{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: CVEs linked to T1098 Account Manipulation","home_page_url":"https://patchfirst.co/technique/T1098/","feed_url":"https://patchfirst.co/feed/technique/T1098.json","description":"New and newly exploited CVEs that lead to ATT&CK T1098 Account Manipulation, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2026-81578#kev","url":"https://patchfirst.co/cve/CVE-2026-81578/","title":"[KEV] CVE-2026-81578: PaperCut NG/MF Missing Authentication for Critical Function Vulnerability","content_text":"PaperCut · NG/MF. In CISA KEV since 2026-08-31. ENISA EUVD lists it as exploited. EPSS 84.7% (higher than 99.71% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1098 Account Manipulation. Named in 1 threat report. Priority 83.7 of 100.","summary":"PaperCut NG/MF Missing Authentication for Critical Function Vulnerability","date_published":"2026-08-31T00:00:00.000Z","date_modified":"2026-09-14T00:16:56.000Z","tags":["kev","public-exploit","T1190","T1098"],"_patchfirst":{"reason":"kev","priority":83.7,"kev":{"dateAdded":"2026-08-31","ransomware":false},"epss":{"score":0.84734,"percentile":0.99707},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"PaperCut","product":"NG/MF","techniqueIds":["T1190","T1098"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-34908#kev","url":"https://patchfirst.co/cve/CVE-2026-34908/","title":"[KEV] CVE-2026-34908: Ubiquiti UniFi OS Improper Access Control Vulnerability","content_text":"Ubiquiti · UniFi OS. In CISA KEV since 2026-06-23. ENISA EUVD lists it as exploited. EPSS 88.3% (higher than 99.77% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1098 Account Manipulation. Priority 75.0 of 100.","summary":"Ubiquiti UniFi OS Improper Access Control Vulnerability","date_published":"2026-06-23T00:00:00.000Z","date_modified":"2026-07-23T16:10:00.000Z","tags":["kev","public-exploit","T1190","T1098"],"_patchfirst":{"reason":"kev","priority":75,"kev":{"dateAdded":"2026-06-23","ransomware":false},"epss":{"score":0.88293,"percentile":0.99768},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"Ubiquiti","product":"UniFi OS","techniqueIds":["T1190","T1098"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-20127#kev","url":"https://patchfirst.co/cve/CVE-2026-20127/","title":"[KEV] CVE-2026-20127: Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability","content_text":"Cisco · Catalyst SD-WAN Controller and Manager. In CISA KEV since 2026-02-25. ENISA EUVD lists it as exploited. EPSS 89.3% (higher than 99.78% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts; T1098 Account Manipulation. Priority 75.0 of 100.","summary":"Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability","date_published":"2026-02-25T00:00:00.000Z","date_modified":"2026-06-17T15:06:12.000Z","tags":["kev","public-exploit","T1190","T1078","T1098"],"_patchfirst":{"reason":"kev","priority":75,"kev":{"dateAdded":"2026-02-25","ransomware":false},"epss":{"score":0.89294,"percentile":0.99782},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"Cisco","product":"Catalyst SD-WAN Controller and Manager","techniqueIds":["T1190","T1078","T1098"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2020-24363#kev","url":"https://patchfirst.co/cve/CVE-2020-24363/","title":"[KEV] CVE-2020-24363: TP-link TL-WA855RE Missing Authentication for Critical Function Vulnerability","content_text":"TP-Link · TL-WA855RE. In CISA KEV since 2025-09-02. ENISA EUVD lists it as exploited. EPSS 22.2% (higher than 97.7% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1098 Account Manipulation. Priority 68.7 of 100.","summary":"TP-link TL-WA855RE Missing Authentication