{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: CVEs linked to T1608.001 Upload Malware","home_page_url":"https://patchfirst.co/technique/T1608.001/","feed_url":"https://patchfirst.co/feed/technique/T1608.001.json","description":"New and newly exploited CVEs that lead to ATT&CK T1608.001 Upload Malware, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2024-54085#kev","url":"https://patchfirst.co/cve/CVE-2024-54085/","title":"[KEV] CVE-2024-54085: AMI MegaRAC SPx Authentication Bypass by Spoofing Vulnerability","content_text":"AMI · MegaRAC SPx. In CISA KEV since 2025-06-25. ENISA EUVD lists it as exploited. EPSS 60.7% (higher than 99.15% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1210 Exploitation of Remote Services; T1495 Firmware Corruption; T1499 Endpoint Denial of Service; T1608.001 Upload Malware. Priority 69.7 of 100.","summary":"AMI MegaRAC SPx Authentication Bypass by Spoofing Vulnerability","date_published":"2025-06-25T00:00:00.000Z","date_modified":"2026-06-17T08:09:44.000Z","tags":["kev","public-exploit","T1068","T1210","T1495","T1499","T1608.001"],"_patchfirst":{"reason":"kev","priority":69.7,"kev":{"dateAdded":"2025-06-25","ransomware":false},"epss":{"score":0.60747,"percentile":0.99147},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"AMI","product":"MegaRAC SPx","techniqueIds":["T1068","T1210","T1495","T1499","T1608.001"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-4632#kev","url":"https://patchfirst.co/cve/CVE-2025-4632/","title":"[KEV] CVE-2025-4632: Samsung MagicINFO 9 Server Path Traversal Vulnerability","content_text":"Samsung · MagicINFO 9 Server. In CISA KEV since 2025-05-22. ENISA EUVD lists it as exploited. EPSS 24.1% (higher than 97.8% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1059 Command and Scripting Interpreter; T1496 Resource Hijacking; T1608.001 Upload Malware. Priority 69.4 of 100.","summary":"Samsung MagicINFO 9 Server Path Traversal Vulnerability","date_published":"2025-05-22T00:00:00.000Z","date_modified":"2026-06-17T09:33:39.000Z","tags":["kev","public-exploit","T1068","T1059","T1496","T1608.001"],"_patchfirst":{"reason":"kev","priority":69.4,"kev":{"dateAdded":"2025-05-22","ransomware":false},"epss":{"score":0.24066,"percentile":0.97843},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Samsung","product":"MagicINFO 9 Server","techniqueIds":["T1068","T1059","T1496","T1608.001"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-32756#kev","url":"https://patchfirst.co/cve/CVE-2025-32756/","title":"[KEV] CVE-2025-32756: Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability","content_text":"Fortinet · Multiple Products. In CISA KEV since 2025-05-14. ENISA EUVD lists it as exploited. EPSS 30.9% (higher than 98.3% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1133 External Remote Services; T1059 Command and Scripting Interpreter; T1003 OS Credential Dumping; T1041 Exfiltration Over C2 Channel; T1046 Network Service Discovery; T1070.004 File Deletion; +1 more. Priority 79.5 of 100.","summary":"Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability","date_published":"2025-05-14T00:00:00.000Z","date_modified":"2026-06-17T09:12:32.000Z","tags":["kev","public-exploit","T1133","T1059","T1003","T1041","T1046","T1070.004","T1608.001"],"_patchfirst":{"reason":"kev","priority":79.5,"kev":{"dateAdded":"2025-05-14","ransomware":false},"epss":{"score":0.30944,"percentile":0.98257},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Fortinet","product":"Multiple Products","techniqueIds":["T1133","T1059","T1003","T1041","T1046","T1070.004","T1608.001"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-32706#kev","url":"https://patchfirst.co/cve/CVE-2025-32706/","title":"[KEV] CVE-2025-32706: Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2025-05-13. ENISA EUVD lists it as exploited. EPSS 2.3% (higher than 83.5% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1059 