https://patchfirst.co/technique/T1210/New and newly exploited CVEs that lead to ATT&CK T1210 Exploitation of Remote Services, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.en-gb360Sat, 31 Oct 2026 05:11:25 GMThttps://patchfirst.co/cve/CVE-2026-33824/CVE-2026-33824#kevTue, 18 Aug 2026 00:00:00 GMTMicrosoft · Internet Key Exchange (IKE) Service Extensions. In CISA KEV since 2026-08-18. ENISA EUVD lists it as exploited. EPSS 77.1% (higher than 99.55% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1210 Exploitation of Remote Services; T1059 Command and Scripting Interpreter. Priority 74.8 of 100.kevpublic-exploitT1210T1059https://patchfirst.co/cve/CVE-2008-4250/CVE-2008-4250#kevWed, 20 May 2026 00:00:00 GMTMicrosoft · Windows. In CISA KEV since 2026-05-20. ENISA EUVD lists it as exploited. EPSS 98.8% (higher than 99.93% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1059 Command and Scripting Interpreter; T1210 Exploitation of Remote Services. Priority 69.8 of 100.kevpublic-exploitT1059T1210https://patchfirst.co/cve/CVE-2024-37079/CVE-2024-37079#kevFri, 23 Jan 2026 00:00:00 GMTBroadcom · VMware vCenter Server. In CISA KEV since 2026-01-23. ENISA EUVD lists it as exploited. EPSS 22.4% (higher than 97.7% of CVEs). CVSS 9.8 CRITICAL. ATT&CK: T1210 Exploitation of Remote Services; T1059 Command and Scripting Interpreter. Priority 69.4 of 100.kevT1210T1059https://patchfirst.co/cve/CVE-2024-54085/CVE-2024-54085#kevWed, 25 Jun 2025 00:00:00 GMTAMI · MegaRAC SPx. In CISA KEV since 2025-06-25. ENISA EUVD lists it as exploited. EPSS 60.7% (higher than 99.15% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1210 Exploitation of Remote Services; T1495 Firmware Corruption; T1499 Endpoint Denial of Service; T1608.001 Upload Malware. Priority 69.7 of 100.kevpublic-exploitT1068T1210T1495T1499T1608.001https://patchfirst.co/cve/CVE-2020-2551/CVE-2020-2551#kevThu, 16 Nov 2023 00:00:00 GMTOracle · Fusion Middleware. In CISA KEV since 2023-11-16. ENISA EUVD lists it as exploited. EPSS 92.8% (higher than 99.83% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1210 Exploitation of Remote Services. Named in 1 threat report. Priority 73.7 of 100.kevpublic-exploitT1190T1210https://patchfirst.co/cve/CVE-2017-7494/CVE-2017-7494#kevThu, 30 Mar 2023 00:00:00 GMTSamba · Samba. In CISA KEV since 2023-03-30, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.4% (higher than 99.94% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1210 Exploitation of Remote Services; T1059 Command and Scripting Interpreter. Priority 79.8 of 100.kevransomwarepublic-exploitT1210T1059https://patchfirst.co/cve/CVE-2023-0669/CVE-2023-0669#kevFri, 10 Feb 2023 00:00:00 GMTFortra · GoAnywhere MFT. In CISA KEV since 2023-02-10, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 7.2 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1210 Exploitation of Remote Services; T1486 Data Encrypted for Impact. Priority 78.0 of 100.kevransomwarepublic-exploitT1190T1210T1486https://patchfirst.co/cve/CVE-2016-6366/CVE-2016-6366#kevTue, 24 May 2022 00:00:00 GMTCisco · Adaptive Security Appliance (ASA). In CISA KEV since 2022-05-24. ENISA EUVD lists it as exploited. EPSS 87.6% (higher than 99.76% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1210 Exploitation of Remote Services; T1059 Command and Scripting Interpreter. Priority 69.1 of 100.kevpublic-exploitT1210T1059https://patchfirst.co/cve/CVE-2019-3568/CVE-2019-3568#kevTue, 19 Apr 2022 00:00:00 GMTMeta Platforms · WhatsApp. In CISA KEV since 2022-04-19. ENISA EUVD lists it as exploited. EPSS 30.1% (higher than 98.2% of CVEs). CVSS 9.8 CRITICAL. ATT&CK: T1210 Exploitation of Remote Services; T1059 Command and Scripting Interpreter. Priority 64.5 of 100.kevT1210T1059https://patchfirst.co/cve/CVE-2017-0148/CVE-2017-0148#kevWed, 06 Apr 2022 00:00:00 GMTMicrosoft · SMBv1 server. In CISA KEV since 2022-04-06, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.4% (higher than 99.94% of CVEs). CVSS 8.1 HIGH. Public exploit code exists. ATT&CK: T1210 Exploitation of Remote Services; T1059 Command and Scripting Interpreter. Priority 78.7 of 100.kevransomwarepublic-exploitT1210T1059https://patchfirst.co/cve/CVE-2017-0146/CVE-2017-0146#kevFri, 