for Critical Function Vulnerability","date_published":"2025-09-02T00:00:00.000Z","date_modified":"2026-06-17T03:05:25.000Z","tags":["kev","public-exploit","T1190","T1098"],"_patchfirst":{"reason":"kev","priority":68.7,"kev":{"dateAdded":"2025-09-02","ransomware":false},"epss":{"score":0.22187,"percentile":0.97672},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"TP-Link","product":"TL-WA855RE","techniqueIds":["T1190","T1098"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-32030#kev","url":"https://patchfirst.co/cve/CVE-2021-32030/","title":"[KEV] CVE-2021-32030: ASUS Routers Improper Authentication Vulnerability","content_text":"ASUS · Routers. In CISA KEV since 2025-06-02. ENISA EUVD lists it as exploited. EPSS 99.4% (higher than 99.94% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1040 Network Sniffing; T1098 Account Manipulation. Priority 69.8 of 100.","summary":"ASUS Routers Improper Authentication Vulnerability","date_published":"2025-06-02T00:00:00.000Z","date_modified":"2026-06-17T03:52:42.000Z","tags":["kev","public-exploit","T1068","T1040","T1098"],"_patchfirst":{"reason":"kev","priority":69.8,"kev":{"dateAdded":"2025-06-02","ransomware":false},"epss":{"score":0.99393,"percentile":0.9994},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"ASUS","product":"Routers","techniqueIds":["T1068","T1040","T1098"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-11680#kev","url":"https://patchfirst.co/cve/CVE-2024-11680/","title":"[KEV] CVE-2024-11680: ProjectSend Improper Authentication Vulnerability","content_text":"ProjectSend · ProjectSend. In CISA KEV since 2024-12-03. ENISA EUVD lists it as exploited. EPSS 91.8% (higher than 99.82% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1098 Account Manipulation; T1505.003 Web Shell. Priority 69.8 of 100.","summary":"ProjectSend Improper Authentication Vulnerability","date_published":"2024-12-03T00:00:00.000Z","date_modified":"2026-07-14T23:17:13.000Z","tags":["kev","public-exploit","T1190","T1098","T1505.003"],"_patchfirst":{"reason":"kev","priority":69.8,"kev":{"dateAdded":"2024-12-03","ransomware":false},"epss":{"score":0.91849,"percentile":0.99816},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"ProjectSend","product":"ProjectSend","techniqueIds":["T1190","T1098","T1505.003"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2014-100005#kev","url":"https://patchfirst.co/cve/CVE-2014-100005/","title":"[KEV] CVE-2014-100005: D-Link DIR-600 Router Cross-Site Request Forgery (CSRF) Vulnerability","content_text":"D-Link · DIR-600 Router. In CISA KEV since 2024-05-16. ENISA EUVD lists it as exploited. EPSS 43.5% (higher than 98.7% of CVEs). CVSS 8.0 HIGH. Public exploit code exists. ATT&CK: T1204.001 Malicious Link; T1059 Command and Scripting Interpreter; T1098 Account Manipulation. Priority 68.3 of 100.","summary":"D-Link DIR-600 Router Cross-Site Request Forgery (CSRF) Vulnerability","date_published":"2024-05-16T00:00:00.000Z","date_modified":"2026-06-17T00:04:00.000Z","tags":["kev","public-exploit","T1204.001","T1059","T1098"],"_patchfirst":{"reason":"kev","priority":68.3,"kev":{"dateAdded":"2024-05-16","ransomware":false},"epss":{"score":0.43456,"percentile":0.98737},"cvss":{"score":8,"severity":"HIGH","version":"3.1"},"vendor":"D-Link","product":"DIR-600 Router","techniqueIds":["T1204.001","T1059","T1098"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-6448#kev","url":"https://patchfirst.co/cve/CVE-2023-6448/","title":"[KEV] CVE-2023-6448: Unitronics Vision PLC and HMI Insecure Default Password Vulnerability","content_text":"Unitronics · Vision PLC and HMI. In CISA KEV since 2023-12-11. ENISA EUVD lists it as