Command and Scripting Interpreter; T1068 Exploitation for Privilege Escalation; T1003.001 LSASS Memory; T1543 Create or Modify System Process; T1608.001 Upload Malware. Priority 65.2 of 100.","summary":"Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow Vulnerability","date_published":"2025-05-13T00:00:00.000Z","date_modified":"2026-06-17T09:12:27.000Z","tags":["kev","public-exploit","T1059","T1068","T1003.001","T1543","T1608.001"],"_patchfirst":{"reason":"kev","priority":65.2,"kev":{"dateAdded":"2025-05-13","ransomware":false},"epss":{"score":0.02333,"percentile":0.83543},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1059","T1068","T1003.001","T1543","T1608.001"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-32709#kev","url":"https://patchfirst.co/cve/CVE-2025-32709/","title":"[KEV] CVE-2025-32709: Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2025-05-13. ENISA EUVD lists it as exploited. EPSS 1.8% (higher than 78.7% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1003 OS Credential Dumping; T1059 Command and Scripting Interpreter; T1543 Create or Modify System Process; T1608.001 Upload Malware. Priority 64.2 of 100.","summary":"Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability","date_published":"2025-05-13T00:00:00.000Z","date_modified":"2026-06-17T09:12:27.000Z","tags":["kev","public-exploit","T1068","T1003","T1059","T1543","T1608.001"],"_patchfirst":{"reason":"kev","priority":64.2,"kev":{"dateAdded":"2025-05-13","ransomware":false},"epss":{"score":0.01818,"percentile":0.7869},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1068","T1003","T1059","T1543","T1608.001"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-32701#kev","url":"https://patchfirst.co/cve/CVE-2025-32701/","title":"[KEV] CVE-2025-32701: Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2025-05-13. ENISA EUVD lists it as exploited. EPSS 1.4% (higher than 72.7% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1059 Command and Scripting Interpreter; T1068 Exploitation for Privilege Escalation; T1003.001 LSASS Memory; T1543 Create or Modify System Process; T1608.001 Upload Malware. Priority 58.0 of 100.","summary":"Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability","date_published":"2025-05-13T00:00:00.000Z","date_modified":"2026-06-17T09:12:26.000Z","tags":["kev","T1059","T1068","T1003.001","T1543","T1608.001"],"_patchfirst":{"reason":"kev","priority":58,"kev":{"dateAdded":"2025-05-13","ransomware":false},"epss":{"score":0.01416,"percentile":0.72729},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1059","T1068","T1003.001","T1543","T1608.001"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2024-37085#kev","url":"https://patchfirst.co/cve/CVE-2024-37085/","title":"[KEV] CVE-2024-37085: VMware ESXi Authentication Bypass Vulnerability","content_text":"VMware · ESXi. In CISA KEV since 2024-07-30, known ransomware use. ENISA EUVD lists it as exploited. EPSS 26.8% (higher than 98% of CVEs). CVSS 7.2 HIGH. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1068 Exploitation for Privilege Escalation; T1608.001 Upload Malware. Priority 77.6 of 100.","summary":"VMware ESXi Authentication Bypass Vulnerability","date_published":"2024-07-30T00:00:00.000Z","date_modified":"2026-06-17T07:37:43.000Z","tags":["kev","ransomware","public-exploit","T1078","T1068","T1608.001"],"_patchfirst":{"reason":"kev","priority":77.6,"kev":{"dateAdded":"2024-07-30","ransomware":true},"epss":{"score":0.2677,"percentile":0.98028},"cvss":{"score":7.2,"severity":"HIGH","version":"3.1"},"vendor":"VMware","product":"ESXi","techniqueIds":["T1078","T1068","T1608.001"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-20353#kev","url":"https://patchfirst.co/cve/CVE-2024-20353/","title":"[KEV] CVE-2024-20353: Cisco ASA and FTD Denial of Service Vulnerability","content_text":"Cisco · Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD). In