https://patchfirst.co/technique/T1557/New and newly exploited CVEs that lead to ATT&CK T1557 Adversary-in-the-Middle, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.en-gb360Sat, 31 Oct 2026 05:11:25 GMThttps://patchfirst.co/cve/CVE-2026-34486/CVE-2026-34486#kevTue, 04 Aug 2026 00:00:00 GMTApache · Tomcat. In CISA KEV since 2026-08-04. ENISA EUVD lists it as exploited. EPSS 98.5% (higher than 99.92% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1040 Network Sniffing; T1557 Adversary-in-the-Middle. Priority 73.2 of 100.kevpublic-exploitT1040T1557https://patchfirst.co/cve/CVE-2026-3502/CVE-2026-3502#kevThu, 02 Apr 2026 00:00:00 GMTTrueConf · Client. In CISA KEV since 2026-04-02. ENISA EUVD lists it as exploited. EPSS 5.8% (higher than 93.2% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1557 Adversary-in-the-Middle; T1059 Command and Scripting Interpreter. Priority 72.1 of 100.kevpublic-exploitT1557T1059https://patchfirst.co/cve/CVE-2025-15556/CVE-2025-15556#kevThu, 12 Feb 2026 00:00:00 GMTNotepad++ · Notepad++. In CISA KEV since 2026-02-12. ENISA EUVD lists it as exploited. EPSS 1.7% (higher than 77.8% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1557 Adversary-in-the-Middle; T1204.002 Malicious File. Priority 68.8 of 100.kevpublic-exploitT1557T1204.002https://patchfirst.co/cve/CVE-2025-31200/CVE-2025-31200#kevThu, 17 Apr 2025 00:00:00 GMTApple · Multiple Products. In CISA KEV since 2025-04-17. ENISA EUVD lists it as exploited. EPSS 20.9% (higher than 97.6% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1105 Ingress Tool Transfer; T1001 Data Obfuscation; T1059 Command and Scripting Interpreter; T1106 Native API; T1557 Adversary-in-the-Middle. Priority 69.4 of 100.kevpublic-exploitT1105T1001T1059T1106T1557https://patchfirst.co/cve/CVE-2025-31201/CVE-2025-31201#kevThu, 17 Apr 2025 00:00:00 GMTApple · Multiple Products. In CISA KEV since 2025-04-17. ENISA EUVD lists it as exploited. EPSS 14.0% (higher than 96.5% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1105 Ingress Tool Transfer; T1001 Data Obfuscation; T1059 Command and Scripting Interpreter; T1106 Native API; T1557 Adversary-in-the-Middle. Priority 69.2 of 100.kevpublic-exploitT1105T1001T1059T1106T1557https://patchfirst.co/cve/CVE-2020-11023/CVE-2020-11023#kevThu, 23 Jan 2025 00:00:00 GMTJQuery · JQuery. In CISA KEV since 2025-01-23. ENISA EUVD lists it as exploited. EPSS 84.9% (higher than 99.71% of CVEs). CVSS 6.1 MEDIUM. Public exploit code exists. ATT&CK: T1204.001 Malicious Link; T1059.007 JavaScript; T1557 Adversary-in-the-Middle. Priority 67.2 of 100.kevpublic-exploitT1204.001T1059.007T1557https://patchfirst.co/cve/CVE-2023-48795/CVE-2023-48795Mon, 18 Dec 2023 00:00:00 GMTNot in CISA KEV. EPSS 93.5% (higher than 99.84% of CVEs). CVSS 5.9 MEDIUM. Public exploit code exists. ATT&CK: T1557 Adversary-in-the-Middle. Named in 1 threat report. Priority 70.8 of 100.public-exploitT1557https://patchfirst.co/cve/CVE-2022-37436/CVE-2022-37436Tue, 