{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: CVEs linked to T1548 Abuse Elevation Control Mechanism","home_page_url":"https://patchfirst.co/technique/T1548/","feed_url":"https://patchfirst.co/feed/technique/T1548.json","description":"New and newly exploited CVEs that lead to ATT&CK T1548 Abuse Elevation Control Mechanism, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2026-111357#kev","url":"https://patchfirst.co/cve/CVE-2026-111357/","title":"[KEV] CVE-2026-111357: Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability","content_text":"Ivanti · Connect Secure. In CISA KEV since 2026-10-30. ENISA EUVD lists it as exploited. EPSS 0.3% (higher than 24.6% of CVEs). CVSS 7.0 HIGH. ATT&CK: T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism. Priority 57.0 of 100.","summary":"Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability","date_published":"2026-10-30T00:00:00.000Z","date_modified":"2026-10-31T04:18:16.000Z","tags":["kev","T1068","T1548"],"_patchfirst":{"reason":"kev","priority":57,"kev":{"dateAdded":"2026-10-30","ransomware":false},"epss":{"score":0.00316,"percentile":0.24569},"cvss":{"score":7,"severity":"HIGH","version":"3.1"},"vendor":"Ivanti","product":"Connect Secure","techniqueIds":["T1068","T1548"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2026-41091#kev","url":"https://patchfirst.co/cve/CVE-2026-41091/","title":"[KEV] CVE-2026-41091: Microsoft Defender Link Following Vulnerability","content_text":"Microsoft · Defender. In CISA KEV since 2026-05-20. ENISA EUVD lists it as exploited. EPSS 8.2% (higher than 94.9% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism. Priority 72.4 of 100.","summary":"Microsoft Defender Link Following Vulnerability","date_published":"2026-05-20T00:00:00.000Z","date_modified":"2026-07-24T10:10:00.000Z","tags":["kev","public-exploit","T1068","T1548"],"_patchfirst":{"reason":"kev","priority":72.4,"kev":{"dateAdded":"2026-05-20","ransomware":false},"epss":{"score":0.08202,"percentile":0.9487},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Defender","techniqueIds":["T1068","T1548"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-36424#kev","url":"https://patchfirst.co/cve/CVE-2023-36424/","title":"[KEV] CVE-2023-36424: Microsoft Windows Out-of-Bounds Read Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2026-04-13. ENISA EUVD lists it as exploited. EPSS 12.1% (higher than 96.1% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism. Priority 72.7 of 100.","summary":"Microsoft Windows Out-of-Bounds Read Vulnerability","date_published":"2026-04-13T00:00:00.000Z","date_modified":"2026-06-17T06:06:15.000Z","tags":["kev","public-exploit","T1068","T1548"],"_patchfirst":{"reason":"kev","priority":72.7,"kev":{"dateAdded":"2026-04-13","ransomware":false},"epss":{"score":0.12087,"percentile":0.9614},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1068","T1548"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-48572","url":"https://patchfirst.co/cve/CVE-2025-48572/","title":"CVE-2025-48572: Android Framework Privilege Escalation Vulnerability","content_text":"Android · Framework. In CISA KEV since 2025-12-02. ENISA EUVD lists it as exploited. EPSS 0.3% (higher than 17.6% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism. Priority 52.0 of 100.","summary":"Android Framework Privilege Escalation Vulnerability","date_published":"2025-12-08T00:00:00.000Z","date_modified":"2026-10-07T20:10:01.000Z","tags":["kev","T1068","T1548"],"_patchfirst":{"reason":"published","priority":52,"kev":{"dateAdded":"2025-12-02","ransomware":false},"epss":{"score":0.00259,"percentile":0.17637},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Android","product":"Framework","techniqueIds":["T1068","T1548"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2025-41244#kev","url":"https://patchfirst.co/cve/CVE-2025-41244/","title":"[KEV] CVE-2025-41244: Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability","content_text":"Broadcom · VMware Aria Operations and VMware Tools. In CISA KEV since 2025-10-30. ENISA EUVD lists it as exploited. EPSS 8.6% (higher than 95.1% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism. Priority 67.5 of 