https://patchfirst.co/technique/T1098/New and newly exploited CVEs that lead to ATT&CK T1098 Account Manipulation, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.en-gb360Sat, 31 Oct 2026 05:11:25 GMThttps://patchfirst.co/cve/CVE-2026-81578/CVE-2026-81578#kevMon, 31 Aug 2026 00:00:00 GMTPaperCut · NG/MF. In CISA KEV since 2026-08-31. ENISA EUVD lists it as exploited. EPSS 84.7% (higher than 99.71% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1098 Account Manipulation. Named in 1 threat report. Priority 83.7 of 100.kevpublic-exploitT1190T1098https://patchfirst.co/cve/CVE-2026-34908/CVE-2026-34908#kevTue, 23 Jun 2026 00:00:00 GMTUbiquiti · UniFi OS. In CISA KEV since 2026-06-23. ENISA EUVD lists it as exploited. EPSS 88.3% (higher than 99.77% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1098 Account Manipulation. Priority 75.0 of 100.kevpublic-exploitT1190T1098https://patchfirst.co/cve/CVE-2026-20127/CVE-2026-20127#kevWed, 25 Feb 2026 00:00:00 GMTCisco · Catalyst SD-WAN Controller and Manager. In CISA KEV since 2026-02-25. ENISA EUVD lists it as exploited. EPSS 89.3% (higher than 99.78% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts; T1098 Account Manipulation. Priority 75.0 of 100.kevpublic-exploitT1190T1078T1098https://patchfirst.co/cve/CVE-2020-24363/CVE-2020-24363#kevTue, 02 Sep 2025 00:00:00 GMTTP-Link · TL-WA855RE. In CISA KEV since 2025-09-02. ENISA EUVD lists it as exploited. EPSS 22.2% (higher than 97.7% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1098 Account Manipulation. Priority 68.7 of 100.kevpublic-exploitT1190T1098https://patchfirst.co/cve/CVE-2021-32030/CVE-2021-32030#kevMon, 02 Jun 2025 00:00:00 GMTASUS · Routers. In CISA KEV since 2025-06-02. ENISA EUVD lists it as exploited. EPSS 99.4% (higher than 99.94% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1040 Network Sniffing; T1098 Account Manipulation. Priority 69.8 of 100.kevpublic-exploitT1068T1040T1098https://patchfirst.co/cve/CVE-2024-11680/CVE-2024-11680#kevTue, 03 Dec 2024 00:00:00 GMTProjectSend · ProjectSend. In CISA KEV since 2024-12-03. ENISA EUVD lists it as exploited. EPSS 91.8% (higher than 99.82% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1098 Account Manipulation; T1505.003 Web Shell. Priority 69.8 of 100.kevpublic-exploitT1190T1098T1505.003https://patchfirst.co/cve/CVE-2014-100005/CVE-2014-100005#kevThu, 16 May 2024 00:00:00 GMTD-Link · DIR-600 Router. In CISA KEV since 2024-05-16. ENISA EUVD lists it as exploited. EPSS 43.5% (higher than 98.7% of CVEs). CVSS 8.0 HIGH. Public exploit code exists. ATT&CK: T1204.001 Malicious Link; T1059 Command and Scripting Interpreter; T1098 Account Manipulation. Priority 68.3 of 100.kevpublic-exploitT1204.001T1059T1098https://patchfirst.co/cve/CVE-2023-6448/CVE-2023-6448#kevMon, 11 Dec 2023 00:00:00 GMTUnitronics · Vision PLC and HMI. In CISA KEV since 2023-12-11. ENISA EUVD lists it as exploited. EPSS 2.1% (higher than 81.6% of CVEs). CVSS 9.8 CRITICAL. ATT&CK: T1078 Valid Accounts; T1098 Account Manipulation. Priority 61.2 of 100.kevT1078T1098https://patchfirst.co/cve/CVE-2012-0767/CVE-2012-0767#kevWed, 08 Jun 2022 00:00:00 GMTAdobe · Flash Player. In CISA KEV since 2022-06-08. ENISA EUVD lists it as exploited. EPSS 6.2% (higher than 93.5% of CVEs). CVSS 6.1 MEDIUM. ATT&CK: T1204.001 Malicious Link; T1185 Browser Session