{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: CVEs linked to T1068 Exploitation for Privilege Escalation","home_page_url":"https://patchfirst.co/technique/T1068/","feed_url":"https://patchfirst.co/feed/technique/T1068.json","description":"New and newly exploited CVEs that lead to ATT&CK T1068 Exploitation for Privilege Escalation, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2026-111357#kev","url":"https://patchfirst.co/cve/CVE-2026-111357/","title":"[KEV] CVE-2026-111357: Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability","content_text":"Ivanti · Connect Secure. In CISA KEV since 2026-10-30. ENISA EUVD lists it as exploited. EPSS 0.3% (higher than 24.6% of CVEs). CVSS 7.0 HIGH. ATT&CK: T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism. Priority 57.0 of 100.","summary":"Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability","date_published":"2026-10-30T00:00:00.000Z","date_modified":"2026-10-31T04:18:16.000Z","tags":["kev","T1068","T1548"],"_patchfirst":{"reason":"kev","priority":57,"kev":{"dateAdded":"2026-10-30","ransomware":false},"epss":{"score":0.00316,"percentile":0.24569},"cvss":{"score":7,"severity":"HIGH","version":"3.1"},"vendor":"Ivanti","product":"Connect Secure","techniqueIds":["T1068","T1548"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2026-46300#kev","url":"https://patchfirst.co/cve/CVE-2026-46300/","title":"[KEV] CVE-2026-46300: Linux Kernel Missing Initialization of a Variable Vulnerability","content_text":"Linux · Kernel. In CISA KEV since 2026-10-28. ENISA EUVD lists it as exploited. EPSS 16.1% (higher than 96.9% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation. Priority 77.5 of 100.","summary":"Linux Kernel Missing Initialization of a Variable Vulnerability","date_published":"2026-10-28T00:00:00.000Z","date_modified":"2026-10-29T17:30:34.000Z","tags":["kev","public-exploit","T1068"],"_patchfirst":{"reason":"kev","priority":77.5,"kev":{"dateAdded":"2026-10-28","ransomware":false},"epss":{"score":0.1613,"percentile":0.96923},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Linux","product":"Kernel","techniqueIds":["T1068"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-114625#kev","url":"https://patchfirst.co/cve/CVE-2026-114625/","title":"[KEV] CVE-2026-114625: Arista VeloCloud Orchestrator SQL Injection Vulnerability","content_text":"Arista · VeloCloud Orchestrator. In CISA KEV since 2026-10-23. ENISA EUVD lists it as exploited. EPSS 1.0% (higher than 63.5% of CVEs). CVSS 9.9 CRITICAL. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1068 Exploitation for Privilege Escalation; T1190 Exploit Public-Facing Application. Priority 72.5 of 100.","summary":"Arista VeloCloud Orchestrator SQL Injection Vulnerability","date_published":"2026-10-23T00:00:00.000Z","date_modified":"2026-10-26T13:10:00.000Z","tags":["kev","public-exploit","T1078","T1068","T1190"],"_patchfirst":{"reason":"kev","priority":72.5,"kev":{"dateAdded":"2026-10-23","ransomware":false},"epss":{"score":0.01025,"percentile":0.63541},"cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1"},"vendor":"Arista","product":"VeloCloud Orchestrator","techniqueIds":["T1078","T1068","T1190"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-106931#kev","url":"https://patchfirst.co/cve/CVE-2026-106931/","title":"[KEV] CVE-2026-106931: EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability","content_text":"EG Secure Solutions · SiteGuard Server Edition. In CISA KEV since 2026-10-20. ENISA EUVD lists it as exploited. EPSS 2.5% (higher than 84.9% of CVEs). CVSS 8.5 HIGH. ATT&CK: T1068 Exploitation for Privilege Escalation; T1059 Command and Scripting Interpreter. Priority 70.7 of 100.","summary":"EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability","date_published":"2026-10-20T00:00:00.000Z","date_modified":"2026-10-21T15:42:24.000Z","tags":["kev","T1068","T1059"],"_patchfirst":{"reason":"kev","priority":70.7,"kev":{"dateAdded":"2026-10-20","ransomware":false},"epss":{"score":0.02528,"percentile":0.84877},"cvss":{"score":8.5,"severity":"HIGH","version":"4.0"},"vendor":"EG Secure Solutions","product":"SiteGuard Server Edition","techniqueIds":["T1068","T1059"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2026-102490#kev","url":"https://patchfirst.co/cve/CVE-2026-102490/","title":"[KEV] CVE-2026-102490: Zammad GmbH Zammad Improper Privilege Management Vulnerability","content_text":"Zammad GmbH · Zammad. In CISA KEV since 2026-10-02. ENISA EUVD lists it as exploited. EPSS 10.9% (higher than 95.9% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1068 Exploitation for Privilege Escalation; T1059 Command and Scripting Interpreter. Priority 72.6 of 100.","summary":"Zammad GmbH Zammad Improper Privilege Management Vulnerability","date_published":"2026-10-02T00:00:00.000Z","date_modified":"2026-10-09T14:21:05.000Z","tags":["kev","T1068","T1059"],"_patchfirst":{"reason":"kev","priority":72.6,"kev":{"dateAdded":"2026-10-02","ransomware":false},"epss":{"score":0.10936,"percentile":0.95877},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Zammad GmbH","product":"Zammad","techniqueIds":["T1068","T1059"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2026-71362#kev","url":"https://patchfirst.co/cve/CVE-2026-71362/","title":"[KEV] CVE-2026-71362: Adobe Commerce and Magento Incorrect Authorization Vulnerability","content_text":"Adobe · Commerce and Magento . In CISA KEV since 2026-09-24. ENISA EUVD lists it as exploited. EPSS 90.5% (higher than 99.8% of CVEs). CVSS 9.1 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1068 Exploitation for Privilege Escalation. Priority 79.3 of 100.","summary":"Adobe Commerce and Magento Incorrect Authorization