https://patchfirst.co/technique/T1136/New and newly exploited CVEs that lead to ATT&CK T1136 Create Account, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.en-gb360Sat, 31 Oct 2026 05:11:25 GMThttps://patchfirst.co/cve/CVE-2025-31161/CVE-2025-31161#kevMon, 07 Apr 2025 00:00:00 GMTCrushFTP · CrushFTP. In CISA KEV since 2025-04-07, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.98% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1059 Command and Scripting Interpreter; T1136 Create Account. Priority 79.9 of 100.kevransomwarepublic-exploitT1078T1059T1136https://patchfirst.co/cve/CVE-2018-19410/CVE-2018-19410#kevTue, 04 Feb 2025 00:00:00 GMTPaessler · PRTG Network Monitor. In CISA KEV since 2025-02-04. ENISA EUVD lists it as exploited. EPSS 97.9% (higher than 99.91% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1136 Create Account. Priority 69.8 of 100.kevpublic-exploitT1190T1136https://patchfirst.co/cve/CVE-2023-20198/CVE-2023-20198#kevMon, 16 Oct 2023 00:00:00 GMTCisco · IOS XE Web UI. In CISA KEV since 2023-10-16. ENISA EUVD lists it as exploited. EPSS 99.6% (higher than 99.95% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1136 Create Account. Named in 2 threat reports. Priority 86.1 of 100.kevpublic-exploitT1190T1136https://patchfirst.co/cve/CVE-2023-22515/CVE-2023-22515#kevThu, 05 Oct 2023 00:00:00 GMTAtlassian · Confluence Data Center and Server. In CISA KEV since 2023-10-05, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.2% (higher than 99.94% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059.007 JavaScript; T1136 Create Account; T1059 Command and Scripting Interpreter; T1078 Valid Accounts. Priority 79.8 of 100.kevransomwarepublic-exploitT1190T1059.007T1136T1059T1078https://patchfirst.co/cve/CVE-2023-35078/CVE-2023-35078#kevTue, 25 Jul 2023 00:00:00 GMTIvanti · Endpoint Manager Mobile (EPMM). In CISA KEV since 2023-07-25, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1136 Create Account; T1213 Data from Information Repositories. Priority 79.9 of 100.kevransomwarepublic-exploitT1190T1136T1213https://patchfirst.co/cve/CVE-2023-27997/CVE-2023-27997#kevTue, 13 Jun 2023 00:00:00 GMTFortinet · FortiOS and FortiProxy SSL-VPN. In CISA KEV since 2023-06-13, known ransomware use. ENISA EUVD lists it as exploited. EPSS 85.7% (higher than 99.72% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1574 Hijack Execution Flow; T1136 Create Account. Named in 1 threat report. Priority 83.7 of 100.kevransomwarepublic-exploitT1190T1574T1136https://patchfirst.co/cve/CVE-2023-34362/CVE-2023-34362#kevFri, 02 Jun 2023 00:00:00 GMTProgress · MOVEit Transfer. In CISA KEV since 2023-06-02, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.9% (higher than 99.97% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1005 Data from Local System; T1082 System Information Discovery; T1105 Ingress Tool Transfer; T1136 Create Account; +1 more. Named in 2 threat reports. Priority 86.0 of 100.kevransomwarepublic-exploitT1190T1059T1005T1082T1105T1136T1531https://patchfirst.co/cve/CVE-2023-28252/CVE-2023-28252#kevTue, 11 Apr 2023 00:00:00 GMTMicrosoft · Windows. In CISA KEV since 2023-04-11, known ransomware use. ENISA EUVD lists it as exploited. EPSS 48.9% (higher than 98.9% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1068 Exploitation for Privilege Escalation; T1003 OS Credential Dumping; T1021 Remote Services; T1059 Command and Scripting Interpreter; T1136 Create Account; +1 more. Priority 78.2 of 