https://patchfirst.co/technique/T1552/New and newly exploited CVEs that lead to ATT&CK T1552 Unsecured Credentials, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.en-gb360Sat, 31 Oct 2026 05:11:25 GMThttps://patchfirst.co/cve/CVE-2026-20128/CVE-2026-20128#kevMon, 20 Apr 2026 00:00:00 GMTCisco · Catalyst SD-WAN Manager. In CISA KEV since 2026-04-20. ENISA EUVD lists it as exploited. EPSS 7.3% (higher than 94.4% of CVEs). CVSS 7.5 HIGH. ATT&CK: T1190 Exploit Public-Facing Application; T1552 Unsecured Credentials. Priority 67.1 of 100.kevT1190T1552https://patchfirst.co/cve/CVE-2023-50224/CVE-2023-50224#kevWed, 03 Sep 2025 00:00:00 GMTTP-Link · TL-WR841N. In CISA KEV since 2025-09-03. ENISA EUVD lists it as exploited. EPSS 20.0% (higher than 97.4% of CVEs). CVSS 6.5 MEDIUM. ATT&CK: T1190 Exploit Public-Facing Application; T1552 Unsecured Credentials. Priority 62.0 of 100.kevT1190T1552https://patchfirst.co/cve/CVE-2019-6693/CVE-2019-6693#kevWed, 25 Jun 2025 00:00:00 GMTFortinet · FortiOS. In CISA KEV since 2025-06-25, known ransomware use. ENISA EUVD lists it as exploited. EPSS 6.6% (higher than 93.9% of CVEs). CVSS 6.5 MEDIUM. Public exploit code exists. ATT&CK: T1552 Unsecured Credentials; T1555 Credentials from Password Stores. Priority 76.3 of 100.kevransomwarepublic-exploitT1552T1555https://patchfirst.co/cve/CVE-2024-20439/CVE-2024-20439#kevMon, 31 Mar 2025 00:00:00 GMTCisco · Smart Licensing Utility. In CISA KEV since 2025-03-31. ENISA EUVD lists it as exploited. EPSS 97.1% (higher than 99.89% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1552 Unsecured Credentials; T1106 Native API. Priority 69.8 of 100.kevpublic-exploitT1552T1106https://patchfirst.co/cve/CVE-2024-3272/CVE-2024-3272#kevThu, 11 Apr 2024 00:00:00 GMTD-Link · Multiple NAS Devices. In CISA KEV since 2024-04-11. ENISA EUVD lists it as exploited. EPSS 98.1% (higher than 99.91% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1552 Unsecured Credentials; T1078 Valid Accounts. Priority 69.8 of 100.kevpublic-exploitT1552T1078https://patchfirst.co/cve/CVE-2024-21887/CVE-2024-21887Fri, 12 Jan 2024 00:00:00 GMTIvanti · Connect Secure and Policy Secure. In CISA KEV since 2024-01-10, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 9.1 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1505.003 Web Shell; T1552 Unsecured Credentials. Named in 4 threat reports. Priority 88.4 of 100.kevransomwarepublic-exploitT1190T1059T1505.003T1552https://patchfirst.co/cve/CVE-2023-49103/CVE-2023-49103#kevThu, 30 Nov 2023 00:00:00 GMTownCloud · ownCloud graphapi. In CISA KEV since 2023-11-30. ENISA EUVD lists it as exploited. EPSS 77.8% (higher than 99.57% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System; T1552 Unsecured Credentials. Priority 68.2 of 100.kevpublic-exploitT1190T1005T1552https://patchfirst.co/cve/CVE-2023-28432/CVE-2023-28432#kevFri, 21 Apr 2023 00:00:00 GMTMinIO · MinIO. In CISA KEV since 2023-04-21. ENISA EUVD lists it as exploited. EPSS 84.0% (higher than 99.69% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1552 Unsecured Credentials. Priority 68.2 of 100.kevpublic-exploitT1190T1552https://patchfirst.co/cve/CVE-2022-24990/CVE-2022-24990#kevFri, 10 Feb 2023 00:00:00 GMTTerraMaster · TerraMaster OS. In CISA KEV since 2023-02-10, known ransomware use. ENISA EUVD lists it as exploited. EPSS 83.2% (higher than 99.68% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1552 Unsecured Credentials. Priority 78.2 of 100.kevransomwarepublic-exploitT1190T1552https://patchfirst.co/cve/CVE-2017-5521/CVE-2017-5521#kevThu, 08 Sep 2022 00:00:00 GMTNETGEAR · Multiple Devices. In CISA KEV since 2022-09-08. ENISA EUVD lists it as exploited. EPSS 89.4% (higher than 99.78% of CVEs). CVSS 8.1 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1552 Unsecured Credentials. Priority 68.6 of 100.kevpublic-exploitT1190T1552https://patchfirst.co/cve/CVE-2011-4723/CVE-2011-4723#kevThu, 08 Sep 2022 00:00:00 GMTD-Link · DIR-300 Router. In CISA KEV since 2022-09-08. ENISA EUVD lists it as exploited. EPSS 3.1% (higher than 87.6% of CVEs). CVSS 5.7 MEDIUM. ATT&CK: T1078 Valid Accounts; T1552 Unsecured Credentials. Priority 59.5 of 100.kevT1078T1552https://patchfirst.co/cve/CVE-2020-5902/CVE-2020-5902#kevWed, 03 Nov 2021 00:00:00 GMTF5 · BIG-IP. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1133 External Remote Services; T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1003 OS Credential Dumping; T1005 Data from Local System; T1070.004 File Deletion; +1 more. Named in 5 threat reports. Priority 89.9 of 100.kevransomwarepublic-exploitT1133T1190T1059T1003T1005T1070.004T1552https://patchfirst.co/cve/CVE-2021-30116/CVE-2021-30116#kevWed, 03 Nov 2021 00:00:00 GMTKaseya · Virtual System/Server Administrator (VSA). In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 85.7% (higher than 99.73% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1552 Unsecured Credentials. Named in 1 threat report. Priority 83.7 of 100.kevransomwarepublic-exploitT1190T1552https://patchfirst.co/cve/CVE-2017-9248/CVE-2017-9248#kevWed, 03 Nov 2021 00:00:00 GMTProgress · ASP.NET AJAX and Sitefinity. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 75.1% (higher than 99.51% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1552 Unsecured Credentials. Priority 69.8 of 100.kevpublic-exploitT1190T1552https://patchfirst.co/cve/CVE-2019-18988/CVE-2019-18988#kevWed, 03 Nov 2021 00:00:00 GMTTeamViewer · Desktop. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 4.7% (higher than 91.8% of CVEs). CVSS 7.0 HIGH. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1552 Unsecured Credentials. Priority 66.3 of 100.kevpublic-exploitT1078T1552https://patchfirst.co/cve/CVE-2020-15105/CVE-2020-15105Fri, 10 Jul 2020 00:00:00 GMTBouke · django-two-factor-auth. Not in CISA KEV. EPSS 0.7% (higher than 53.1% of CVEs). CVSS 5.4 MEDIUM. ATT&CK: T1552 Unsecured Credentials; T1078 Valid Accounts. Priority 14.4 of 100.T1552T1078https://patchfirst.co/cve/CVE-2020-15095/CVE-2020-15095Tue, 07 Jul 2020 00:00:00 GMTnpm · cli. Not in CISA KEV. EPSS 0.4% (higher than 34.6% of CVEs). CVSS 4.4 MEDIUM. ATT&CK: T1552 Unsecured Credentials. Priority 10.0 of 100.T1552https://patchfirst.co/cve/CVE-2020-12008/CVE-2020-12008Mon, 29 Jun 2020 00:00:00 GMTNot in CISA KEV. EPSS 0.9% (higher than 61.2% of CVEs). ATT&CK: T1552 Unsecured Credentials. Priority 12.2 of 100.T1552https://patchfirst.co/cve/CVE-2019-3763/CVE-2019-3763Wed, 11 Sep 2019 00:00:00 GMTDell · RSA Identity Governance and Lifecycle. Not in CISA KEV. EPSS 0.3% (higher than 25.5% of CVEs). CVSS 8.8 HIGH. ATT&CK: T1552 Unsecured Credentials; T1078 Valid Accounts. Priority 11.3 of 100.T1552T1078https://patchfirst.co/cve/CVE-2019-3787/CVE-2019-3787Wed, 19 Jun 2019 00:00:00 GMTCloud Foundry · UAA Release (OSS). Not in CISA KEV. EPSS 1.1% (higher than 65.7% of CVEs). CVSS 8.3 HIGH. ATT&CK: T1552 Unsecured Credentials; T1078 Valid Accounts; T1098 Account Manipulation. Priority 18.9 of 100.T1552T1078T1098https://patchfirst.co/cve/CVE-2019-6549/CVE-2019-6549Tue, 12 Feb 2019 00:00:00 GMTICS-CERT · PR100088 Modbus gateway. Not in CISA KEV. EPSS 0.6% (higher than 48.3% of CVEs). ATT&CK: T1552 Unsecured Credentials; T1078 Valid Accounts. Priority 9.7 of 100.T1552T1078https://patchfirst.co/cve/CVE-2018-15797/CVE-2018-15797Wed, 05 Dec 2018 00:00:00 GMTCloud Foundry · NFS Volume Release. Not in CISA KEV. EPSS 1.6% (higher than 75.5% of CVEs). CVSS 8.4 HIGH. ATT&CK: T1552 Unsecured Credentials; T1068 Exploitation for Privilege Escalation. Priority 21.0 of 100.T1552T1068https://patchfirst.co/cve/CVE-2018-17900/CVE-2018-17900Fri, 12 Oct 2018 00:00:00 GMTYokogawa · STARDOM Controllers FCJ,FCN-100,FCN-RTU, FCN-500. Not in CISA KEV. EPSS 1.9% (higher than 79.3% of CVEs). ATT&CK: T1552 Unsecured Credentials; T1078 Valid Accounts. Priority 15.9 of 100.T1552T1078https://patchfirst.co/cve/CVE-2018-11088/CVE-2018-11088Mon, 17 Sep 2018 00:00:00 GMTPivotal · Application Service. Not in CISA KEV. EPSS 1.0% (higher than 61.6% of CVEs). ATT&CK: T1552 Unsecured Credentials; T1068 Exploitation for Privilege Escalation. Priority 12.3 of 100.T1552T1068