https://patchfirst.co/technique/T1078/New and newly exploited CVEs that lead to ATT&CK T1078 Valid Accounts, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.en-gb360Sat, 31 Oct 2026 05:11:25 GMThttps://patchfirst.co/cve/CVE-2026-41709/CVE-2026-41709#kevWed, 28 Oct 2026 00:00:00 GMTBroadcom · VMware ESX. In CISA KEV since 2026-10-28. ENISA EUVD lists it as exploited. EPSS 0.7% (higher than 52.7% of CVEs). CVSS 2.7 LOW. ATT&CK: T1078 Valid Accounts. Priority 59.8 of 100.kevT1078https://patchfirst.co/cve/CVE-2026-114625/CVE-2026-114625#kevFri, 23 Oct 2026 00:00:00 GMTArista · VeloCloud Orchestrator. In CISA KEV since 2026-10-23. ENISA EUVD lists it as exploited. EPSS 1.0% (higher than 63.5% of CVEs). CVSS 9.9 CRITICAL. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1068 Exploitation for Privilege Escalation; T1190 Exploit Public-Facing Application. Priority 72.5 of 100.kevpublic-exploitT1078T1068T1190https://patchfirst.co/cve/CVE-2026-96656/CVE-2026-96656#kevTue, 20 Oct 2026 00:00:00 GMTPlex · Media Server. In CISA KEV since 2026-10-20. ENISA EUVD lists it as exploited. EPSS 1.8% (higher than 78.3% of CVEs). CVSS 7.2 HIGH. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1059 Command and Scripting Interpreter. Priority 73.1 of 100.kevpublic-exploitT1078T1059https://patchfirst.co/cve/CVE-2026-110936/CVE-2026-110936#kevTue, 20 Oct 2026 00:00:00 GMTSiemens · Software Center. In CISA KEV since 2026-10-20. ENISA EUVD lists it as exploited. EPSS 1.0% (higher than 61.7% of CVEs). CVSS 6.7 MEDIUM. ATT&CK: T1078 Valid Accounts; T1059 Command and Scripting Interpreter; T1574.008 Path Interception by Search Order Hijacking. Priority 65.0 of 100.kevT1078T1059T1574.008https://patchfirst.co/cve/CVE-2026-105133/CVE-2026-105133#kevWed, 14 Oct 2026 00:00:00 GMTAhsay · AhsayCBS. In CISA KEV since 2026-10-14. ENISA EUVD lists it as exploited. EPSS 79.5% (higher than 99.6% of CVEs). CVSS 7.3 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts. Priority 78.0 of 100.kevpublic-exploitT1190T1078https://patchfirst.co/cve/CVE-2026-0322/CVE-2026-0322#kevWed, 14 Oct 2026 00:00:00 GMTPalo Alto Networks · PAN-OS. In CISA KEV since 2026-10-14. ENISA EUVD lists it as exploited. EPSS 1.7% (higher than 77.7% of CVEs). CVSS 7.2 HIGH. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1059 Command and Scripting Interpreter. Priority 73.6 of 100.kevpublic-exploitT1078T1059https://patchfirst.co/cve/CVE-2023-22894/CVE-2023-22894#kevThu, 08 Oct 2026 00:00:00 GMTStrapi · Strapi. In CISA KEV since 2026-10-08. ENISA EUVD lists it as exploited. EPSS 4.1% (higher than 90.8% of CVEs). CVSS 4.9 MEDIUM. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1212 Exploitation for Credential Access. Priority 74.6 of 100.kevpublic-exploitT1078T1212https://patchfirst.co/cve/CVE-2026-76504/CVE-2026-76504#kevWed, 30 Sep 2026 00:00:00 GMTCisco · Catalyst SD-WAN Manager. In CISA KEV since 2026-09-30. ENISA EUVD lists it as exploited. EPSS 38.9% (higher than 98.6% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts. Priority 79.6 of 100.kevpublic-exploitT1190T1078https://patchfirst.co/cve/CVE-2026-5430/CVE-2026-5430#kevThu, 24 Sep 2026 00:00:00 GMTWSO2 · Multiple Products. In CISA KEV since 2026-09-24. ENISA EUVD lists it as exploited. EPSS 22.4% (higher than 97.7% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts; T1550 Use Alternate Authentication Material. Priority 79.5 of 100.kevpublic-exploitT1190T1078T1550https://patchfirst.co/cve/CVE-2026-87886/CVE-2026-87886Thu, 17 Sep 2026 00:00:00 GMTAcronis · Backup. In