17 Jan 2023 00:00:00 GMTApache Software Foundation · Apache HTTP Server. Not in CISA KEV. EPSS 55.9% (higher than 99.04% of CVEs). CVSS 5.3 MEDIUM. ATT&CK: T1190 Exploit Public-Facing Application; T1557 Adversary-in-the-Middle. Named in 1 threat report. Priority 28.1 of 100.T1190T1557https://patchfirst.co/cve/CVE-2022-22536/CVE-2022-22536#kevThu, 18 Aug 2022 00:00:00 GMTSAP · Multiple Products. In CISA KEV since 2022-08-18. ENISA EUVD lists it as exploited. EPSS 97.9% (higher than 99.91% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1557 Adversary-in-the-Middle. Priority 70.0 of 100.kevpublic-exploitT1190T1557https://patchfirst.co/cve/CVE-2022-26925/CVE-2022-26925#kevFri, 01 Jul 2022 00:00:00 GMTMicrosoft · Windows. In CISA KEV since 2022-07-01. ENISA EUVD lists it as exploited. EPSS 10.5% (higher than 95.7% of CVEs). CVSS 5.9 MEDIUM. ATT&CK: T1190 Exploit Public-Facing Application; T1557 Adversary-in-the-Middle. Priority 71.3 of 100.kevT1190T1557https://patchfirst.co/cve/CVE-2022-1040/CVE-2022-1040#kevThu, 31 Mar 2022 00:00:00 GMTSophos · Firewall. In CISA KEV since 2022-03-31. ENISA EUVD lists it as exploited. EPSS 99.8% (higher than 99.96% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1040 Network Sniffing; T1078 Valid Accounts; T1557 Adversary-in-the-Middle; T1574 Hijack Execution Flow. Priority 79.9 of 100.kevpublic-exploitT1190T1059T1040T1078T1557T1574https://patchfirst.co/cve/CVE-2021-36942/CVE-2021-36942#kevWed, 03 Nov 2021 00:00:00 GMTMicrosoft · Windows. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 66.0% (higher than 99.27% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1557 Adversary-in-the-Middle. Priority 78.1 of 100.kevransomwarepublic-exploitT1190T1557https://patchfirst.co/cve/CVE-2019-5591/CVE-2019-5591#kevWed, 03 Nov 2021 00:00:00 GMTFortinet · FortiOS. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 18.6% (higher than 97.3% of CVEs). CVSS 6.5 MEDIUM. Public exploit code exists. ATT&CK: T1133 External Remote Services; T1557 Adversary-in-the-Middle; T1005 Data from Local System. Priority 77.0 of 100.kevransomwarepublic-exploitT1133T1557T1005https://patchfirst.co/cve/CVE-2020-3137/CVE-2020-3137Wed, 23 Sep 2020 00:00:00 GMTCisco · Cisco Email Security Appliance (ESA). Not in CISA KEV. EPSS 0.8% (higher than 57.8% of CVEs). CVSS 6.1 MEDIUM. ATT&CK: T1204.001 Malicious Link; T1059.007 JavaScript; T1557 Adversary-in-the-Middle. Priority 15.8 of 100.T1204.001T1059.007T1557https://patchfirst.co/cve/CVE-2020-3349/CVE-2020-3349Thu, 16 Jul 2020 00:00:00 GMTCisco · Cisco Data Center Network Manager. Not in CISA KEV. EPSS 0.6% (higher than 49.8% of CVEs). CVSS 4.8 MEDIUM. ATT&CK: T1204.001 Malicious Link; T1059.007 JavaScript; T1557 Adversary-in-the-Middle. Priority 13.3 of 100.T1204.001T1059.007T1557https://patchfirst.co/cve/CVE-2020-15093/CVE-2020-15093Thu, 09 Jul 2020 00:00:00 GMTawslabs · tough. Not in CISA KEV. EPSS 1.4% (higher than 71.6% of CVEs). CVSS 8.6 