{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: CVEs linked to T1212 Exploitation for Credential Access","home_page_url":"https://patchfirst.co/technique/T1212/","feed_url":"https://patchfirst.co/feed/technique/T1212.json","description":"New and newly exploited CVEs that lead to ATT&CK T1212 Exploitation for Credential Access, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2023-22894#kev","url":"https://patchfirst.co/cve/CVE-2023-22894/","title":"[KEV] CVE-2023-22894: Strapi Cleartext Storage of Sensitive Information Vulnerability","content_text":"Strapi · Strapi. In CISA KEV since 2026-10-08. ENISA EUVD lists it as exploited. EPSS 4.1% (higher than 90.8% of CVEs). CVSS 4.9 MEDIUM. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1212 Exploitation for Credential Access. Priority 74.6 of 100.","summary":"Strapi Cleartext Storage of Sensitive Information Vulnerability","date_published":"2026-10-08T00:00:00.000Z","date_modified":"2026-10-09T14:20:41.000Z","tags":["kev","public-exploit","T1078","T1212"],"_patchfirst":{"reason":"kev","priority":74.6,"kev":{"dateAdded":"2026-10-08","ransomware":false},"epss":{"score":0.04114,"percentile":0.90767},"cvss":{"score":4.9,"severity":"MEDIUM","version":"3.1"},"vendor":"Strapi","product":"Strapi","techniqueIds":["T1078","T1212"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-48927#kev","url":"https://patchfirst.co/cve/CVE-2025-48927/","title":"[KEV] CVE-2025-48927: TeleMessage TM SGNL Initialization of a Resource with an Insecure Default Vulnerability","content_text":"TeleMessage · TM SGNL. In CISA KEV since 2025-07-01. ENISA EUVD lists it as exploited. EPSS 11.6% (higher than 96% of CVEs). CVSS 5.3 MEDIUM. ATT&CK: T1212 Exploitation for Credential Access; T1005 Data from Local System; T1555 Credentials from Password Stores. Priority 60.9 of 100.","summary":"TeleMessage TM SGNL Initialization of a Resource with an Insecure Default Vulnerability","date_published":"2025-07-01T00:00:00.000Z","date_modified":"2026-06-17T09:30:29.000Z","tags":["kev","T1212","T1005","T1555"],"_patchfirst":{"reason":"kev","priority":60.9,"kev":{"dateAdded":"2025-07-01","ransomware":false},"epss":{"score":0.11567,"percentile":0.96029},"cvss":{"score":5.3,"severity":"MEDIUM","version":"3.1"},"vendor":"TeleMessage","product":"TM SGNL","techniqueIds":["T1212","T1005","T1555"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2025-48928#kev","url":"https://patchfirst.co/cve/CVE-2025-48928/","title":"[KEV] CVE-2025-48928: TeleMessage TM SGNL Exposure of Core Dump File to an Unauthorized Control Sphere Vulnerability","content_text":"TeleMessage · TM SGNL. In CISA KEV since 2025-07-01. ENISA EUVD lists it as exploited. EPSS 0.6% (higher than 47.5% of CVEs). CVSS 4.0 MEDIUM. ATT&CK: T1212 Exploitation for Credential Access; T1005 Data from Local System; T1555 Credentials from Password Stores. Priority 50.3 of 100.","summary":"TeleMessage TM SGNL Exposure of Core Dump File to an Unauthorized Control Sphere Vulnerability","date_published":"2025-07-01T00:00:00.000Z","date_modified":"2026-06-17T09:30:30.000Z","tags":["kev","T1212","T1005","T1555"],"_patchfirst":{"reason":"kev","priority":50.3,"kev":{"dateAdded":"2025-07-01","ransomware":false},"epss":{"score":0.00577,"percentile":0.47534},"cvss":{"score":4,"severity":"MEDIUM","version":"3.1"},"vendor":"TeleMessage","product":"TM SGNL","techniqueIds":["T1212","T1005","T1555"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2024-53704#kev","url":"https://patchfirst.co/cve/CVE-2024-53704/","title":"[KEV] CVE-2024-53704: SonicWall SonicOS SSLVPN Improper Authentication Vulnerability","content_text":"SonicWall · SonicOS. In CISA KEV since 2025-02-18, known ransomware use. ENISA EUVD lists it as exploited. EPSS 95.3% (higher than 99.87% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1199 Trusted Relationship; T1212 Exploitation for Credential Access; T1078.004 Cloud Accounts; T1083 File and Directory Discovery. Priority 79.8 of 100.","summary":"SonicWall SonicOS SSLVPN Improper Authentication Vulnerability","date_published":"2025-02-18T00:00:00.000Z","date_modified":"2026-08-04T05:16:31.000Z","tags":["kev","ransomware","public-exploit","T1199","T1212","T1078.004","T1083"],"_patchfirst":{"reason":"kev","priority":79.8,"kev":{"dateAdded":"2025-02-18","ransomware":true},"epss":{"score":0.95314,"percentile":0.99865},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"SonicWall","product":"SonicOS","techniqueIds":["T1199","T1212","T1078.004","T1083"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2022-22948#kev","url":"https://patchfirst.co/cve/CVE-2022-22948/","title":"[KEV] CVE-2022-22948: VMware vCenter Server Incorrect Default File Permissions Vulnerability","content_text":"VMware · vCenter Server. In CISA KEV since 2024-07-17. ENISA EUVD lists it as exploited. EPSS 13.3% (higher than 96.4% of CVEs). CVSS 6.5 MEDIUM. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1212 Exploitation for Credential Access; T1068 Exploitation for Privilege Escalation. Named in 2 threat reports. Priority 73.0 of 100.","summary":"VMware vCenter Server Incorrect Default File Permissions Vulnerability","date_published":"2024-07-17T00:00:00.000Z","date_modified":"2026-06-17T04:29:13.000Z","tags":["kev","public-exploit","T1078","T1212","T1068"],"_patchfirst":{"reason":"kev","priority":73,"kev":{"dateAdded":"2024-07-17","ransomware":false},"epss":{"score":0.13282,"percentile":0.96384},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.1"},"vendor":"VMware","product":"vCenter Server","techniqueIds":["T1078","T1212","T1068"],"reportCount":2,"hasPublicExploit":true,"euvdExploited":true}}]}