https://patchfirst.co/technique/T1608.001/New and newly exploited CVEs that lead to ATT&CK T1608.001 Upload Malware, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.en-gb360Sat, 31 Oct 2026 05:11:25 GMThttps://patchfirst.co/cve/CVE-2024-54085/CVE-2024-54085#kevWed, 25 Jun 2025 00:00:00 GMTAMI · MegaRAC SPx. In CISA KEV since 2025-06-25. ENISA EUVD lists it as exploited. EPSS 60.7% (higher than 99.15% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1210 Exploitation of Remote Services; T1495 Firmware Corruption; T1499 Endpoint Denial of Service; T1608.001 Upload Malware. Priority 69.7 of 100.kevpublic-exploitT1068T1210T1495T1499T1608.001https://patchfirst.co/cve/CVE-2025-4632/CVE-2025-4632#kevThu, 22 May 2025 00:00:00 GMTSamsung · MagicINFO 9 Server. In CISA KEV since 2025-05-22. ENISA EUVD lists it as exploited. EPSS 24.1% (higher than 97.8% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1059 Command and Scripting Interpreter; T1496 Resource Hijacking; T1608.001 Upload Malware. Priority 69.4 of 100.kevpublic-exploitT1068T1059T1496T1608.001https://patchfirst.co/cve/CVE-2025-32756/CVE-2025-32756#kevWed, 14 May 2025 00:00:00 GMTFortinet · Multiple Products. In CISA KEV since 2025-05-14. ENISA EUVD lists it as exploited. EPSS 30.9% (higher than 98.3% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1133 External Remote Services; T1059 Command and Scripting Interpreter; T1003 OS Credential Dumping; T1041 Exfiltration Over C2 Channel; T1046 Network Service Discovery; T1070.004 File Deletion; +1 more. Priority 79.5 of 100.kevpublic-exploitT1133T1059T1003T1041T1046T1070.004T1608.001https://patchfirst.co/cve/CVE-2025-32706/CVE-2025-32706#kevTue, 13 May 2025 00:00:00 GMTMicrosoft · Windows. In CISA KEV since 2025-05-13. ENISA EUVD lists it as exploited. EPSS 2.3% (higher than 83.5% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1059 Command and Scripting Interpreter; T1068 Exploitation for Privilege Escalation; T1003.001 LSASS Memory; T1543 Create or Modify System Process; T1608.001 Upload Malware. Priority 65.2 of 100.kevpublic-exploitT1059T1068T1003.001T1543T1608.001https://patchfirst.co/cve/CVE-2025-32709/CVE-2025-32709#kevTue, 13 May 2025 00:00:00 GMTMicrosoft · Windows. In CISA KEV since 2025-05-13. ENISA EUVD lists it as exploited. EPSS 1.8% (higher than 78.7% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1003 OS Credential Dumping; T1059 Command and Scripting Interpreter; T1543 Create or Modify System Process; T1608.001 Upload Malware. Priority 64.2 of 100.kevpublic-exploitT1068T1003T1059T1543T1608.001https://patchfirst.co/cve/CVE-2025-32701/CVE-2025-32701#kevTue, 13 May 2025 00:00:00 GMTMicrosoft · Windows. In CISA KEV since 2025-05-13. ENISA EUVD lists it as exploited. EPSS 1.4% (higher than 72.7% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1059 Command and Scripting Interpreter; T1068 Exploitation for Privilege Escalation; T1003.001 LSASS Memory; T1543 Create or Modify System Process; T1608.001 Upload Malware. Priority 58.0 of 100.kevT1059T1068T1003.001T1543T1608.001https://patchfirst.co/cve/CVE-2024-37085/CVE-2024-37085#kevTue, 30 Jul 2024 00:00:00 GMTVMware · ESXi. In CISA KEV since 2024-07-30, known ransomware use. ENISA EUVD lists it as exploited. EPSS 26.8% (higher than 98% of CVEs). CVSS 7.2 HIGH. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1068 Exploitation for Privilege Escalation; T1608.001 Upload Malware. Priority 77.6 of 100.kevransomwarepublic-exploitT1078T1068T1608.001https://patchfirst.co/cve/CVE-2024-20353/CVE-2024-20353#kevWed, 24 Apr 2024 00:00:00 GMTCisco · Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD). In CISA KEV since 2024-04-24. ENISA EUVD lists it as exploited. EPSS 69.8% (higher than 99.37% of CVEs). CVSS 8.6 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1653 Power Settings; T1037 Boot or Logon Initialization Scripts; T1608.001 Upload Malware. Named in 2 threat reports. Priority 85.0 of 100.kevpublic-exploitT1190T1653T1037T1608.001https://patchfirst.co/cve/CVE-2023-33246/CVE-2023-33246#kevWed, 06 Sep 2023 00:00:00 GMTApache · RocketMQ. In CISA KEV since 2023-09-06. ENISA EUVD lists it as exploited. EPSS 96.6% (higher than 99.88% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1608.001 Upload Malware. Priority 69.8 of 100.kevpublic-exploitT1190T1059T1608.001https://patchfirst.co/cve/CVE-2021-44228/CVE-2021-44228#kevFri, 10 Dec 2021 00:00:00 GMTApache · Log4j2. In CISA KEV since 2021-12-10, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1486 Data Encrypted for Impact; T1496 Resource Hijacking; T1505.003 Web Shell; T1608.001 Upload Malware. Named in 10 threat reports. Priority 90.0 of 100.kevransomwarepublic-exploitT1190T1486T1496T1505.003T1608.001https://patchfirst.co/cve/CVE-2019-0604/CVE-2019-0604#kevWed, 03 Nov 2021 00:00:00 GMTMicrosoft · SharePoint. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.9% (higher than 99.97% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1041 Exfiltration Over C2 Channel; T1505.003 Web Shell; T1608.001 Upload Malware; T1003 OS Credential Dumping. Named in 4 threat reports. Priority 88.8 of 100.kevransomwarepublic-exploitT1190T1041T1505.003T1608.001T1003