{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: CVEs linked to T1486 Data Encrypted for Impact","home_page_url":"https://patchfirst.co/technique/T1486/","feed_url":"https://patchfirst.co/feed/technique/T1486.json","description":"New and newly exploited CVEs that lead to ATT&CK T1486 Data Encrypted for Impact, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2023-38831#kev","url":"https://patchfirst.co/cve/CVE-2023-38831/","title":"[KEV] CVE-2023-38831: RARLAB WinRAR Code Execution Vulnerability","content_text":"RARLAB · WinRAR. In CISA KEV since 2023-08-24, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.8% (higher than 99.96% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1204 User Execution; T1005 Data from Local System; T1041 Exfiltration Over C2 Channel; T1053 Scheduled Task/Job; T1105 Ingress Tool Transfer; T1112 Modify Registry; +1 more. Named in 1 threat report. Priority 82.3 of 100.","summary":"RARLAB WinRAR Code Execution Vulnerability","date_published":"2023-08-24T00:00:00.000Z","date_modified":"2026-08-05T05:16:38.000Z","tags":["kev","ransomware","public-exploit","T1204","T1005","T1041","T1053","T1105","T1112","T1486"],"_patchfirst":{"reason":"kev","priority":82.3,"kev":{"dateAdded":"2023-08-24","ransomware":true},"epss":{"score":0.99815,"percentile":0.99959},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"RARLAB","product":"WinRAR","techniqueIds":["T1204","T1005","T1041","T1053","T1105","T1112","T1486"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-27532#kev","url":"https://patchfirst.co/cve/CVE-2023-27532/","title":"[KEV] CVE-2023-27532: Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function Vulnerability","content_text":"Veeam · Backup & Replication. In CISA KEV since 2023-08-22, known ransomware use. ENISA EUVD lists it as exploited. EPSS 80.6% (higher than 99.62% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1133 External Remote Services; T1059.003 Windows Command Shell; T1087 Account Discovery; T1087.001 Local Account; T1486 Data Encrypted for Impact; T1555 Credentials from Password Stores. Named in 1 threat report. Priority 82.0 of 100.","summary":"Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function Vulnerability","date_published":"2023-08-22T00:00:00.000Z","date_modified":"2026-06-17T05:45:24.000Z","tags":["kev","ransomware","public-exploit","T1133","T1059.003","T1087","T1087.001","T1486","T1555"],"_patchfirst":{"reason":"kev","priority":82,"kev":{"dateAdded":"2023-08-22","ransomware":true},"epss":{"score":0.80599,"percentile":0.99624},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"Veeam","product":"Backup & Replication","techniqueIds":["T1133","T1059.003","T1087","T1087.001","T1486","T1555"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-36884#kev","url":"https://patchfirst.co/cve/CVE-2023-36884/","title":"[KEV] CVE-2023-36884: Microsoft Windows Search Remote Code Execution Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2023-07-17, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.4% (higher than 99.94% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1566 Phishing; T1204.002 Malicious File; T1005 Data from Local System; T1486 Data Encrypted for Impact; T1489 Service Stop; T1490 Inhibit System Recovery; +1 more. Priority 78.2 of 100.","summary":"Microsoft Windows Search Remote Code Execution Vulnerability","date_published":"2023-07-17T00:00:00.000Z","date_modified":"2026-08-10T16:18:30.000Z","tags":["kev","ransomware","public-exploit","T1566","T1204.002","T1005","T1486","T1489","T1490","T1553.005"],"_patchfirst":{"reason":"kev","priority":78.2,"kev":{"dateAdded":"2023-07-17","ransomware":true},"epss":{"score":0.99439,"percentile":0.99942},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1566","T1204.002","T1005","T1486","T1489","T1490","T1553.005"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-45046#kev","url":"https://patchfirst.co/cve/CVE-2021-45046/","title":"[KEV] CVE-2021-45046: Apache Log4j2 Deserialization of Untrusted Data Vulnerability","content_text":"Apache · Log4j2. In CISA KEV since 2023-05-01, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.98% of CVEs). CVSS 9.0 CRITICAL. Public exploit code exists. ATT&CK: T1059 Command and Scripting Interpreter; T1486 Data Encrypted for Impact. Named in 2 threat reports. Priority 85.4 of 100.","summary":"Apache Log4j2 Deserialization of Untrusted Data Vulnerability","date_published":"2023-05-01T00:00:00.000Z","date_modified":"2026-06-17T04:13:05.000Z","tags":["kev","ransomware","public-exploit","T1059","T1486"],"_patchfirst":{"reason":"kev","priority":85.4,"kev":{"dateAdded":"2023-05-01","ransomware":true},"epss":{"score":0.99977,"percentile":0.9998},"cvss":{"score":9,"severity":"CRITICAL","version":"3.1"},"vendor":"Apache","product":"Log4j2","techniqueIds":["T1059","T1486"],"reportCount":2,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-28252#kev","url":"https://patchfirst.co/cve/CVE-2023-28252/","title":"[KEV] CVE-2023-28252: Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2023-04-11, known ransomware use. ENISA EUVD lists it as exploited. EPSS 48.9% (higher than 98.9% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1068 Exploitation for Privilege Escalation; T1003 OS Credential Dumping; T1021 Remote Services; T1059 Command and Scripting Interpreter; T1136 Create Account; +1 more. Priority 78.2 of 100.","summary":"Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability","date_published":"2023-04-11T00:00:00.000Z","date_modified":"2026-06-17T05:47:14.000Z","tags":["kev","ransomware","public-exploit","T1078","T1068","T1003","T1021","T1059","T1136","T1486"],"_patchfirst":{"reason":"kev","priority":78.2,"kev":{"dateAdded":"2023-04-11","ransomware":true},"epss":{"score":0.48892,"percentile":0.98877},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1078","T1068","T1003","T1021","T1059","T1136","T1486"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-0669#kev","url":"https://patchfirst.co/cve/CVE-2023-0669/","title":"[KEV] CVE-2023-0669: Fortra GoAnywhere MFT Remote Code Execution Vulnerability","content_text":"Fortra · GoAnywhere MFT. In CISA KEV since 2023-02-10, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 7.2 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1210 Exploitation of Remote Services; T1486 Data Encrypted for Impact. Priority 78.0 of 100.","summary":"Fortra GoAnywhere MFT Remote Code Execution Vulnerability","date_published":"2023-02-10T00:00:00.000Z","date_modified":"2026-08-06T05:16:38.000Z","tags":["kev","ransomware","public-exploit","T1190","T1210","T1486"],"_patchfirst":{"reason":"kev","priority":78,"kev":{"dateAdded":"2023-02-10","ransomware":true},"epss":{"score":0.99999,"percentile":0.99996},"cvss":{"score":7.2,"severity":"HIGH","version":"3.1"},"vendor":"Fortra","product":"GoAnywhere MFT","techniqueIds":["T1190","T1210","T1486"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2015-8651#kev","url":"https://patchfirst.co/cve/CVE-2015-8651/","title":"[KEV] CVE-2015-8651: Adobe Flash Player Integer Overflow Vulnerability","content_text":"Adobe · Flash Player. In CISA KEV since 2022-05-25. ENISA EUVD lists it as exploited. EPSS 67.7% (higher than 99.31% of CVEs). CVSS 8.8 HIGH. ATT&CK: T1189 Drive-by Compromise; T1105 Ingress Tool Transfer; T1486 Data Encrypted for Impact. Named in 3 threat reports. Priority 81.8 of 100.","summary":"Adobe Flash Player Integer Overflow Vulnerability","date_published":"2022-05-25T00:00:00.000Z","date_modified":"2026-06-17T00:34:57.000Z","tags":["kev","T1189","T1105","T1486"],"_patchfirst":{"reason":"kev","priority":81.8,"kev":{"dateAdded":"2022-05-25","ransomware":false},"epss":{"score":0.67698,"percentile":0.99314},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Adobe","product":"Flash Player","techniqueIds":["T1189","T1105","T1486"],"reportCount":3,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2022-22947#kev","url":"https://patchfirst.co/cve/CVE-2022-22947/","title":"[KEV] CVE-2022-22947: VMware Spring Cloud Gateway Code Injection Vulnerability","content_text":"VMware · Spring Cloud Gateway. In CISA KEV since 2022-05-16. ENISA EUVD lists it as exploited. EPSS 98.3% (higher than 99.92% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1486 Data Encrypted for Impact. Priority 70.0 of 100.","summary":"VMware Spring Cloud Gateway Code Injection Vulnerability","date_published":"2022-05-16T00:00:00.000Z","date_modified":"2026-06-17T04:29:13.000Z","tags":["kev","public-exploit","T1190","T1059","T1486"],"_patchfirst":{"reason":"kev","priority":70,"kev":{"dateAdded":"2022-05-16","ransomware":false},"epss":{"score":0.98253,"percentile":0.99916},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"VMware","product":"Spring Cloud Gateway","techniqueIds":["T1190","T1059","T1486"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2009-3960#kev","url":"https://patchfirst.co/cve/CVE-2009-3960/","title":"[KEV] CVE-2009-3960: Adobe BlazeDS Information Disclosure Vulnerability","content_text":"Adobe · BlazeDS. In CISA KEV since 2022-03-07, known ransomware use. ENISA EUVD lists it as exploited. EPSS 90.1% (higher than 99.8% of CVEs). CVSS 6.5 MEDIUM. Public exploit code exists. ATT&CK: T1486 Data Encrypted for Impact. Priority 77.5 of 100.","summary":"Adobe BlazeDS Information Disclosure Vulnerability","date_published":"2022-03-07T00:00:00.000Z","date_modified":"2026-08-06T05:16:33.000Z","tags":["kev","ransomware","public-exploit","T1486"],"_patchfirst":{"reason":"kev","priority":77.5,"kev":{"dateAdded":"2022-03-07","ransomware":true},"epss":{"score":0.90118,"percentile":0.99795},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.1"},"vendor":"Adobe","product":"BlazeDS","techniqueIds":["T1486"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2016-1019#kev","url":"https://patchfirst.co/cve/CVE-2016-1019/","title":"[KEV] CVE-2016-1019: Adobe Flash Player Arbitrary Code Execution Vulnerability","content_text":"Adobe · Flash Player. In CISA KEV since 2022-03-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 22.3% (higher than 97.7% of CVEs). CVSS 9.8 CRITICAL. ATT&CK: T1105 Ingress Tool Transfer; T1486 Data Encrypted for Impact. Named in 4 threat reports. Priority 83.4 of 100.","summary":"Adobe Flash Player Arbitrary Code Execution Vulnerability","date_published":"2022-03-03T00:00:00.000Z","date_modified":"2026-10-01T20:17:16.000Z","tags":["kev","ransomware","T1105","T1486"],"_patchfirst":{"reason":"kev","priority":83.4,"kev":{"dateAdded":"2022-03-03","ransomware":true},"epss":{"score":0.22316,"percentile":0.97683},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Adobe","product":"Flash Player","techniqueIds":["T1105","T1486"],"reportCount":4,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2021-44228#kev","url":"https://patchfirst.co/cve/CVE-2021-44228/","title":"[KEV] CVE-2021-44228: Apache Log4j2 Remote Code Execution Vulnerability","content_text":"Apache · Log4j2. In CISA KEV since 2021-12-10, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1486 Data Encrypted for Impact; T1496 Resource Hijacking; T1505.003 Web Shell; T1608.001 Upload Malware. Named in 10 threat reports. Priority 90.0 of 100.","summary":"Apache Log4j2 Remote Code Execution Vulnerability","date_published":"2021-12-10T00:00:00.000Z","date_modified":"2026-08-11T19:33:44.000Z","tags":["kev","ransomware","public-exploit","T1190","T1486","T1496","T1505.003","T1608.001"],"_patchfirst":{"reason":"kev","priority":90,"kev":{"dateAdded":"2021-12-10","ransomware":true},"epss":{"score":0.99999,"percentile":1},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"Apache","product":"Log4j2","techniqueIds":["T1190","T1486","T1496","T1505.003","T1608.001"],"reportCount":10,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-34473#kev","url":"https://patchfirst.co/cve/CVE-2021-34473/","title":"[KEV] CVE-2021-34473: Microsoft Exchange Server Remote Code Execution Vulnerability","content_text":"Microsoft · Exchange Server. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 9.1 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1053.005 Scheduled Task; T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol; T1136 Create Account; T1486 Data Encrypted for Impact. Named in 9 threat reports. Priority 89.4 of 100.","summary":"Microsoft Exchange Server Remote Code Execution Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-08-10T19:58:52.000Z","tags":["kev","ransomware","public-exploit","T1190","T1053.005","T1048.003","T1136","T1486"],"_patchfirst":{"reason":"kev","priority":89.4,"kev":{"dateAdded":"2021-11-03","ransomware":true},"epss":{"score":0.99999,"percentile":0.99996},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1"},"vendor":"Microsoft","product":"Exchange Server","techniqueIds":["T1190","T1053.005","T1048.003","T1136","T1486"],"reportCount":9,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2020-1472#kev","url":"https://patchfirst.co/cve/CVE-2020-1472/","title":"[KEV] CVE-2020-1472: Microsoft Netlogon Privilege Escalation Vulnerability","content_text":"Microsoft · Netlogon. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.4% (higher than 99.94% of CVEs). CVSS 5.5 MEDIUM. Public exploit code exists. ATT&CK: T1110 Brute Force; T1133 External Remote Services; T1021 Remote Services; T1068 Exploitation for Privilege Escalation; T1087.002 Domain Account; T1486 Data Encrypted for Impact. Named in 8 threat reports. Priority 86.8 of 100.","summary":"Microsoft Netlogon Privilege Escalation Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T03:01:29.000Z","tags":["kev","ransomware","public-exploit","T1110","T1133","T1021","T1068","T1087.002","T1486"],"_patchfirst":{"reason":"kev","priority":86.8,"kev":{"dateAdded":"2021-11-03","ransomware":true},"epss":{"score":0.99389,"percentile":0.9994},"cvss":{"score":5.5,"severity":"MEDIUM","version":"3.1"},"vendor":"Microsoft","product":"Netlogon","techniqueIds":["T1110","T1133","T1021","T1068","T1087.002","T1486"],"reportCount":8,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-42258#kev","url":"https://patchfirst.co/cve/CVE-2021-42258/","title":"[KEV] CVE-2021-42258: BQE BillQuick Web Suite SQL Injection Vulnerability","content_text":"BQE · BillQuick Web Suite. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 75.2% (higher than 99.51% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1059 Command and Scripting Interpreter; T1486 Data Encrypted for Impact. Priority 79.8 of 100.","summary":"BQE BillQuick Web Suite SQL Injection Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T04:09:31.000Z","tags":["kev","ransomware","public-exploit","T1059","T1486"],"_patchfirst":{"reason":"kev","priority":79.8,"kev":{"dateAdded":"2021-11-03","ransomware":true},"epss":{"score":0.75182,"percentile":0.9951},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"BQE","product":"BillQuick Web Suite","techniqueIds":["T1059","T1486"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2019-11634#kev","url":"https://patchfirst.co/cve/CVE-2019-11634/","title":"[KEV] CVE-2019-11634: Citrix Workspace Application and Receiver for Windows Remote Code Execution Vulnerability","content_text":"Citrix · Workspace Application and Receiver for Windows. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 8.1% (higher than 94.8% of CVEs). CVSS 9.8 CRITICAL. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1003 OS Credential Dumping; T1005 Data from Local System; T1046 Network Service Discovery; T1078 Valid Accounts; +1 more. Named in 1 threat report. Priority 77.7 of 100.","summary":"Citrix Workspace Application and Receiver for Windows Remote Code Execution Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-08-12T05:17:21.000Z","tags":["kev","ransomware","T1190","T1059","T1003","T1005","T1046","T1078","T1486"],"_patchfirst":{"reason":"kev","priority":77.7,"kev":{"dateAdded":"2021-11-03","ransomware":true},"epss":{"score":0.08091,"percentile":0.94808},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Citrix","product":"Workspace Application and Receiver for Windows","techniqueIds":["T1190","T1059","T1003","T1005","T1046","T1078","T1486"],"reportCount":1,"hasPublicExploit":false,"euvdExploited":true}}]}