{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: CVEs linked to T1611 Escape to Host","home_page_url":"https://patchfirst.co/technique/T1611/","feed_url":"https://patchfirst.co/feed/technique/T1611.json","description":"New and newly exploited CVEs that lead to ATT&CK T1611 Escape to Host, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2022-0492#kev","url":"https://patchfirst.co/cve/CVE-2022-0492/","title":"[KEV] CVE-2022-0492: Linux Kernel Improper Authentication Vulnerability","content_text":"Linux · Kernel. In CISA KEV since 2026-06-02. ENISA EUVD lists it as exploited. EPSS 5.5% (higher than 92.8% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1611 Escape to Host. Priority 72.0 of 100.","summary":"Linux Kernel Improper Authentication Vulnerability","date_published":"2026-06-02T00:00:00.000Z","date_modified":"2026-06-17T04:20:42.000Z","tags":["kev","public-exploit","T1068","T1611"],"_patchfirst":{"reason":"kev","priority":72,"kev":{"dateAdded":"2026-06-02","ransomware":false},"epss":{"score":0.05528,"percentile":0.92802},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Linux","product":"Kernel","techniqueIds":["T1068","T1611"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-22224#kev","url":"https://patchfirst.co/cve/CVE-2025-22224/","title":"[KEV] CVE-2025-22224: VMware ESXi and Workstation TOCTOU Race Condition Vulnerability","content_text":"VMware · ESXi and Workstation. In CISA KEV since 2025-03-04. ENISA EUVD lists it as exploited. EPSS 1.6% (higher than 75.2% of CVEs). CVSS 8.2 HIGH. ATT&CK: T1055 Process Injection; T1611 Escape to Host. Priority 68.8 of 100.","summary":"VMware ESXi and Workstation TOCTOU Race Condition Vulnerability","date_published":"2025-03-04T00:00:00.000Z","date_modified":"2026-06-17T08:45:43.000Z","tags":["kev","T1055","T1611"],"_patchfirst":{"reason":"kev","priority":68.8,"kev":{"dateAdded":"2025-03-04","ransomware":false},"epss":{"score":0.01561,"percentile":0.75213},"cvss":{"score":8.2,"severity":"HIGH","version":"3.1"},"vendor":"VMware","product":"ESXi and Workstation","techniqueIds":["T1055","T1611"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2025-22226#kev","url":"https://patchfirst.co/cve/CVE-2025-22226/","title":"[KEV] CVE-2025-22226: VMware ESXi, Workstation, and Fusion Information Disclosure Vulnerability","content_text":"VMware · ESXi, Workstation, and Fusion. In CISA KEV since 2025-03-04. ENISA EUVD lists it as exploited. EPSS 1.6% (higher than 76.2% of CVEs). CVSS 6.0 MEDIUM. ATT&CK: T1005 Data from Local System; T1611 Escape to Host. Priority 67.4 of 100.","summary":"VMware ESXi, Workstation, and Fusion Information Disclosure Vulnerability","date_published":"2025-03-04T00:00:00.000Z","date_modified":"2026-06-17T08:45:44.000Z","tags":["kev","T1005","T1611"],"_patchfirst":{"reason":"kev","priority":67.4,"kev":{"dateAdded":"2025-03-04","ransomware":false},"epss":{"score":0.01633,"percentile":0.7624},"cvss":{"score":6,"severity":"MEDIUM","version":"3.1"},"vendor":"VMware","product":"ESXi, Workstation, and Fusion","techniqueIds":["T1005","T1611"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2025-22225#kev","url":"https://patchfirst.co/cve/CVE-2025-22225/","title":"[KEV] CVE-2025-22225: VMware ESXi Arbitrary Write Vulnerability","content_text":"VMware · ESXi. In CISA KEV since 2025-03-04, known ransomware use. ENISA EUVD lists it as exploited. EPSS 1.0% (higher than 63.3% of CVEs). CVSS 8.2 HIGH. ATT&CK: T1068 Exploitation for Privilege Escalation; T1611 Escape to Host. Priority 66.4 of 100.","summary":"VMware ESXi Arbitrary Write Vulnerability","date_published":"2025-03-04T00:00:00.000Z","date_modified":"2026-08-04T05:16:33.000Z","tags":["kev","ransomware","T1068","T1611"],"_patchfirst":{"reason":"kev","priority":66.4,"kev":{"dateAdded":"2025-03-04","ransomware":true},"epss":{"score":0.01016,"percentile":0.63283},"cvss":{"score":8.2,"severity":"HIGH","version":"3.1"},"vendor":"VMware","product":"ESXi","techniqueIds":["T1068","T1611"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2020-16017#kev","url":"https://patchfirst.co/cve/CVE-2020-16017/","title":"[KEV] CVE-2020-16017: Google Chrome Use-After-Free Vulnerability","content_text":"Google · Chrome. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 2.7% (higher than 86.1% of CVEs). CVSS 9.6 CRITICAL. ATT&CK: T1189 Drive-by Compromise; T1611 Escape to Host. Priority 61.9 of 100.","summary":"Google Chrome Use-After-Free Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T02:57:38.000Z","tags":["kev","T1189","T1611"],"_patchfirst":{"reason":"kev","priority":61.9,"kev":{"dateAdded":"2021-11-03","ransomware":false},"epss":{"score":0.0273,"percentile":0.86066},"cvss":{"score":9.6,"severity":"CRITICAL","version":"3.1"},"vendor":"Google","product":"Chrome","techniqueIds":["T1189","T1611"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2019-5736","url":"https://patchfirst.co/cve/CVE-2019-5736/","title":"CVE-2019-5736: runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc…","content_text":"Not in CISA KEV. EPSS 98.5% (higher than 99.92% of CVEs). Public exploit code exists. ATT&CK: T1610 Deploy Container; T1611 Escape to Host. Named in 1 threat report. Priority 66.2 of 100.","summary":"runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc…","date_published":"2019-02-11T00:00:00.000Z","date_modified":"2024-08-04T20:01:52.000Z","tags":["public-exploit","T1610","T1611"],"_patchfirst":{"reason":"published","priority":66.2,"kev":null,"epss":{"score":0.98452,"percentile":0.99919},"cvss":null,"vendor":null,"product":null,"techniqueIds":["T1610","T1611"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":false}}]}