/CVE-2020-15233/","title":"CVE-2020-15233: OAuth2 Redirect URL validity does not respect query parameters and character casing for loopback addresses","content_text":"ory · fosite. Not in CISA KEV. EPSS 0.8% (higher than 56.5% of CVEs). CVSS 6.1 MEDIUM. ATT&CK: T1566.002 Spearphishing Link; T1036 Masquerading. Priority 15.6 of 100.","summary":"OAuth2 Redirect URL validity does not respect query parameters and character casing for loopback addresses","date_published":"2020-10-02T00:00:00.000Z","date_modified":"2024-08-04T13:08:22.000Z","tags":["T1566.002","T1036"],"_patchfirst":{"reason":"published","priority":15.6,"kev":null,"epss":{"score":0.008,"percentile":0.56531},"cvss":{"score":6.1,"severity":"MEDIUM","version":"3.1"},"vendor":"ory","product":"fosite","techniqueIds":["T1566.002","T1036"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2020-16198","url":"https://patchfirst.co/cve/CVE-2020-16198/","title":"CVE-2020-16198: Philips Clinical Collaboration Platform Protection Mechanism Failure","content_text":"Philips · Clinical Collaboration Platform. Not in CISA KEV. EPSS 0.6% (higher than 46.9% of CVEs). CVSS 5.0 MEDIUM. ATT&CK: T1036 Masquerading. Priority 12.9 of 100.","summary":"Philips Clinical Collaboration Platform Protection Mechanism Failure","date_published":"2020-09-18T00:00:00.000Z","date_modified":"2025-06-04T21:17:52.000Z","tags":["T1036"],"_patchfirst":{"reason":"published","priority":12.9,"kev":null,"epss":{"score":0.00564,"percentile":0.46883},"cvss":{"score":5,"severity":"MEDIUM","version":"3.1"},"vendor":"Philips","product":"Clinical Collaboration Platform","techniqueIds":["T1036"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2020-1456","url":"https://patchfirst.co/cve/CVE-2020-1456/","title":"CVE-2020-1456: A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a…","content_text":"Microsoft · Microsoft SharePoint Enterprise Server. Not in CISA KEV. EPSS 2.2% (higher than 82.7% of CVEs). CVSS 5.4 MEDIUM. ATT&CK: T1059 Command and Scripting Interpreter; T1005 Data from Local System; T1036 Masquerading; T1485 Data Destruction; T1565 Data Manipulation. Priority 21.0 of 100.","summary":"A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a…","date_published":"2020-07-14T00:00:00.000Z","date_modified":"2025-02-28T20:32:04.000Z","tags":["T1059","T1005","T1036","T1485","T1565"],"_patchfirst":{"reason":"published","priority":21,"kev":null,"epss":{"score":0.02229,"percentile":0.82723},"cvss":{"score":5.4,"severity":"MEDIUM","version":"3.1"},"vendor":"Microsoft","product":"Microsoft SharePoint Enterprise Server","techniqueIds":["T1059","T1005","T1036","T1485","T1565"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2020-5270","url":"https://patchfirst.co/cve/CVE-2020-5270/","title":"CVE-2020-5270: Open redirection when using back parameter of PrestaShop","content_text":"PrestaShop · PrestaShop. Not in CISA KEV. EPSS 0.8% (higher than 57.6% of CVEs). CVSS 4.1 MEDIUM. ATT&CK: T1566.002 Spearphishing Link; T1005 Data from Local System; T1036 Masquerading; T1059.007 JavaScript; T1557 Adversary-in-the-Middle. Priority 14.4 of 100.","summary":"Open redirection when using back parameter of PrestaShop","date_published":"2020-04-20T00:00:00.000Z","date_modified":"2024-08-04T08:22:09.000Z","tags":["T1566.002","T1005","T1036","T1059.007","T1557"],"_patchfirst":{"reason":"published","priority":14.4,"kev":null,"epss":{"score":0.00832,"percentile":0.57598},"cvss":{"score":4.1,"severity":"MEDIUM","version":"3.1"},"vendor":"PrestaShop","product":"PrestaShop","techniqueIds":["T1566.002","T1005","T1036","T1059.007","T1557"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2020-5250","url":"https://patchfirst.co/cve/CVE-2020-5250/","title":"CVE-2020-5250: Possible information disclosure in PrestaShop","content_text":"PrestaShop · PrestaShop. Not