Hijacking; T1098 Account Manipulation; T1114.002 Remote Email Collection. Priority 46.0 of 100.kevT1204.001T1185T1098T1114.002https://patchfirst.co/cve/CVE-2018-13382/CVE-2018-13382#kevMon, 10 Jan 2022 00:00:00 GMTFortinet · FortiOS and FortiProxy. In CISA KEV since 2022-01-10, known ransomware use. ENISA EUVD lists it as exploited. EPSS 81.7% (higher than 99.64% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1098 Account Manipulation. Priority 78.2 of 100.kevransomwarepublic-exploitT1190T1098https://patchfirst.co/cve/CVE-2020-26919/CVE-2020-26919#kevWed, 03 Nov 2021 00:00:00 GMTNETGEAR · JGS516PE Devices. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 57.5% (higher than 99.08% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1098 Account Manipulation. Priority 69.7 of 100.kevpublic-exploitT1190T1098https://patchfirst.co/cve/CVE-2020-5362/CVE-2020-5362Wed, 10 Jun 2020 00:00:00 GMTDell · Dell Client Consumer and Commercial platforms. Not in CISA KEV. EPSS 0.3% (higher than 21.6% of CVEs). CVSS 7.1 HIGH. ATT&CK: T1068 Exploitation for Privilege Escalation; T1098 Account Manipulation. Priority 9.3 of 100.T1068T1098https://patchfirst.co/cve/CVE-2020-5350/CVE-2020-5350Wed, 15 Apr 2020 00:00:00 GMTDell · Integrated Data Protection Appliance. Not in CISA KEV. EPSS 2.0% (higher than 80.5% of CVEs). CVSS 7.9 HIGH. ATT&CK: T1059 Command and Scripting Interpreter; T1098 Account Manipulation. Priority 21.6 of 100.T1059T1098https://patchfirst.co/cve/CVE-2020-0758/CVE-2020-0758Thu, 12 Mar 2020 00:00:00 GMTMicrosoft · Team Foundation Server 2018. Not in CISA KEV. EPSS 2.0% (higher than 80.9% of CVEs). ATT&CK: T1098 Account Manipulation; T1068 Exploitation for Privilege Escalation. Priority 16.2 of 100.T1098T1068https://patchfirst.co/cve/CVE-2019-15956/CVE-2019-15956Tue, 26 Nov 2019 00:00:00 GMTCisco · Cisco Web Security Appliance (WSA). Not in CISA KEV. EPSS 1.0% (higher than 62.2% of CVEs). CVSS 8.8 HIGH. ATT&CK: T1078 Valid Accounts; T1190 Exploit Public-Facing Application; T1098 Account Manipulation; T1499 Endpoint Denial of Service. Priority 18.6 of 100.T1078T1190T1098T1499https://patchfirst.co/cve/CVE-2019-1915/CVE-2019-1915Wed, 02 Oct 2019 00:00:00 GMTCisco · Cisco Unified Communications Manager. Not in CISA KEV. EPSS 0.7% (higher than 52% of CVEs). CVSS 6.5 MEDIUM. ATT&CK: T1189 Drive-by Compromise; T1204.002 Malicious File; T1566 Phishing; T1068 Exploitation for Privilege Escalation; T1098 Account Manipulation. Priority 14.9 of 100.T1189T1204.002T1566T1068T1098https://patchfirst.co/cve/CVE-2019-3787/CVE-2019-3787Wed, 19 Jun 2019 00:00:00 GMTCloud Foundry · UAA Release (OSS). Not in CISA KEV. EPSS 1.1% (higher than 65.7% of CVEs). CVSS 8.3 HIGH. ATT&CK: T1552 Unsecured Credentials; T1078 Valid Accounts; T1098 Account Manipulation. Priority 18.9 of 100.T1552T1078T1098https://patchfirst.co/cve/CVE-2019-3775/CVE-2019-3775Thu, 07 Mar 2019 00:00:00 GMTCloud Foundry · UAA Release (OSS). Not in CISA KEV. EPSS 0.9% (higher than 59% of CVEs). CVSS 7.1 HIGH. ATT&CK: T1098 Account Manipulation. Priority 16.8 of 100.T1098https://patchfirst.co/cve/CVE-2019-3782/CVE-2019-3782Wed, 13 Feb 2019 00:00:00 GMTCloud Foundry · CredHub CLI. Not in CISA KEV. EPSS 0.4% (higher than 29.4% of CVEs). CVSS 6.3 MEDIUM. ATT&CK: T1552.001 Credentials In Files; T1098 Account Manipulation. Priority 10.3 of 100.T1552.001T1098