Vulnerability","date_published":"2026-09-24T00:00:00.000Z","date_modified":"2026-10-26T13:10:00.000Z","tags":["kev","public-exploit","T1190","T1068"],"_patchfirst":{"reason":"kev","priority":79.3,"kev":{"dateAdded":"2026-09-24","ransomware":false},"epss":{"score":0.90491,"percentile":0.99801},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1"},"vendor":"Adobe","product":"Commerce and Magento ","techniqueIds":["T1190","T1068"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-93952#kev","url":"https://patchfirst.co/cve/CVE-2026-93952/","title":"[KEV] CVE-2026-93952: Arista VeloCloud Orchestrator Improper Input Validation Vulnerability","content_text":"Arista · VeloCloud Orchestrator. In CISA KEV since 2026-09-22. ENISA EUVD lists it as exploited. EPSS 1.4% (higher than 72.2% of CVEs). CVSS 10.0 CRITICAL. ATT&CK: T1190 Exploit Public-Facing Application; T1068 Exploitation for Privilege Escalation. Priority 69.4 of 100.","summary":"Arista VeloCloud Orchestrator Improper Input Validation Vulnerability","date_published":"2026-09-22T00:00:00.000Z","date_modified":"2026-09-23T14:32:12.000Z","tags":["kev","T1190","T1068"],"_patchfirst":{"reason":"kev","priority":69.4,"kev":{"dateAdded":"2026-09-22","ransomware":false},"epss":{"score":0.01384,"percentile":0.72172},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"Arista","product":"VeloCloud Orchestrator","techniqueIds":["T1190","T1068"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2025-39964#kev","url":"https://patchfirst.co/cve/CVE-2025-39964/","title":"[KEV] CVE-2025-39964: Linux Kernel Race Condition Vulnerability","content_text":"Linux · Kernel. In CISA KEV since 2026-09-18. ENISA EUVD lists it as exploited. EPSS 1.6% (higher than 75.3% of CVEs). CVSS 5.5 MEDIUM. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1499.004 Application or System Exploitation. Priority 71.9 of 100.","summary":"Linux Kernel Race Condition Vulnerability","date_published":"2026-09-18T00:00:00.000Z","date_modified":"2026-10-19T21:10:00.000Z","tags":["kev","public-exploit","T1068","T1499.004"],"_patchfirst":{"reason":"kev","priority":71.9,"kev":{"dateAdded":"2026-09-18","ransomware":false},"epss":{"score":0.0157,"percentile":0.75345},"cvss":{"score":5.5,"severity":"MEDIUM","version":"3.1"},"vendor":"Linux","product":"Kernel","techniqueIds":["T1068","T1499.004"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-53266#kev","url":"https://patchfirst.co/cve/CVE-2026-53266/","title":"[KEV] CVE-2026-53266: Linux Kernel Out-of-Bounds Write Vulnerability","content_text":"Linux · Kernel. In CISA KEV since 2026-09-18. ENISA EUVD lists it as exploited. EPSS 0.9% (higher than 60.7% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation. Priority 71.3 of 100.","summary":"Linux Kernel Out-of-Bounds Write Vulnerability","date_published":"2026-09-18T00:00:00.000Z","date_modified":"2026-09-19T04:17:53.000Z","tags":["kev","public-exploit","T1068"],"_patchfirst":{"reason":"kev","priority":71.3,"kev":{"dateAdded":"2026-09-18","ransomware":false},"epss":{"score":0.00934,"percentile":0.60731},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Linux","product":"Kernel","techniqueIds":["T1068"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-87886","url":"https://patchfirst.co/cve/CVE-2026-87886/","title":"CVE-2026-87886: Acronis Backup Incorrect Default Permissions Vulnerability","content_text":"Acronis · Backup. In CISA KEV since 2026-09-16. ENISA EUVD lists it as exploited. EPSS 0.2% (higher than 14.3% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1078 Valid Accounts; T1068 Exploitation for Privilege Escalation. Priority 56.3 of 100.","summary":"Acronis Backup Incorrect Default Permissions Vulnerability","date_published":"2026-09-17T00:00:00.000Z","date_modified":"2026-09-18T19:29:35.000Z","tags":["kev","T1078","T1068"],"_patchfirst":{"reason":"published","priority":56.3,"kev":{"dateAdded":"2026-09-16","ransomware":false},"epss":{"score":0.00233,"percentile":0.14253},"cvss":{"score":7.8,"severity":"HIGH","version":"3.0"},"vendor":"Acronis","product":"Backup","techniqueIds":["T1078","T1068"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2026-58704#kev","url":"https://patchfirst.co/cve/CVE-2026-58704/","title":"[KEV] CVE-2026-58704: Google Pixel Improper Authorization Vulnerability","content_text":"Google · Pixel. In CISA KEV since 2026-09-16. ENISA EUVD lists it as exploited. EPSS 0.6% (higher than 49.9% of CVEs). CVSS 8.8 HIGH. ATT&CK: T1211 Exploitation for Stealth; T1068 Exploitation for Privilege Escalation. Priority 64.1 of 100.","summary":"Google Pixel Improper Authorization Vulnerability","date_published":"2026-09-16T00:00:00.000Z","date_modified":"2026-10-07T19:17:39.000Z","tags":["kev","T1211","T1068"],"_patchfirst":{"reason":"kev","priority":64.1,"kev":{"dateAdded":"2026-09-16","ransomware":false},"epss":{"score":0.00625,"percentile":0.49932},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Google","product":"Pixel","techniqueIds":["T1211","T1068"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2026-86060#kev","url":"https://patchfirst.co/cve/CVE-2026-86060/","title":"[KEV] CVE-2026-86060: MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability","content_text":"MikroTik · RouterOS. In CISA KEV since 2026-09-10. ENISA EUVD lists it as exploited. EPSS 6.4% (higher than 93.7% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1068 Exploitation for Privilege Escalation. Priority 78.6 of 100.","summary":"MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability","date_published":"2026-09-10T00:00:00.000Z","date_modified":"2026-09-11T12:52:16.000Z","tags":["kev","public-exploit","T1190","T1068"],"_patchfirst":{"reason":"kev","priority":78.6,"kev":{"dateAdded":"2026-09-10","ransomware":false},"epss":{"score":0.06392,"percentile":0.93659},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"MikroTik","product":"RouterOS","techniqueIds":["T1190","T1068"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-81963#kev","url":"https://patchfirst.co/cve/CVE-2026-81963/","title":"[KEV] CVE-2026-81963: