https://patchfirst.co/technique/T1565.001/New and newly exploited CVEs that lead to ATT&CK T1565.001 Stored Data Manipulation, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.en-gb360Sat, 31 Oct 2026 05:11:25 GMThttps://patchfirst.co/cve/CVE-2026-104286/CVE-2026-104286#kevThu, 01 Oct 2026 00:00:00 GMTFortinet · FortiMail. In CISA KEV since 2026-10-01. ENISA EUVD lists it as exploited. EPSS 4.6% (higher than 91.6% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1565.001 Stored Data Manipulation. Priority 78.2 of 100.kevpublic-exploitT1190T1565.001https://patchfirst.co/cve/CVE-2026-67279/CVE-2026-67279#kevFri, 25 Sep 2026 00:00:00 GMTMikroTik · RouterOS. In CISA KEV since 2026-09-25. ENISA EUVD lists it as exploited. EPSS 2.3% (higher than 83.1% of CVEs). CVSS 6.5 MEDIUM. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1565.001 Stored Data Manipulation. Priority 74.2 of 100.kevpublic-exploitT1190T1059T1565.001https://patchfirst.co/cve/CVE-2026-20253/CVE-2026-20253#kevThu, 18 Jun 2026 00:00:00 GMTSplunk · Enterprise. In CISA KEV since 2026-06-18. ENISA EUVD lists it as exploited. EPSS 96.9% (higher than 99.89% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1565.001 Stored Data Manipulation. Priority 74.8 of 100.kevpublic-exploitT1190T1565.001https://patchfirst.co/cve/CVE-2026-20262/CVE-2026-20262#kevMon, 15 Jun 2026 00:00:00 GMTCisco · Catalyst SD-WAN Manager. In CISA KEV since 2026-06-15. ENISA EUVD lists it as exploited. EPSS 29.1% (higher than 98.2% of CVEs). CVSS 6.5 MEDIUM. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1565.001 Stored Data Manipulation. Priority 72.2 of 100.kevpublic-exploitT1190T1565.001https://patchfirst.co/cve/CVE-2026-42208/CVE-2026-42208#kevFri, 08 May 2026 00:00:00 GMTBerriAI · LiteLLM. In CISA KEV since 2026-05-08. ENISA EUVD lists it as exploited. EPSS 89.4% (higher than 99.78% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System; T1565.001 Stored Data Manipulation. Priority 74.8 of 100.kevpublic-exploitT1190T1005T1565.001https://patchfirst.co/cve/CVE-2026-20122/CVE-2026-20122#kevMon, 20 Apr 2026 00:00:00 GMTCisco · Catalyst SD-WAN Manger. In CISA KEV since 2026-04-20. ENISA EUVD lists it as exploited. EPSS 25.8% (higher than 98% of CVEs). CVSS 5.4 MEDIUM. ATT&CK: T1190 Exploit Public-Facing Application; T1565.001 Stored Data Manipulation. Priority 66.4 of 100.kevT1190T1565.001https://patchfirst.co/cve/CVE-2025-0108/CVE-2025-0108#kevTue, 18 Feb 2025 00:00:00 GMTPalo Alto Networks · PAN-OS. In CISA KEV since 2025-02-18. ENISA EUVD lists it as exploited. EPSS 98.1% (higher than 99.91% of CVEs). CVSS 9.1 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1055 Process Injection; T1565.001 Stored Data Manipulation. Priority 69.4 of 100.kevpublic-exploitT1190T1055T1565.001https://patchfirst.co/cve/CVE-2024-8956/CVE-2024-8956#kevMon, 04 Nov 2024 00:00:00 GMTPTZOptics · PT30X-SDI/NDI Cameras. In CISA KEV since 2024-11-04. ENISA EUVD lists it as exploited. EPSS 58.8% (higher than 99.11% of CVEs). CVSS 9.1 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System; T1565.001 Stored Data Manipulation. Priority 69.2 of 100.kevpublic-exploitT1190T1005T1565.001https://patchfirst.co/cve/CVE-2022-41328/CVE-2022-41328#kevTue, 14 Mar 2023 00:00:00 GMTFortinet · FortiOS. In CISA KEV since 2023-03-14. ENISA EUVD lists it as exploited. EPSS 10.7% (higher than 95.8% of CVEs). CVSS 7.1 HIGH. ATT&CK: T1574 Hijack Execution Flow; T1037 Boot or Logon Initialization Scripts; T1049 System Network Connections Discovery; T1565.001 