HIGH. ATT&CK: T1110 Brute Force; T1040 Network Sniffing; T1078 Valid Accounts; T1557 Adversary-in-the-Middle. Priority 20.3 of 100.T1110T1040T1078T1557https://patchfirst.co/cve/CVE-2020-3356/CVE-2020-3356Thu, 18 Jun 2020 00:00:00 GMTCisco · Cisco Data Center Network Manager. Not in CISA KEV. EPSS 0.8% (higher than 56.6% of CVEs). CVSS 6.1 MEDIUM. ATT&CK: T1204.001 Malicious Link; T1059.007 JavaScript; T1557 Adversary-in-the-Middle. Priority 15.6 of 100.T1204.001T1059.007T1557https://patchfirst.co/cve/CVE-2020-3233/CVE-2020-3233Wed, 03 Jun 2020 00:00:00 GMTCisco · Cisco IOx. Not in CISA KEV. EPSS 0.6% (higher than 50.3% of CVEs). CVSS 6.4 MEDIUM. ATT&CK: T1059.007 JavaScript; T1557 Adversary-in-the-Middle. Priority 14.5 of 100.T1059.007T1557https://patchfirst.co/cve/CVE-2020-11082/CVE-2020-11082Thu, 28 May 2020 00:00:00 GMTkaminari · Kaminari. Not in CISA KEV. EPSS 1.5% (higher than 75% of CVEs). CVSS 6.4 MEDIUM. ATT&CK: T1204.001 Malicious Link; T1059.007 JavaScript; T1557 Adversary-in-the-Middle. Priority 19.5 of 100.T1204.001T1059.007T1557https://patchfirst.co/cve/CVE-2020-11035/CVE-2020-11035Tue, 05 May 2020 00:00:00 GMTglpi-project · GLPI. Not in CISA KEV. EPSS 0.9% (higher than 59.6% of CVEs). CVSS 7.5 HIGH. ATT&CK: T1110 Brute Force; T1040 Network Sniffing; T1078 Valid Accounts; T1557 Adversary-in-the-Middle. Priority 17.2 of 100.T1110T1040T1078T1557https://patchfirst.co/cve/CVE-2020-5336/CVE-2020-5336Mon, 04 May 2020 00:00:00 GMTDell · RSA Archer. Not in CISA KEV. EPSS 0.7% (higher than 53.3% of CVEs). CVSS 4.6 MEDIUM. ATT&CK: T1204.001 Malicious Link; T1059.007 JavaScript; T1557 Adversary-in-the-Middle. Priority 13.9 of 100.T1204.001T1059.007T1557https://patchfirst.co/cve/CVE-2020-11030/CVE-2020-11030Thu, 30 Apr 2020 00:00:00 GMTWordPress · WordPress. Not in CISA KEV. EPSS 1.4% (higher than 73.1% of CVEs). CVSS 6.4 MEDIUM. ATT&CK: T1059.007 JavaScript; T1557 Adversary-in-the-Middle. Priority 19.1 of 100.T1059.007T1557https://patchfirst.co/cve/CVE-2020-5270/CVE-2020-5270Mon, 20 Apr 2020 00:00:00 GMTPrestaShop · PrestaShop. Not in CISA KEV. EPSS 0.8% (higher than 57.6% of CVEs). CVSS 4.1 MEDIUM. ATT&CK: T1566.002 Spearphishing Link; T1005 Data from Local System; T1036 Masquerading; T1059.007 JavaScript; T1557 Adversary-in-the-Middle. Priority 14.4 of 100.T1566.002T1005T1036T1059.007T1557https://patchfirst.co/cve/CVE-2020-5269/CVE-2020-5269Mon, 20 Apr 2020 00:00:00 GMTPrestaShop · PrestaShop. Not in CISA KEV. EPSS 0.8% (higher than 56.8% of CVEs). CVSS 4.1 MEDIUM. ATT&CK: T1204.001 Malicious Link; T1059.007 JavaScript; T1557 Adversary-in-the-Middle. Priority 14.2 of 100.T1204.001T1059.007T1557https://patchfirst.co/cve/CVE-2020-5271/CVE-2020-5271Mon, 20 Apr 2020 00:00:00 GMTPrestaShop · PrestaShop. Not in CISA KEV. EPSS 0.8% (higher than 56.8% of CVEs). CVSS 4.1 MEDIUM. ATT&CK: T1204.001 Malicious Link; T1059.007 JavaScript; T1557 Adversary-in-the-Middle. Priority 14.2 of 100.T1204.001T1059.007T1557https://patchfirst.co/cve/CVE-2020-5264/CVE-2020-5264Mon, 