https://patchfirst.co/technique/T1041/New and newly exploited CVEs that lead to ATT&CK T1041 Exfiltration Over C2 Channel, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.en-gb360Sat, 31 Oct 2026 05:11:25 GMThttps://patchfirst.co/cve/CVE-2025-33053/CVE-2025-33053#kevTue, 10 Jun 2025 00:00:00 GMTMicrosoft · Windows. In CISA KEV since 2025-06-10. ENISA EUVD lists it as exploited. EPSS 87.0% (higher than 99.75% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1566.001 Spearphishing Attachment; T1059 Command and Scripting Interpreter; T1041 Exfiltration Over C2 Channel; T1056.001 Keylogging; T1543 Create or Modify System Process. Priority 69.1 of 100.kevpublic-exploitT1566.001T1059T1041T1056.001T1543https://patchfirst.co/cve/CVE-2024-27443/CVE-2024-27443#kevMon, 19 May 2025 00:00:00 GMTSynacor · Zimbra Collaboration Suite (ZCS). In CISA KEV since 2025-05-19. ENISA EUVD lists it as exploited. EPSS 24.6% (higher than 97.9% of CVEs). CVSS 6.1 MEDIUM. Public exploit code exists. ATT&CK: T1566.002 Spearphishing Link; T1059.004 Unix Shell; T1114 Email Collection; T1041 Exfiltration Over C2 Channel. Priority 66.8 of 100.kevpublic-exploitT1566.002T1059.004T1114T1041https://patchfirst.co/cve/CVE-2025-32756/CVE-2025-32756#kevWed, 14 May 2025 00:00:00 GMTFortinet · Multiple Products. In CISA KEV since 2025-05-14. ENISA EUVD lists it as exploited. EPSS 30.9% (higher than 98.3% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1133 External Remote Services; T1059 Command and Scripting Interpreter; T1003 OS Credential Dumping; T1041 Exfiltration Over C2 Channel; T1046 Network Service Discovery; T1070.004 File Deletion; +1 more. Priority 79.5 of 100.kevpublic-exploitT1133T1059T1003T1041T1046T1070.004T1608.001https://patchfirst.co/cve/CVE-2024-55550/CVE-2024-55550#kevTue, 07 Jan 2025 00:00:00 GMTMitel · MiCollab. In CISA KEV since 2025-01-07, known ransomware use. ENISA EUVD lists it as exploited. EPSS 38.2% (higher than 98.6% of CVEs). CVSS 2.7 LOW. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System; T1041 Exfiltration Over C2 Channel. Priority 74.6 of 100.kevransomwarepublic-exploitT1190T1005T1041https://patchfirst.co/cve/CVE-2024-4577/CVE-2024-4577#kevWed, 12 Jun 2024 00:00:00 GMTPHP Group · PHP. In CISA KEV since 2024-06-12, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.98% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1003 OS Credential Dumping; T1003.001 LSASS Memory; T1033 System Owner/User Discovery; T1041 Exfiltration Over C2 Channel; +6 more. Priority 79.9 of 100.kevransomwarepublic-exploitT1190T1059T1003T1003.001T1033T1041T1053T1068T1071.001T1112T1543T1570https://patchfirst.co/cve/CVE-2023-5631/CVE-2023-5631#kevThu, 26 Oct 2023 00:00:00 GMTRoundcube · Webmail. In CISA KEV since 2023-10-26. ENISA EUVD lists it as exploited. EPSS 76.3% (higher than 99.54% of CVEs). CVSS 5.4 MEDIUM. Public exploit code exists. ATT&CK: T1204.001 Malicious Link; T1059.007 JavaScript; T1041 Exfiltration Over C2 Channel. Priority 66.7 of 100.kevpublic-exploitT1204.001T1059.007T1041https://patchfirst.co/cve/CVE-2023-38831/CVE-2023-38831#kevThu, 24 Aug 2023 00:00:00 GMTRARLAB · WinRAR. In CISA KEV since 2023-08-24, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.8% (higher than 99.96% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1204 User Execution; T1005 Data from Local System; T1041 Exfiltration Over C2 Channel; T1053 Scheduled Task/Job; T1105 Ingress Tool Transfer; T1112 Modify Registry; +1 more. Named in 1 threat report. Priority 82.3 of 100.kevransomwarepublic-exploitT1204T1005T1041T1053T1105T1112T1486https://patchfirst.co/cve/CVE-2023-2868/CVE-2023-2868#kevFri, 26 May 2023 00:00:00 GMTBarracuda Networks · Email Security Gateway (ESG) Appliance. In CISA KEV since 2023-05-26. ENISA EUVD lists it as exploited. EPSS 86.8% (higher than 99.74% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1566.001 Spearphishing Attachment; T1059 Command and Scripting Interpreter; T1041 Exfiltration Over C2 Channel; T1105 Ingress Tool Transfer. Priority 69.8 of 100.kevpublic-exploitT1566.001T1059T1041T1105https://patchfirst.co/cve/CVE-2023-1389/CVE-2023-1389#kevMon, 01 May 2023 00:00:00 GMTTP-Link · Archer AX21. In CISA KEV since 2023-05-01. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1106 Native API; T1496 Resource Hijacking; T1041 Exfiltration Over C2 Channel; T1070 Indicator Removal; T1498 Network Denial of Service. Priority 69.2 of 100.kevpublic-exploitT1106T1496T1041T1070T1498https://patchfirst.co/cve/CVE-2019-0604/CVE-2019-0604#kevWed, 03 Nov 2021 00:00:00 GMTMicrosoft · SharePoint. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.9% (higher than 99.97% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1041 Exfiltration Over C2 Channel; T1505.003 Web Shell; T1608.001 Upload Malware; T1003 OS Credential Dumping. Named in 4 threat reports. Priority 88.8 of 100.kevransomwarepublic-exploitT1190T1041T1505.003T1608.001T1003https://patchfirst.co/cve/CVE-2019-18935/CVE-2019-18935#kevWed, 03 Nov 2021 00:00:00 GMTProgress · Telerik UI for ASP.NET AJAX. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.7% (higher than 99.95% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1041 Exfiltration Over C2 Channel; T1496 Resource Hijacking; T1505.003 Web Shell. Named in 1 threat report. Priority 83.7 of 100.kevransomwarepublic-exploitT1190T1041T1496T1505.003https://patchfirst.co/cve/CVE-2018-4878/CVE-2018-4878#kevWed, 03 Nov 2021 00:00:00 GMTAdobe · Flash Player. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 90.3% (higher than 99.8% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1204.002 Malicious File; T1219 Remote Access Tools; T1041 Exfiltration Over C2 Channel. Named in 1 threat report. Priority 67.3 of 100.kevransomwarepublic-exploitT1204.002T1219T1041