https://patchfirst.co/technique/T1211/New and newly exploited CVEs that lead to ATT&CK T1211 Exploitation for Stealth, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.en-gb360Sat, 31 Oct 2026 05:11:25 GMThttps://patchfirst.co/cve/CVE-2026-58704/CVE-2026-58704#kevWed, 16 Sep 2026 00:00:00 GMTGoogle · Pixel. In CISA KEV since 2026-09-16. ENISA EUVD lists it as exploited. EPSS 0.6% (higher than 49.9% of CVEs). CVSS 8.8 HIGH. ATT&CK: T1211 Exploitation for Stealth; T1068 Exploitation for Privilege Escalation. Priority 64.1 of 100.kevT1211T1068https://patchfirst.co/cve/CVE-2026-21510/CVE-2026-21510#kevTue, 10 Feb 2026 00:00:00 GMTMicrosoft · Windows. In CISA KEV since 2026-02-10. ENISA EUVD lists it as exploited. EPSS 61.2% (higher than 99.16% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1211 Exploitation for Stealth; T1553 Subvert Trust Controls. Priority 74.0 of 100.kevpublic-exploitT1211T1553https://patchfirst.co/cve/CVE-2026-21514/CVE-2026-21514#kevTue, 10 Feb 2026 00:00:00 GMTMicrosoft · Office. In CISA KEV since 2026-02-10. ENISA EUVD lists it as exploited. EPSS 1.6% (higher than 75.6% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1204.002 Malicious File; T1211 Exploitation for Stealth. Priority 68.6 of 100.kevpublic-exploitT1204.002T1211https://patchfirst.co/cve/CVE-2026-21509/CVE-2026-21509#kevMon, 26 Jan 2026 00:00:00 GMTMicrosoft · Office. In CISA KEV since 2026-01-26. ENISA EUVD lists it as exploited. EPSS 70.8% (higher than 99.4% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1204.002 Malicious File; T1211 Exploitation for Stealth. Priority 73.3 of 100.kevpublic-exploitT1204.002T1211https://patchfirst.co/cve/CVE-2025-26633/CVE-2025-26633#kevTue, 11 Mar 2025 00:00:00 GMTMicrosoft · Windows. In CISA KEV since 2025-03-11, known ransomware use. ENISA EUVD lists it as exploited. EPSS 30.4% (higher than 98.2% of CVEs). CVSS 7.0 HIGH. Public exploit code exists. ATT&CK: T1211 Exploitation for Stealth; T1059 Command and Scripting Interpreter. Priority 77.5 of 100.kevransomwarepublic-exploitT1211T1059https://patchfirst.co/cve/CVE-2025-24200/CVE-2025-24200#kevWed, 12 Feb 2025 00:00:00 GMTApple · iOS and iPadOS. In CISA KEV since 2025-02-12. ENISA EUVD lists it as exploited. EPSS 4.5% (higher than 91.4% of CVEs). CVSS 6.1 MEDIUM. ATT&CK: T1211 Exploitation for Stealth; T1005 Data from Local System. Priority 60.6 of 100.kevT1211T1005https://patchfirst.co/cve/CVE-2024-30040/CVE-2024-30040#kevTue, 14 May 2024 00:00:00 GMTMicrosoft · Windows. In CISA KEV since 2024-05-14. ENISA EUVD lists it as exploited. EPSS 3.9% (higher than 90.4% of CVEs). CVSS 8.8 HIGH. ATT&CK: T1204.001 Malicious Link; T1211 Exploitation for Stealth. Priority 62.2 of 100.kevT1204.001T1211https://patchfirst.co/cve/CVE-2024-23296/CVE-2024-23296#kevWed, 06 Mar 2024 00:00:00 GMTApple · Multiple Products. In CISA KEV since 2024-03-06. ENISA EUVD lists it as exploited. EPSS 1.4% (higher than 72.7% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1211 Exploitation for Stealth. Priority 63.0 of 100.kevpublic-exploitT1068T1211https://patchfirst.co/cve/CVE-2024-23225/CVE-2024-23225#kevWed, 06 Mar 2024 00:00:00 GMTApple · Multiple Products. In CISA KEV since 2024-03-06. ENISA EUVD lists it as exploited. EPSS 1.5% (higher than 73.9% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1068 Exploitation for Privilege Escalation; T1211 Exploitation for Stealth. Priority 58.2 of 100.kevT1068T1211https://patchfirst.co/cve/CVE-2023-21237/CVE-2023-21237#kevTue, 05 Mar 2024 00:00:00 GMTAndroid · Pixel. In CISA KEV since 2024-03-05. ENISA EUVD lists it as exploited. EPSS 0.3% (higher than 18.5% of CVEs). CVSS 5.5 MEDIUM. ATT&CK: T1211 Exploitation for Stealth; T1005 Data from Local