20 Apr 2020 00:00:00 GMTPrestaShop · PrestaShop. Not in CISA KEV. EPSS 0.8% (higher than 55.1% of CVEs). CVSS 4.4 MEDIUM. ATT&CK: T1204.001 Malicious Link; T1059.007 JavaScript; T1557 Adversary-in-the-Middle. Priority 14.1 of 100.T1204.001T1059.007T1557https://patchfirst.co/cve/CVE-2020-5266/CVE-2020-5266Thu, 16 Apr 2020 00:00:00 GMTPrestaShop · ps_linklist. Not in CISA KEV. EPSS 0.6% (higher than 50.5% of CVEs). CVSS 4.4 MEDIUM. ATT&CK: T1189 Drive-by Compromise; T1059.007 JavaScript; T1557 Adversary-in-the-Middle. Priority 13.2 of 100.T1189T1059.007T1557https://patchfirst.co/cve/CVE-2020-3121/CVE-2020-3121Sun, 26 Jan 2020 00:00:00 GMTCisco · Cisco 550X Series Stackable Managed Switches. Not in CISA KEV. EPSS 1.1% (higher than 64.7% of CVEs). CVSS 6.1 MEDIUM. ATT&CK: T1204.001 Malicious Link; T1059.007 JavaScript; T1557 Adversary-in-the-Middle. Priority 17.2 of 100.T1204.001T1059.007T1557https://patchfirst.co/cve/CVE-2019-15994/CVE-2019-15994Tue, 26 Nov 2019 00:00:00 GMTCisco · Cisco Stealthwatch Enterprise. Not in CISA KEV. EPSS 0.8% (higher than 56.6% of CVEs). CVSS 5.4 MEDIUM. ATT&CK: T1204.001 Malicious Link; T1059.007 JavaScript; T1557 Adversary-in-the-Middle. Priority 15.1 of 100.T1204.001T1059.007T1557https://patchfirst.co/cve/CVE-2019-15280/CVE-2019-15280Wed, 16 Oct 2019 00:00:00 GMTCisco · Cisco Firepower Management Center. Not in CISA KEV. EPSS 0.6% (higher than 49.8% of CVEs). CVSS 4.8 MEDIUM. ATT&CK: T1189 Drive-by Compromise; T1059.007 JavaScript; T1557 Adversary-in-the-Middle. Priority 13.3 of 100.T1189T1059.007T1557https://patchfirst.co/cve/CVE-2019-3754/CVE-2019-3754Tue, 03 Sep 2019 00:00:00 GMTDELL EMC · Unity Operating Environment. Not in CISA KEV. EPSS 1.1% (higher than 65.9% of CVEs). CVSS 4.7 MEDIUM. ATT&CK: T1204.001 Malicious Link; T1059.007 JavaScript; T1557 Adversary-in-the-Middle. Priority 16.5 of 100.T1204.001T1059.007T1557https://patchfirst.co/cve/CVE-2019-1943/CVE-2019-1943Wed, 17 Jul 2019 00:00:00 GMTCisco · Cisco Small Business 300 Series Managed Switches. Not in CISA KEV. EPSS 9.7% (higher than 95.5% of CVEs). CVSS 4.7 MEDIUM. Public exploit code exists. ATT&CK: T1557 Adversary-in-the-Middle; T1565.002 Transmitted Data Manipulation; T1189 Drive-by Compromise. Priority 27.4 of 100.public-exploitT1557T1565.002T1189https://patchfirst.co/cve/CVE-2019-1941/CVE-2019-1941Wed, 17 Jul 2019 00:00:00 GMTCisco · Cisco Identity Services Engine Software. Not in CISA KEV. EPSS 1.3% (higher than 69.8% of CVEs). CVSS 6.1 MEDIUM. ATT&CK: T1204.001 Malicious Link; T1059.007 JavaScript; T1557 Adversary-in-the-Middle. Priority 18.2 of 100.T1204.001T1059.007T1557https://patchfirst.co/cve/CVE-2019-1860/CVE-2019-1860Thu, 16 May 2019 00:00:00 GMTCisco · Cisco Unified Intelligence Center. Not in CISA KEV. EPSS 1.3% (higher than 69.5% of CVEs). CVSS 5.9 MEDIUM. ATT&CK: T1557 Adversary-in-the-Middle; T1005 Data from Local System. Priority 18.0 of 