Microsoft Windows Link Following Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2026-09-08. ENISA EUVD lists it as exploited. EPSS 0.4% (higher than 33.5% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1059 Command and Scripting Interpreter. Priority 65.2 of 100.","summary":"Microsoft Windows Link Following Vulnerability","date_published":"2026-09-08T00:00:00.000Z","date_modified":"2026-09-09T05:18:17.000Z","tags":["kev","public-exploit","T1068","T1059"],"_patchfirst":{"reason":"kev","priority":65.2,"kev":{"dateAdded":"2026-09-08","ransomware":false},"epss":{"score":0.00393,"percentile":0.33518},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1068","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-85880#kev","url":"https://patchfirst.co/cve/CVE-2026-85880/","title":"[KEV] CVE-2026-85880: Microsoft Windows Heap-Based Buffer Overflow Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2026-09-08. ENISA EUVD lists it as exploited. EPSS 0.4% (higher than 32.8% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1068 Exploitation for Privilege Escalation; T1055 Process Injection. Priority 60.0 of 100.","summary":"Microsoft Windows Heap-Based Buffer Overflow Vulnerability","date_published":"2026-09-08T00:00:00.000Z","date_modified":"2026-09-24T23:19:20.000Z","tags":["kev","T1068","T1055"],"_patchfirst":{"reason":"kev","priority":60,"kev":{"dateAdded":"2026-09-08","ransomware":false},"epss":{"score":0.00387,"percentile":0.3281},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1068","T1055"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2026-53362#kev","url":"https://patchfirst.co/cve/CVE-2026-53362/","title":"[KEV] CVE-2026-53362: Linux Kernel Unspecified Vulnerability","content_text":"Linux · Kernel. In CISA KEV since 2026-08-27. ENISA EUVD lists it as exploited. EPSS 0.7% (higher than 53.5% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation. Priority 69.2 of 100.","summary":"Linux Kernel Unspecified Vulnerability","date_published":"2026-08-27T00:00:00.000Z","date_modified":"2026-10-15T13:46:55.000Z","tags":["kev","public-exploit","T1068"],"_patchfirst":{"reason":"kev","priority":69.2,"kev":{"dateAdded":"2026-08-27","ransomware":false},"epss":{"score":0.00709,"percentile":0.53485},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Linux","product":"Kernel","techniqueIds":["T1068"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2022-0995#kev","url":"https://patchfirst.co/cve/CVE-2022-0995/","title":"[KEV] CVE-2022-0995: Linux Kernel Out-of-Bounds Write Vulnerability","content_text":"Linux · Kernel. In CISA KEV since 2026-08-26. ENISA EUVD lists it as exploited. EPSS 8.9% (higher than 95.2% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation. Priority 77.5 of 100.","summary":"Linux Kernel Out-of-Bounds Write Vulnerability","date_published":"2026-08-26T00:00:00.000Z","date_modified":"2026-08-27T04:16:39.000Z","tags":["kev","public-exploit","T1068"],"_patchfirst":{"reason":"kev","priority":77.5,"kev":{"dateAdded":"2026-08-26","ransomware":false},"epss":{"score":0.08859,"percentile":0.95202},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Linux","product":"Kernel","techniqueIds":["T1068"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2015-5287#kev","url":"https://patchfirst.co/cve/CVE-2015-5287/","title":"[KEV] CVE-2015-5287: Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability","content_text":"Red Hat · Automatic Bug Reporting Tool. In CISA KEV since 2026-08-26. ENISA EUVD lists it as exploited. EPSS 5.0% (higher than 92.2% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1068 Exploitation for Privilege Escalation. Priority 76.9 of 100.","summary":"Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability","date_published":"2026-08-26T00:00:00.000Z","date_modified":"2026-08-27T04:16:38.000Z","tags":["kev","public-exploit","T1078","T1068"],"_patchfirst":{"reason":"kev","priority":76.9,"kev":{"dateAdded":"2026-08-26","ransomware":false},"epss":{"score":0.05003,"percentile":0.92227},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Red Hat","product":"Automatic Bug Reporting Tool","techniqueIds":["T1078","T1068"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-68820#kev","url":"https://patchfirst.co/cve/CVE-2026-68820/","title":"[KEV] CVE-2026-68820: Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability","content_text":"Microsoft · Windows Ancillary Function Driver for WinSock . In CISA KEV since 2026-08-11. ENISA EUVD lists it as exploited. EPSS 8.6% (higher than 95.1% of CVEs). CVSS 7.0 HIGH. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation. Priority 76.9 of 100.","summary":"Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability","date_published":"2026-08-11T00:00:00.000Z","date_modified":"2026-10-26T13:10:00.000Z","tags":["kev","public-exploit","T1068"],"_patchfirst":{"reason":"kev","priority":76.9,"kev":{"dateAdded":"2026-08-11","ransomware":false},"epss":{"score":0.08567,"percentile":0.95064},"cvss":{"score":7,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Windows Ancillary Function Driver for WinSock ","techniqueIds":["T1068"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-46817#kev","url":"https://patchfirst.co/cve/CVE-2026-46817/","title":"[KEV] CVE-2026-46817: Oracle E-Business Suite Improper Privilege Management Vulnerability","content_text":"Oracle · E-Business Suite. In CISA KEV since 2026-07-15. ENISA EUVD lists it as exploited. EPSS 12.3% (higher than 96.2% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1068 Exploitation