https://patchfirst.co/technique/T1496/New and newly exploited CVEs that lead to ATT&CK T1496 Resource Hijacking, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.en-gb360Sat, 31 Oct 2026 22:22:55 GMThttps://patchfirst.co/cve/CVE-2025-4632/CVE-2025-4632#kevThu, 22 May 2025 00:00:00 GMTSamsung · MagicINFO 9 Server. In CISA KEV since 2025-05-22. ENISA EUVD lists it as exploited. EPSS 24.1% (higher than 97.8% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1059 Command and Scripting Interpreter; T1496 Resource Hijacking; T1608.001 Upload Malware. Priority 69.4 of 100.kevpublic-exploitT1068T1059T1496T1608.001https://patchfirst.co/cve/CVE-2024-23692/CVE-2024-23692#kevTue, 09 Jul 2024 00:00:00 GMTRejetto · HTTP File Server. In CISA KEV since 2024-07-09, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.5% (higher than 99.94% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1082 System Information Discovery; T1005 Data from Local System; T1105 Ingress Tool Transfer; T1496 Resource Hijacking. Priority 79.8 of 100.kevransomwarepublic-exploitT1082T1005T1105T1496https://patchfirst.co/cve/CVE-2023-22527/CVE-2023-22527#kevWed, 24 Jan 2024 00:00:00 GMTAtlassian · Confluence Data Center and Server. In CISA KEV since 2024-01-24, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.98% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1496 Resource Hijacking. Priority 79.9 of 100.kevransomwarepublic-exploitT1496https://patchfirst.co/cve/CVE-2023-49897/CVE-2023-49897#kevThu, 21 Dec 2023 00:00:00 GMTFXC · AE1021, AE1021PE. In CISA KEV since 2023-12-21. ENISA EUVD lists it as exploited. EPSS 50.4% (higher than 98.9% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1496 Resource Hijacking; T1498 Network Denial of Service. Priority 68.9 of 100.kevpublic-exploitT1496T1498https://patchfirst.co/cve/CVE-2023-47565/CVE-2023-47565#kevThu, 21 Dec 2023 00:00:00 GMTQNAP · VioStor NVR. In CISA KEV since 2023-12-21. ENISA EUVD lists it as exploited. EPSS 73.3% (higher than 99.46% of CVEs). CVSS 8.8 HIGH. ATT&CK: T1496 Resource Hijacking; T1498 Network Denial of Service. Priority 64.1 of 100.kevT1496T1498https://patchfirst.co/cve/CVE-2023-32315/CVE-2023-32315#kevThu, 24 Aug 2023 00:00:00 GMTIgnite Realtime · Openfire. In CISA KEV since 2023-08-24. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1202 Indirect Command Execution; T1505.003 Web Shell; T1087.002 Domain Account; T1496 Resource Hijacking. Named in 1 threat report. Priority 82.1 of 100.kevpublic-exploitT1202T1505.003T1087.002T1496https://patchfirst.co/cve/CVE-2023-38035/CVE-2023-38035#kevTue, 22 Aug 2023 00:00:00 GMTIvanti · Sentry. In CISA KEV since 2023-08-22, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.97% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1018 Remote System Discovery; T1046 Network Service Discovery; T1071.001 Web Protocols; T1105 Ingress Tool Transfer; +2 more. Priority 79.9 of 100.kevransomwarepublic-exploitT1190T1059T1018T1046T1071.001T1105T1496T1571https://patchfirst.co/cve/CVE-2022-29303/CVE-2022-29303#kevThu, 13 Jul 2023 00:00:00 GMTSolarView · Compact. In CISA KEV since 2023-07-13. ENISA EUVD lists it as exploited. EPSS 98.0% (higher than 99.91% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1505 Server Software Component; T1059 Command and Scripting Interpreter; T1496 Resource Hijacking. Priority 69.8 of 100.kevpublic-exploitT1505T1059T1496https://patchfirst.co/cve/CVE-2023-1389/CVE-2023-1389#kevMon, 01 May 2023 00:00:00 GMTTP-Link · Archer AX21. In CISA KEV since 2023-05-01. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1106 Native API; T1496 Resource Hijacking; T1041 Exfiltration Over C2 Channel; T1070 Indicator Removal; T1498 Network Denial of Service. Priority 69.2 of 100.kevpublic-exploitT1106T1496T1041T1070T1498https://patchfirst.co/cve/CVE-2022-29464/CVE-2022-29464#kevMon, 25 Apr 2022 00:00:00 GMTWSO2 · Multiple Products. In CISA KEV since 2022-04-25, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1202 Indirect Command Execution; T1496 Resource Hijacking. Priority 79.9 of 100.kevransomwarepublic-exploitT1190T1202T1496https://patchfirst.co/cve/CVE-2021-44228/CVE-2021-44228#kevFri, 10 Dec 2021 00:00:00 GMTApache · Log4j2. In CISA KEV since 2021-12-10, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1486 Data Encrypted for Impact; T1496 Resource Hijacking; T1505.003 Web Shell; T1608.001 Upload Malware. Named in 10 threat reports. Priority 90.0 of 100.kevransomwarepublic-exploitT1190T1486T1496T1505.003T1608.001https://patchfirst.co/cve/CVE-2021-35394/CVE-2021-35394#kevFri, 10 Dec 2021 00:00:00 GMTRealtek · Jungle Software Development Kit (SDK). In CISA KEV since 2021-12-10. ENISA EUVD lists it as exploited. EPSS 99.9% (higher than 99.96% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1071.001 Web Protocols; T1105 Ingress Tool Transfer; T1496 Resource Hijacking; T1499 Endpoint Denial of Service; +1 more. Priority 69.9 of 100.kevpublic-exploitT1190T1059T1071.001T1105T1496T1499T1569.002https://patchfirst.co/cve/CVE-2021-26084/CVE-2021-26084#kevWed, 03 Nov 2021 00:00:00 GMTAtlassian · Confluence Server and Data Center. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1059 Command and Scripting Interpreter; T1496 Resource Hijacking. Named in 3 threat reports. Priority 87.6 of 100.kevransomwarepublic-exploitT1059T1496https://patchfirst.co/cve/CVE-2018-7600/CVE-2018-7600#kevWed, 03 Nov 2021 00:00:00 GMTDrupal · Drupal Core. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.98% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1485 Data Destruction; T1496 Resource Hijacking. Named in 1 threat report. Priority 83.7 of 100.kevransomwarepublic-exploitT1190T1059T1485T1496https://patchfirst.co/cve/CVE-2019-18935/CVE-2019-18935#kevWed, 03 Nov 2021 00:00:00 GMTProgress · Telerik UI for ASP.NET AJAX. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.7% (higher than 99.95% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1041 Exfiltration Over C2 Channel; T1496 Resource Hijacking; T1505.003 Web Shell. Named in 1 threat report. Priority 83.7 of 100.kevransomwarepublic-exploitT1190T1041T1496T1505.003https://patchfirst.co/cve/CVE-2018-11776/CVE-2018-11776#kevWed, 03 Nov 2021 00:00:00 GMTApache · Struts. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 8.1 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1496 Resource Hijacking. Named in 1 threat report. Priority 82.5 of 100.kevpublic-exploitT1190T1059T1496https://patchfirst.co/cve/CVE-2021-22205/CVE-2021-22205#kevWed, 03 Nov 2021 00:00:00 GMTGitLab · Community and Enterprise Editions. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.7% (higher than 99.95% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1498 Network Denial of Service; T1496 Resource Hijacking. Priority 80.0 of 100.kevransomwarepublic-exploitT1190T1059T1498T1496https://patchfirst.co/cve/CVE-2017-9822/CVE-2017-9822#kevWed, 03 Nov 2021 00:00:00 GMTDotNetNuke (DNN) · DotNetNuke (DNN). In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 94.8% (higher than 99.86% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1496 Resource Hijacking. Priority 79.1 of 100.kevransomwarepublic-exploitT1190T1059T1496https://patchfirst.co/cve/CVE-2020-8515/CVE-2020-8515#kevWed, 03 Nov 2021 00:00:00 GMTDrayTek · Multiple Vigor Routers. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1133 External Remote Services; T1059 Command and Scripting Interpreter; T1496 Resource Hijacking. Priority 69.9 of 100.kevpublic-exploitT1133T1059T1496https://patchfirst.co/cve/CVE-2020-16200/CVE-2020-16200Fri, 18 Sep 2020 00:00:00 GMTPhilips · Clinical Collaboration Platform. Not in CISA KEV. EPSS 0.6% (higher than 49.8% of CVEs). CVSS 6.5 MEDIUM. ATT&CK: T1496 Resource Hijacking. Priority 14.5 of 100.T1496https://patchfirst.co/cve/CVE-2018-11084/CVE-2018-11084Tue, 18 Sep 2018 00:00:00 GMTCloud Foundry · Garden-runC. Not in CISA KEV. EPSS 1.2% (higher than 67.8% of CVEs). CVSS 6.8 MEDIUM. ATT&CK: T1496 Resource Hijacking. Priority 19.7 of 100.T1496