https://patchfirst.co/technique/T1543/New and newly exploited CVEs that lead to ATT&CK T1543 Create or Modify System Process, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.en-gb360Sat, 31 Oct 2026 05:11:25 GMThttps://patchfirst.co/cve/CVE-2023-0386/CVE-2023-0386#kevTue, 17 Jun 2025 00:00:00 GMTLinux · Kernel. In CISA KEV since 2025-06-17. ENISA EUVD lists it as exploited. EPSS 7.9% (higher than 94.7% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1548.001 Setuid and Setgid; T1543 Create or Modify System Process. Priority 67.4 of 100.kevpublic-exploitT1548.001T1543https://patchfirst.co/cve/CVE-2025-33053/CVE-2025-33053#kevTue, 10 Jun 2025 00:00:00 GMTMicrosoft · Windows. In CISA KEV since 2025-06-10. ENISA EUVD lists it as exploited. EPSS 87.0% (higher than 99.75% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1566.001 Spearphishing Attachment; T1059 Command and Scripting Interpreter; T1041 Exfiltration Over C2 Channel; T1056.001 Keylogging; T1543 Create or Modify System Process. Priority 69.1 of 100.kevpublic-exploitT1566.001T1059T1041T1056.001T1543https://patchfirst.co/cve/CVE-2025-4428/CVE-2025-4428#kevMon, 19 May 2025 00:00:00 GMTIvanti · Endpoint Manager Mobile (EPMM). In CISA KEV since 2025-05-19. ENISA EUVD lists it as exploited. EPSS 88.0% (higher than 99.76% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1543 Create or Modify System Process. Priority 69.1 of 100.kevpublic-exploitT1190T1059T1543https://patchfirst.co/cve/CVE-2025-32706/CVE-2025-32706#kevTue, 13 May 2025 00:00:00 GMTMicrosoft · Windows. In CISA KEV since 2025-05-13. ENISA EUVD lists it as exploited. EPSS 2.3% (higher than 83.5% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1059 Command and Scripting Interpreter; T1068 Exploitation for Privilege Escalation; T1003.001 LSASS Memory; T1543 Create or Modify System Process; T1608.001 Upload Malware. Priority 65.2 of 100.kevpublic-exploitT1059T1068T1003.001T1543T1608.001https://patchfirst.co/cve/CVE-2025-32709/CVE-2025-32709#kevTue, 13 May 2025 00:00:00 GMTMicrosoft · Windows. In CISA KEV since 2025-05-13. ENISA EUVD lists it as exploited. EPSS 1.8% (higher than 78.7% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1003 OS Credential Dumping; T1059 Command and Scripting Interpreter; T1543 Create or Modify System Process; T1608.001 Upload Malware. Priority 64.2 of 100.kevpublic-exploitT1068T1003T1059T1543T1608.001https://patchfirst.co/cve/CVE-2025-32701/CVE-2025-32701#kevTue, 13 May 2025 00:00:00 GMTMicrosoft · Windows. In CISA KEV since 2025-05-13. ENISA EUVD lists it as exploited. EPSS 1.4% (higher than 72.7% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1059 Command and Scripting Interpreter; T1068 Exploitation for Privilege Escalation; T1003.001 LSASS Memory; T1543 Create or Modify System Process; T1608.001 Upload Malware. Priority 58.0 of 100.kevT1059T1068T1003.001T1543T1608.001https://patchfirst.co/cve/CVE-2023-44221/CVE-2023-44221#kevThu, 01 May 2025 00:00:00 GMTSonicWall · SMA100 Appliances. In CISA KEV since 2025-05-01. ENISA EUVD lists it as exploited. EPSS 76.3% (higher than 99.54% of CVEs). CVSS 7.2 HIGH. ATT&CK: T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism; T1059.004 Unix Shell; T1543 Create or Modify System Process. Priority 62.9 of 100.kevT1068T1548T1059.004T1543https://patchfirst.co/cve/CVE-2024-35250/CVE-2024-35250#kevMon, 16 Dec 2024 00:00:00 GMTMicrosoft · Windows. In CISA KEV since 2024-12-16. ENISA EUVD lists it as exploited. EPSS 25.2% (higher than 97.9% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1543 Create or Modify System Process. Priority 68.0 of 100.kevpublic-exploitT1068T1543https://patchfirst.co/cve/CVE-2024-49138/CVE-2024-49138Thu, 12 Dec 2024 00:00:00 GMTMicrosoft · Windows. In CISA KEV since 2024-12-10. ENISA EUVD lists it as exploited. EPSS 26.2% (higher than 98% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1543 Create or Modify System Process. Priority 68.1 of 100.kevpublic-exploitT1068T1543https://patchfirst.co/cve/CVE-2024-4577/CVE-2024-4577#kevWed, 12 Jun 2024 00:00:00 GMTPHP Group · PHP. In CISA KEV since 2024-06-12, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.98% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1003 OS Credential Dumping; T1003.001 LSASS Memory; T1033 System Owner/User Discovery; T1041 Exfiltration Over C2 Channel; +6 more. Priority 79.9 of 100.kevransomwarepublic-exploitT1190T1059T1003T1003.001T1033T1041T1053T1068T1071.001T1112T1543T1570https://patchfirst.co/cve/CVE-2021-45382/CVE-2021-45382#kevMon, 04 Apr 2022 00:00:00 GMTD-Link · Multiple Routers. In CISA KEV since 2022-04-04. ENISA EUVD lists it as exploited. EPSS 97.8% (higher than 99.91% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1070 Indicator Removal; T1071 Application Layer Protocol; T1499.002 Service Exhaustion Flood; T1543 Create or Modify System Process. Priority 69.8 of 100.kevpublic-exploitT1190T1059T1070T1071T1499.002T1543