for Privilege Escalation. Priority 84.1 of 100.","summary":"Oracle E-Business Suite Improper Privilege Management Vulnerability","date_published":"2026-07-15T00:00:00.000Z","date_modified":"2026-07-21T10:10:00.000Z","tags":["kev","public-exploit","T1190","T1068"],"_patchfirst":{"reason":"kev","priority":84.1,"kev":{"dateAdded":"2026-07-15","ransomware":false},"epss":{"score":0.12313,"percentile":0.96185},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Oracle","product":"E-Business Suite","techniqueIds":["T1190","T1068"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-56164#kev","url":"https://patchfirst.co/cve/CVE-2026-56164/","title":"[KEV] CVE-2026-56164: Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability","content_text":"Microsoft · SharePoint Server. In CISA KEV since 2026-07-14. ENISA EUVD lists it as exploited. EPSS 1.0% (higher than 63.1% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1068 Exploitation for Privilege Escalation. Priority 67.5 of 100.","summary":"Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability","date_published":"2026-07-14T00:00:00.000Z","date_modified":"2026-07-14T21:10:41.000Z","tags":["kev","public-exploit","T1190","T1068"],"_patchfirst":{"reason":"kev","priority":67.5,"kev":{"dateAdded":"2026-07-14","ransomware":false},"epss":{"score":0.01011,"percentile":0.63142},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Microsoft","product":"SharePoint Server","techniqueIds":["T1190","T1068"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-56155#kev","url":"https://patchfirst.co/cve/CVE-2026-56155/","title":"[KEV] CVE-2026-56155: Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability","content_text":"Microsoft · Active Directory Federation Services. In CISA KEV since 2026-07-14. ENISA EUVD lists it as exploited. EPSS 0.3% (higher than 28.2% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1078 Valid Accounts; T1068 Exploitation for Privilege Escalation. Priority 54.1 of 100.","summary":"Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability","date_published":"2026-07-14T00:00:00.000Z","date_modified":"2026-07-15T14:18:24.000Z","tags":["kev","T1078","T1068"],"_patchfirst":{"reason":"kev","priority":54.1,"kev":{"dateAdded":"2026-07-14","ransomware":false},"epss":{"score":0.00346,"percentile":0.28208},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Active Directory Federation Services","techniqueIds":["T1078","T1068"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2026-20245#kev","url":"https://patchfirst.co/cve/CVE-2026-20245/","title":"[KEV] CVE-2026-20245: Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output Vulnerability","content_text":"Cisco · Catalyst SD-WAN Manager. In CISA KEV since 2026-06-09. ENISA EUVD lists it as exploited. EPSS 25.3% (higher than 97.9% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1059 Command and Scripting Interpreter. Priority 73.0 of 100.","summary":"Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output Vulnerability","date_published":"2026-06-09T00:00:00.000Z","date_modified":"2026-07-23T07:10:00.000Z","tags":["kev","public-exploit","T1068","T1059"],"_patchfirst":{"reason":"kev","priority":73,"kev":{"dateAdded":"2026-06-09","ransomware":false},"epss":{"score":0.25323,"percentile":0.9794},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Cisco","product":"Catalyst SD-WAN Manager","techniqueIds":["T1068","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2022-0492#kev","url":"https://patchfirst.co/cve/CVE-2022-0492/","title":"[KEV] CVE-2022-0492: Linux Kernel Improper Authentication Vulnerability","content_text":"Linux · Kernel. In CISA KEV since 2026-06-02. ENISA EUVD lists it as exploited. EPSS 5.5% (higher than 92.8% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1611 Escape to Host. Priority 72.0 of 100.","summary":"Linux Kernel Improper Authentication Vulnerability","date_published":"2026-06-02T00:00:00.000Z","date_modified":"2026-06-17T04:20:42.000Z","tags":["kev","public-exploit","T1068","T1611"],"_patchfirst":{"reason":"kev","priority":72,"kev":{"dateAdded":"2026-06-02","ransomware":false},"epss":{"score":0.05528,"percentile":0.92802},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Linux","product":"Kernel","techniqueIds":["T1068","T1611"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-48595#kev","url":"https://patchfirst.co/cve/CVE-2025-48595/","title":"[KEV] CVE-2025-48595: Android Framework Integer Overflow Vulnerability","content_text":"Android · Framework. In CISA KEV since 2026-06-02. ENISA EUVD lists it as exploited. EPSS 1.9% (higher than 80.2% of CVEs). CVSS 8.4 HIGH. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1059 Command and Scripting Interpreter. Priority 69.9 of 100.","summary":"Android Framework Integer Overflow Vulnerability","date_published":"2026-06-02T00:00:00.000Z","date_modified":"2026-07-22T08:10:00.000Z","tags":["kev","public-exploit","T1068","T1059"],"_patchfirst":{"reason":"kev","priority":69.9,"kev":{"dateAdded":"2026-06-02","ransomware":false},"epss":{"score":0.01947,"percentile":0.80167},"cvss":{"score":8.4,"severity":"HIGH","version":"3.1"},"vendor":"Android","product":"Framework","techniqueIds":["T1068","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-48172#kev","url":"https://patchfirst.co/cve/CVE-2026-48172/","title":"[KEV] CVE-2026-48172: LiteSpeed cPanel Plugin Privilege Escalation Vulnerability","content_text":"LiteSpeed · cPanel Plugin. In CISA KEV since 2026-05-26. ENISA EUVD lists it as exploited. EPSS 17.9% (higher than 97.2% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1068 Exploitation for Privilege Escalation. Priority 84.3 of 100.","summary":"LiteSpeed cPanel Plugin Privilege Escalation