{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: CVEs linked to T1059.004 Unix Shell","home_page_url":"https://patchfirst.co/technique/T1059.004/","feed_url":"https://patchfirst.co/feed/technique/T1059.004.json","description":"New and newly exploited CVEs that lead to ATT&CK T1059.004 Unix Shell, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2026-48907#kev","url":"https://patchfirst.co/cve/CVE-2026-48907/","title":"[KEV] CVE-2026-48907: Widget Factory Joomla Content Editor Improper Access Control Vulnerability","content_text":"Widget Factory · Joomla Content Editor . In CISA KEV since 2026-06-16. ENISA EUVD lists it as exploited. EPSS 85.4% (higher than 99.72% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059.004 Unix Shell. Priority 74.8 of 100.","summary":"Widget Factory Joomla Content Editor Improper Access Control Vulnerability","date_published":"2026-06-16T00:00:00.000Z","date_modified":"2026-07-23T07:10:00.000Z","tags":["kev","public-exploit","T1190","T1059.004"],"_patchfirst":{"reason":"kev","priority":74.8,"kev":{"dateAdded":"2026-06-16","ransomware":false},"epss":{"score":0.85439,"percentile":0.9972},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Widget Factory","product":"Joomla Content Editor ","techniqueIds":["T1190","T1059.004"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2014-6278#kev","url":"https://patchfirst.co/cve/CVE-2014-6278/","title":"[KEV] CVE-2014-6278: GNU Bash OS Command Injection Vulnerability","content_text":"GNU · GNU Bash. In CISA KEV since 2025-10-02. ENISA EUVD lists it as exploited. EPSS 99.7% (higher than 99.95% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1059.004 Unix Shell. Named in 1 threat report. Priority 73.0 of 100.","summary":"GNU Bash OS Command Injection Vulnerability","date_published":"2025-10-02T00:00:00.000Z","date_modified":"2026-06-17T00:12:50.000Z","tags":["kev","public-exploit","T1059.004"],"_patchfirst":{"reason":"kev","priority":73,"kev":{"dateAdded":"2025-10-02","ransomware":false},"epss":{"score":0.99669,"percentile":0.9995},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"GNU","product":"GNU Bash","techniqueIds":["T1059.004"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-25257#kev","url":"https://patchfirst.co/cve/CVE-2025-25257/","title":"[KEV] CVE-2025-25257: Fortinet FortiWeb SQL Injection Vulnerability","content_text":"Fortinet · FortiWeb. In CISA KEV since 2025-07-18. ENISA EUVD lists it as exploited. EPSS 99.9% (higher than 99.97% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1055 Process Injection; T1068 Exploitation for Privilege Escalation; T1190 Exploit Public-Facing Application; T1059.004 Unix Shell; T1485 Data Destruction. Priority 69.9 of 100.","summary":"Fortinet FortiWeb SQL Injection Vulnerability","date_published":"2025-07-18T00:00:00.000Z","date_modified":"2026-06-17T09:00:34.000Z","tags":["kev","public-exploit","T1055","T1068","T1190","T1059.004","T1485"],"_patchfirst":{"reason":"kev","priority":69.9,"kev":{"dateAdded":"2025-07-18","ransomware":false},"epss":{"score":0.99921,"percentile":0.99968},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Fortinet","product":"FortiWeb","techniqueIds":["T1055","T1068","T1190","T1059.004","T1485"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2016-10033#kev","url":"https://patchfirst.co/cve/CVE-2016-10033/","title":"[KEV] CVE-2016-10033: PHPMailer Command Injection Vulnerability","content_text":"PHP · PHPMailer. In CISA KEV since 2025-07-07. ENISA EUVD lists it as exploited. EPSS 99.7% (higher than 99.95% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059.004 Unix Shell. Priority 69.9 of 100.","summary":"PHPMailer Command Injection Vulnerability","date_published":"2025-07-07T00:00:00.000Z","date_modified":"2026-06-17T00:38:55.000Z","tags":["kev","public-exploit","T1190","T1059.004"],"_patchfirst":{"reason":"kev","priority":69.9,"kev":{"dateAdded":"2025-07-07","ransomware":false},"epss":{"score":0.99714,"percentile":0.99952},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"PHP","product":"PHPMailer","techniqueIds":["T1190","T1059.004"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-39780#kev","url":"https://patchfirst.co/cve/CVE-2023-39780/","title":"[KEV] CVE-2023-39780: ASUS RT-AX55 Routers OS Command Injection