{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: MinIO vulnerabilities","home_page_url":"https://patchfirst.co/vendor/minio/","feed_url":"https://patchfirst.co/feed/vendor/minio.json","description":"New and newly exploited MinIO CVEs, with CISA KEV, EPSS and ATT&CK context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2023-28434#kev","url":"https://patchfirst.co/cve/CVE-2023-28434/","title":"[KEV] CVE-2023-28434: MinIO Security Feature Bypass Vulnerability","content_text":"MinIO · MinIO. In CISA KEV since 2023-09-19. ENISA EUVD lists it as exploited. EPSS 7.9% (higher than 94.7% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1565 Data Manipulation. Priority 68.1 of 100.","summary":"MinIO Security Feature Bypass Vulnerability","date_published":"2023-09-19T00:00:00.000Z","date_modified":"2026-06-17T05:47:43.000Z","tags":["kev","public-exploit","T1078","T1565"],"_patchfirst":{"reason":"kev","priority":68.1,"kev":{"dateAdded":"2023-09-19","ransomware":false},"epss":{"score":0.07917,"percentile":0.94716},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"MinIO","product":"MinIO","techniqueIds":["T1078","T1565"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-28432#kev","url":"https://patchfirst.co/cve/CVE-2023-28432/","title":"[KEV] CVE-2023-28432: MinIO Information Disclosure Vulnerability","content_text":"MinIO · MinIO. In CISA KEV since 2023-04-21. ENISA EUVD lists it as exploited. EPSS 84.0% (higher than 99.69% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1552 Unsecured Credentials. Priority 68.2 of 100.","summary":"MinIO Information Disclosure Vulnerability","date_published":"2023-04-21T00:00:00.000Z","date_modified":"2026-06-17T05:47:42.000Z","tags":["kev","public-exploit","T1190","T1552"],"_patchfirst":{"reason":"kev","priority":68.2,"kev":{"dateAdded":"2023-04-21","ransomware":false},"epss":{"score":0.83957,"percentile":0.99692},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"MinIO","product":"MinIO","techniqueIds":["T1190","T1552"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-41266","url":"https://patchfirst.co/cve/CVE-2021-41266/","title":"CVE-2021-41266: Authentication bypass issue in the Operator Console","content_text":"minio · console. Not in CISA KEV. EPSS 48.1% (higher than 98.9% of CVEs). CVSS 8.6 HIGH. Public exploit code exists. Priority 65.8 of 100.","summary":"Authentication bypass issue in the Operator Console","date_published":"2021-11-15T00:00:00.000Z","date_modified":"2024-08-04T03:08:31.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":65.8,"kev":null,"epss":{"score":0.48134,"percentile":0.98858},"cvss":{"score":8.6,"severity":"HIGH","version":"3.1"},"vendor":"minio","product":"console","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}}]}