https://patchfirst.co/technique/T1548/New and newly exploited CVEs that lead to ATT&CK T1548 Abuse Elevation Control Mechanism, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.en-gb360Sat, 31 Oct 2026 05:11:25 GMThttps://patchfirst.co/cve/CVE-2026-111357/CVE-2026-111357#kevFri, 30 Oct 2026 00:00:00 GMTIvanti · Connect Secure. In CISA KEV since 2026-10-30. ENISA EUVD lists it as exploited. EPSS 0.3% (higher than 24.6% of CVEs). CVSS 7.0 HIGH. ATT&CK: T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism. Priority 57.0 of 100.kevT1068T1548https://patchfirst.co/cve/CVE-2026-41091/CVE-2026-41091#kevWed, 20 May 2026 00:00:00 GMTMicrosoft · Defender. In CISA KEV since 2026-05-20. ENISA EUVD lists it as exploited. EPSS 8.2% (higher than 94.9% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism. Priority 72.4 of 100.kevpublic-exploitT1068T1548https://patchfirst.co/cve/CVE-2023-36424/CVE-2023-36424#kevMon, 13 Apr 2026 00:00:00 GMTMicrosoft · Windows. In CISA KEV since 2026-04-13. ENISA EUVD lists it as exploited. EPSS 12.1% (higher than 96.1% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism. Priority 72.7 of 100.kevpublic-exploitT1068T1548https://patchfirst.co/cve/CVE-2025-48572/CVE-2025-48572Mon, 08 Dec 2025 00:00:00 GMTAndroid · Framework. In CISA KEV since 2025-12-02. ENISA EUVD lists it as exploited. EPSS 0.3% (higher than 17.6% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism. Priority 52.0 of 100.kevT1068T1548https://patchfirst.co/cve/CVE-2025-41244/CVE-2025-41244#kevThu, 30 Oct 2025 00:00:00 GMTBroadcom · VMware Aria Operations and VMware Tools. In CISA KEV since 2025-10-30. ENISA EUVD lists it as exploited. EPSS 8.6% (higher than 95.1% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism. Priority 67.5 of 100.kevpublic-exploitT1068T1548https://patchfirst.co/cve/CVE-2025-59230/CVE-2025-59230#kevTue, 14 Oct 2025 00:00:00 GMTMicrosoft · Windows. In CISA KEV since 2025-10-14. ENISA EUVD lists it as exploited. EPSS 2.7% (higher than 85.7% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism. Priority 60.6 of 100.kevT1068T1548https://patchfirst.co/cve/CVE-2025-32463/CVE-2025-32463#kevMon, 29 Sep 2025 00:00:00 GMTSudo · Sudo. In CISA KEV since 2025-09-29. ENISA EUVD lists it as exploited. EPSS 55.5% (higher than 99.03% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism. Priority 68.3 of 100.kevpublic-exploitT1068T1548https://patchfirst.co/cve/CVE-2023-44221/CVE-2023-44221#kevThu, 01 May 2025 00:00:00 GMTSonicWall · SMA100 Appliances. In CISA KEV since 2025-05-01. ENISA EUVD lists it as exploited. EPSS 76.3% (higher than 99.54% of CVEs). CVSS 7.2 HIGH. ATT&CK: T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism; T1059.004 Unix Shell; T1543 Create or Modify System Process. Priority 62.9 of 100.kevT1068T1548T1059.004T1543https://patchfirst.co/cve/CVE-2025-2783/CVE-2025-2783#kevThu, 27 Mar 2025 00:00:00 GMTGoogle · Chromium Mojo. In CISA KEV since 2025-03-27. ENISA EUVD lists it as exploited. EPSS 9.2% (higher than 95.3% of CVEs). CVSS 8.3 HIGH. Public exploit code exists. ATT&CK: T1203 Exploitation for Client Execution; T1548 Abuse Elevation Control Mechanism; T1497 Virtualization/Sandbox Evasion. Priority 67.9 of 100.kevpublic-exploitT1203T1548T1497https://patchfirst.co/cve/CVE-2024-49039/CVE-2024-49039#kevTue, 12 Nov 2024 00:00:00 GMTMicrosoft · Windows. In CISA KEV since 2024-11-12, known ransomware use. ENISA EUVD lists it as exploited. EPSS 14.2% (higher than 96.6% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism. Priority 78.5 of 100.kevransomwarepublic-exploitT1068T1548https://patchfirst.co/cve/CVE-2023-42824/CVE-2023-42824#kevThu, 05 Oct 2023 00:00:00 GMTApple · iOS and iPadOS. In CISA KEV since 2023-10-05. ENISA EUVD lists it as exploited. EPSS 1.0% (higher than 61.9% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism. Priority 60.8 of 100.kevpublic-exploitT1068T1548https://patchfirst.co/cve/CVE-2010-3904/CVE-2010-3904#kevFri, 12 May 2023 00:00:00 GMTLinux · Kernel. In CISA KEV since 2023-05-12. ENISA EUVD lists it as exploited. EPSS 15.9% (higher than 96.9% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism. Priority 67.8 of 100.kevpublic-exploitT1068T1548https://patchfirst.co/cve/CVE-2019-8526/CVE-2019-8526#kevMon, 17 Apr 2023 00:00:00 GMTApple · macOS. In CISA KEV since 2023-04-17. ENISA EUVD lists it as exploited. EPSS 0.7% (higher than 53.2% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism. Priority 54.1 of 100.kevT1068T1548https://patchfirst.co/cve/CVE-2021-3493/CVE-2021-3493#kevThu, 20 Oct 2022 00:00:00 GMTLinux · Kernel. In CISA KEV since 2022-10-20. ENISA EUVD lists it as exploited. EPSS 49.2% (higher than 98.9% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism. Priority 68.2 of 100.kevpublic-exploitT1068T1548https://patchfirst.co/cve/CVE-2014-3153/CVE-2014-3153#kevWed, 