Stored Data Manipulation. Named in 1 threat report. Priority 66.0 of 100.kevT1574T1037T1049T1565.001https://patchfirst.co/cve/CVE-2022-27593/CVE-2022-27593#kevThu, 08 Sep 2022 00:00:00 GMTQNAP · Photo Station. In CISA KEV since 2022-09-08, known ransomware use. ENISA EUVD lists it as exploited. EPSS 87.9% (higher than 99.76% of CVEs). CVSS 9.1 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1565.001 Stored Data Manipulation. Priority 79.3 of 100.kevransomwarepublic-exploitT1190T1565.001https://patchfirst.co/cve/CVE-2020-36193/CVE-2020-36193#kevThu, 25 Aug 2022 00:00:00 GMTPEAR · Archive_Tar. In CISA KEV since 2022-08-25. ENISA EUVD lists it as exploited. EPSS 70.6% (higher than 99.39% of CVEs). CVSS 7.5 HIGH. ATT&CK: T1190 Exploit Public-Facing Application; T1565.001 Stored Data Manipulation. Priority 73.1 of 100.kevT1190T1565.001https://patchfirst.co/cve/CVE-2022-30333/CVE-2022-30333#kevTue, 09 Aug 2022 00:00:00 GMTRARLAB · UnRAR. In CISA KEV since 2022-08-09, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.2% (higher than 99.94% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1565.001 Stored Data Manipulation. Priority 78.2 of 100.kevransomwarepublic-exploitT1565.001https://patchfirst.co/cve/CVE-2022-27924/CVE-2022-27924#kevThu, 04 Aug 2022 00:00:00 GMTSynacor · Zimbra Collaboration Suite (ZCS). In CISA KEV since 2022-08-04, known ransomware use. ENISA EUVD lists it as exploited. EPSS 93.9% (higher than 99.84% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1565.001 Stored Data Manipulation. Priority 78.2 of 100.kevransomwarepublic-exploitT1190T1565.001https://patchfirst.co/cve/CVE-2019-2616/CVE-2019-2616#kevFri, 25 Mar 2022 00:00:00 GMTOracle · BI Publisher (Formerly XML Publisher). In CISA KEV since 2022-03-25. ENISA EUVD lists it as exploited. EPSS 92.2% (higher than 99.82% of CVEs). CVSS 7.2 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1213 Data from Information Repositories; T1565.001 Stored Data Manipulation. Priority 68.0 of 100.kevpublic-exploitT1190T1213T1565.001https://patchfirst.co/cve/CVE-2020-3476/CVE-2020-3476Thu, 24 Sep 2020 00:00:00 GMTCisco · Cisco IOS XE Software. Not in CISA KEV. EPSS 0.3% (higher than 19.1% of CVEs). CVSS 4.4 MEDIUM. ATT&CK: T1078 Valid Accounts; T1565.001 Stored Data Manipulation. Priority 6.9 of 100.T1078T1565.001https://patchfirst.co/cve/CVE-2020-3440/CVE-2020-3440Wed, 26 Aug 2020 00:00:00 GMTCisco · Cisco Webex Meetings. Not in CISA KEV. EPSS 2.6% (higher than 85.4% of CVEs). CVSS 6.5 MEDIUM. ATT&CK: T1204.002 Malicious File; T1566 Phishing; T1565.001 Stored Data Manipulation. Priority 23.0 of 100.T1204.002T1566T1565.001https://patchfirst.co/cve/CVE-2020-5345/CVE-2020-5345Tue, 23 Jun 2020 00:00:00 GMTDell · Unisphere for PowerMax. Not in CISA KEV. EPSS 0.7% (higher than 54.8% of CVEs). CVSS 6.4 MEDIUM. ATT&CK: T1565.001 Stored Data Manipulation; T1190 Exploit Public-Facing Application. Priority 15.4 of 100.T1565.001T1190https://patchfirst.co/cve/CVE-2020-3237/CVE-2020-3237Wed, 03 Jun 2020 00:00:00 GMTCisco · Cisco IOx. Not in CISA KEV. EPSS 0.4% (higher than 28.6% of CVEs). CVSS 6.3 MEDIUM. ATT&CK: T1133 External Remote Services; T1565.001 Stored Data Manipulation. Priority 10.1 of 100.T1133T1565.001https://patchfirst.co/cve/CVE-2020-3309/CVE-2020-3309Wed, 06 May 2020 00:00:00 GMTCisco · Cisco Firepower Threat Defense Software. Not in CISA KEV. EPSS 1.8% (higher than 78% of CVEs). CVSS 6.5 MEDIUM. ATT&CK: T1133 External Remote Services; T1190 Exploit Public-Facing