exploited. EPSS 2.1% (higher than 81.6% of CVEs). CVSS 9.8 CRITICAL. ATT&CK: T1078 Valid Accounts; T1098 Account Manipulation. Priority 61.2 of 100.","summary":"Unitronics Vision PLC and HMI Insecure Default Password Vulnerability","date_published":"2023-12-11T00:00:00.000Z","date_modified":"2026-06-17T06:50:46.000Z","tags":["kev","T1078","T1098"],"_patchfirst":{"reason":"kev","priority":61.2,"kev":{"dateAdded":"2023-12-11","ransomware":false},"epss":{"score":0.02089,"percentile":0.81582},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Unitronics","product":"Vision PLC and HMI","techniqueIds":["T1078","T1098"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2012-0767#kev","url":"https://patchfirst.co/cve/CVE-2012-0767/","title":"[KEV] CVE-2012-0767: Adobe Flash Player Cross-Site Scripting (XSS) Vulnerability","content_text":"Adobe · Flash Player. In CISA KEV since 2022-06-08. ENISA EUVD lists it as exploited. EPSS 6.2% (higher than 93.5% of CVEs). CVSS 6.1 MEDIUM. ATT&CK: T1204.001 Malicious Link; T1185 Browser Session Hijacking; T1098 Account Manipulation; T1114.002 Remote Email Collection. Priority 46.0 of 100.","summary":"Adobe Flash Player Cross-Site Scripting (XSS) Vulnerability","date_published":"2022-06-08T00:00:00.000Z","date_modified":"2026-06-16T23:38:13.000Z","tags":["kev","T1204.001","T1185","T1098","T1114.002"],"_patchfirst":{"reason":"kev","priority":46,"kev":{"dateAdded":"2022-06-08","ransomware":false},"epss":{"score":0.06187,"percentile":0.93491},"cvss":{"score":6.1,"severity":"MEDIUM","version":"3.1"},"vendor":"Adobe","product":"Flash Player","techniqueIds":["T1204.001","T1185","T1098","T1114.002"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2018-13382#kev","url":"https://patchfirst.co/cve/CVE-2018-13382/","title":"[KEV] CVE-2018-13382: Fortinet FortiOS and FortiProxy Improper Authorization","content_text":"Fortinet · FortiOS and FortiProxy. In CISA KEV since 2022-01-10, known ransomware use. ENISA EUVD lists it as exploited. EPSS 81.7% (higher than 99.64% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1098 Account Manipulation. Priority 78.2 of 100.","summary":"Fortinet FortiOS and FortiProxy Improper Authorization","date_published":"2022-01-10T00:00:00.000Z","date_modified":"2026-06-17T01:39:18.000Z","tags":["kev","ransomware","public-exploit","T1190","T1098"],"_patchfirst":{"reason":"kev","priority":78.2,"kev":{"dateAdded":"2022-01-10","ransomware":true},"epss":{"score":0.81691,"percentile":0.99643},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"Fortinet","product":"FortiOS and FortiProxy","techniqueIds":["T1190","T1098"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2020-26919#kev","url":"https://patchfirst.co/cve/CVE-2020-26919/","title":"[KEV] CVE-2020-26919: Netgear JGS516PE Devices Missing Function Level Access Control Vulnerability","content_text":"NETGEAR · JGS516PE Devices. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 57.5% (higher than 99.08% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1098 Account Manipulation. Priority 69.7 of 100.","summary":"Netgear JGS516PE Devices Missing Function Level Access Control Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T03:08:32.000Z","tags":["kev","public-exploit","T1190","T1098"],"_patchfirst":{"reason":"kev","priority":69.7,"kev":{"dateAdded":"2021-11-03","ransomware":false},"epss":{"score":0.57468,"percentile":0.99078},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"NETGEAR","product":"JGS516PE Devices","techniqueIds":["T1190","T1098"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2020-5362","url":"https://patchfirst.co/cve/CVE-2020-5362/","title":"CVE-2020-5362: Dell