25 May 2022 00:00:00 GMTLinux · Kernel. In CISA KEV since 2022-05-25. ENISA EUVD lists it as exploited. EPSS 37.2% (higher than 98.5% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism. Priority 78.2 of 100.kevpublic-exploitT1068T1548https://patchfirst.co/cve/CVE-2018-8611/CVE-2018-8611#kevTue, 24 May 2022 00:00:00 GMTMicrosoft · Windows. In CISA KEV since 2022-05-24. ENISA EUVD lists it as exploited. EPSS 4.2% (higher than 90.9% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism. Priority 66.6 of 100.kevpublic-exploitT1068T1548https://patchfirst.co/cve/CVE-2019-0880/CVE-2019-0880#kevMon, 23 May 2022 00:00:00 GMTMicrosoft · Windows. In CISA KEV since 2022-05-23. ENISA EUVD lists it as exploited. EPSS 2.3% (higher than 83.3% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism. Priority 60.1 of 100.kevT1068T1548https://patchfirst.co/cve/CVE-2022-1388/CVE-2022-1388#kevTue, 10 May 2022 00:00:00 GMTF5 · BIG-IP. In CISA KEV since 2022-05-10, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.97% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1548 Abuse Elevation Control Mechanism. Priority 79.9 of 100.kevransomwarepublic-exploitT1548https://patchfirst.co/cve/CVE-2017-0213/CVE-2017-0213#kevMon, 28 Mar 2022 00:00:00 GMTMicrosoft · Windows. In CISA KEV since 2022-03-28, known ransomware use. ENISA EUVD lists it as exploited. EPSS 84.3% (higher than 99.7% of CVEs). CVSS 7.3 HIGH. Public exploit code exists. ATT&CK: T1548 Abuse Elevation Control Mechanism; T1068 Exploitation for Privilege Escalation. Named in 4 threat reports. Priority 87.0 of 100.kevransomwarepublic-exploitT1548T1068https://patchfirst.co/cve/CVE-2010-4398/CVE-2010-4398#kevMon, 28 Mar 2022 00:00:00 GMTMicrosoft · Windows. In CISA KEV since 2022-03-28. ENISA EUVD lists it as exploited. EPSS 8.7% (higher than 95.1% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism. Named in 1 threat report. Priority 71.4 of 100.kevpublic-exploitT1078T1068T1548https://patchfirst.co/cve/CVE-2009-1123/CVE-2009-1123#kevThu, 03 Mar 2022 00:00:00 GMTMicrosoft · Windows. In CISA KEV since 2022-03-03. ENISA EUVD lists it as exploited. EPSS 4.9% (higher than 92% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism. Priority 61.9 of 100.kevT1068T1548https://patchfirst.co/cve/CVE-2022-23131/CVE-2022-23131#kevTue, 22 Feb 2022 00:00:00 GMTZabbix · Frontend. In CISA KEV since 2022-02-22. ENISA EUVD lists it as exploited. EPSS 95.7% (higher than 99.87% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1548 Abuse Elevation Control Mechanism; T1059 Command and Scripting Interpreter; T1078 Valid Accounts. Priority 69.8 of 100.kevpublic-exploitT1190T1548T1059T1078https://patchfirst.co/cve/CVE-2019-13272/CVE-2019-13272#kevFri, 10 Dec 2021 00:00:00 GMTLinux · Kernel. In CISA KEV since 2021-12-10. ENISA EUVD lists it as exploited. EPSS 52.2% (higher than 99% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism. Priority 68.3 of 100.kevpublic-exploitT1068T1548https://patchfirst.co/cve/CVE-2016-7255/CVE-2016-7255#kevWed, 03 Nov 2021 00:00:00 GMTMicrosoft · Win32k. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 81.0% (higher than 99.63% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism. Priority 78.4 of 100.kevransomwarepublic-exploitT1068T1548https://patchfirst.co/cve/CVE-2021-38648/CVE-2021-38648#kevWed, 03 Nov 2021 00:00:00 GMTMicrosoft · Open Management Infrastructure (OMI). In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 11.4% (higher than 96% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism. Priority 67.7 of 100.kevpublic-exploitT1068T1548https://patchfirst.co/cve/CVE-2021-30713/CVE-2021-30713#kevWed, 03 Nov 2021 00:00:00 GMTApple · macOS. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 7.0% (higher than 94.2% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism. Priority 62.3 of 100.kevT1068T1548https://patchfirst.co/cve/CVE-2021-31979/CVE-2021-31979#kevWed, 03 Nov 2021 00:00:00 GMTMicrosoft · Windows. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 4.5% (higher than 91.6% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism. Priority 61.8 of 100.kevT1068T1548https://patchfirst.co/cve/CVE-2019-3717/CVE-2019-3717Mon, 05 Aug 2019 00:00:00 GMTDell · Dell Client Commercial and Consumer platforms. Not in CISA KEV. EPSS 0.4% (higher than 30.1% of CVEs). CVSS 7.1 HIGH. ATT&CK: T1200 Hardware Additions; T1548 Abuse Elevation Control Mechanism. Priority 11.0 of 100.T1200T1548https://patchfirst.co/cve/CVE-2019-1812/CVE-2019-1812Wed, 15 May 2019 00:00:00 GMTCisco · Cisco NX-OS Software. Not in CISA KEV. EPSS 0.3% (higher than 27.1% of CVEs). CVSS 6.7 MEDIUM. ATT&CK: T1078 Valid Accounts; T1059 Command and Scripting Interpreter; T1548 Abuse Elevation Control Mechanism. Priority 10.1 of 100.T1078T1059T1548