https://patchfirst.co/technique/T1090/New and newly exploited CVEs that lead to ATT&CK T1090 Proxy, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.en-gb360Sat, 31 Oct 2026 05:11:25 GMThttps://patchfirst.co/cve/CVE-2026-96652/CVE-2026-96652#kevTue, 20 Oct 2026 00:00:00 GMTPlex · Media Server. In CISA KEV since 2026-10-20. ENISA EUVD lists it as exploited. EPSS 1.8% (higher than 78.7% of CVEs). CVSS 4.3 MEDIUM. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1090 Proxy. Priority 71.2 of 100.kevpublic-exploitT1190T1090https://patchfirst.co/cve/CVE-2026-96655/CVE-2026-96655#kevTue, 20 Oct 2026 00:00:00 GMTPlex · Media Server. In CISA KEV since 2026-10-20. ENISA EUVD lists it as exploited. EPSS 1.6% (higher than 76.3% of CVEs). CVSS 4.3 MEDIUM. ATT&CK: T1190 Exploit Public-Facing Application; T1090 Proxy. Priority 65.7 of 100.kevT1190T1090https://patchfirst.co/cve/CVE-2026-64849/CVE-2026-64849#kevWed, 19 Aug 2026 00:00:00 GMTMLflow · MLflow. In CISA KEV since 2026-08-19. ENISA EUVD lists it as exploited. EPSS 10.0% (higher than 95.6% of CVEs). CVSS 9.3 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1090 Proxy. Priority 78.6 of 100.kevpublic-exploitT1190T1090https://patchfirst.co/cve/CVE-2026-15409/CVE-2026-15409#kevTue, 14 Jul 2026 00:00:00 GMTSonicWall · SMA1000 Appliances. In CISA KEV since 2026-07-14, known ransomware use. ENISA EUVD lists it as exploited. EPSS 6.8% (higher than 94% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1090 Proxy. Named in 1 threat report. Priority 87.7 of 100.kevransomwarepublic-exploitT1190T1090https://patchfirst.co/cve/CVE-2021-22175/CVE-2021-22175#kevWed, 18 Feb 2026 00:00:00 GMTGitLab · GitLab. In CISA KEV since 2026-02-18. ENISA EUVD lists it as exploited. EPSS 53.4% (higher than 99% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1090 Proxy. Priority 69.7 of 100.kevpublic-exploitT1190T1090https://patchfirst.co/cve/CVE-2020-7796/CVE-2020-7796#kevTue, 17 Feb 2026 00:00:00 GMTSynacor · Zimbra Collaboration Suite. In CISA KEV since 2026-02-17. ENISA EUVD lists it as exploited. EPSS 93.6% (higher than 99.84% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1090 Proxy. Priority 69.8 of 100.kevpublic-exploitT1190T1090https://patchfirst.co/cve/CVE-2021-21311/CVE-2021-21311#kevMon, 29 Sep 2025 00:00:00 GMTAdminer · Adminer. In CISA KEV since 2025-09-29. ENISA EUVD lists it as exploited. EPSS 98.5% (higher than 99.92% of CVEs). CVSS 7.2 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1090 Proxy. Priority 68.0 of 100.kevpublic-exploitT1190T1090https://patchfirst.co/cve/CVE-2019-9621/CVE-2019-9621#kevMon, 07 Jul 2025 00:00:00 GMTSynacor · Zimbra Collaboration Suite (ZCS). In CISA KEV since 2025-07-07. ENISA EUVD lists it as exploited. EPSS 81.0% (higher than 99.63% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1090 Proxy. Priority 68.2 of 100.kevpublic-exploitT1190T1090https://patchfirst.co/cve/CVE-2021-40438/CVE-2021-40438#kevWed, 01 Dec 2021 00:00:00 GMTApache · Apache. In CISA KEV since 2021-12-01, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 9.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1090 Proxy. Priority 79.3 of 100.kevransomwarepublic-exploitT1190T1090https://patchfirst.co/cve/CVE-2021-26855/CVE-2021-26855#kevWed, 03 Nov 2021 00:00:00 GMTMicrosoft · Exchange Server. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 9.1 CRITICAL. Public exploit code exists. ATT&CK: T1133 External Remote Services; T1090 Proxy; T1005 Data from Local System; T1505.003 Web Shell. Named in 5 threat reports. Priority 89.4 of 100.kevransomwarepublic-exploitT1133T1090T1005T1505.003https://patchfirst.co/cve/CVE-2019-3396/CVE-2019-3396#kevWed, 03 Nov 2021 00:00:00 GMTAtlassian · Confluence Server and Data Server. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.9% (higher than 99.97% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1133 External Remote Services; T1090 Proxy; T1202 Indirect Command Execution. Named in 1 threat report. Priority 83.7 of 100.kevransomwarepublic-exploitT1133T1090T1202https://patchfirst.co/cve/CVE-2021-22986/CVE-2021-22986#kevWed, 03 Nov 2021 00:00:00 GMTF5 · BIG-IP and BIG-IQ Centralized Management. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.9% (higher than 99.97% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1133 External Remote Services; T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1090 Proxy; T1485 Data Destruction. Priority 79.9 of 100.kevransomwarepublic-exploitT1133T1190T1059T1090T1485https://patchfirst.co/cve/CVE-2016-3718/CVE-2016-3718#kevWed, 03 Nov 2021 00:00:00 GMTImageMagick · ImageMagick. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 75.6% (higher than 99.52% of CVEs). CVSS 5.5 MEDIUM. Public exploit code exists. ATT&CK: T1090 Proxy. Priority 66.8 of 100.kevpublic-exploitT1090