CISA KEV since 2024-04-24. ENISA EUVD lists it as exploited. EPSS 69.8% (higher than 99.37% of CVEs). CVSS 8.6 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1653 Power Settings; T1037 Boot or Logon Initialization Scripts; T1608.001 Upload Malware. Named in 2 threat reports. Priority 85.0 of 100.","summary":"Cisco ASA and FTD Denial of Service Vulnerability","date_published":"2024-04-24T00:00:00.000Z","date_modified":"2026-08-11T19:33:44.000Z","tags":["kev","public-exploit","T1190","T1653","T1037","T1608.001"],"_patchfirst":{"reason":"kev","priority":85,"kev":{"dateAdded":"2024-04-24","ransomware":false},"epss":{"score":0.69824,"percentile":0.99368},"cvss":{"score":8.6,"severity":"HIGH","version":"3.1"},"vendor":"Cisco","product":"Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)","techniqueIds":["T1190","T1653","T1037","T1608.001"],"reportCount":2,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-33246#kev","url":"https://patchfirst.co/cve/CVE-2023-33246/","title":"[KEV] CVE-2023-33246: Apache RocketMQ Command Execution Vulnerability","content_text":"Apache · RocketMQ. In CISA KEV since 2023-09-06. ENISA EUVD lists it as exploited. EPSS 96.6% (higher than 99.88% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1608.001 Upload Malware. Priority 69.8 of 100.","summary":"Apache RocketMQ Command Execution Vulnerability","date_published":"2023-09-06T00:00:00.000Z","date_modified":"2026-06-17T06:01:24.000Z","tags":["kev","public-exploit","T1190","T1059","T1608.001"],"_patchfirst":{"reason":"kev","priority":69.8,"kev":{"dateAdded":"2023-09-06","ransomware":false},"epss":{"score":0.96568,"percentile":0.99882},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Apache","product":"RocketMQ","techniqueIds":["T1190","T1059","T1608.001"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-44228#kev","url":"https://patchfirst.co/cve/CVE-2021-44228/","title":"[KEV] CVE-2021-44228: Apache Log4j2 Remote Code Execution Vulnerability","content_text":"Apache · Log4j2. In CISA KEV since 2021-12-10, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1486 Data Encrypted for Impact; T1496 Resource Hijacking; T1505.003 Web Shell; T1608.001 Upload Malware. Named in 10 threat reports. Priority 90.0 of 100.","summary":"Apache Log4j2 Remote Code Execution Vulnerability","date_published":"2021-12-10T00:00:00.000Z","date_modified":"2026-08-11T19:33:44.000Z","tags":["kev","ransomware","public-exploit","T1190","T1486","T1496","T1505.003","T1608.001"],"_patchfirst":{"reason":"kev","priority":90,"kev":{"dateAdded":"2021-12-10","ransomware":true},"epss":{"score":0.99999,"percentile":1},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"Apache","product":"Log4j2","techniqueIds":["T1190","T1486","T1496","T1505.003","T1608.001"],"reportCount":10,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2019-0604#kev","url":"https://patchfirst.co/cve/CVE-2019-0604/","title":"[KEV] CVE-2019-0604: Microsoft SharePoint Remote Code Execution Vulnerability","content_text":"Microsoft · SharePoint. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.9% (higher than 99.97% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1041 Exfiltration Over C2 Channel; T1505.003 Web Shell; T1608.001 Upload Malware; T1003 OS Credential Dumping. Named in 4 threat reports. Priority 88.8 of 100.","summary":"Microsoft SharePoint Remote Code Execution Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T02:08:31.000Z","tags":["kev","ransomware","public-exploit","T1190","T1041","T1505.003","T1608.001","T1003"],"_patchfirst":{"reason":"kev","priority":88.8,"kev":{"dateAdded":"2021-11-03","ransomware":true},"epss":{"score":0.99913,"percentile":0.99968},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Microsoft","product":"SharePoint","techniqueIds":["T1190","T1041","T1505.003","T1608.001","T1003"],"reportCount":4,"hasPublicExploit":true,"euvdExploited":true}}]}