CISA KEV since 2026-09-16. ENISA EUVD lists it as exploited. EPSS 0.2% (higher than 14.3% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1078 Valid Accounts; T1068 Exploitation for Privilege Escalation. Priority 56.3 of 100.kevT1078T1068https://patchfirst.co/cve/CVE-2026-76460/CVE-2026-76460#kevWed, 16 Sep 2026 00:00:00 GMTCisco · Identity Services Engine. In CISA KEV since 2026-09-16. ENISA EUVD lists it as exploited. EPSS 75.6% (higher than 99.52% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts. Priority 79.9 of 100.kevpublic-exploitT1190T1078https://patchfirst.co/cve/CVE-2026-42016/CVE-2026-42016#kevFri, 11 Sep 2026 00:00:00 GMTJFrog · Artifactory. In CISA KEV since 2026-09-11. ENISA EUVD lists it as exploited. EPSS 8.6% (higher than 95.1% of CVEs). CVSS 8.8 HIGH. ATT&CK: T1078 Valid Accounts. Priority 73.2 of 100.kevT1078https://patchfirst.co/cve/CVE-2026-84869/CVE-2026-84869#kevFri, 11 Sep 2026 00:00:00 GMTConnectWise · ScreenConnect. In CISA KEV since 2026-09-11. ENISA EUVD lists it as exploited. EPSS 0.9% (higher than 60.4% of CVEs). CVSS 9.9 CRITICAL. ATT&CK: T1078 Valid Accounts; T1059 Command and Scripting Interpreter; T1105 Ingress Tool Transfer. Priority 67.0 of 100.kevT1078T1059T1105https://patchfirst.co/cve/CVE-2026-82329/CVE-2026-82329#kevWed, 02 Sep 2026 00:00:00 GMTJFrog · Artifactory. In CISA KEV since 2026-09-02. ENISA EUVD lists it as exploited. EPSS 14.4% (higher than 96.6% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts. Priority 79.2 of 100.kevpublic-exploitT1190T1078https://patchfirst.co/cve/CVE-2026-83548/CVE-2026-83548#kevWed, 02 Sep 2026 00:00:00 GMTSonicWall · SMA1000 Appliances. In CISA KEV since 2026-09-02. ENISA EUVD lists it as exploited. EPSS 8.0% (higher than 94.8% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts. Priority 79.0 of 100.kevpublic-exploitT1190T1078https://patchfirst.co/cve/CVE-2026-83549/CVE-2026-83549#kevWed, 02 Sep 2026 00:00:00 GMTSonicWall · SMA1000 Appliances. In CISA KEV since 2026-09-02. ENISA EUVD lists it as exploited. EPSS 9.9% (higher than 95.6% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1059 Command and Scripting Interpreter. Priority 77.6 of 100.kevpublic-exploitT1078T1059https://patchfirst.co/cve/CVE-2026-59822/CVE-2026-59822#kevWed, 02 Sep 2026 00:00:00 GMTBerriAI · LiteLLM. In CISA KEV since 2026-09-02. ENISA EUVD lists it as exploited. EPSS 0.8% (higher than 57.7% of CVEs). CVSS 8.2 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts. Priority 65.3 of 100.kevpublic-exploitT1190T1078https://patchfirst.co/cve/CVE-2015-5287/CVE-2015-5287#kevWed, 26 Aug 2026 00:00:00 GMTRed Hat · Automatic Bug Reporting Tool. In CISA KEV since 2026-08-26. ENISA EUVD lists it as exploited. EPSS 5.0% (higher than 92.2% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1068 Exploitation for Privilege Escalation. Priority 76.9 of 100.kevpublic-exploitT1078T1068https://patchfirst.co/cve/CVE-2026-55040/CVE-2026-55040#kevTue, 18 Aug 2026 00:00:00 GMTMicrosoft · SharePoint. In CISA KEV since 2026-08-18. ENISA EUVD lists it as exploited. EPSS 69.5% (higher than 99.36% of CVEs). CVSS 9.1 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts. Priority 79.2 of 100.kevpublic-exploitT1190T1078https://patchfirst.co/cve/CVE-2026-18556/CVE-2026-18556#kevTue, 04 Aug 2026 00:00:00 GMTN-able · N-central. In CISA KEV since 2026-08-04. ENISA EUVD lists it as exploited. EPSS 7.9% (higher than 94.7% of CVEs). CVSS 7.4 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts. Named in 5 threat reports. Priority 82.1 