https://patchfirst.co/technique/T1091/New and newly exploited CVEs that lead to ATT&CK T1091 Replication Through Removable Media, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.en-gb360Sat, 31 Oct 2026 05:11:25 GMThttps://patchfirst.co/cve/CVE-2025-24985/CVE-2025-24985#kevTue, 11 Mar 2025 00:00:00 GMTMicrosoft · Windows. In CISA KEV since 2025-03-11. ENISA EUVD lists it as exploited. EPSS 3.9% (higher than 90.2% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1091 Replication Through Removable Media; T1059 Command and Scripting Interpreter. Priority 66.5 of 100.kevpublic-exploitT1091T1059https://patchfirst.co/cve/CVE-2025-24991/CVE-2025-24991#kevTue, 11 Mar 2025 00:00:00 GMTMicrosoft · Windows. In CISA KEV since 2025-03-11. ENISA EUVD lists it as exploited. EPSS 2.0% (higher than 80.9% of CVEs). CVSS 5.5 MEDIUM. ATT&CK: T1091 Replication Through Removable Media; T1005 Data from Local System. Priority 58.0 of 100.kevT1091T1005https://patchfirst.co/cve/CVE-2019-15959/CVE-2019-15959Wed, 23 Sep 2020 00:00:00 GMTCisco · Cisco SPA525G2 5-line IP Phone. Not in CISA KEV. EPSS 0.4% (higher than 32.7% of CVEs). CVSS 6.6 MEDIUM. ATT&CK: T1091 Replication Through Removable Media; T1059 Command and Scripting Interpreter. Priority 11.2 of 100.T1091T1059https://patchfirst.co/cve/CVE-2020-12024/CVE-2020-12024Mon, 29 Jun 2020 00:00:00 GMTNot in CISA KEV. EPSS 0.4% (higher than 29.8% of CVEs). ATT&CK: T1091 Replication Through Removable Media. Priority 6.0 of 100.T1091https://patchfirst.co/cve/CVE-2020-4068/CVE-2020-4068Mon, 22 Jun 2020 00:00:00 GMTkylebrowning · APNSwift. Not in CISA KEV. EPSS 1.3% (higher than 70.7% of CVEs). CVSS 6.3 MEDIUM. ATT&CK: T1091 Replication Through Removable Media; T1133 External Remote Services; T1190 Exploit Public-Facing Application; T1566 Phishing; T1499.004 Application or System Exploitation; T1574 Hijack Execution Flow. Priority 18.6 of 100.T1091T1133T1190T1566T1499.004T1574