{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: CVEs linked to T1134 Access Token Manipulation","home_page_url":"https://patchfirst.co/technique/T1134/","feed_url":"https://patchfirst.co/feed/technique/T1134.json","description":"New and newly exploited CVEs that lead to ATT&CK T1134 Access Token Manipulation, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2025-29824#kev","url":"https://patchfirst.co/cve/CVE-2025-29824/","title":"[KEV] CVE-2025-29824: Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2025-04-08, known ransomware use. ENISA EUVD lists it as exploited. EPSS 19.3% (higher than 97.3% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1134 Access Token Manipulation. Priority 77.9 of 100.","summary":"Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability","date_published":"2025-04-08T00:00:00.000Z","date_modified":"2026-06-17T09:05:43.000Z","tags":["kev","ransomware","public-exploit","T1068","T1134"],"_patchfirst":{"reason":"kev","priority":77.9,"kev":{"dateAdded":"2025-04-08","ransomware":true},"epss":{"score":0.19254,"percentile":0.97333},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1068","T1134"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-36033#kev","url":"https://patchfirst.co/cve/CVE-2023-36033/","title":"[KEV] CVE-2023-36033: Microsoft Windows Desktop Window Manager (DWM) Core Library Privilege Escalation Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2023-11-14. ENISA EUVD lists it as exploited. EPSS 10.9% (higher than 95.9% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1068 Exploitation for Privilege Escalation; T1134 Access Token Manipulation. Priority 62.6 of 100.","summary":"Microsoft Windows Desktop Window Manager (DWM) Core Library Privilege Escalation Vulnerability","date_published":"2023-11-14T00:00:00.000Z","date_modified":"2026-06-17T06:05:42.000Z","tags":["kev","T1068","T1134"],"_patchfirst":{"reason":"kev","priority":62.6,"kev":{"dateAdded":"2023-11-14","ransomware":false},"epss":{"score":0.10945,"percentile":0.9588},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1068","T1134"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2019-0543#kev","url":"https://patchfirst.co/cve/CVE-2019-0543/","title":"[KEV] CVE-2019-0543: Microsoft Windows Privilege Escalation Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2022-03-15, known ransomware use. ENISA EUVD lists it as exploited. EPSS 4.7% (higher than 91.8% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1134 Access Token Manipulation. Priority 76.8 of 100.","summary":"Microsoft Windows Privilege Escalation Vulnerability","date_published":"2022-03-15T00:00:00.000Z","date_modified":"2026-06-17T02:08:20.000Z","tags":["kev","ransomware","public-exploit","T1068","T1134"],"_patchfirst":{"reason":"kev","priority":76.8,"kev":{"dateAdded":"2022-03-15","ransomware":true},"epss":{"score":0.04679,"percentile":0.91765},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1068","T1134"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2016-0099#kev","url":"https://patchfirst.co/cve/CVE-2016-0099/","title":"[KEV] CVE-2016-0099: Microsoft Windows Secondary Logon Service Privilege Escalation Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2022-03-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 37.0% (higher than 98.5% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1134 Access Token Manipulation. Priority 78.2 of 100.","summary":"Microsoft Windows Secondary Logon Service Privilege Escalation Vulnerability","date_published":"2022-03-03T00:00:00.000Z","date_modified":"2026-06-17T00:36:55.000Z","tags":["kev","ransomware","public-exploit","T1068","T1134"],"_patchfirst":{"reason":"kev","priority":78.2,"kev":{"dateAdded":"2022-03-03","ransomware":true},"epss":{"score":0.37045,"percentile":0.98514},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1068","T1134"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2002-0367#kev","url":"https://patchfirst.co/cve/CVE-2002-0367/","title":"[KEV] CVE-2002-0367: Microsoft Windows Privilege Escalation Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2022-03-03. ENISA EUVD lists it as exploited. EPSS 4.9% (higher than 92.1% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1134 Access Token Manipulation. Priority 66.9 of 100.","summary":"Microsoft Windows Privilege Escalation Vulnerability","date_published":"2022-03-03T00:00:00.000Z","date_modified":"2026-06-16T21:57:17.000Z","tags":["kev","public-exploit","T1068","T1134"],"_patchfirst":{"reason":"kev","priority":66.9,"kev":{"dateAdded":"2022-03-03","ransomware":false},"epss":{"score":0.04919,"percentile":0.92106},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1068","T1134"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2020-0981","url":"https://patchfirst.co/cve/CVE-2020-0981/","title":"CVE-2020-0981: A security feature bypass vulnerability exists when Windows fails to properly handle token relationships.An attacker…","content_text":"Microsoft · Windows 10 Version 1909 for 32-bit Systems. Not in CISA KEV. EPSS 1.3% (higher than 69.8% of CVEs). Public exploit code exists. ATT&CK: T1134 Access Token Manipulation; T1068 Exploitation for Privilege Escalation; T1497 Virtualization/Sandbox Evasion. Priority 19.0 of 100.","summary":"A security feature bypass vulnerability exists when Windows fails to properly handle token relationships.An attacker…","date_published":"2020-04-15T00:00:00.000Z","date_modified":"2024-08-04T06:18:03.000Z","tags":["public-exploit","T1134","T1068","T1497"],"_patchfirst":{"reason":"published","priority":19,"kev":null,"epss":{"score":0.01271,"percentile":0.69812},"cvss":null,"vendor":"Microsoft","product":"Windows 10 Version 1909 for 32-bit Systems","techniqueIds":["T1134","T1068","T1497"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}}]}