100.T1557T1005https://patchfirst.co/cve/CVE-2019-1715/CVE-2019-1715Fri, 03 May 2019 00:00:00 GMTCisco · Cisco Adaptive Security Appliance (ASA) Software. Not in CISA KEV. EPSS 1.7% (higher than 77.5% of CVEs). CVSS 5.3 MEDIUM. ATT&CK: T1110 Brute Force; T1040 Network Sniffing; T1078 Valid Accounts; T1557 Adversary-in-the-Middle. Priority 19.2 of 100.T1110T1040T1078T1557https://patchfirst.co/cve/CVE-2019-1838/CVE-2019-1838Fri, 03 May 2019 00:00:00 GMTCisco · Cisco Application Policy Infrastructure Controller (APIC). Not in CISA KEV. EPSS 0.8% (higher than 56.9% of CVEs). CVSS 5.4 MEDIUM. ATT&CK: T1204.001 Malicious Link; T1059.007 JavaScript; T1557 Adversary-in-the-Middle. Priority 15.2 of 100.T1204.001T1059.007T1557https://patchfirst.co/cve/CVE-2019-6538/CVE-2019-6538Mon, 25 Mar 2019 00:00:00 GMTMedtronic · Conexus Radio Frequency Telemetry Protocol. Not in CISA KEV. EPSS 0.9% (higher than 59.5% of CVEs). CVSS 9.3 CRITICAL. ATT&CK: T1005 Data from Local System; T1499.004 Application or System Exploitation; T1557 Adversary-in-the-Middle; T1574 Hijack Execution Flow. Priority 19.8 of 100.T1005T1499.004T1557T1574https://patchfirst.co/cve/CVE-2019-1665/CVE-2019-1665Thu, 21 Feb 2019 00:00:00 GMTCisco · Cisco HyperFlex HX-Series. Not in CISA KEV. EPSS 1.1% (higher than 65.5% of CVEs). CVSS 4.7 MEDIUM. ATT&CK: T1204.001 Malicious Link; T1059.007 JavaScript; T1557 Adversary-in-the-Middle. Priority 16.4 of 100.T1204.001T1059.007T1557https://patchfirst.co/cve/CVE-2018-15784/CVE-2018-15784Fri, 18 Jan 2019 00:00:00 GMTDell · Dell Networking OS10. Not in CISA KEV. EPSS 0.6% (higher than 49.2% of CVEs). CVSS 7.4 HIGH. ATT&CK: T1557 Adversary-in-the-Middle. Priority 15.0 of 100.T1557https://patchfirst.co/cve/CVE-2018-15393/CVE-2018-15393Thu, 08 Nov 2018 00:00:00 GMTCisco · Cisco Content Security Management Appliance (SMA). Not in CISA KEV. EPSS 1.2% (higher than 69% of CVEs). CVSS 4.8 MEDIUM. ATT&CK: T1204.001 Malicious Link; T1059.007 JavaScript; T1557 Adversary-in-the-Middle. Priority 17.2 of 100.T1204.001T1059.007T1557https://patchfirst.co/cve/CVE-2018-10610/CVE-2018-10610Tue, 09 Oct 2018 00:00:00 GMTWECON Technology Co., Ltd · LeviStudioU. Not in CISA KEV. EPSS 1.1% (higher than 66.1% of CVEs). ATT&CK: T1005 Data from Local System; T1499.004 Application or System Exploitation; T1557 Adversary-in-the-Middle; T1574 Hijack Execution Flow. Priority 13.2 of 100.T1005T1499.004T1557T1574https://patchfirst.co/cve/CVE-2018-14809/CVE-2018-14809Wed, 26 Sep 2018 00:00:00 GMTFuji Electric · V-Server. Not in CISA KEV. EPSS 2.7% (higher than 85.7% of CVEs). ATT&CK: T1005 Data from Local System; T1499.004 Application or System Exploitation; T1557 Adversary-in-the-Middle; T1574 Hijack Execution Flow. Priority 17.1 of 100.T1005T1499.004T1557T1574https://patchfirst.co/cve/CVE-2018-11087/CVE-2018-11087Fri, 14 Sep 2018 00:00:00 GMTPivotal · Spring AMQP. Not in CISA KEV. EPSS 1.2% (higher than 69% of CVEs). ATT&CK: T1557 Adversary-in-the-Middle. Priority 13.8 of 100.T1557