https://patchfirst.co/technique/T1497/New and newly exploited CVEs that lead to ATT&CK T1497 Virtualization/Sandbox Evasion, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.en-gb360Sat, 31 Oct 2026 05:11:25 GMThttps://patchfirst.co/cve/CVE-2025-6558/CVE-2025-6558#kevTue, 22 Jul 2025 00:00:00 GMTGoogle · Chromium. In CISA KEV since 2025-07-22. ENISA EUVD lists it as exploited. EPSS 10.9% (higher than 95.9% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1189 Drive-by Compromise; T1203 Exploitation for Client Execution; T1497 Virtualization/Sandbox Evasion. Priority 68.3 of 100.kevpublic-exploitT1189T1203T1497https://patchfirst.co/cve/CVE-2025-2783/CVE-2025-2783#kevThu, 27 Mar 2025 00:00:00 GMTGoogle · Chromium Mojo. In CISA KEV since 2025-03-27. ENISA EUVD lists it as exploited. EPSS 9.2% (higher than 95.3% of CVEs). CVSS 8.3 HIGH. Public exploit code exists. ATT&CK: T1203 Exploitation for Client Execution; T1548 Abuse Elevation Control Mechanism; T1497 Virtualization/Sandbox Evasion. Priority 67.9 of 100.kevpublic-exploitT1203T1548T1497https://patchfirst.co/cve/CVE-2014-0546/CVE-2014-0546#kevWed, 25 May 2022 00:00:00 GMTAdobe · Reader and Acrobat. In CISA KEV since 2022-05-25. ENISA EUVD lists it as exploited. EPSS 22.3% (higher than 97.7% of CVEs). CVSS 9.8 CRITICAL. ATT&CK: T1068 Exploitation for Privilege Escalation; T1497 Virtualization/Sandbox Evasion. Priority 49.4 of 100.kevT1068T1497https://patchfirst.co/cve/CVE-2015-3113/CVE-2015-3113#kevWed, 13 Apr 2022 00:00:00 GMTAdobe · Flash Player. In CISA KEV since 2022-04-13. ENISA EUVD lists it as exploited. EPSS 99.8% (higher than 99.96% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1071.001 Web Protocols; T1497 Virtualization/Sandbox Evasion; T1622 Debugger Evasion. Named in 3 threat reports. Priority 77.6 of 100.kevpublic-exploitT1071.001T1497T1622https://patchfirst.co/cve/CVE-2020-0981/CVE-2020-0981Wed, 15 Apr 2020 00:00:00 GMTMicrosoft · Windows 10 Version 1909 for 32-bit Systems. Not in CISA KEV. EPSS 1.3% (higher than 69.8% of CVEs). Public exploit code exists. ATT&CK: T1134 Access Token Manipulation; T1068 Exploitation for Privilege Escalation; T1497 Virtualization/Sandbox Evasion. Priority 19.0 of 100.public-exploitT1134T1068T1497https://patchfirst.co/cve/CVE-2018-8489/CVE-2018-8489Wed, 10 Oct 2018 00:00:00 GMTMicrosoft · Windows 7. Not in CISA KEV. EPSS 4.4% (higher than 91.3% of CVEs). ATT&CK: T1497 Virtualization/Sandbox Evasion. Priority 18.3 of 100.T1497