in CISA KEV. EPSS 0.9% (higher than 58.2% of CVEs). CVSS 7.6 HIGH. Public exploit code exists. ATT&CK: T1036 Masquerading. Priority 22.0 of 100.","summary":"Possible information disclosure in PrestaShop","date_published":"2020-03-05T00:00:00.000Z","date_modified":"2024-08-04T08:22:09.000Z","tags":["public-exploit","T1036"],"_patchfirst":{"reason":"published","priority":22,"kev":null,"epss":{"score":0.00851,"percentile":0.58171},"cvss":{"score":7.6,"severity":"HIGH","version":"3.1"},"vendor":"PrestaShop","product":"PrestaShop","techniqueIds":["T1036"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2019-1031","url":"https://patchfirst.co/cve/CVE-2019-1031/","title":"CVE-2019-1031: Microsoft Office SharePoint XSS Vulnerability","content_text":"Microsoft · Microsoft SharePoint Enterprise Server 2016. Not in CISA KEV. EPSS 1.7% (higher than 76.7% of CVEs). ATT&CK: T1059 Command and Scripting Interpreter; T1005 Data from Local System; T1036 Masquerading; T1485 Data Destruction; T1565 Data Manipulation. Priority 15.3 of 100.","summary":"Microsoft Office SharePoint XSS Vulnerability","date_published":"2019-06-12T00:00:00.000Z","date_modified":"2025-05-20T17:50:11.000Z","tags":["T1059","T1005","T1036","T1485","T1565"],"_patchfirst":{"reason":"published","priority":15.3,"kev":null,"epss":{"score":0.01662,"percentile":0.76671},"cvss":null,"vendor":"Microsoft","product":"Microsoft SharePoint Enterprise Server 2016","techniqueIds":["T1059","T1005","T1036","T1485","T1565"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2019-3788","url":"https://patchfirst.co/cve/CVE-2019-3788/","title":"CVE-2019-3788: UAA redirect-uri allows wildcard in the subdomain","content_text":"Cloud Foundry · UAA Release (OSS). Not in CISA KEV. EPSS 0.8% (higher than 57.6% of CVEs). CVSS 8.7 HIGH. ATT&CK: T1566.002 Spearphishing Link; T1036 Masquerading. Priority 17.6 of 100.","summary":"UAA redirect-uri allows wildcard in the subdomain","date_published":"2019-04-25T00:00:00.000Z","date_modified":"2024-09-16T22:02:12.000Z","tags":["T1566.002","T1036"],"_patchfirst":{"reason":"published","priority":17.6,"kev":null,"epss":{"score":0.00832,"percentile":0.57572},"cvss":{"score":8.7,"severity":"HIGH","version":"3.0"},"vendor":"Cloud Foundry","product":"UAA Release (OSS)","techniqueIds":["T1566.002","T1036"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2019-1831","url":"https://patchfirst.co/cve/CVE-2019-1831/","title":"CVE-2019-1831: Cisco Email Security Appliance Content Filter Bypass Vulnerability","content_text":"Cisco · Cisco Email Security Appliance (ESA). Not in CISA KEV. EPSS 1.6% (higher than 76.4% of CVEs). CVSS 5.8 MEDIUM. ATT&CK: T1036 Masquerading; T1566 Phishing. Priority 19.3 of 100.","summary":"Cisco Email Security Appliance Content Filter Bypass Vulnerability","date_published":"2019-04-18T00:00:00.000Z","date_modified":"2024-11-19T19:10:48.000Z","tags":["T1036","T1566"],"_patchfirst":{"reason":"published","priority":19.3,"kev":null,"epss":{"score":0.01647,"percentile":0.76439},"cvss":{"score":5.8,"severity":"MEDIUM","version":"3.0"},"vendor":"Cisco","product":"Cisco Email Security Appliance (ESA)","techniqueIds":["T1036","T1566"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2019-3778","url":"https://patchfirst.co/cve/CVE-2019-3778/","title":"CVE-2019-3778: Open Redirect in spring-security-oauth2","content_text":"Spring · Spring Security OAuth. Not in CISA KEV. EPSS 16.6% (higher than 97% of CVEs). Public exploit code exists. ATT&CK: T1566.002 Spearphishing Link; T1036 Masquerading. Priority 25.5 of 100.","summary":"Open Redirect in spring-security-oauth2","date_published":"2019-03-07T00:00:00.000Z","date_modified":"2024-09-16T20:57:23.000Z","tags":["public-exploit","T1566.002","T1036"],"_patchfirst":{"reason":"published","priority":25.5,"kev":null,"epss":{"score":0.16596,"percentile":0.97009},"cvss":null,"vendor":"Spring","product":"Spring