Vulnerability","content_text":"ASUS · RT-AX55 Routers. In CISA KEV since 2025-06-02. ENISA EUVD lists it as exploited. EPSS 39.5% (higher than 98.6% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1133 External Remote Services; T1588 Obtain Capabilities; T1059.004 Unix Shell; T1021.004 SSH. Priority 68.9 of 100.","summary":"ASUS RT-AX55 Routers OS Command Injection Vulnerability","date_published":"2025-06-02T00:00:00.000Z","date_modified":"2026-06-17T06:12:51.000Z","tags":["kev","public-exploit","T1078","T1133","T1588","T1059.004","T1021.004"],"_patchfirst":{"reason":"kev","priority":68.9,"kev":{"dateAdded":"2025-06-02","ransomware":false},"epss":{"score":0.39514,"percentile":0.98611},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"ASUS","product":"RT-AX55 Routers","techniqueIds":["T1078","T1133","T1588","T1059.004","T1021.004"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-27443#kev","url":"https://patchfirst.co/cve/CVE-2024-27443/","title":"[KEV] CVE-2024-27443: Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability","content_text":"Synacor · Zimbra Collaboration Suite (ZCS). In CISA KEV since 2025-05-19. ENISA EUVD lists it as exploited. EPSS 24.6% (higher than 97.9% of CVEs). CVSS 6.1 MEDIUM. Public exploit code exists. ATT&CK: T1566.002 Spearphishing Link; T1059.004 Unix Shell; T1114 Email Collection; T1041 Exfiltration Over C2 Channel. Priority 66.8 of 100.","summary":"Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability","date_published":"2025-05-19T00:00:00.000Z","date_modified":"2026-06-17T07:19:54.000Z","tags":["kev","public-exploit","T1566.002","T1059.004","T1114","T1041"],"_patchfirst":{"reason":"kev","priority":66.8,"kev":{"dateAdded":"2025-05-19","ransomware":false},"epss":{"score":0.24606,"percentile":0.97881},"cvss":{"score":6.1,"severity":"MEDIUM","version":"3.1"},"vendor":"Synacor","product":"Zimbra Collaboration Suite (ZCS)","techniqueIds":["T1566.002","T1059.004","T1114","T1041"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-44221#kev","url":"https://patchfirst.co/cve/CVE-2023-44221/","title":"[KEV] CVE-2023-44221: SonicWall SMA100 Appliances OS Command Injection Vulnerability","content_text":"SonicWall · SMA100 Appliances. In CISA KEV since 2025-05-01. ENISA EUVD lists it as exploited. EPSS 76.3% (higher than 99.54% of CVEs). CVSS 7.2 HIGH. ATT&CK: T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism; T1059.004 Unix Shell; T1543 Create or Modify System Process. Priority 62.9 of 100.","summary":"SonicWall SMA100 Appliances OS Command Injection Vulnerability","date_published":"2025-05-01T00:00:00.000Z","date_modified":"2026-06-17T06:27:09.000Z","tags":["kev","T1068","T1548","T1059.004","T1543"],"_patchfirst":{"reason":"kev","priority":62.9,"kev":{"dateAdded":"2025-05-01","ransomware":false},"epss":{"score":0.7625,"percentile":0.99536},"cvss":{"score":7.2,"severity":"HIGH","version":"3.1"},"vendor":"SonicWall","product":"SMA100 Appliances","techniqueIds":["T1068","T1548","T1059.004","T1543"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2024-51378#kev","url":"https://patchfirst.co/cve/CVE-2024-51378/","title":"[KEV] CVE-2024-51378: CyberPanel Incorrect Default Permissions Vulnerability","content_text":"CyberPersons · CyberPanel. In CISA KEV since 2024-12-04, known ransomware use. ENISA EUVD lists it as exploited. EPSS 94.7% (higher than 99.86% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059.004 Unix Shell. Priority 79.8 of 100.","summary":"CyberPanel Incorrect Default Permissions Vulnerability","date_published":"2024-12-04T00:00:00.000Z","date_modified":"2026-08-05T05:16:41.000Z","tags":["kev","ransomware","public-exploit","T1190","T1059.004"],"_patchfirst":{"reason":"kev","priority":79.8,"kev":{"dateAdded":"2024-12-04","ransomware":true},"epss":{"score":0.94748,"percentile":0.99858},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"CyberPersons","product":"CyberPanel","techniqueIds":["T1190","T1059.004"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-24919#kev","url":"https://patchfirst.co/cve/CVE-2024-24919/","title":"[KEV] CVE-2024-24919: Check Point Quantum Security Gateways Information Disclosure Vulnerability","content_text":"Check Point · Quantum Security Gateways. In CISA KEV since 