Client Consumer and Commercial platforms include an improper authorization vulnerability in the Dell…","content_text":"Dell · Dell Client Consumer and Commercial platforms. Not in CISA KEV. EPSS 0.3% (higher than 21.6% of CVEs). CVSS 7.1 HIGH. ATT&CK: T1068 Exploitation for Privilege Escalation; T1098 Account Manipulation. Priority 9.3 of 100.","summary":"Dell Client Consumer and Commercial platforms include an improper authorization vulnerability in the Dell…","date_published":"2020-06-10T00:00:00.000Z","date_modified":"2024-09-17T02:41:23.000Z","tags":["T1068","T1098"],"_patchfirst":{"reason":"published","priority":9.3,"kev":null,"epss":{"score":0.0029,"percentile":0.21612},"cvss":{"score":7.1,"severity":"HIGH","version":"3.1"},"vendor":"Dell","product":"Dell Client Consumer and Commercial platforms","techniqueIds":["T1068","T1098"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2020-5350","url":"https://patchfirst.co/cve/CVE-2020-5350/","title":"CVE-2020-5350: Dell EMC Integrated Data Protection Appliance versions 2.0, 2.1, 2.2, 2.3, 2.4 contain a command injection…","content_text":"Dell · Integrated Data Protection Appliance. Not in CISA KEV. EPSS 2.0% (higher than 80.5% of CVEs). CVSS 7.9 HIGH. ATT&CK: T1059 Command and Scripting Interpreter; T1098 Account Manipulation. Priority 21.6 of 100.","summary":"Dell EMC Integrated Data Protection Appliance versions 2.0, 2.1, 2.2, 2.3, 2.4 contain a command injection…","date_published":"2020-04-15T00:00:00.000Z","date_modified":"2024-09-16T17:54:54.000Z","tags":["T1059","T1098"],"_patchfirst":{"reason":"published","priority":21.6,"kev":null,"epss":{"score":0.01975,"percentile":0.80461},"cvss":{"score":7.9,"severity":"HIGH","version":"3.1"},"vendor":"Dell","product":"Integrated Data Protection Appliance","techniqueIds":["T1059","T1098"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2020-0758","url":"https://patchfirst.co/cve/CVE-2020-0758/","title":"CVE-2020-0758: An elevation of privilege vulnerability exists when Azure DevOps Server and Team Foundation Services improperly handle…","content_text":"Microsoft · Team Foundation Server 2018. Not in CISA KEV. EPSS 2.0% (higher than 80.9% of CVEs). ATT&CK: T1098 Account Manipulation; T1068 Exploitation for Privilege Escalation. Priority 16.2 of 100.","summary":"An elevation of privilege vulnerability exists when Azure DevOps Server and Team Foundation Services improperly handle…","date_published":"2020-03-12T00:00:00.000Z","date_modified":"2024-08-04T06:11:05.000Z","tags":["T1098","T1068"],"_patchfirst":{"reason":"published","priority":16.2,"kev":null,"epss":{"score":0.02015,"percentile":0.80876},"cvss":null,"vendor":"Microsoft","product":"Team Foundation Server 2018","techniqueIds":["T1098","T1068"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2019-15956","url":"https://patchfirst.co/cve/CVE-2019-15956/","title":"CVE-2019-15956: Cisco Web Security Appliance Unauthorized Device Reset Vulnerability","content_text":"Cisco · Cisco Web Security Appliance (WSA). Not in CISA KEV. EPSS 1.0% (higher than 62.2% of CVEs). CVSS 8.8 HIGH. ATT&CK: T1078 Valid Accounts; T1190 Exploit Public-Facing Application; T1098 Account Manipulation; T1499 Endpoint Denial of Service. Priority 18.6 of 100.","summary":"Cisco Web Security Appliance Unauthorized Device Reset Vulnerability","date_published":"2019-11-26T00:00:00.000Z","date_modified":"2024-11-20T17:04:44.000Z","tags":["T1078","T1190","T1098","T1499"],"_patchfirst":{"reason":"published","priority":18.6,"kev":null,"epss":{"score":0.00981,"percentile":0.6223},"cvss":{"score":8.8,"severity":"HIGH","version":"3.0"},"vendor":"Cisco","product":"Cisco Web Security