System. Priority 45.6 of 100.kevT1211T1005https://patchfirst.co/cve/CVE-2022-48618/CVE-2022-48618#kevWed, 31 Jan 2024 00:00:00 GMTApple · Multiple Products. In CISA KEV since 2024-01-31. ENISA EUVD lists it as exploited. EPSS 0.5% (higher than 41.9% of CVEs). CVSS 7.0 HIGH. ATT&CK: T1068 Exploitation for Privilege Escalation; T1211 Exploitation for Stealth. Priority 51.3 of 100.kevT1068T1211https://patchfirst.co/cve/CVE-2023-36025/CVE-2023-36025#kevTue, 14 Nov 2023 00:00:00 GMTMicrosoft · Windows. In CISA KEV since 2023-11-14. ENISA EUVD lists it as exploited. EPSS 88.1% (higher than 99.77% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1204.001 Malicious Link; T1211 Exploitation for Stealth. Priority 79.1 of 100.kevpublic-exploitT1204.001T1211https://patchfirst.co/cve/CVE-2022-22265/CVE-2022-22265#kevMon, 18 Sep 2023 00:00:00 GMTSamsung · Mobile Devices. In CISA KEV since 2023-09-18. ENISA EUVD lists it as exploited. EPSS 0.4% (higher than 33% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1068 Exploitation for Privilege Escalation; T1211 Exploitation for Stealth. Priority 50.1 of 100.kevT1068T1211https://patchfirst.co/cve/CVE-2023-38606/CVE-2023-38606Thu, 27 Jul 2023 00:00:00 GMTApple · Multiple Products. In CISA KEV since 2023-07-26. ENISA EUVD lists it as exploited. EPSS 2.9% (higher than 86.9% of CVEs). CVSS 5.5 MEDIUM. ATT&CK: T1068 Exploitation for Privilege Escalation; T1211 Exploitation for Stealth. Priority 59.2 of 100.kevT1068T1211https://patchfirst.co/cve/CVE-2023-35311/CVE-2023-35311#kevTue, 11 Jul 2023 00:00:00 GMTMicrosoft · Outlook. In CISA KEV since 2023-07-11. ENISA EUVD lists it as exploited. EPSS 15.5% (higher than 96.8% of CVEs). CVSS 8.8 HIGH. ATT&CK: T1204.001 Malicious Link; T1211 Exploitation for Stealth. Priority 63.5 of 100.kevT1204.001T1211https://patchfirst.co/cve/CVE-2021-25395/CVE-2021-25395#kevThu, 29 Jun 2023 00:00:00 GMTSamsung · Mobile Devices. In CISA KEV since 2023-06-29. ENISA EUVD lists it as exploited. EPSS 0.4% (higher than 30.5% of CVEs). CVSS 6.4 MEDIUM. ATT&CK: T1068 Exploitation for Privilege Escalation; T1211 Exploitation for Stealth. Priority 48.6 of 100.kevT1068T1211https://patchfirst.co/cve/CVE-2023-32409/CVE-2023-32409Fri, 23 Jun 2023 00:00:00 GMTApple · Multiple Products. In CISA KEV since 2023-05-22. ENISA EUVD lists it as exploited. EPSS 16.5% (higher than 97% of CVEs). CVSS 8.6 HIGH. ATT&CK: T1211 Exploitation for Stealth. Priority 63.4 of 100.kevT1211https://patchfirst.co/cve/CVE-2022-44698/CVE-2022-44698#kevTue, 13 Dec 2022 00:00:00 GMTMicrosoft · Defender. In CISA KEV since 2022-12-13, known ransomware use. ENISA EUVD lists it as exploited. EPSS 76.3% (higher than 99.54% of CVEs). CVSS 5.4 MEDIUM. ATT&CK: T1204.002 Malicious File; T1211 Exploitation for Stealth. Named in 1 threat report. Priority 75.6 of 100.kevransomwareT1204.002T1211https://patchfirst.co/cve/CVE-2022-4135/CVE-2022-4135#kevMon, 28 Nov 2022 00:00:00 GMTGoogle · Chromium GPU. In CISA KEV since 2022-11-28. ENISA EUVD lists it as exploited. EPSS 31.9% (higher than 98.3% of CVEs). CVSS 9.6 CRITICAL. Public exploit code exists. ATT&CK: T1189 Drive-by Compromise; T1211 Exploitation for Stealth. Priority 69.4 of 100.kevpublic-exploitT1189T1211https://patchfirst.co/cve/CVE-2021-31010/CVE-2021-31010#kevThu, 25 Aug 2022 00:00:00 GMTApple · iOS, macOS, watchOS. In CISA KEV since 2022-08-25. ENISA EUVD lists it as exploited. EPSS 3.7% (higher than 89.6% of CVEs). CVSS 7.5 HIGH. ATT&CK: T1211 Exploitation for Stealth; T1068 Exploitation for Privilege Escalation. Priority 61.2 of 100.kevT1211T1068https://patchfirst.co/cve/CVE-2020-3837/CVE-2020-3837#kevMon, 27 Jun 2022 00:00:00 GMTApple · Multiple Products. In CISA KEV since 