2024-05-30, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.98% of CVEs). CVSS 8.6 HIGH. Public exploit code exists. ATT&CK: T1202 Indirect Command Execution; T1005 Data from Local System; T1003.003 NTDS; T1003.008 /etc/passwd and /etc/shadow; T1059.004 Unix Shell. Priority 79.0 of 100.","summary":"Check Point Quantum Security Gateways Information Disclosure Vulnerability","date_published":"2024-05-30T00:00:00.000Z","date_modified":"2026-08-05T05:16:41.000Z","tags":["kev","ransomware","public-exploit","T1202","T1005","T1003.003","T1003.008","T1059.004"],"_patchfirst":{"reason":"kev","priority":79,"kev":{"dateAdded":"2024-05-30","ransomware":true},"epss":{"score":0.99978,"percentile":0.9998},"cvss":{"score":8.6,"severity":"HIGH","version":"3.1"},"vendor":"Check Point","product":"Quantum Security Gateways","techniqueIds":["T1202","T1005","T1003.003","T1003.008","T1059.004"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-36380#kev","url":"https://patchfirst.co/cve/CVE-2021-36380/","title":"[KEV] CVE-2021-36380: Sunhillo SureLine OS Command Injection Vulnerablity","content_text":"Sunhillo · SureLine. In CISA KEV since 2024-03-05. ENISA EUVD lists it as exploited. EPSS 97.8% (higher than 99.91% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059.004 Unix Shell. Priority 69.8 of 100.","summary":"Sunhillo SureLine OS Command Injection Vulnerablity","date_published":"2024-03-05T00:00:00.000Z","date_modified":"2026-06-17T03:58:46.000Z","tags":["kev","public-exploit","T1190","T1059.004"],"_patchfirst":{"reason":"kev","priority":69.8,"kev":{"dateAdded":"2024-03-05","ransomware":false},"epss":{"score":0.97832,"percentile":0.99906},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Sunhillo","product":"SureLine","techniqueIds":["T1190","T1059.004"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-46604#kev","url":"https://patchfirst.co/cve/CVE-2023-46604/","title":"[KEV] CVE-2023-46604: Apache ActiveMQ Deserialization of Untrusted Data Vulnerability","content_text":"Apache · ActiveMQ. In CISA KEV since 2023-11-02, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059.004 Unix Shell; T1053.005 Scheduled Task. Priority 79.9 of 100.","summary":"Apache ActiveMQ Deserialization of Untrusted Data Vulnerability","date_published":"2023-11-02T00:00:00.000Z","date_modified":"2026-06-17T06:31:11.000Z","tags":["kev","ransomware","public-exploit","T1190","T1059.004","T1053.005"],"_patchfirst":{"reason":"kev","priority":79.9,"kev":{"dateAdded":"2023-11-02","ransomware":true},"epss":{"score":0.99992,"percentile":0.99986},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Apache","product":"ActiveMQ","techniqueIds":["T1190","T1059.004","T1053.005"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2022-33891#kev","url":"https://patchfirst.co/cve/CVE-2022-33891/","title":"[KEV] CVE-2022-33891: Apache Spark Command Injection Vulnerability","content_text":"Apache · Spark. In CISA KEV since 2023-03-07. ENISA EUVD lists it as exploited. EPSS 93.2% (higher than 99.83% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059.004 Unix Shell. Named in 1 threat report. Priority 73.0 of 100.","summary":"Apache Spark Command Injection Vulnerability","date_published":"2023-03-07T00:00:00.000Z","date_modified":"2026-06-17T04:49:25.000Z","tags":["kev","public-exploit","T1190","T1059.004"],"_patchfirst":{"reason":"kev","priority":73,"kev":{"dateAdded":"2023-03-07","ransomware":false},"epss":{"score":0.93244,"percentile":0.99835},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Apache","product":"Spark","techniqueIds":["T1190","T1059.004"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2022-44877#kev","url":"https://patchfirst.co/cve/CVE-2022-44877/","title":"[KEV] CVE-2022-44877: CWP Control Web Panel OS Command Injection Vulnerability","content_text":"CWP · Control Web Panel. In CISA KEV since 2023-01-17. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059.004 Unix Shell. Priority 69.9 of 100.","summary":"CWP Control Web Panel OS Command Injection Vulnerability","date_published":"2023-01-17T00:00:00.000Z","date_modified":"2026-06-17T05:09:01.000Z","tags":["kev","public-exploit","T1190","T1059.004"],"_patchfirst":{"reason":"kev","priority":69.9,"kev":{"dateAdded":"2023-01-17","ransomware":false},"epss":{"score":0.99995,"percentile":0.99988},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"CWP","product":"Control Web Panel","techniqueIds":["T1190","T1059.004"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2022-20699#kev","url":"https://patchfirst.co/cve/CVE-2022-20699/","title":"[KEV] CVE-2022-20699: Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability","content_text":"Cisco · Small Business RV160, RV260, RV340, and RV345 Series Routers. In CISA KEV since 2022-03-03. ENISA EUVD lists it as exploited. EPSS 72.5% (higher than 99.44% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1133 External Remote Services; T1059.004 Unix Shell. Priority 69.7 of 100.","summary":"Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability","date_published":"2022-03-03T00:00:00.000Z","date_modified":"2026-06-17T04:24:53.000Z","tags":["kev","public-exploit","T1133","T1059.004"],"_patchfirst":{"reason":"kev","priority":69.7,"kev":{"dateAdded":"2022-03-03","ransomware":false},"epss":{"score":0.72458,"percentile":0.99439},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Cisco","product":"Small Business RV160, RV260, RV340, and RV345 Series Routers","techniqueIds":["T1133","T1059.004"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2022-20700#kev","url":"https://patchfirst.co/cve/CVE-2022-20700/","title":"[KEV] CVE-2022-20700: Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability","content_text":"Cisco · Small Business RV160, RV260, RV340, and RV345 Series Routers. In CISA KEV since 2022-03-03. ENISA EUVD lists it as exploited. EPSS 5.7% (higher than 93% of CVEs). CVSS 9.8 CRITICAL. ATT&CK: T1190 Exploit Public-Facing Application; T1059.004 Unix Shell. Priority 63.5 of 100.","summary":"Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability","date_published":"2022-03-03T00:00:00.000Z","date_modified":"2026-06-17T04:24:53.000Z","tags":["kev","T1190","T1059.004"],"_patchfirst":{"reason":"kev","priority":63.5,"kev":{"dateAdded":"2022-03-03","ransomware":false},"epss":{"score":0.05655,"percentile":0.92959},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Cisco","product":"Small Business RV160, RV260, RV340, and RV345 Series Routers","techniqueIds":["T1190","T1059.004"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2014-6271#kev","url":"https://patchfirst.co/cve/CVE-2014-6271/","title":"[KEV] CVE-2014-6271: GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability","content_text":"GNU · Bourne-Again Shell (Bash). In CISA KEV since 2022-01-28. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1133 External Remote Services; T1190 Exploit Public-Facing Application; T1059.004 Unix Shell. Named in 2 threat reports. Priority 76.0 of 100.","summary":"GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability","date_published":"2022-01-28T00:00:00.000Z","date_modified":"2026-06-17T00:12:48.000Z","tags":["kev","public-exploit","T1133","T1190","T1059.004"],"_patchfirst":{"reason":"kev","priority":76,"kev":{"dateAdded":"2022-01-28","ransomware":false},"epss":{"score":0.99999,"percentile":0.99993},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"GNU","product":"Bourne-Again Shell (Bash)","techniqueIds":["T1133","T1190","T1059.004"],"reportCount":2,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2014-7169#kev","url":"https://patchfirst.co/cve/CVE-2014-7169/","title":"[KEV] CVE-2014-7169: GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability","content_text":"GNU · Bourne-Again Shell (Bash). In CISA KEV since 2022-01-28. ENISA EUVD lists it as exploited. EPSS 99.9% (higher than 99.97% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1133 External Remote Services; T1190 Exploit Public-Facing Application; T1059.004 Unix Shell. Priority 69.9 of 100.","summary":"GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability","date_published":"2022-01-28T00:00:00.000Z","date_modified":"2026-06-17T00:14:28.000Z","tags":["kev","public-exploit","T1133","T1190","T1059.004"],"_patchfirst":{"reason":"kev","priority":69.9,"kev":{"dateAdded":"2022-01-28","ransomware":false},"epss":{"score":0.9994,"percentile":0.99972},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"GNU","product":"Bourne-Again Shell (Bash)","techniqueIds":["T1133","T1190","T1059.004"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}}]}