{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: CVEs linked to T1046 Network Service Discovery","home_page_url":"https://patchfirst.co/technique/T1046/","feed_url":"https://patchfirst.co/feed/technique/T1046.json","description":"New and newly exploited CVEs that lead to ATT&CK T1046 Network Service Discovery, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2021-39935#kev","url":"https://patchfirst.co/cve/CVE-2021-39935/","title":"[KEV] CVE-2021-39935: GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability","content_text":"GitLab · Community and Enterprise Editions. In CISA KEV since 2026-02-03. ENISA EUVD lists it as exploited. EPSS 36.1% (higher than 98.5% of CVEs). CVSS 7.5 HIGH. ATT&CK: T1190 Exploit Public-Facing Application; T1046 Network Service Discovery. Priority 62.9 of 100.","summary":"GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability","date_published":"2026-02-03T00:00:00.000Z","date_modified":"2026-06-17T04:04:27.000Z","tags":["kev","T1190","T1046"],"_patchfirst":{"reason":"kev","priority":62.9,"kev":{"dateAdded":"2026-02-03","ransomware":false},"epss":{"score":0.3614,"percentile":0.98473},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"GitLab","product":"Community and Enterprise Editions","techniqueIds":["T1190","T1046"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2025-32756#kev","url":"https://patchfirst.co/cve/CVE-2025-32756/","title":"[KEV] CVE-2025-32756: Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability","content_text":"Fortinet · Multiple Products. In CISA KEV since 2025-05-14. ENISA EUVD lists it as exploited. EPSS 30.9% (higher than 98.3% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1133 External Remote Services; T1059 Command and Scripting Interpreter; T1003 OS Credential Dumping; T1041 Exfiltration Over C2 Channel; T1046 Network Service Discovery; T1070.004 File Deletion; +1 more. Priority 79.5 of 100.","summary":"Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability","date_published":"2025-05-14T00:00:00.000Z","date_modified":"2026-06-17T09:12:32.000Z","tags":["kev","public-exploit","T1133","T1059","T1003","T1041","T1046","T1070.004","T1608.001"],"_patchfirst":{"reason":"kev","priority":79.5,"kev":{"dateAdded":"2025-05-14","ransomware":false},"epss":{"score":0.30944,"percentile":0.98257},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Fortinet","product":"Multiple Products","techniqueIds":["T1133","T1059","T1003","T1041","T1046","T1070.004","T1608.001"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-0282#kev","url":"https://patchfirst.co/cve/CVE-2025-0282/","title":"[KEV] CVE-2025-0282: Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability","content_text":"Ivanti · Connect Secure, Policy Secure, and ZTA Gateways. In CISA KEV since 2025-01-08, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.98% of CVEs). CVSS 9.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1595 Active Scanning; T1003 OS Credential Dumping; T1055 Process Injection; T1018 Remote System Discovery; T1046 Network Service Discovery. Named in 2 threat reports. Priority 85.4 of 100.","summary":"Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability","date_published":"2025-01-08T00:00:00.000Z","date_modified":"2026-10-01T19:17:15.000Z","tags":["kev","ransomware","public-exploit","T1190","T1595","T1003","T1055","T1018","T1046"],"_patchfirst":{"reason":"kev","priority":85.4,"kev":{"dateAdded":"2025-01-08","ransomware":true},"epss":{"score":0.99981,"percentile":0.99981},"cvss":{"score":9,"severity":"CRITICAL","version":"3.1"},"vendor":"Ivanti","product":"Connect Secure, Policy Secure, and ZTA Gateways","techniqueIds":["T1190","T1595","T1003","T1055","T1018","T1046"],"reportCount":2,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-38035#kev","url":"https://patchfirst.co/cve/CVE-2023-38035/","title":"[KEV] CVE-2023-38035: Ivanti Sentry Authentication Bypass Vulnerability","content_text":"Ivanti · Sentry. In CISA KEV since 2023-08-22, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.97% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1018 Remote System Discovery; T1046 Network Service Discovery; T1071.001 Web Protocols; T1105 Ingress Tool Transfer; +2 more. Priority 79.9 of 100.","summary":"Ivanti Sentry Authentication Bypass Vulnerability","date_published":"2023-08-22T00:00:00.000Z","date_modified":"2026-06-17T06:09:16.000Z","tags":["kev","ransomware","public-exploit","T1190","T1059","T1018","T1046","T1071.001","T1105","T1496","T1571"],"_patchfirst":{"reason":"kev","priority":79.9,"kev":{"dateAdded":"2023-08-22","ransomware":true},"epss":{"score":0.9995,"percentile":0.99974},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Ivanti","product":"Sentry","techniqueIds":["T1190","T1059","T1018","T1046","T1071.001","T1105","T1496","T1571"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-26360","url":"https://patchfirst.co/cve/CVE-2023-26360/","title":"CVE-2023-26360: Adobe ColdFusion Deserialization of Untrusted Data Vulnerability","content_text":"Adobe · ColdFusion. In CISA KEV since 2023-03-15. ENISA EUVD lists it as exploited. EPSS 97.3% (higher than 99.9% of CVEs). CVSS 8.6 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059.007 JavaScript; T1003.001 LSASS Memory; T1036.005 Match Legitimate Resource Name or Location; T1046 Network Service Discovery; T1071.001 Web Protocols; +3 more. Priority 69.0 of 100.","summary":"Adobe ColdFusion Deserialization of Untrusted Data Vulnerability","date_published":"2023-03-23T00:00:00.000Z","date_modified":"2026-06-17T05:43:10.000Z","tags":["kev","public-exploit","T1190","T1059.007","T1003.001","T1036.005","T1046","T1071.001","T1105","T1484.001","T1505.003"],"_patchfirst":{"reason":"published","priority":69,"kev":{"dateAdded":"2023-03-15","ransomware":false},"epss":{"score":0.97339,"percentile":0.99897},"cvss":{"score":8.6,"severity":"HIGH","version":"3.1"},"vendor":"Adobe","product":"ColdFusion","techniqueIds":["T1190","T1059.007","T1003.001","T1036.005","T1046","T1071.001","T1105","T1484.001","T1505.003"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-21973#kev","url":"https://patchfirst.co/cve/CVE-2021-21973/","title":"[KEV] CVE-2021-21973: VMware vCenter Server and Cloud Foundation Server Side Request Forgery (SSRF) Vulnerability","content_text":"VMware · vCenter Server and Cloud Foundation. In CISA KEV since 2022-03-07. ENISA EUVD lists it as exploited. EPSS 88.0% (higher than 99.76% of CVEs). CVSS 5.3 MEDIUM. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1046 Network Service Discovery. Priority 66.7 of 100.","summary":"VMware vCenter Server and Cloud Foundation Server Side Request Forgery (SSRF) Vulnerability","date_published":"2022-03-07T00:00:00.000Z","date_modified":"2026-06-17T03:36:28.000Z","tags":["kev","public-exploit","T1190","T1046"],"_patchfirst":{"reason":"kev","priority":66.7,"kev":{"dateAdded":"2022-03-07","ransomware":false},"epss":{"score":0.88012,"percentile":0.99764},"cvss":{"score":5.3,"severity":"MEDIUM","version":"3.1"},"vendor":"VMware","product":"vCenter Server and Cloud Foundation","techniqueIds":["T1190","T1046"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2019-13608#kev","url":"https://patchfirst.co/cve/CVE-2019-13608/","title":"[KEV] CVE-2019-13608: Citrix StoreFront Server XML External Entity (XXE) Processing Vulnerability","content_text":"Citrix · StoreFront Server. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 30.0% (higher than 98.2% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1059 Command and Scripting Interpreter; T1003 OS Credential Dumping; T1005 Data from Local System; T1046 Network Service Discovery; T1078 Valid Accounts. Priority 77.9 of 100.","summary":"Citrix StoreFront Server XML External Entity (XXE) Processing Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T02:17:04.000Z","tags":["kev","ransomware","public-exploit","T1059","T1003","T1005","T1046","T1078"],"_patchfirst":{"reason":"kev","priority":77.9,"kev":{"dateAdded":"2021-11-03","ransomware":true},"epss":{"score":0.30041,"percentile":0.98206},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"Citrix","product":"StoreFront Server","techniqueIds":["T1059","T1003","T1005","T1046","T1078"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2019-11634#kev","url":"https://patchfirst.co/cve/CVE-2019-11634/","title":"[KEV] CVE-2019-11634: Citrix Workspace Application and Receiver for Windows Remote Code Execution Vulnerability","content_text":"Citrix · Workspace Application and Receiver for Windows. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 8.1% (higher than 94.8% of CVEs). CVSS 9.8 CRITICAL. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1003 OS Credential Dumping; T1005 Data from Local System; T1046 Network Service Discovery; T1078 Valid Accounts; +1 more. Named in 1 threat report. Priority 77.7 of 100.","summary":"Citrix Workspace Application and Receiver for Windows Remote Code Execution Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-08-12T05:17:21.000Z","tags":["kev","ransomware","T1190","T1059","T1003","T1005","T1046","T1078","T1486"],"_patchfirst":{"reason":"kev","priority":77.7,"kev":{"dateAdded":"2021-11-03","ransomware":true},"epss":{"score":0.08091,"percentile":0.94808},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Citrix","product":"Workspace Application and Receiver for Windows","techniqueIds":["T1190","T1059","T1003","T1005","T1046","T1078","T1486"],"reportCount":1,"hasPublicExploit":false,"euvdExploited":true}}]}