100.","summary":"Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability","date_published":"2025-10-30T00:00:00.000Z","date_modified":"2026-10-18T21:10:00.000Z","tags":["kev","public-exploit","T1068","T1548"],"_patchfirst":{"reason":"kev","priority":67.5,"kev":{"dateAdded":"2025-10-30","ransomware":false},"epss":{"score":0.08629,"percentile":0.95094},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Broadcom","product":"VMware Aria Operations and VMware Tools","techniqueIds":["T1068","T1548"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-59230#kev","url":"https://patchfirst.co/cve/CVE-2025-59230/","title":"[KEV] CVE-2025-59230: Microsoft Windows Improper Access Control Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2025-10-14. ENISA EUVD lists it as exploited. EPSS 2.7% (higher than 85.7% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism. Priority 60.6 of 100.","summary":"Microsoft Windows Improper Access Control Vulnerability","date_published":"2025-10-14T00:00:00.000Z","date_modified":"2026-06-17T09:45:46.000Z","tags":["kev","T1068","T1548"],"_patchfirst":{"reason":"kev","priority":60.6,"kev":{"dateAdded":"2025-10-14","ransomware":false},"epss":{"score":0.02657,"percentile":0.85657},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1068","T1548"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2025-32463#kev","url":"https://patchfirst.co/cve/CVE-2025-32463/","title":"[KEV] CVE-2025-32463: Sudo Inclusion of Functionality from Untrusted Control Sphere Vulnerability","content_text":"Sudo · Sudo. In CISA KEV since 2025-09-29. ENISA EUVD lists it as exploited. EPSS 55.5% (higher than 99.03% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism. Priority 68.3 of 100.","summary":"Sudo Inclusion of Functionality from Untrusted Control Sphere Vulnerability","date_published":"2025-09-29T00:00:00.000Z","date_modified":"2026-06-17T09:12:02.000Z","tags":["kev","public-exploit","T1068","T1548"],"_patchfirst":{"reason":"kev","priority":68.3,"kev":{"dateAdded":"2025-09-29","ransomware":false},"epss":{"score":0.55498,"percentile":0.99034},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Sudo","product":"Sudo","techniqueIds":["T1068","T1548"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-44221#kev","url":"https://patchfirst.co/cve/CVE-2023-44221/","title":"[KEV] CVE-2023-44221: SonicWall SMA100 Appliances OS Command Injection Vulnerability","content_text":"SonicWall · SMA100 Appliances. In CISA KEV since 2025-05-01. ENISA EUVD lists it as exploited. EPSS 76.3% (higher than 99.54% of CVEs). CVSS 7.2 HIGH. ATT&CK: T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism; T1059.004 Unix Shell; T1543 Create or Modify System Process. Priority 62.9 of 100.","summary":"SonicWall SMA100 Appliances OS Command Injection Vulnerability","date_published":"2025-05-01T00:00:00.000Z","date_modified":"2026-06-17T06:27:09.000Z","tags":["kev","T1068","T1548","T1059.004","T1543"],"_patchfirst":{"reason":"kev","priority":62.9,"kev":{"dateAdded":"2025-05-01","ransomware":false},"epss":{"score":0.7625,"percentile":0.99536},"cvss":{"score":7.2,"severity":"HIGH","version":"3.1"},"vendor":"SonicWall","product":"SMA100 Appliances","techniqueIds":["T1068","T1548","T1059.004","T1543"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2025-2783#kev","url":"https://patchfirst.co/cve/CVE-2025-2783/","title":"[KEV] CVE-2025-2783: Google Chromium Mojo Sandbox Escape Vulnerability","content_text":"Google · Chromium Mojo. In CISA KEV since 2025-03-27. ENISA EUVD lists it as exploited. EPSS 9.2% (higher than 95.3% of CVEs). CVSS 8.3 HIGH. Public exploit code exists. ATT&CK: T1203 Exploitation for Client Execution; T1548 Abuse Elevation Control Mechanism; T1497 Virtualization/Sandbox Evasion. Priority 67.9 of 100.","summary":"Google Chromium Mojo Sandbox Escape Vulnerability","date_published":"2025-03-27T00:00:00.000Z","date_modified":"2026-06-17T09:07:37.000Z","tags":["kev","public-exploit","T1203","T1548","T1497"],"_patchfirst":{"reason":"kev","priority":67.9,"kev":{"dateAdded":"2025-03-27","ransomware":false},"epss":{"score":0.09238,"percentile":0.95345},"cvss":{"score":8.3,"severity":"HIGH","version":"3.1"},"vendor":"Google","product":"Chromium Mojo","techniqueIds":["T1203","T1548","T1497"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-49039#kev","url":"https://patchfirst.co/cve/CVE-2024-49039/","title":"[KEV] CVE-2024-49039: Microsoft Windows Task Scheduler Privilege Escalation Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2024-11-12, known ransomware use. ENISA EUVD lists it as exploited. EPSS 14.2% (higher than 96.6% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism. Priority 78.5 of 100.","summary":"Microsoft Windows Task Scheduler Privilege Escalation Vulnerability","date_published":"2024-11-12T00:00:00.000Z","date_modified":"2026-08-04T05:16:30.000Z","tags":["kev","ransomware","public-exploit","T1068","T1548"],"_patchfirst":{"reason":"kev","priority":78.5,"kev":{"dateAdded":"2024-11-12","ransomware":true},"epss":{"score":0.14179,"percentile":0.96577},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1068","T1548"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-42824#kev","url":"https://patchfirst.co/cve/CVE-2023-42824/","title":"[KEV] CVE-2023-42824: Apple iOS and iPadOS Kernel Privilege Escalation Vulnerability","content_text":"Apple · iOS and iPadOS. In CISA KEV since 2023-10-05. ENISA EUVD lists it as exploited. EPSS 1.0% (higher than 61.9% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism. Priority 60.8 of 100.","summary":"Apple iOS and iPadOS Kernel Privilege Escalation Vulnerability","date_published":"2023-10-05T00:00:00.000Z","date_modified":"2026-06-17T06:24:36.000Z","tags":["kev","public-exploit","T1068","T1548"],"_patchfirst":{"reason":"kev","priority":60.8,"kev":{"dateAdded":"2023-10-05","ransomware":false},"epss":{"score":0.00971,"percentile":0.61879},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Apple","product":"iOS and iPadOS","techniqueIds":["T1068","T1548"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2010-3904#kev","url":"https://patchfirst.co/cve/CVE-2010-3904/","title":"[KEV] CVE-2010-3904: Linux Kernel Improper Input Validation Vulnerability","content_text":"Linux · Kernel. In CISA KEV since 2023-05-12. ENISA EUVD lists it as exploited. EPSS 15.9% (higher than 96.9% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism. Priority 67.8 of 100.","summary":"Linux Kernel Improper Input Validation Vulnerability","date_published":"2023-05-12T00:00:00.000Z","date_modified":"2026-06-16T23:23:47.000Z","tags":["kev","public-exploit","T1068","T1548"],"_patchfirst":{"reason":"kev","priority":67.8,"kev":{"dateAdded":"2023-05-12","ransomware":false},"epss":{"score":0.15861,"percentile":0.96881},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Linux","product":"Kernel","techniqueIds":["T1068","T1548"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2019-8526#kev","url":"https://patchfirst.co/cve/CVE-2019-8526/","title":"[KEV] CVE-2019-8526: Apple macOS Use-After-Free Vulnerability","content_text":"Apple · macOS. In CISA KEV since 2023-04-17. ENISA EUVD lists it as exploited. EPSS 0.7% (higher than 53.2% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism. Priority 54.1 of 100.","summary":"Apple macOS Use-After-Free Vulnerability","date_published":"2023-04-17T00:00:00.000Z","date_modified":"2026-06-17T02:42:06.000Z","tags":["kev","T1068","T1548"],"_patchfirst":{"reason":"kev","priority":54.1,"kev":{"dateAdded":"2023-04-17","ransomware":false},"epss":{"score":0.00701,"percentile":0.53201},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Apple","product":"macOS","techniqueIds":["T1068","T1548"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2021-3493#kev","url":"https://patchfirst.co/cve/CVE-2021-3493/","title":"[KEV] CVE-2021-3493: Linux Kernel Privilege Escalation Vulnerability","content_text":"Linux · Kernel. In CISA KEV since 2022-10-20. ENISA EUVD lists it as exploited. EPSS 49.2% (higher than 98.9% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism. Priority 68.2 of 100.","summary":"Linux Kernel Privilege Escalation Vulnerability","date_published":"2022-10-20T00:00:00.000Z","date_modified":"2026-06-17T04:05:12.000Z","tags":["kev","public-exploit","T1068","T1548"],"_patchfirst":{"reason":"kev","priority":68.2,"kev":{"dateAdded":"2022-10-20","ransomware":false},"epss":{"score":0.49166,"percentile":0.98882},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Linux","product":"Kernel","techniqueIds":["T1068","T1548"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2014-3153#kev","url":"https://patchfirst.co/cve/CVE-2014-3153/","title":"[KEV] CVE-2014-3153: Linux Kernel Privilege Escalation Vulnerability","content_text":"Linux · Kernel. In CISA KEV since 2022-05-25. ENISA EUVD lists it as exploited. EPSS 37.2% (higher than 98.5% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism. Priority 78.2 of 100.","summary":"Linux Kernel Privilege Escalation Vulnerability","date_published":"2022-05-25T00:00:00.000Z","date_modified":"2026-06-17T00:07:40.000Z","tags":["kev","public-exploit","T1068","T1548"],"_patchfirst":{"reason":"kev","priority":78.2,"kev":{"dateAdded":"2022-05-25","ransomware":false},"epss":{"score":0.37233,"percentile":0.98522},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Linux","product":"Kernel","techniqueIds":["T1068","T1548"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2018-8611#kev","url":"https://patchfirst.co/cve/CVE-2018-8611/","title":"[KEV] CVE-2018-8611: Microsoft Windows Kernel Privilege Escalation Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2022-05-24. ENISA EUVD lists it as exploited. EPSS 4.2% (higher than 90.9% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism. Priority 66.6 of 100.","summary":"Microsoft Windows Kernel Privilege Escalation Vulnerability","date_published":"2022-05-24T00:00:00.000Z","date_modified":"2026-06-17T02:05:11.000Z","tags":["kev","public-exploit","T1068","T1548"],"_patchfirst":{"reason":"kev","priority":66.6,"kev":{"dateAdded":"2022-05-24","ransomware":false},"epss":{"score":0.04196,"percentile":0.90937},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1068","T1548"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2019-0880#kev","url":"https://patchfirst.co/cve/CVE-2019-0880/","title":"[KEV] CVE-2019-0880: Microsoft Windows Privilege Escalation Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2022-05-23. ENISA EUVD lists it as exploited. EPSS 2.3% (higher than 83.3% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism. Priority 60.1 of 100.","summary":"Microsoft Windows Privilege Escalation Vulnerability","date_published":"2022-05-23T00:00:00.000Z","date_modified":"2026-06-17T02:09:06.000Z","tags":["kev","T1068","T1548"],"_patchfirst":{"reason":"kev","priority":60.1,"kev":{"dateAdded":"2022-05-23","ransomware":false},"epss":{"score":0.02308,"percentile":0.83345},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1068","T1548"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2022-1388#kev","url":"https://patchfirst.co/cve/CVE-2022-1388/","title":"[KEV] CVE-2022-1388: F5 BIG-IP Missing Authentication Vulnerability","content_text":"F5 · BIG-IP. In CISA KEV since 2022-05-10, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.97% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1548 Abuse Elevation Control Mechanism. Priority 79.9 of 100.","summary":"F5 BIG-IP Missing Authentication Vulnerability","date_published":"2022-05-10T00:00:00.000Z","date_modified":"2026-06-17T04:22:20.000Z","tags":["kev","ransomware","public-exploit","T1548"],"_patchfirst":{"reason":"kev","priority":79.9,"kev":{"dateAdded":"2022-05-10","ransomware":true},"epss":{"score":0.99954,"percentile":0.99974},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"F5","product":"BIG-IP","techniqueIds":["T1548"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2017-0213#kev","url":"https://patchfirst.co/cve/CVE-2017-0213/","title":"[KEV] CVE-2017-0213: Microsoft Windows Privilege Escalation Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2022-03-28, known ransomware use. ENISA EUVD lists it as exploited. EPSS 84.3% (higher than 99.7% of CVEs). CVSS 7.3 HIGH. Public exploit code exists. ATT&CK: T1548 Abuse Elevation Control Mechanism; T1068 Exploitation for Privilege Escalation. Named in 4 threat reports. Priority 87.0 of 100.","summary":"Microsoft Windows Privilege Escalation Vulnerability","date_published":"2022-03-28T00:00:00.000Z","date_modified":"2026-06-17T00:57:16.000Z","tags":["kev","ransomware","public-exploit","T1548","T1068"],"_patchfirst":{"reason":"kev","priority":87,"kev":{"dateAdded":"2022-03-28","ransomware":true},"epss":{"score":0.84258,"percentile":0.99697},"cvss":{"score":7.3,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1548","T1068"],"reportCount":4,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2010-4398#kev","url":"https://patchfirst.co/cve/CVE-2010-4398/","title":"[KEV] CVE-2010-4398: Microsoft Windows Kernel Stack-Based Buffer Overflow Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2022-03-28. ENISA EUVD lists it as exploited. EPSS 8.7% (higher than 95.1% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism. Named in 1 threat report. Priority 71.4 of 100.","summary":"Microsoft Windows Kernel Stack-Based Buffer Overflow Vulnerability","date_published":"2022-03-28T00:00:00.000Z","date_modified":"2026-06-16T23:24:42.000Z","tags":["kev","public-exploit","T1078","T1068","T1548"],"_patchfirst":{"reason":"kev","priority":71.4,"kev":{"dateAdded":"2022-03-28","ransomware":false},"epss":{"score":0.08661,"percentile":0.9511},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1078","T1068","T1548"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2009-1123#kev","url":"https://patchfirst.co/cve/CVE-2009-1123/","title":"[KEV] CVE-2009-1123: Microsoft Windows Improper Input Validation Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2022-03-03. ENISA EUVD lists it as exploited. EPSS 4.9% (higher than 92% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism. Priority 61.9 of 100.","summary":"Microsoft Windows Improper Input Validation Vulnerability","date_published":"2022-03-03T00:00:00.000Z","date_modified":"2026-06-16T23:06:33.000Z","tags":["kev","T1068","T1548"],"_patchfirst":{"reason":"kev","priority":61.9,"kev":{"dateAdded":"2022-03-03","ransomware":false},"epss":{"score":0.04878,"percentile":0.9205},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1068","T1548"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2022-23131#kev","url":"https://patchfirst.co/cve/CVE-2022-23131/","title":"[KEV] CVE-2022-23131: Zabbix Frontend Authentication Bypass Vulnerability","content_text":"Zabbix · Frontend. In CISA KEV since 2022-02-22. ENISA EUVD lists it as exploited. EPSS 95.7% (higher than 99.87% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1548 Abuse Elevation Control Mechanism; T1059 Command and Scripting Interpreter; T1078 Valid Accounts. Priority 69.8 of 100.","summary":"Zabbix Frontend Authentication Bypass Vulnerability","date_published":"2022-02-22T00:00:00.000Z","date_modified":"2026-06-17T04:29:34.000Z","tags":["kev","public-exploit","T1190","T1548","T1059","T1078"],"_patchfirst":{"reason":"kev","priority":69.8,"kev":{"dateAdded":"2022-02-22","ransomware":false},"epss":{"score":0.95683,"percentile":0.9987},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Zabbix","product":"Frontend","techniqueIds":["T1190","T1548","T1059","T1078"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2019-13272#kev","url":"https://patchfirst.co/cve/CVE-2019-13272/","title":"[KEV] CVE-2019-13272: Linux Kernel Improper Privilege Management Vulnerability","content_text":"Linux · Kernel. In CISA KEV since 2021-12-10. ENISA EUVD lists it as exploited. EPSS 52.2% (higher than 99% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism. Priority 68.3 of 100.","summary":"Linux Kernel Improper Privilege Management Vulnerability","date_published":"2021-12-10T00:00:00.000Z","date_modified":"2026-06-17T02:16:26.000Z","tags":["kev","public-exploit","T1068","T1548"],"_patchfirst":{"reason":"kev","priority":68.3,"kev":{"dateAdded":"2021-12-10","ransomware":false},"epss":{"score":0.52199,"percentile":0.98958},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Linux","product":"Kernel","techniqueIds":["T1068","T1548"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2016-7255#kev","url":"https://patchfirst.co/cve/CVE-2016-7255/","title":"[KEV] CVE-2016-7255: Microsoft Win32k Privilege Escalation Vulnerability","content_text":"Microsoft · Win32k. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 81.0% (higher than 99.63% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism. Priority 78.4 of 100.","summary":"Microsoft Win32k Privilege Escalation Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-09-10T04:17:32.000Z","tags":["kev","ransomware","public-exploit","T1068","T1548"],"_patchfirst":{"reason":"kev","priority":78.4,"kev":{"dateAdded":"2021-11-03","ransomware":true},"epss":{"score":0.80968,"percentile":0.9963},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Win32k","techniqueIds":["T1068","T1548"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-38648#kev","url":"https://patchfirst.co/cve/CVE-2021-38648/","title":"[KEV] CVE-2021-38648: Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability","content_text":"Microsoft · Open Management Infrastructure (OMI). In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 11.4% (higher than 96% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism. Priority 67.7 of 100.","summary":"Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-08-10T20:15:31.000Z","tags":["kev","public-exploit","T1068","T1548"],"_patchfirst":{"reason":"kev","priority":67.7,"kev":{"dateAdded":"2021-11-03","ransomware":false},"epss":{"score":0.11424,"percentile":0.95998},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Open Management Infrastructure (OMI)","techniqueIds":["T1068","T1548"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-30713#kev","url":"https://patchfirst.co/cve/CVE-2021-30713/","title":"[KEV] CVE-2021-30713: Apple macOS Unspecified Vulnerability","content_text":"Apple · macOS. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 7.0% (higher than 94.2% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism. Priority 62.3 of 100.","summary":"Apple macOS Unspecified Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T03:50:44.000Z","tags":["kev","T1068","T1548"],"_patchfirst":{"reason":"kev","priority":62.3,"kev":{"dateAdded":"2021-11-03","ransomware":false},"epss":{"score":0.07038,"percentile":0.9418},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Apple","product":"macOS","techniqueIds":["T1068","T1548"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2021-31979#kev","url":"https://patchfirst.co/cve/CVE-2021-31979/","title":"[KEV] CVE-2021-31979: Microsoft Windows Kernel Privilege Escalation Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 4.5% (higher than 91.6% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism. Priority 61.8 of 100.","summary":"Microsoft Windows Kernel Privilege Escalation Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-08-10T19:58:41.000Z","tags":["kev","T1068","T1548"],"_patchfirst":{"reason":"kev","priority":61.8,"kev":{"dateAdded":"2021-11-03","ransomware":false},"epss":{"score":0.0454,"percentile":0.91555},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1068","T1548"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2019-3717","url":"https://patchfirst.co/cve/CVE-2019-3717/","title":"CVE-2019-3717: Select Dell Client Commercial and Consumer platforms contain an Improper Access Vulnerability","content_text":"Dell · Dell Client Commercial and Consumer platforms. Not in CISA KEV. EPSS 0.4% (higher than 30.1% of CVEs). CVSS 7.1 HIGH. ATT&CK: T1200 Hardware Additions; T1548 Abuse Elevation Control Mechanism. Priority 11.0 of 100.","summary":"Select Dell Client Commercial and Consumer platforms contain an Improper Access Vulnerability","date_published":"2019-08-05T00:00:00.000Z","date_modified":"2024-09-16T16:43:43.000Z","tags":["T1200","T1548"],"_patchfirst":{"reason":"published","priority":11,"kev":null,"epss":{"score":0.00362,"percentile":0.3008},"cvss":{"score":7.1,"severity":"HIGH","version":"3.0"},"vendor":"Dell","product":"Dell Client Commercial and Consumer platforms","techniqueIds":["T1200","T1548"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2019-1812","url":"https://patchfirst.co/cve/CVE-2019-1812/","title":"CVE-2019-1812: Cisco NX-OS CLI Command Software Image Signature Verification Vulnerabilities","content_text":"Cisco · Cisco NX-OS Software. Not in CISA KEV. EPSS 0.3% (higher than 27.1% of CVEs). CVSS 6.7 MEDIUM. ATT&CK: T1078 Valid Accounts; T1059 Command and Scripting Interpreter; T1548 Abuse Elevation Control Mechanism. Priority 10.1 of 100.","summary":"Cisco NX-OS CLI Command Software Image Signature Verification Vulnerabilities","date_published":"2019-05-15T00:00:00.000Z","date_modified":"2024-11-20T17:19:07.000Z","tags":["T1078","T1059","T1548"],"_patchfirst":{"reason":"published","priority":10.1,"kev":null,"epss":{"score":0.00337,"percentile":0.27147},"cvss":{"score":6.7,"severity":"MEDIUM","version":"3.0"},"vendor":"Cisco","product":"Cisco NX-OS Software","techniqueIds":["T1078","T1059","T1548"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}}]}