100.kevransomwarepublic-exploitT1078T1068T1003T1021T1059T1136T1486https://patchfirst.co/cve/CVE-2021-45467/CVE-2021-45467Mon, 26 Dec 2022 00:00:00 GMTNot in CISA KEV. EPSS 70.7% (higher than 99.4% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1136 Create Account. Named in 1 threat report. Priority 70.6 of 100.public-exploitT1190T1136https://patchfirst.co/cve/CVE-2021-44077/CVE-2021-44077#kevWed, 01 Dec 2021 00:00:00 GMTZoho · ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus. In CISA KEV since 2021-12-01. ENISA EUVD lists it as exploited. EPSS 93.3% (higher than 99.84% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1505.003 Web Shell; T1003 OS Credential Dumping; T1003.003 NTDS; T1027 Obfuscated Files or Information; T1047 Windows Management Instrumentation; +7 more. Priority 69.8 of 100.kevpublic-exploitT1190T1505.003T1003T1003.003T1027T1047T1070.004T1087.002T1136T1140T1218T1560.001T1573.001https://patchfirst.co/cve/CVE-2021-34473/CVE-2021-34473#kevWed, 03 Nov 2021 00:00:00 GMTMicrosoft · Exchange Server. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 9.1 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1053.005 Scheduled Task; T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol; T1136 Create Account; T1486 Data Encrypted for Impact. Named in 9 threat reports. Priority 89.4 of 100.kevransomwarepublic-exploitT1190T1053.005T1048.003T1136T1486https://patchfirst.co/cve/CVE-2021-40539/CVE-2021-40539#kevWed, 03 Nov 2021 00:00:00 GMTZoho · ManageEngine. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.0% (higher than 99.93% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1505.003 Web Shell; T1003 OS Credential Dumping; T1003.003 NTDS; T1027 Obfuscated Files or Information; T1047 Windows Management Instrumentation; +7 more. Named in 1 threat report. Priority 83.7 of 100.kevransomwarepublic-exploitT1190T1505.003T1003T1003.003T1027T1047T1070.004T1087.002T1136T1140T1218T1560.001T1573.001https://patchfirst.co/cve/CVE-2021-20021/CVE-2021-20021#kevWed, 03 Nov 2021 00:00:00 GMTSonicWall · SonicWall Email Security. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 88.8% (higher than 99.78% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1136 Create Account. Priority 79.8 of 100.kevransomwarepublic-exploitT1190T1136https://patchfirst.co/cve/CVE-2020-10181/CVE-2020-10181#kevWed, 03 Nov 2021 00:00:00 GMTSumavision · Enhanced Multimedia Router (EMR). In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 14.9% (higher than 96.7% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1136 Create Account. Priority 69.2 of 100.kevpublic-exploitT1190T1136https://patchfirst.co/cve/CVE-2020-16874/CVE-2020-16874Fri, 11 Sep 2020 00:00:00 GMTMicrosoft · Microsoft Visual Studio 2019 version 16.7 (includes 16.0 – 16.6). Not in CISA KEV. EPSS 4.3% (higher than 91.1% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1204.002 Malicious File; T1499.004 Application or System Exploitation; T1574 Hijack Execution Flow; T1005 Data from Local System; T1136 Create Account; T1485 Data Destruction; +1 more. Priority 24.4 of 100.T1204.002T1499.004T1574T1005T1136T1485T1565https://patchfirst.co/cve/CVE-2020-1569/CVE-2020-1569Mon, 17 Aug 2020 00:00:00 GMTMicrosoft · Microsoft Edge (EdgeHTML-based). Not in CISA KEV. EPSS 3.0% (higher than 87.3% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1204.002 Malicious File; T1566 Phishing; T1499.004 Application or System Exploitation; T1574 Hijack Execution Flow; T1005 Data from Local System; T1136 