Vulnerability","date_published":"2026-05-26T00:00:00.000Z","date_modified":"2026-10-07T19:17:37.000Z","tags":["kev","public-exploit","T1190","T1068"],"_patchfirst":{"reason":"kev","priority":84.3,"kev":{"dateAdded":"2026-05-26","ransomware":false},"epss":{"score":0.17915,"percentile":0.97175},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"LiteSpeed","product":"cPanel Plugin","techniqueIds":["T1190","T1068"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-41091#kev","url":"https://patchfirst.co/cve/CVE-2026-41091/","title":"[KEV] CVE-2026-41091: Microsoft Defender Link Following Vulnerability","content_text":"Microsoft · Defender. In CISA KEV since 2026-05-20. ENISA EUVD lists it as exploited. EPSS 8.2% (higher than 94.9% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism. Priority 72.4 of 100.","summary":"Microsoft Defender Link Following Vulnerability","date_published":"2026-05-20T00:00:00.000Z","date_modified":"2026-07-24T10:10:00.000Z","tags":["kev","public-exploit","T1068","T1548"],"_patchfirst":{"reason":"kev","priority":72.4,"kev":{"dateAdded":"2026-05-20","ransomware":false},"epss":{"score":0.08202,"percentile":0.9487},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Defender","techniqueIds":["T1068","T1548"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-31431#kev","url":"https://patchfirst.co/cve/CVE-2026-31431/","title":"[KEV] CVE-2026-31431: Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability","content_text":"Linux · Kernel. In CISA KEV since 2026-05-01. ENISA EUVD lists it as exploited. EPSS 98.1% (higher than 99.91% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation. Priority 73.4 of 100.","summary":"Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability","date_published":"2026-05-01T00:00:00.000Z","date_modified":"2026-09-08T15:13:07.000Z","tags":["kev","public-exploit","T1068"],"_patchfirst":{"reason":"kev","priority":73.4,"kev":{"dateAdded":"2026-05-01","ransomware":false},"epss":{"score":0.98114,"percentile":0.99912},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Linux","product":"Kernel","techniqueIds":["T1068"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-57726#kev","url":"https://patchfirst.co/cve/CVE-2024-57726/","title":"[KEV] CVE-2024-57726: SimpleHelp Missing Authorization Vulnerability","content_text":"SimpleHelp  · SimpleHelp. In CISA KEV since 2026-04-24, known ransomware use. ENISA EUVD lists it as exploited. EPSS 66.4% (higher than 99.28% of CVEs). CVSS 9.9 CRITICAL. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1068 Exploitation for Privilege Escalation. Priority 79.8 of 100.","summary":"SimpleHelp Missing Authorization Vulnerability","date_published":"2026-04-24T00:00:00.000Z","date_modified":"2026-06-17T08:13:58.000Z","tags":["kev","ransomware","public-exploit","T1078","T1068"],"_patchfirst":{"reason":"kev","priority":79.8,"kev":{"dateAdded":"2026-04-24","ransomware":true},"epss":{"score":0.66414,"percentile":0.99281},"cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1"},"vendor":"SimpleHelp ","product":"SimpleHelp","techniqueIds":["T1078","T1068"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-33825#kev","url":"https://patchfirst.co/cve/CVE-2026-33825/","title":"[KEV] CVE-2026-33825: Microsoft Defender Insufficient Granularity of Access Control Vulnerability","content_text":"Microsoft · Defender. In CISA KEV since 2026-04-22, known ransomware use. ENISA EUVD lists it as exploited. EPSS 6.7% (higher than 94% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1068 Exploitation for Privilege Escalation. Priority 82.3 of 100.","summary":"Microsoft Defender Insufficient Granularity of Access Control Vulnerability","date_published":"2026-04-22T00:00:00.000Z","date_modified":"2026-07-24T22:10:00.000Z","tags":["kev","ransomware","public-exploit","T1078","T1068"],"_patchfirst":{"reason":"kev","priority":82.3,"kev":{"dateAdded":"2026-04-22","ransomware":true},"epss":{"score":0.06749,"percentile":0.93957},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Defender","techniqueIds":["T1078","T1068"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-60710#kev","url":"https://patchfirst.co/cve/CVE-2025-60710/","title":"[KEV] CVE-2025-60710: Microsoft Windows Link Following Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2026-04-13, known ransomware use. ENISA EUVD lists it as exploited. EPSS 4.6% (higher than 91.7% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1059 Command and Scripting Interpreter. Priority 81.8 of 100.","summary":"Microsoft Windows Link Following Vulnerability","date_published":"2026-04-13T00:00:00.000Z","date_modified":"2026-10-18T21:10:00.000Z","tags":["kev","ransomware","public-exploit","T1068","T1059"],"_patchfirst":{"reason":"kev","priority":81.8,"kev":{"dateAdded":"2026-04-13","ransomware":true},"epss":{"score":0.04614,"percentile":0.91675},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1068","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-36424#kev","url":"https://patchfirst.co/cve/CVE-2023-36424/","title":"[KEV] CVE-2023-36424: Microsoft Windows Out-of-Bounds Read Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2026-04-13. ENISA EUVD lists it as exploited. EPSS 12.1% (higher than 96.1% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism. Priority 72.7 of 100.","summary":"Microsoft Windows Out-of-Bounds Read Vulnerability","date_published":"2026-04-13T00:00:00.000Z","date_modified":"2026-06-17T06:06:15.000Z","tags":["kev","public-exploit","T1068","T1548"],"_patchfirst":{"reason":"kev","priority":72.7,"kev":{"dateAdded":"2026-04-13","ransomware":false},"epss":{"score":0.12087,"percentile":0.9614},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1068","T1548"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-43520#kev","url":"https://patchfirst.co/cve/CVE-2025-43520/","title":"[KEV] CVE-2025-43520: Apple Multiple Products Classic Buffer Overflow Vulnerability","content_text":"Apple · Multiple Products. In CISA KEV since 2026-03-20. ENISA EUVD lists it as exploited. EPSS 0.4% (higher than 36.8% of CVEs). CVSS 5.5 MEDIUM. Public exploit code exists. ATT&CK: T1204.002 Malicious File; T1068 Exploitation for Privilege Escalation; T1499.004 Application or System Exploitation. Priority 59.2 of 100.","summary":"Apple Multiple Products Classic Buffer Overflow Vulnerability","date_published":"2026-03-20T00:00:00.000Z","date_modified":"2026-10-07T11:10:00.000Z","tags":["kev","public-exploit","T1204.002","T1068","T1499.004"],"_patchfirst":{"reason":"kev","priority":59.2,"kev":{"dateAdded":"2026-03-20","ransomware":false},"epss":{"score":0.00425,"percentile":0.36797},"cvss":{"score":5.5,"severity":"MEDIUM","version":"3.1"},"vendor":"Apple","product":"Multiple Products","techniqueIds":["T1204.002","T1068","T1499.004"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-43510#kev","url":"https://patchfirst.co/cve/CVE-2025-43510/","title":"[KEV] CVE-2025-43510: Apple Multiple Products Improper Locking Vulnerability","content_text":"Apple · Multiple Products. In CISA KEV since 2026-03-20. ENISA EUVD lists it as exploited. EPSS 0.4% (higher than 29.3% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1204.002 Malicious File; T1068 Exploitation for Privilege Escalation. Priority 54.3 of 100.","summary":"Apple Multiple Products Improper Locking Vulnerability","date_published":"2026-03-20T00:00:00.000Z","date_modified":"2026-10-07T11:10:00.000Z","tags":["kev","T1204.002","T1068"],"_patchfirst":{"reason":"kev","priority":54.3,"kev":{"dateAdded":"2026-03-20","ransomware":false},"epss":{"score":0.00355,"percentile":0.29265},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Apple","product":"Multiple Products","techniqueIds":["T1204.002","T1068"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2023-41974#kev","url":"https://patchfirst.co/cve/CVE-2023-41974/","title":"[KEV] CVE-2023-41974: Apple iOS and iPadOS Use-After-Free Vulnerability","content_text":"Apple · iOS and iPadOS. In CISA KEV since 2026-03-05. ENISA EUVD lists it as exploited. EPSS 2.0% (higher than 80.2% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1204.002 Malicious File; T1068 Exploitation for Privilege Escalation. Priority 69.5 of 100.","summary":"Apple iOS and iPadOS Use-After-Free Vulnerability","date_published":"2026-03-05T00:00:00.000Z","date_modified":"2026-06-17T06:23:10.000Z","tags":["kev","public-exploit","T1204.002","T1068"],"_patchfirst":{"reason":"kev","priority":69.5,"kev":{"dateAdded":"2026-03-05","ransomware":false},"epss":{"score":0.01955,"percentile":0.80242},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Apple","product":"iOS and iPadOS","techniqueIds":["T1204.002","T1068"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-21385#kev","url":"https://patchfirst.co/cve/CVE-2026-21385/","title":"[KEV] CVE-2026-21385: Qualcomm Multiple Chipsets Memory Corruption Vulnerability","content_text":"Qualcomm · Multiple Chipsets. In CISA KEV since 2026-03-03. ENISA EUVD lists it as exploited. EPSS 1.3% (higher than 70.7% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1204.002 Malicious File; T1068 Exploitation for Privilege Escalation. Priority 67.6 of 100.","summary":"Qualcomm Multiple Chipsets Memory Corruption Vulnerability","date_published":"2026-03-03T00:00:00.000Z","date_modified":"2026-06-17T10:18:36.000Z","tags":["kev","public-exploit","T1204.002","T1068"],"_patchfirst":{"reason":"kev","priority":67.6,"kev":{"dateAdded":"2026-03-03","ransomware":false},"epss":{"score":0.01316,"percentile":0.70731},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Qualcomm","product":"Multiple Chipsets","techniqueIds":["T1204.002","T1068"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2022-20775#kev","url":"https://patchfirst.co/cve/CVE-2022-20775/","title":"[KEV] CVE-2022-20775: Cisco SD-WAN Path Traversal Vulnerability","content_text":"Cisco · SD-WAN. In CISA KEV since 2026-02-25. ENISA EUVD lists it as exploited. EPSS 12.5% (higher than 96.2% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1059 Command and Scripting Interpreter. Named in 1 threat report. Priority 76.6 of 100.","summary":"Cisco SD-WAN Path Traversal Vulnerability","date_published":"2026-02-25T00:00:00.000Z","date_modified":"2026-06-17T04:25:04.000Z","tags":["kev","public-exploit","T1068","T1059"],"_patchfirst":{"reason":"kev","priority":76.6,"kev":{"dateAdded":"2026-02-25","ransomware":false},"epss":{"score":0.12475,"percentile":0.96214},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Cisco","product":"SD-WAN","techniqueIds":["T1068","T1059"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-22769#kev","url":"https://patchfirst.co/cve/CVE-2026-22769/","title":"[KEV] CVE-2026-22769: Dell RecoverPoint for Virtual Machines (RP4VMs) Use of Hard-coded Credentials Vulnerability","content_text":"Dell · RecoverPoint for Virtual Machines (RP4VMs). In CISA KEV since 2026-02-18. ENISA EUVD lists it as exploited. EPSS 13.5% (higher than 96.4% of CVEs). CVSS 10.0 CRITICAL. ATT&CK: T1078 Valid Accounts; T1068 Exploitation for Privilege Escalation. Priority 69.3 of 100.","summary":"Dell RecoverPoint for Virtual Machines (RP4VMs) Use of Hard-coded Credentials Vulnerability","date_published":"2026-02-18T00:00:00.000Z","date_modified":"2026-06-17T10:20:23.000Z","tags":["kev","T1078","T1068"],"_patchfirst":{"reason":"kev","priority":69.3,"kev":{"dateAdded":"2026-02-18","ransomware":false},"epss":{"score":0.13525,"percentile":0.96448},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"Dell","product":"RecoverPoint for Virtual Machines (RP4VMs)","techniqueIds":["T1078","T1068"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2026-20700#kev","url":"https://patchfirst.co/cve/CVE-2026-20700/","title":"[KEV] CVE-2026-20700: Apple Multiple Buffer Overflow Vulnerability","content_text":"Apple · Multiple Products. In CISA KEV since 2026-02-12. ENISA EUVD lists it as exploited. EPSS 1.7% (higher than 76.9% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1059 Command and Scripting Interpreter. Priority 68.8 of 100.","summary":"Apple Multiple Buffer Overflow Vulnerability","date_published":"2026-02-12T00:00:00.000Z","date_modified":"2026-06-17T10:17:43.000Z","tags":["kev","public-exploit","T1068","T1059"],"_patchfirst":{"reason":"kev","priority":68.8,"kev":{"dateAdded":"2026-02-12","ransomware":false},"epss":{"score":0.01679,"percentile":0.7689},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Apple","product":"Multiple Products","techniqueIds":["T1068","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-21533#kev","url":"https://patchfirst.co/cve/CVE-2026-21533/","title":"[KEV] CVE-2026-21533: Microsoft Windows Improper Privilege Management Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2026-02-10. ENISA EUVD lists it as exploited. EPSS 4.2% (higher than 90.9% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1059 Command and Scripting Interpreter. Priority 71.6 of 100.","summary":"Microsoft Windows Improper Privilege Management Vulnerability","date_published":"2026-02-10T00:00:00.000Z","date_modified":"2026-06-17T10:18:47.000Z","tags":["kev","public-exploit","T1068","T1059"],"_patchfirst":{"reason":"kev","priority":71.6,"kev":{"dateAdded":"2026-02-10","ransomware":false},"epss":{"score":0.04182,"percentile":0.90912},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1068","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-21525#kev","url":"https://patchfirst.co/cve/CVE-2026-21525/","title":"[KEV] CVE-2026-21525: Microsoft Windows NULL Pointer Dereference Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2026-02-10. ENISA EUVD lists it as exploited. EPSS 4.9% (higher than 92% of CVEs). CVSS 6.2 MEDIUM. ATT&CK: T1068 Exploitation for Privilege Escalation; T1499.004 Application or System Exploitation. Priority 65.7 of 100.","summary":"Microsoft Windows NULL Pointer Dereference Vulnerability","date_published":"2026-02-10T00:00:00.000Z","date_modified":"2026-06-17T10:18:46.000Z","tags":["kev","T1068","T1499.004"],"_patchfirst":{"reason":"kev","priority":65.7,"kev":{"dateAdded":"2026-02-10","ransomware":false},"epss":{"score":0.04865,"percentile":0.92031},"cvss":{"score":6.2,"severity":"MEDIUM","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1068","T1499.004"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2026-21519#kev","url":"https://patchfirst.co/cve/CVE-2026-21519/","title":"[KEV] CVE-2026-21519: Microsoft Windows Type Confusion Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2026-02-10. ENISA EUVD lists it as exploited. EPSS 2.5% (higher than 84.5% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1068 Exploitation for Privilege Escalation. Priority 65.4 of 100.","summary":"Microsoft Windows Type Confusion Vulnerability","date_published":"2026-02-10T00:00:00.000Z","date_modified":"2026-06-17T10:18:46.000Z","tags":["kev","T1068"],"_patchfirst":{"reason":"kev","priority":65.4,"kev":{"dateAdded":"2026-02-10","ransomware":false},"epss":{"score":0.02477,"percentile":0.84538},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1068"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2018-14634#kev","url":"https://patchfirst.co/cve/CVE-2018-14634/","title":"[KEV] CVE-2018-14634: Linux Kernel Integer Overflow Vulnerability","content_text":"Linux · Kernel. In CISA KEV since 2026-01-26. ENISA EUVD lists it as exploited. EPSS 14.7% (higher than 96.7% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation. Priority 72.8 of 100.","summary":"Linux Kernel Integer Overflow Vulnerability","date_published":"2026-01-26T00:00:00.000Z","date_modified":"2026-06-17T01:41:20.000Z","tags":["kev","public-exploit","T1068"],"_patchfirst":{"reason":"kev","priority":72.8,"kev":{"dateAdded":"2026-01-26","ransomware":false},"epss":{"score":0.14689,"percentile":0.96663},"cvss":{"score":7.8,"severity":"HIGH","version":"3.0"},"vendor":"Linux","product":"Kernel","techniqueIds":["T1068"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-40602","url":"https://patchfirst.co/cve/CVE-2025-40602/","title":"CVE-2025-40602: SonicWall SMA1000 Missing Authorization Vulnerability","content_text":"SonicWall · SMA1000 appliance. In CISA KEV since 2025-12-17. ENISA EUVD lists it as exploited. EPSS 2.8% (higher than 86.2% of CVEs). CVSS 6.6 MEDIUM. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1078 Valid Accounts. Priority 79.9 of 100.","summary":"SonicWall SMA1000 Missing Authorization Vulnerability","date_published":"2025-12-18T00:00:00.000Z","date_modified":"2026-06-17T09:21:49.000Z","tags":["kev","public-exploit","T1068","T1078"],"_patchfirst":{"reason":"published","priority":79.9,"kev":{"dateAdded":"2025-12-17","ransomware":false},"epss":{"score":0.02756,"percentile":0.86228},"cvss":{"score":6.6,"severity":"MEDIUM","version":"3.1"},"vendor":"SonicWall","product":"SMA1000 appliance","techniqueIds":["T1068","T1078"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-62221#kev","url":"https://patchfirst.co/cve/CVE-2025-62221/","title":"[KEV] CVE-2025-62221: Microsoft Windows Use After Free Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2025-12-09. ENISA EUVD lists it as exploited. EPSS 2.5% (higher than 84.7% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1059 Command and Scripting Interpreter. Priority 70.4 of 100.","summary":"Microsoft Windows Use After Free