Appliance (WSA)","techniqueIds":["T1078","T1190","T1098","T1499"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2019-1915","url":"https://patchfirst.co/cve/CVE-2019-1915/","title":"CVE-2019-1915: Multiple Cisco Unified Communications Products Cross-Site Request Forgery Vulnerability","content_text":"Cisco · Cisco Unified Communications Manager. Not in CISA KEV. EPSS 0.7% (higher than 52% of CVEs). CVSS 6.5 MEDIUM. ATT&CK: T1189 Drive-by Compromise; T1204.002 Malicious File; T1566 Phishing; T1068 Exploitation for Privilege Escalation; T1098 Account Manipulation. Priority 14.9 of 100.","summary":"Multiple Cisco Unified Communications Products Cross-Site Request Forgery Vulnerability","date_published":"2019-10-02T00:00:00.000Z","date_modified":"2024-11-21T19:10:23.000Z","tags":["T1189","T1204.002","T1566","T1068","T1098"],"_patchfirst":{"reason":"published","priority":14.9,"kev":null,"epss":{"score":0.00671,"percentile":0.51983},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.0"},"vendor":"Cisco","product":"Cisco Unified Communications Manager","techniqueIds":["T1189","T1204.002","T1566","T1068","T1098"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2019-3787","url":"https://patchfirst.co/cve/CVE-2019-3787/","title":"CVE-2019-3787: UAA defaults email address to an insecure domain","content_text":"Cloud Foundry · UAA Release (OSS). Not in CISA KEV. EPSS 1.1% (higher than 65.7% of CVEs). CVSS 8.3 HIGH. ATT&CK: T1552 Unsecured Credentials; T1078 Valid Accounts; T1098 Account Manipulation. Priority 18.9 of 100.","summary":"UAA defaults email address to an insecure domain","date_published":"2019-06-19T00:00:00.000Z","date_modified":"2024-09-16T21:57:57.000Z","tags":["T1552","T1078","T1098"],"_patchfirst":{"reason":"published","priority":18.9,"kev":null,"epss":{"score":0.01102,"percentile":0.65684},"cvss":{"score":8.3,"severity":"HIGH","version":"3.0"},"vendor":"Cloud Foundry","product":"UAA Release (OSS)","techniqueIds":["T1552","T1078","T1098"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2019-3775","url":"https://patchfirst.co/cve/CVE-2019-3775/","title":"CVE-2019-3775: UAA allows users to modify their own email address","content_text":"Cloud Foundry · UAA Release (OSS). Not in CISA KEV. EPSS 0.9% (higher than 59% of CVEs). CVSS 7.1 HIGH. ATT&CK: T1098 Account Manipulation. Priority 16.8 of 100.","summary":"UAA allows users to modify their own email address","date_published":"2019-03-07T00:00:00.000Z","date_modified":"2024-09-16T22:31:19.000Z","tags":["T1098"],"_patchfirst":{"reason":"published","priority":16.8,"kev":null,"epss":{"score":0.00876,"percentile":0.58974},"cvss":{"score":7.1,"severity":"HIGH","version":"3.0"},"vendor":"Cloud Foundry","product":"UAA Release (OSS)","techniqueIds":["T1098"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2019-3782","url":"https://patchfirst.co/cve/CVE-2019-3782/","title":"CVE-2019-3782: CredHub CLI writes environment variable credentials to disk","content_text":"Cloud Foundry · CredHub CLI. Not in CISA KEV. EPSS 0.4% (higher than 29.4% of CVEs). CVSS 6.3 MEDIUM. ATT&CK: T1552.001 Credentials In Files; T1098 Account Manipulation. Priority 10.3 of 100.","summary":"CredHub CLI writes environment variable credentials to disk","date_published":"2019-02-13T00:00:00.000Z","date_modified":"2024-09-16T23:36:58.000Z","tags":["T1552.001","T1098"],"_patchfirst":{"reason":"published","priority":10.3,"kev":null,"epss":{"score":0.00357,"percentile":0.29435},"cvss":{"score":6.3,"severity":"MEDIUM","version":"3.0"},"vendor":"Cloud Foundry","product":"CredHub CLI","techniqueIds":["T1552.001","T1098"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}}]}