Security OAuth","techniqueIds":["T1566.002","T1036"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2018-17934","url":"https://patchfirst.co/cve/CVE-2018-17934/","title":"CVE-2018-17934: NUUO CMS All versions 3.3 and prior the application allows external input to construct a pathname that is able to be…","content_text":"Not in CISA KEV. EPSS 19.7% (higher than 97.4% of CVEs). Public exploit code exists. ATT&CK: T1202 Indirect Command Execution; T1005 Data from Local System; T1036 Masquerading; T1203 Exploitation for Client Execution. Priority 24.5 of 100.","summary":"NUUO CMS All versions 3.3 and prior the application allows external input to construct a pathname that is able to be…","date_published":"2018-11-27T00:00:00.000Z","date_modified":"2024-08-05T11:01:14.000Z","tags":["public-exploit","T1202","T1005","T1036","T1203"],"_patchfirst":{"reason":"published","priority":24.5,"kev":null,"epss":{"score":0.19653,"percentile":0.97389},"cvss":null,"vendor":null,"product":null,"techniqueIds":["T1202","T1005","T1036","T1203"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2018-11067","url":"https://patchfirst.co/cve/CVE-2018-11067/","title":"CVE-2018-11067: Dell EMC Avamar and Integrated Data Protection Appliance Open Redirection Vulnerability","content_text":"Dell EMC · Avamar. Not in CISA KEV. EPSS 1.8% (higher than 78.6% of CVEs). ATT&CK: T1566.002 Spearphishing Link; T1036 Masquerading. Priority 15.7 of 100.","summary":"Dell EMC Avamar and Integrated Data Protection Appliance Open Redirection Vulnerability","date_published":"2018-11-26T00:00:00.000Z","date_modified":"2024-09-17T00:11:44.000Z","tags":["T1566.002","T1036"],"_patchfirst":{"reason":"published","priority":15.7,"kev":null,"epss":{"score":0.01811,"percentile":0.78597},"cvss":null,"vendor":"Dell EMC","product":"Avamar","techniqueIds":["T1566.002","T1036"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2018-8607","url":"https://patchfirst.co/cve/CVE-2018-8607/","title":"CVE-2018-8607: A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) version 8 does not properly…","content_text":"Microsoft · Microsoft Dynamics 365. Not in CISA KEV. EPSS 1.6% (higher than 75.8% of CVEs). ATT&CK: T1059 Command and Scripting Interpreter; T1005 Data from Local System; T1036 Masquerading; T1485 Data Destruction; T1565 Data Manipulation. Priority 15.2 of 100.","summary":"A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) version 8 does not properly…","date_published":"2018-11-14T00:00:00.000Z","date_modified":"2024-08-05T07:02:25.000Z","tags":["T1059","T1005","T1036","T1485","T1565"],"_patchfirst":{"reason":"published","priority":15.2,"kev":null,"epss":{"score":0.01605,"percentile":0.75832},"cvss":null,"vendor":"Microsoft","product":"Microsoft Dynamics 365","techniqueIds":["T1059","T1005","T1036","T1485","T1565"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2018-5451","url":"https://patchfirst.co/cve/CVE-2018-5451/","title":"CVE-2018-5451: In Philips Alice 6 System version R8.0.2 or prior, when an actor claims to have a given identity, the software does…","content_text":"Philips · Philips Alice 6 System. Not in CISA KEV. EPSS 2.6% (higher than 85.6% of CVEs). ATT&CK: T1036 Masquerading. Priority 17.1 of 100.","summary":"In Philips Alice 6 System version R8.0.2 or prior, when an actor claims to have a given identity, the software does…","date_published":"2018-03-28T00:00:00.000Z","date_modified":"2024-09-17T04:00:25.000Z","tags":["T1036"],"_patchfirst":{"reason":"published","priority":17.1,"kev":null,"epss":{"score":0.02646,"percentile":0.85588},"cvss":null,"vendor":"Philips","product":"Philips Alice 6 System","techniqueIds":["T1036"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}}]}