Vulnerability","date_published":"2025-12-09T00:00:00.000Z","date_modified":"2026-09-25T23:10:00.000Z","tags":["kev","public-exploit","T1068","T1059"],"_patchfirst":{"reason":"kev","priority":70.4,"kev":{"dateAdded":"2025-12-09","ransomware":false},"epss":{"score":0.02505,"percentile":0.8471},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1068","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-48572","url":"https://patchfirst.co/cve/CVE-2025-48572/","title":"CVE-2025-48572: Android Framework Privilege Escalation Vulnerability","content_text":"Android · Framework. In CISA KEV since 2025-12-02. ENISA EUVD lists it as exploited. EPSS 0.3% (higher than 17.6% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism. Priority 52.0 of 100.","summary":"Android Framework Privilege Escalation Vulnerability","date_published":"2025-12-08T00:00:00.000Z","date_modified":"2026-10-07T20:10:01.000Z","tags":["kev","T1068","T1548"],"_patchfirst":{"reason":"published","priority":52,"kev":{"dateAdded":"2025-12-02","ransomware":false},"epss":{"score":0.00259,"percentile":0.17637},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Android","product":"Framework","techniqueIds":["T1068","T1548"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2025-48633","url":"https://patchfirst.co/cve/CVE-2025-48633/","title":"CVE-2025-48633: Android Framework Information Disclosure Vulnerability","content_text":"Android · Framework. In CISA KEV since 2025-12-02. ENISA EUVD lists it as exploited. EPSS 0.3% (higher than 18% of CVEs). CVSS 5.5 MEDIUM. ATT&CK: T1078 Valid Accounts; T1068 Exploitation for Privilege Escalation. Priority 50.5 of 100.","summary":"Android Framework Information Disclosure Vulnerability","date_published":"2025-12-08T00:00:00.000Z","date_modified":"2026-10-07T20:10:01.000Z","tags":["kev","T1078","T1068"],"_patchfirst":{"reason":"published","priority":50.5,"kev":{"dateAdded":"2025-12-02","ransomware":false},"epss":{"score":0.00262,"percentile":0.18043},"cvss":{"score":5.5,"severity":"MEDIUM","version":"3.1"},"vendor":"Android","product":"Framework","techniqueIds":["T1078","T1068"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2025-62215#kev","url":"https://patchfirst.co/cve/CVE-2025-62215/","title":"[KEV] CVE-2025-62215: Microsoft Windows Race Condition Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2025-11-12. ENISA EUVD lists it as exploited. EPSS 4.5% (higher than 91.4% of CVEs). CVSS 7.0 HIGH. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1068 Exploitation for Privilege Escalation. Priority 71.2 of 100.","summary":"Microsoft Windows Race Condition Vulnerability","date_published":"2025-11-12T00:00:00.000Z","date_modified":"2026-06-17T09:51:34.000Z","tags":["kev","public-exploit","T1078","T1068"],"_patchfirst":{"reason":"kev","priority":71.2,"kev":{"dateAdded":"2025-11-12","ransomware":false},"epss":{"score":0.04464,"percentile":0.9143},"cvss":{"score":7,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1078","T1068"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-41244#kev","url":"https://patchfirst.co/cve/CVE-2025-41244/","title":"[KEV] CVE-2025-41244: Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability","content_text":"Broadcom · VMware Aria Operations and VMware Tools. In CISA KEV since 2025-10-30. ENISA EUVD lists it as exploited. EPSS 8.6% (higher than 95.1% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism. Priority 67.5 of 100.","summary":"Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability","date_published":"2025-10-30T00:00:00.000Z","date_modified":"2026-10-18T21:10:00.000Z","tags":["kev","public-exploit","T1068","T1548"],"_patchfirst":{"reason":"kev","priority":67.5,"kev":{"dateAdded":"2025-10-30","ransomware":false},"epss":{"score":0.08629,"percentile":0.95094},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Broadcom","product":"VMware Aria Operations and VMware Tools","techniqueIds":["T1068","T1548"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-6205#kev","url":"https://patchfirst.co/cve/CVE-2025-6205/","title":"[KEV] CVE-2025-6205: Dassault Systèmes DELMIA Apriso Missing Authorization Vulnerability","content_text":"Dassault Systèmes · DELMIA Apriso. In CISA KEV since 2025-10-28. ENISA EUVD lists it as exploited. EPSS 73.7% (higher than 99.47% of CVEs). CVSS 9.1 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1068 Exploitation for Privilege Escalation. Priority 69.3 of 100.","summary":"Dassault Systèmes DELMIA Apriso Missing Authorization Vulnerability","date_published":"2025-10-28T00:00:00.000Z","date_modified":"2026-06-17T10:01:22.000Z","tags":["kev","public-exploit","T1190","T1068"],"_patchfirst":{"reason":"kev","priority":69.3,"kev":{"dateAdded":"2025-10-28","ransomware":false},"epss":{"score":0.73672,"percentile":0.99471},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1"},"vendor":"Dassault Systèmes","product":"DELMIA Apriso","techniqueIds":["T1190","T1068"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-33073#kev","url":"https://patchfirst.co/cve/CVE-2025-33073/","title":"[KEV] CVE-2025-33073: Microsoft Windows SMB Client Improper Access Control Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2025-10-20. ENISA EUVD lists it as exploited. EPSS 82.7% (higher than 99.67% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1078 Valid Accounts. Priority 79.1 of 100.","summary":"Microsoft Windows SMB Client Improper Access Control Vulnerability","date_published":"2025-10-20T00:00:00.000Z","date_modified":"2026-06-17T09:13:04.000Z","tags":["kev","public-exploit","T1068","T1078"],"_patchfirst":{"reason":"kev","priority":79.1,"kev":{"dateAdded":"2025-10-20","ransomware":false},"epss":{"score":0.82699,"percentile":0.99667},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1068","T1078"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}}]}