Application; T1574 Hijack Execution Flow; T1565.001 Stored Data Manipulation. Priority 20.2 of 100.T1133T1190T1574T1565.001https://patchfirst.co/cve/CVE-2020-11010/CVE-2020-11010Mon, 20 Apr 2020 00:00:00 GMTtortoise · tortoise-orm. Not in CISA KEV. EPSS 1.0% (higher than 64.2% of CVEs). CVSS 6.3 MEDIUM. ATT&CK: T1133 External Remote Services; T1059 Command and Scripting Interpreter; T1005 Data from Local System; T1136 Create Account; T1190 Exploit Public-Facing Application; T1505.003 Web Shell; +1 more. Priority 17.2 of 100.T1133T1059T1005T1136T1190T1505.003T1565.001https://patchfirst.co/cve/CVE-2019-18234/CVE-2019-18234Mon, 23 Dec 2019 00:00:00 GMTNot in CISA KEV. EPSS 1.9% (higher than 79.5% of CVEs). ATT&CK: T1133 External Remote Services; T1059 Command and Scripting Interpreter; T1005 Data from Local System; T1136 Create Account; T1190 Exploit Public-Facing Application; T1505.003 Web Shell; +1 more. Priority 15.9 of 100.T1133T1059T1005T1136T1190T1505.003T1565.001https://patchfirst.co/cve/CVE-2019-15972/CVE-2019-15972Tue, 26 Nov 2019 00:00:00 GMTCisco · Cisco Unified Communications Manager. Not in CISA KEV. EPSS 1.6% (higher than 75.8% of CVEs). CVSS 5.4 MEDIUM. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1133 External Remote Services; T1059 Command and Scripting Interpreter; T1005 Data from Local System; T1565.001 Stored Data Manipulation. Priority 23.9 of 100.public-exploitT1078T1133T1059T1005T1565.001https://patchfirst.co/cve/CVE-2019-1863/CVE-2019-1863Wed, 21 Aug 2019 00:00:00 GMTCisco · Cisco Unified Computing System E-Series Software (UCSE). Not in CISA KEV. EPSS 1.7% (higher than 77.2% of CVEs). CVSS 6.5 MEDIUM. ATT&CK: T1078 Valid Accounts; T1190 Exploit Public-Facing Application; T1068 Exploitation for Privilege Escalation; T1565.001 Stored Data Manipulation. Priority 20.0 of 100.T1078T1190T1068T1565.001https://patchfirst.co/cve/CVE-2019-1942/CVE-2019-1942Wed, 17 Jul 2019 00:00:00 GMTCisco · Cisco Identity Services Engine Software. Not in CISA KEV. EPSS 1.2% (higher than 68.8% of CVEs). CVSS 4.3 MEDIUM. ATT&CK: T1078 Valid Accounts; T1133 External Remote Services; T1059 Command and Scripting Interpreter; T1005 Data from Local System; T1565.001 Stored Data Manipulation. Priority 16.8 of 100.T1078T1133T1059T1005T1565.001https://patchfirst.co/cve/CVE-2019-1836/CVE-2019-1836Fri, 03 May 2019 00:00:00 GMTCisco · Cisco NX-OS Software for Nexus 9000 Series Fabric Switches ACI Mode. Not in CISA KEV. EPSS 0.4% (higher than 38.1% of CVEs). CVSS 5.5 MEDIUM. ATT&CK: T1133 External Remote Services; T1565.001 Stored Data Manipulation. Priority 12.8 of 100.T1133T1565.001https://patchfirst.co/cve/CVE-2019-3786/CVE-2019-3786Wed, 24 Apr 2019 00:00:00 GMTCloud Foundry · BOSH Backup and Restore. Not in CISA KEV. EPSS 0.6% (higher than 47.8% of CVEs). CVSS 7.7 HIGH. ATT&CK: T1565.001 Stored Data Manipulation; T1005 Data from Local System. Priority 14.9 of 100.T1565.001T1005https://patchfirst.co/cve/CVE-2019-1689/CVE-2019-1689Mon, 25 Feb 2019 00:00:00 GMTCisco · Cisco Webex Teams. Not in CISA KEV. EPSS 1.6% (higher than 75.4% of CVEs). CVSS 7.3 HIGH. ATT&CK: T1105 Ingress Tool Transfer; T1531 Account Access Removal; T1565.001 Stored Data Manipulation. Priority 20.2 of 100.T1105T1531T1565.001https://patchfirst.co/cve/CVE-2018-5459/CVE-2018-5459Tue, 13 Feb 2018 00:00:00 GMTNot in CISA KEV. EPSS 2.7% (higher than 85.8% of CVEs). ATT&CK: T1005 Data from Local System; T1485 Data Destruction; T1565.001 Stored Data Manipulation. Priority 17.2 of 100.T1005T1485T1565.001