{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: SaltStack vulnerabilities","home_page_url":"https://patchfirst.co/vendor/saltstack/","feed_url":"https://patchfirst.co/feed/vendor/saltstack.json","description":"New and newly exploited SaltStack CVEs, with CISA KEV, EPSS and ATT&CK context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2020-16846#kev","url":"https://patchfirst.co/cve/CVE-2020-16846/","title":"[KEV] CVE-2020-16846: SaltStack Salt Shell Injection Vulnerability","content_text":"SaltStack · Salt. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 99.6% (higher than 99.95% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 69.8 of 100.","summary":"SaltStack Salt Shell Injection Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T02:58:07.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":69.8,"kev":{"dateAdded":"2021-11-03","ransomware":false},"epss":{"score":0.99585,"percentile":0.99947},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"SaltStack","product":"Salt","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2020-11651#kev","url":"https://patchfirst.co/cve/CVE-2020-11651/","title":"[KEV] CVE-2020-11651: SaltStack Salt Authentication Bypass Vulnerability","content_text":"SaltStack · Salt. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 96.6% (higher than 99.88% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 69.8 of 100.","summary":"SaltStack Salt Authentication Bypass Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T02:50:33.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":69.8,"kev":{"dateAdded":"2021-11-03","ransomware":false},"epss":{"score":0.96614,"percentile":0.99883},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"SaltStack","product":"Salt","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2020-11652#kev","url":"https://patchfirst.co/cve/CVE-2020-11652/","title":"[KEV] CVE-2020-11652: SaltStack Salt Path Traversal Vulnerability","content_text":"SaltStack · Salt. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 86.2% (higher than 99.73% of CVEs). CVSS 6.5 MEDIUM. Public exploit code exists. ATT&CK: T1005 Data from Local System; T1190 Exploit Public-Facing Application. Priority 67.5 of 100.","summary":"SaltStack Salt Path Traversal Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T02:50:33.000Z","tags":["kev","public-exploit","T1005","T1190"],"_patchfirst":{"reason":"kev","priority":67.5,"kev":{"dateAdded":"2021-11-03","ransomware":false},"epss":{"score":0.86178,"percentile":0.99732},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.1"},"vendor":"SaltStack","product":"Salt","techniqueIds":["T1005","T1190"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}}]}