25 Mar 2022 00:00:00 GMTMicrosoft · Windows. In CISA KEV since 2022-03-25, known ransomware use. ENISA EUVD lists it as exploited. EPSS 89.8% (higher than 99.79% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1210 Exploitation of Remote Services; T1059 Command and Scripting Interpreter. Priority 79.1 of 100.kevransomwarepublic-exploitT1210T1059https://patchfirst.co/cve/CVE-2018-0167/CVE-2018-0167#kevThu, 03 Mar 2022 00:00:00 GMTCisco · IOS, XR, and XE Software. In CISA KEV since 2022-03-03. ENISA EUVD lists it as exploited. EPSS 3.4% (higher than 88.7% of CVEs). CVSS 8.8 HIGH. ATT&CK: T1210 Exploitation of Remote Services; T1059 Command and Scripting Interpreter; T1499.004 Application or System Exploitation. Priority 61.9 of 100.kevT1210T1059T1499.004https://patchfirst.co/cve/CVE-2016-8562/CVE-2016-8562#kevThu, 03 Mar 2022 00:00:00 GMTSiemens · SIMATIC CP. In CISA KEV since 2022-03-03. ENISA EUVD lists it as exploited. EPSS 3.6% (higher than 89.5% of CVEs). CVSS 7.5 HIGH. ATT&CK: T1210 Exploitation of Remote Services; T1499.004 Application or System Exploitation. Priority 61.1 of 100.kevT1210T1499.004https://patchfirst.co/cve/CVE-2017-6663/CVE-2017-6663#kevThu, 03 Mar 2022 00:00:00 GMTCisco · IOS and IOS XE Software. In CISA KEV since 2022-03-03. ENISA EUVD lists it as exploited. EPSS 2.1% (higher than 81.8% of CVEs). CVSS 6.5 MEDIUM. ATT&CK: T1210 Exploitation of Remote Services; T1499.004 Application or System Exploitation. Priority 58.9 of 100.kevT1210T1499.004https://patchfirst.co/cve/CVE-2017-0144/CVE-2017-0144#kevThu, 10 Feb 2022 00:00:00 GMTMicrosoft · SMBv1. In CISA KEV since 2022-02-10, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.2% (higher than 99.94% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1210 Exploitation of Remote Services; T1059 Command and Scripting Interpreter. Named in 3 threat reports. Priority 86.9 of 100.kevransomwarepublic-exploitT1210T1059https://patchfirst.co/cve/CVE-2017-0145/CVE-2017-0145#kevThu, 10 Feb 2022 00:00:00 GMTMicrosoft · SMBv1. In CISA KEV since 2022-02-10, known ransomware use. ENISA EUVD lists it as exploited. EPSS 89.8% (higher than 99.79% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1210 Exploitation of Remote Services; T1059 Command and Scripting Interpreter. Priority 79.1 of 100.kevransomwarepublic-exploitT1210T1059https://patchfirst.co/cve/CVE-2021-42013/CVE-2021-42013#kevWed, 03 Nov 2021 00:00:00 GMTApache · HTTP Server. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.98% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1210 Exploitation of Remote Services; T1059 Command and Scripting Interpreter. Named in 1 threat report. Priority 83.7 of 100.kevransomwarepublic-exploitT1210T1059https://patchfirst.co/cve/CVE-2021-41773/CVE-2021-41773#kevWed, 03 Nov 2021 00:00:00 GMTApache · HTTP Server. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1210 Exploitation of Remote Services; T1059 Command and Scripting Interpreter. Priority 79.9 of 100.kevransomwarepublic-exploitT1210T1059https://patchfirst.co/cve/CVE-2020-3992/CVE-2020-3992#kevWed, 03 Nov 2021 00:00:00 GMTVMware · ESXi. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 83.0% (higher than 99.67% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1210 Exploitation of Remote Services. Priority 79.8 of 100.kevransomwarepublic-exploitT1210https://patchfirst.co/cve/CVE-2018-0171/CVE-2018-0171#kevWed, 03 Nov 2021 00:00:00 GMTCisco · IOS and IOS XE. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 99.5% (higher than 99.94% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1210 Exploitation of Remote Services; T1059 Command and Scripting Interpreter; T1499.004 Application or System Exploitation. Named in 2 threat reports. Priority 76.0 of 100.kevpublic-exploitT1210T1059T1499.004https://patchfirst.co/cve/CVE-2020-3118/CVE-2020-3118#kevWed, 03 Nov 2021 00:00:00 GMTCisco · IOS XR. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 11.7% (higher than 96.1% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1210 Exploitation of Remote Services; T1059 Command and Scripting Interpreter. Priority 68.4 of 100.kevpublic-exploitT1210T1059