Create Account; +2 more. Priority 23.6 of 100.T1204.002T1566T1499.004T1574T1005T1136T1485T1565https://patchfirst.co/cve/CVE-2020-1495/CVE-2020-1495Mon, 17 Aug 2020 00:00:00 GMTMicrosoft · Microsoft SharePoint Server 2010 Service Pack 2. Not in CISA KEV. EPSS 4.2% (higher than 91% of CVEs). ATT&CK: T1204.002 Malicious File; T1566 Phishing; T1499.004 Application or System Exploitation; T1574 Hijack Execution Flow; T1005 Data from Local System; T1136 Create Account; +2 more. Priority 18.9 of 100.T1204.002T1566T1499.004T1574T1005T1136T1485T1565https://patchfirst.co/cve/CVE-2020-1109/CVE-2020-1109Thu, 21 May 2020 00:00:00 GMTMicrosoft · Windows 10 Version 1709. Not in CISA KEV. EPSS 1.0% (higher than 62.6% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1499.004 Application or System Exploitation; T1574 Hijack Execution Flow; T1005 Data from Local System; T1136 Create Account; T1485 Data Destruction; T1565 Data Manipulation. Priority 18.0 of 100.T1499.004T1574T1005T1136T1485T1565https://patchfirst.co/cve/CVE-2020-1111/CVE-2020-1111Thu, 21 May 2020 00:00:00 GMTMicrosoft · Windows 10 Version 1809. Not in CISA KEV. EPSS 1.0% (higher than 61.3% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1068 Exploitation for Privilege Escalation; T1005 Data from Local System; T1136 Create Account; T1485 Data Destruction; T1565 Data Manipulation. Priority 17.7 of 100.T1068T1005T1136T1485T1565https://patchfirst.co/cve/CVE-2020-11010/CVE-2020-11010Mon, 20 Apr 2020 00:00:00 GMTtortoise · tortoise-orm. Not in CISA KEV. EPSS 1.0% (higher than 64.2% of CVEs). CVSS 6.3 MEDIUM. ATT&CK: T1133 External Remote Services; T1059 Command and Scripting Interpreter; T1005 Data from Local System; T1136 Create Account; T1190 Exploit Public-Facing Application; T1505.003 Web Shell; +1 more. Priority 17.2 of 100.T1133T1059T1005T1136T1190T1505.003T1565.001https://patchfirst.co/cve/CVE-2020-0671/CVE-2020-0671Tue, 11 Feb 2020 00:00:00 GMTMicrosoft · Windows. Not in CISA KEV. EPSS 1.4% (higher than 71.8% of CVEs). ATT&CK: T1499.004 Application or System Exploitation; T1574 Hijack Execution Flow; T1005 Data from Local System; T1136 Create Account; T1485 Data Destruction; T1565 Data Manipulation. Priority 15.0 of 100.T1499.004T1574T1005T1136T1485T1565https://patchfirst.co/cve/CVE-2020-5231/CVE-2020-5231Thu, 30 Jan 2020 00:00:00 GMTopencast · opencast. Not in CISA KEV. EPSS 0.6% (higher than 49.9% of CVEs). CVSS 4.8 MEDIUM. ATT&CK: T1078.001 Default Accounts; T1136 Create Account. Priority 13.3 of 100.T1078.001T1136https://patchfirst.co/cve/CVE-2019-18234/CVE-2019-18234Mon, 23 Dec 2019 00:00:00 GMTNot in CISA KEV. EPSS 1.9% (higher than 79.5% of CVEs). ATT&CK: T1133 External Remote Services; T1059 Command and Scripting Interpreter; T1005 Data from Local System; T1136 Create Account; T1190 Exploit Public-Facing Application; T1505.003 Web Shell; +1 more. Priority 15.9 of 100.T1133T1059T1005T1136T1190T1505.003T1565.001https://patchfirst.co/cve/CVE-2019-3758/CVE-2019-3758Wed, 18 Sep 2019 00:00:00 GMTDell · RSA Archer. Not in CISA KEV. EPSS 1.5% (higher than 73.6% of CVEs). CVSS 8.1 HIGH. ATT&CK: T1190 Exploit Public-Facing Application; T1136 Create Account. Priority 20.4 of 100.T1190T1136https://patchfirst.co/cve/CVE-2019-1118/CVE-2019-1118Mon, 29 Jul 2019 00:00:00 GMTMicrosoft · Windows. Not in CISA KEV. EPSS 23.6% (higher than 97.8% of CVEs). Public exploit code exists. ATT&CK: T1189 Drive-by Compromise; T1204.002 Malicious File; T1499.004 Application or System