ctrlINT What the industry said about every indicator, with the quote

CVE-2020-1938Vulnerability

Apache Tomcat Improper Privilege Management Vulnerability

Exploited in the wildCISA added it to its Known Exploited Vulnerabilities list on .

Reported by 3 independent sources · first reported by SOCRadar · last reported

Last reported 12 days ago

CISA KEVAdded 3 Mar 2022
Fix due 17 Mar 2022
Used by ransomware: not knownCISA KEV catalogue
EPSS99.3%
higher than 99% of CVEsFIRST EPSS, as of 17 Oct 2026

What the reports say

3 reports, newest first · the exact sentence from each

  1. “CVE-2020-1938”

    Recorded FutureVendor
    September 2026 CVE Landscape

  2. “…eploying tools like GodPotato, Kerberoast, AS-REProast, Evil-WinRM, and exploits like CVE-2021-4034 (aka PwnKit), CVE-2024-1086, and CVE-2020-1938 (aka Ghostcat) for privilege escalation, followed by lateral movement to adjacent systems.”

    The Hacker NewsNews
    CyberXero Uses Claude Code in Campaign That Stole Over 628,000 Ukrainian Records

  3. “Local Privilege Escalation: PwnKit (CVE-2021-4034), an nf_tables kernel exploit (CVE-2024-1086), and a Tomcat Ghostcat AJP client (CVE-2020-1938)”

    SOCRadarVendor
    Operation Master: Deconstructing a Multi-Tiered Intrusion and Monetization Pipeline

Indicators reported together

named in the same reports

Also named with it: CVE-2021-4034, CVE-2026-60137, CVE-2026-63030, CVE-2026-0257, CVE-2022-28368, CVE-2023-7028, CVE-2024-1086, CVE-2026-60004, CVE-2022-0847, CVE-2026-35273, CVE-2026-85046, CVE-2026-85880, CVE-2026-87491, CVE-2026-48710, CVE-2025-39964, CVE-2026-20316, CVE-2026-39987, CVE-2021-29441, CVE-2026-81963, CVE-2026-81578

Thanks — we review every report.

Report a wrong value
What is wrong with CVE-2020-1938 here?
No account needed. We do not store your IP address.