2022-06-27. ENISA EUVD lists it as exploited. EPSS 14.8% (higher than 96.7% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1211 Exploitation for Stealth; T1068 Exploitation for Privilege Escalation. Priority 67.8 of 100.kevpublic-exploitT1211T1068https://patchfirst.co/cve/CVE-2021-30983/CVE-2021-30983#kevMon, 27 Jun 2022 00:00:00 GMTApple · iOS and iPadOS. In CISA KEV since 2022-06-27. ENISA EUVD lists it as exploited. EPSS 2.9% (higher than 87% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1211 Exploitation for Stealth; T1068 Exploitation for Privilege Escalation. Priority 60.9 of 100.kevT1211T1068https://patchfirst.co/cve/CVE-2010-0738/CVE-2010-0738#kevWed, 25 May 2022 00:00:00 GMTRed Hat · JBoss. In CISA KEV since 2022-05-25, known ransomware use. ENISA EUVD lists it as exploited. EPSS 73.8% (higher than 99.48% of CVEs). CVSS 5.3 MEDIUM. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1211 Exploitation for Stealth. Priority 76.6 of 100.kevransomwarepublic-exploitT1190T1211https://patchfirst.co/cve/CVE-2015-0016/CVE-2015-0016#kevWed, 25 May 2022 00:00:00 GMTMicrosoft · Windows. In CISA KEV since 2022-05-25. ENISA EUVD lists it as exploited. EPSS 75.8% (higher than 99.52% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1211 Exploitation for Stealth; T1068 Exploitation for Privilege Escalation. Priority 68.4 of 100.kevpublic-exploitT1211T1068https://patchfirst.co/cve/CVE-2013-2423/CVE-2013-2423#kevWed, 25 May 2022 00:00:00 GMTOracle · Java Runtime Environment (JRE). In CISA KEV since 2022-05-25. ENISA EUVD lists it as exploited. EPSS 85.2% (higher than 99.72% of CVEs). CVSS 3.7 LOW. Public exploit code exists. ATT&CK: T1211 Exploitation for Stealth. Named in 1 threat report. Priority 64.4 of 100.kevpublic-exploitT1211https://patchfirst.co/cve/CVE-2013-0431/CVE-2013-0431#kevWed, 25 May 2022 00:00:00 GMTOracle · Java Runtime Environment (JRE). In CISA KEV since 2022-05-25, known ransomware use. ENISA EUVD lists it as exploited. EPSS 90.1% (higher than 99.8% of CVEs). CVSS 3.7 LOW. Public exploit code exists. ATT&CK: T1211 Exploitation for Stealth. Priority 60.5 of 100.kevransomwarepublic-exploitT1211https://patchfirst.co/cve/CVE-2015-0071/CVE-2015-0071#kevWed, 25 May 2022 00:00:00 GMTMicrosoft · Internet Explorer. In CISA KEV since 2022-05-25. ENISA EUVD lists it as exploited. EPSS 33.6% (higher than 98.4% of CVEs). CVSS 6.5 MEDIUM. ATT&CK: T1211 Exploitation for Stealth; T1189 Drive-by Compromise. Priority 47.2 of 100.kevT1211T1189https://patchfirst.co/cve/CVE-2021-30883/CVE-2021-30883#kevMon, 23 May 2022 00:00:00 GMTApple · Multiple Products. In CISA KEV since 2022-05-23. ENISA EUVD lists it as exploited. EPSS 14.7% (higher than 96.7% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1211 Exploitation for Stealth; T1068 Exploitation for Privilege Escalation. Priority 62.8 of 100.kevT1211T1068https://patchfirst.co/cve/CVE-2022-21999/CVE-2022-21999#kevFri, 25 Mar 2022 00:00:00 GMTMicrosoft · Windows. In CISA KEV since 2022-03-25, known ransomware use. ENISA EUVD lists it as exploited. EPSS 41.0% (higher than 98.7% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1068 Exploitation for Privilege Escalation; T1059 Command and Scripting Interpreter; T1136.001 Local Account; T1211 Exploitation for Stealth. Priority 78.2 of 100.kevransomwarepublic-exploitT1078T1068T1059T1136.001T1211https://patchfirst.co/cve/CVE-2012-0507/CVE-2012-0507#kevThu, 03 Mar 2022 00:00:00 GMTOracle · Java SE. In CISA KEV since 2022-03-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 98.2% (higher than 99.91% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1211 Exploitation for Stealth; T1499.004 Application or System Exploitation. Named in 2 threat reports. Priority 86.0 of 100.kevransomwarepublic-exploitT1190T1211T1499.004https://patchfirst.co/cve/CVE-2021-42292/CVE-2021-42292#kevWed, 17 Nov 2021 00:00:00 GMTMicrosoft · Office. In CISA KEV since 2021-11-17. ENISA EUVD lists it as exploited. EPSS 43.0% (higher than 98.7% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1204.002 Malicious File; T1211 Exploitation for Stealth. Priority 68.2 of 100.kevpublic-exploitT1204.002T1211https://patchfirst.co/cve/CVE-2019-16256/CVE-2019-16256#kevWed, 03 Nov 2021 00:00:00 GMTSIMalliance · Toolbox Browser. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 4.9% (higher than 92.2% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1211 Exploitation for Stealth; T1005 Data from Local System; T1059 Command and Scripting Interpreter. Priority 68.3 of 100.kevpublic-exploitT1211T1005T1059https://patchfirst.co/cve/CVE-2020-1464/CVE-2020-1464#kevWed, 03 Nov 2021 00:00:00 GMTMicrosoft · Windows. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 38.9% (higher than 98.6% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1211 Exploitation for Stealth; T1553 Subvert Trust Controls. Priority 68.2 of 100.kevpublic-exploitT1211T1553https://patchfirst.co/cve/CVE-2021-30633/CVE-2021-30633#kevWed, 03 Nov 2021 00:00:00 GMTGoogle · Chromium Indexed DB API. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 33.2% (higher than 98.4% of CVEs). CVSS 9.6 CRITICAL. ATT&CK: T1189 Drive-by Compromise; T1211 Exploitation for Stealth. Priority 64.4 of 100.kevT1189T1211https://patchfirst.co/cve/CVE-2021-37973/CVE-2021-37973#kevWed, 03 Nov 2021 00:00:00 GMTGoogle · Chromium Portals. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 11.7% (higher than 96.1% of CVEs). CVSS 9.6 CRITICAL. ATT&CK: T1189 Drive-by Compromise; T1211 Exploitation for Stealth. Priority 63.9 of 100.kevT1189T1211https://patchfirst.co/cve/CVE-2020-1040/CVE-2020-1040#kevWed, 03 Nov 2021 00:00:00 GMTMicrosoft · Hyper-V RemoteFX. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 7.4% (higher than 94.4% of CVEs). CVSS 9.0 CRITICAL. ATT&CK: T1211 Exploitation for Stealth; T1059 Command and Scripting Interpreter. Priority 63.2 of 100.kevT1211T1059https://patchfirst.co/cve/CVE-2020-3244/CVE-2020-3244Thu, 18 Jun 2020 00:00:00 GMTCisco · Cisco ASR 5000 Series Software. Not in CISA KEV. EPSS 1.0% (higher than 63.1% of CVEs). CVSS 5.3 MEDIUM. ATT&CK: T1190 Exploit Public-Facing Application; T1211 Exploitation for Stealth. Priority 16.3 of 100.T1190T1211https://patchfirst.co/cve/CVE-2020-11019/CVE-2020-11019Fri, 29 May 2020 00:00:00 GMTFreeRDP · FreeRDP. Not in CISA KEV. EPSS 2.3% (higher than 83.1% of CVEs). CVSS 4.3 MEDIUM. Public exploit code exists. ATT&CK: T1005 Data from Local System; T1499.004 Application or System Exploitation; T1211 Exploitation for Stealth. Priority 24.6 of 100.public-exploitT1005T1499.004T1211https://patchfirst.co/cve/CVE-2020-11087/CVE-2020-11087Fri, 29 May 2020 00:00:00 GMTFreeRDP · FreeRDP. Not in CISA KEV. EPSS 1.4% (higher than 72.9% of CVEs). CVSS 3.1 LOW. ATT&CK: T1005 Data from Local System; T1211 Exploitation for Stealth. Priority 16.7 of 100.T1005T1211https://patchfirst.co/cve/CVE-2020-1141/CVE-2020-1141Thu, 21 May 2020 00:00:00 GMTMicrosoft · Windows 10 Version 1507. Not in CISA KEV. EPSS 2.0% (higher than 80.9% of CVEs). CVSS 5.5 MEDIUM. ATT&CK: T1005 Data from Local System; T1211 Exploitation for Stealth. Priority 20.0 of 100.T1005T1211https://patchfirst.co/cve/CVE-2013-2460/CVE-2013-2460Tue, 18 Jun 2013 00:00:00 GMTNot in CISA KEV. EPSS 70.0% (higher than 99.38% of CVEs). Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1211 Exploitation for Stealth. Named in 2 threat reports. Priority 67.4 of 100.public-exploitT1190T1211