Exploitation; T1574 Hijack Execution Flow; T1005 Data from Local System; T1136 Create Account; +2 more. Priority 24.6 of 100.public-exploitT1189T1204.002T1499.004T1574T1005T1136T1485T1565https://patchfirst.co/cve/CVE-2019-3798/CVE-2019-3798Wed, 17 Apr 2019 00:00:00 GMTCloud Foundry · CAPI-release. Not in CISA KEV. EPSS 1.3% (higher than 71.3% of CVEs). CVSS 6.0 MEDIUM. ATT&CK: T1136 Create Account; T1068 Exploitation for Privilege Escalation. Priority 18.5 of 100.T1136T1068https://patchfirst.co/cve/CVE-2019-0609/CVE-2019-0609Mon, 08 Apr 2019 00:00:00 GMTMicrosoft · Internet Explorer 11. Not in CISA KEV. EPSS 9.8% (higher than 95.6% of CVEs). ATT&CK: T1204.002 Malicious File; T1566 Phishing; T1499.004 Application or System Exploitation; T1574 Hijack Execution Flow; T1005 Data from Local System; T1136 Create Account; +2 more. Priority 19.8 of 100.T1204.002T1566T1499.004T1574T1005T1136T1485T1565https://patchfirst.co/cve/CVE-2018-8575/CVE-2018-8575Wed, 14 Nov 2018 00:00:00 GMTMicrosoft · Microsoft Project. Not in CISA KEV. EPSS 19.5% (higher than 97.4% of CVEs). ATT&CK: T1204.002 Malicious File; T1566 Phishing; T1068 Exploitation for Privilege Escalation; T1005 Data from Local System; T1136 Create Account; T1485 Data Destruction; +1 more. Priority 19.5 of 100.T1204.002T1566T1068T1005T1136T1485T1565https://patchfirst.co/cve/CVE-2018-8353/CVE-2018-8353Wed, 15 Aug 2018 00:00:00 GMTNot in CISA KEV. EPSS 67.3% (higher than 99.3% of CVEs). Public exploit code exists. ATT&CK: T1204.002 Malicious File; T1566 Phishing; T1499.004 Application or System Exploitation; T1574 Hijack Execution Flow; T1005 Data from Local System; T1136 Create Account; +2 more. Priority 24.9 of 100.public-exploitT1204.002T1566T1499.004T1574T1005T1136T1485T1565https://patchfirst.co/cve/CVE-2018-8355/CVE-2018-8355Wed, 15 Aug 2018 00:00:00 GMTMicrosoft · ChakraCore. Not in CISA KEV. EPSS 67.9% (higher than 99.32% of CVEs). Public exploit code exists. ATT&CK: T1189 Drive-by Compromise; T1204.002 Malicious File; T1499.004 Application or System Exploitation; T1574 Hijack Execution Flow; T1005 Data from Local System; T1136 Create Account; +2 more. Priority 24.9 of 100.public-exploitT1189T1204.002T1499.004T1574T1005T1136T1485T1565https://patchfirst.co/cve/CVE-2018-8248/CVE-2018-8248Thu, 14 Jun 2018 00:00:00 GMTMicrosoft · Microsoft Office. Not in CISA KEV. EPSS 21.4% (higher than 97.6% of CVEs). ATT&CK: T1189 Drive-by Compromise; T1204.002 Malicious File; T1499.004 Application or System Exploitation; T1574 Hijack Execution Flow; T1005 Data from Local System; T1136 Create Account; +2 more. Priority 19.5 of 100.T1189T1204.002T1499.004T1574T1005T1136T1485T1565https://patchfirst.co/cve/CVE-2018-8110/CVE-2018-8110Thu, 14 Jun 2018 00:00:00 GMTMicrosoft · Microsoft Edge. Not in CISA KEV. EPSS 16.9% (higher than 97.1% of CVEs). ATT&CK: T1204.002 Malicious File; T1566 Phishing; T1499.004 Application or System Exploitation; T1574 Hijack Execution Flow; T1005 Data from Local System; T1136 Create Account; +2 more. Priority 19.4 of 100.T1204.002T1566T1499.004T1574T1005T1136T1485T1565https://patchfirst.co/cve/CVE-2018-8111/CVE-2018-8111Thu, 14 Jun 2018 00:00:00 GMTMicrosoft · Microsoft Edge. Not in CISA KEV. EPSS 16.9% (higher than 97% of CVEs). ATT&CK: T1204.002 Malicious File; T1566 Phishing; T1499.004 Application or System Exploitation; T1574 Hijack Execution Flow; T1005 Data from Local System; T1136 Create Account; +2 more. Priority 19.4 of 100.T1204.002T1566T1499.004T1574T1005T1136T1485T1565