of 100.kevpublic-exploitT1190T1078https://patchfirst.co/cve/CVE-2026-18577/CVE-2026-18577#kevMon, 03 Aug 2026 00:00:00 GMTN-able · N-central. In CISA KEV since 2026-08-03. ENISA EUVD lists it as exploited. EPSS 14.6% (higher than 96.7% of CVEs). CVSS 8.1 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts. Named in 7 threat reports. Priority 88.0 of 100.kevpublic-exploitT1190T1078https://patchfirst.co/cve/CVE-2026-20316/CVE-2026-20316#kevWed, 29 Jul 2026 00:00:00 GMTCisco · Secure Firewall Management Center (FMC). In CISA KEV since 2026-07-29, known ransomware use. ENISA EUVD lists it as exploited. EPSS 35.1% (higher than 98.4% of CVEs). CVSS 5.3 MEDIUM. ATT&CK: T1078 Valid Accounts; T1005 Data from Local System. Named in 1 threat report. Priority 80.3 of 100.kevransomwareT1078T1005https://patchfirst.co/cve/CVE-2026-16232/CVE-2026-16232#kevWed, 22 Jul 2026 00:00:00 GMTCheck Point · SmartConsole. In CISA KEV since 2026-07-22. ENISA EUVD lists it as exploited. EPSS 3.5% (higher than 89.2% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts. Named in 1 threat report. Priority 76.6 of 100.kevpublic-exploitT1190T1078https://patchfirst.co/cve/CVE-2026-15410/CVE-2026-15410#kevTue, 14 Jul 2026 00:00:00 GMTSonicWall · SMA1000 Appliances. In CISA KEV since 2026-07-14, known ransomware use. ENISA EUVD lists it as exploited. EPSS 11.8% (higher than 96.1% of CVEs). CVSS 7.2 HIGH. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1059 Command and Scripting Interpreter. Named in 1 threat report. Priority 86.1 of 100.kevransomwarepublic-exploitT1078T1059https://patchfirst.co/cve/CVE-2026-56155/CVE-2026-56155#kevTue, 14 Jul 2026 00:00:00 GMTMicrosoft · Active Directory Federation Services. In CISA KEV since 2026-07-14. ENISA EUVD lists it as exploited. EPSS 0.3% (higher than 28.2% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1078 Valid Accounts; T1068 Exploitation for Privilege Escalation. Priority 54.1 of 100.kevT1078T1068https://patchfirst.co/cve/CVE-2026-48558/CVE-2026-48558#kevMon, 29 Jun 2026 00:00:00 GMTSimpleHelp · SimpleHelp. In CISA KEV since 2026-06-29. ENISA EUVD lists it as exploited. EPSS 77.7% (higher than 99.56% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts. Priority 74.9 of 100.kevpublic-exploitT1190T1078https://patchfirst.co/cve/CVE-2026-35273/CVE-2026-35273#kevFri, 12 Jun 2026 00:00:00 GMTOracle · PeopleSoft Enterprise PeopleTools. In CISA KEV since 2026-06-12, known ransomware use. ENISA EUVD lists it as exploited. EPSS 96.7% (higher than 99.88% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts. Priority 84.8 of 100.kevransomwarepublic-exploitT1190T1078https://patchfirst.co/cve/CVE-2026-50751/CVE-2026-50751#kevMon, 08 Jun 2026 00:00:00 GMTCheck Point · Security Gateway. In CISA KEV since 2026-06-08, known ransomware use. ENISA EUVD lists it as exploited. EPSS 85.3% (higher than 99.72% of CVEs). CVSS 9.3 CRITICAL. Public exploit code exists. ATT&CK: T1133 External Remote Services; T1078 Valid Accounts. Priority 84.5 of 100.kevransomwarepublic-exploitT1133T1078https://patchfirst.co/cve/CVE-2026-34926/CVE-2026-34926#kevThu, 21 May 2026 00:00:00 GMTTrend Micro · Apex One. In CISA KEV since 2026-05-21. ENISA EUVD lists it as exploited. EPSS 13.4% (higher than 96.4% of CVEs). CVSS 6.7 MEDIUM. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1059 Command and Scripting Interpreter. Priority 72.0 of 100.kevpublic-exploitT1078T1059https://patchfirst.co/cve/CVE-2026-6973/CVE-2026-6973#kevThu, 07 May 2026 00:00:00 GMTIvanti · Endpoint Manager Mobile (EPMM). In CISA KEV since 2026-05-07. ENISA EUVD lists it as exploited. EPSS 34.5% (higher than 98.4% of CVEs). CVSS 7.2 HIGH. ATT&CK: T1078 Valid Accounts; T1059 Command and Scripting Interpreter. Priority 67.7 of 100.kevT1078T1059https://patchfirst.co/cve/CVE-2026-41940/CVE-2026-41940#kevThu, 30 Apr 2026 00:00:00 GMTWebPros · cPanel & WHM and WP2 (WordPress Squared). In CISA KEV since 2026-04-30, known ransomware use. ENISA EUVD lists it as exploited. EPSS 98.5% (higher than 99.92% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts. Priority 84.8 of 100.kevransomwarepublic-exploitT1190T1078https://patchfirst.co/cve/CVE-2024-57726/CVE-2024-57726#kevFri, 24 Apr 2026 00:00:00 GMTSimpleHelp · SimpleHelp. In CISA KEV since 2026-04-24, known ransomware use. ENISA EUVD lists it as exploited. EPSS 66.4% (higher than 99.28% of CVEs). CVSS 9.9 CRITICAL. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1068 Exploitation for Privilege Escalation. Priority 79.8 of 100.kevransomwarepublic-exploitT1078T1068https://patchfirst.co/cve/CVE-2026-33825/CVE-2026-33825#kevWed, 22 Apr 2026 00:00:00 GMTMicrosoft · Defender. In CISA KEV since 2026-04-22, known ransomware use. ENISA EUVD lists it as exploited. EPSS 6.7% (higher than 94% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1068 Exploitation for Privilege Escalation. Priority 82.3 of 100.kevransomwarepublic-exploitT1078T1068https://patchfirst.co/cve/CVE-2023-27351/CVE-2023-27351#kevMon, 20 Apr 2026 00:00:00 GMTPaperCut · NG/MF. In CISA KEV since 2026-04-20, known ransomware use. ENISA EUVD lists it as exploited. EPSS 78.1% (higher than 99.58% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts. Priority 78.2 of 100.kevransomwarepublic-exploitT1190T1078https://patchfirst.co/cve/CVE-2024-27199/CVE-2024-27199#kevMon, 20 Apr 2026 00:00:00 GMTJetBrains · TeamCity. In CISA KEV since 2026-04-20, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.98% of CVEs). CVSS 7.3 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts. Priority 78.1 of 100.kevransomwarepublic-exploitT1190T1078https://patchfirst.co/cve/CVE-2025-32975/CVE-2025-32975#kevMon, 20 Apr 2026 00:00:00 GMTQuest · KACE Systems Management Appliance (SMA). In CISA KEV since 2026-04-20. ENISA EUVD lists it as exploited. EPSS 2.5% (higher than 84.6% of CVEs). CVSS 10.0 CRITICAL. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts. Priority 66.9 of 100.kevT1190T1078https://patchfirst.co/cve/CVE-2025-68613/CVE-2025-68613#kevWed, 11 Mar 2026 00:00:00 GMTn8n · n8n. In CISA KEV since 2026-03-11. ENISA EUVD lists it as exploited. EPSS 99.0% (higher than 99.93% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1059 Command and Scripting Interpreter. Named in 1 threat report. Priority 78.0 of 100.kevpublic-exploitT1078T1059https://patchfirst.co/cve/CVE-2021-22681/CVE-2021-22681#kevThu, 05 Mar 2026 00:00:00 GMTRockwell · Multiple Products. In CISA KEV since 2026-03-05. ENISA EUVD lists it as exploited. EPSS 63.6% (higher than 99.21% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts. Priority 74.7 of 100.kevpublic-exploitT1190T1078https://patchfirst.co/cve/CVE-2017-7921/CVE-2017-7921#kevThu, 05 Mar 2026 00:00:00 GMTHikvision · Multiple Products. In CISA KEV since 2026-03-05. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts. Priority 69.9 of 100.kevpublic-exploitT1190T1078https://patchfirst.co/cve/CVE-2026-20127/CVE-2026-20127#kevWed, 25 Feb 2026 00:00:00 GMTCisco · Catalyst SD-WAN Controller and Manager. In CISA KEV since 2026-02-25. ENISA EUVD lists it as exploited. EPSS 89.3% (higher than 99.78% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts; T1098 Account Manipulation. Priority 75.0 of 100.kevpublic-exploitT1190T1078T1098https://patchfirst.co/cve/CVE-2026-22769/CVE-2026-22769#kevWed, 18 Feb 2026 00:00:00 GMTDell · RecoverPoint for Virtual Machines (RP4VMs). In CISA KEV since 2026-02-18. ENISA EUVD lists it as exploited. EPSS 13.5% (higher than 96.4% of CVEs). CVSS 10.0 CRITICAL. ATT&CK: T1078 Valid Accounts; T1068 Exploitation for Privilege Escalation. Priority 69.3 of 100.kevT1078T1068https://patchfirst.co/cve/CVE-2025-40536/CVE-2025-40536#kevThu, 12 Feb 2026 00:00:00 GMTSolarWinds · Web Help Desk. In CISA KEV since 2026-02-12. ENISA EUVD lists it as exploited. EPSS 73.6% (higher than 99.47% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts. Priority 74.8 of 100.kevpublic-exploitT1190T1078https://patchfirst.co/cve/CVE-2026-24858/CVE-2026-24858#kevTue, 27 Jan 2026 00:00:00 GMTFortinet · Multiple Products. In CISA KEV since 2026-01-27. ENISA EUVD lists it as exploited. EPSS 86.6% (higher than 99.74% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts. Priority 74.8 of 100.kevpublic-exploitT1190T1078https://patchfirst.co/cve/CVE-2026-23760/CVE-2026-23760#kevMon, 26 Jan 2026 00:00:00 GMTSmarterTools · SmarterMail. In CISA KEV since 2026-01-26, known ransomware use. ENISA EUVD lists it as exploited. EPSS 96.4% (higher than 99.88% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1078 Valid Accounts. Priority 84.8 of 100.kevransomwarepublic-exploitT1190T1059T1078https://patchfirst.co/cve/CVE-2026-24061/CVE-2026-24061#kevMon, 26 Jan 2026 00:00:00 GMTGNU · InetUtils. In CISA KEV since 2026-01-26. ENISA EUVD lists it as exploited. EPSS 99.0% (higher than 99.93% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts. Priority 84.8 of 100.kevpublic-exploitT1190T1078https://patchfirst.co/cve/CVE-2025-34026/CVE-2025-34026#kevThu, 22 Jan 2026 00:00:00 GMTVersa · Concerto. In CISA KEV since 2026-01-22. ENISA EUVD lists it as exploited. EPSS 81.8% (higher than 99.64% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System; T1078 Valid Accounts. Priority 68.2 of 100.kevpublic-exploitT1190T1005T1078https://patchfirst.co/cve/CVE-2026-20805/CVE-2026-20805#kevTue, 13 Jan 2026 00:00:00 GMTMicrosoft · Windows. In CISA KEV since 2026-01-13. ENISA EUVD lists it as exploited. EPSS 7.5% (higher than 94.5% of CVEs). CVSS 5.5 MEDIUM. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1005 Data from Local System. Priority 70.7 of 100.kevpublic-exploitT1078T1005https://patchfirst.co/cve/CVE-2025-40602/CVE-2025-40602Thu, 18 Dec 2025 00:00:00 GMTSonicWall · SMA1000 appliance. In CISA KEV since 2025-12-17. ENISA EUVD lists it as exploited. EPSS 2.8% (higher than 86.2% of CVEs). CVSS 6.6 MEDIUM. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1078 Valid Accounts. Priority 79.9 of 100.kevpublic-exploitT1068T1078https://patchfirst.co/cve/CVE-2025-59718/CVE-2025-59718#kevTue, 16 Dec 2025 00:00:00 GMTFortinet · Multiple Products. In CISA KEV since 2025-12-16. ENISA EUVD lists it as exploited. EPSS 68.3% (higher than 99.33% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts. Priority 84.7 of 100.kevpublic-exploitT1190T1078https://patchfirst.co/cve/CVE-2025-48633/CVE-2025-48633Mon, 08 Dec 2025 00:00:00 GMTAndroid · Framework. In CISA KEV since 2025-12-02. ENISA EUVD lists it as exploited. EPSS 0.3% (higher than 18% of CVEs). CVSS 5.5 MEDIUM. ATT&CK: T1078 Valid Accounts; T1068 Exploitation for Privilege Escalation. Priority 50.5 of 100.kevT1078T1068