Why this site does not use CWE → CAPEC → ATT&CK
74.7% of KEV has no public ATT&CK mapping. The obvious way to fill that is the deterministic chain most tools use: take the CVE's CWE, follow CWE → CAPEC attack patterns, follow CAPEC → ATT&CK references. We reproduce that computation here, on today's KEV, so you can see why it is not on any other page.
The chain, run on KEV 2026.08.21
Source: CAPEC STIX from the mitre/cti mirror (559 non-deprecated patterns); CWE ids from each KEV entry's cwes; ATT&CK refs from CAPEC external_references with source_name = ATTACK. Recomputed every build.
Techniques per CVE
How many ATT&CK techniques the chain assigns to each KEV CVE it reaches. A useful mapping would put most mass at 1–3.
What it assigns most often
Share of chain-reached KEV CVEs that receive each technique. Read the names.
| Technique | CVEs | % of reached | |
|---|---|---|---|
| T1574.007 Path Interception by PATH Environment Variable | 168 | 33.8% | |
| T1574.006 Dynamic Linker Hijacking | 167 | 33.6% | |
| T1562.003 Impair Command History Logging | 164 | 33.0% | |
| T1027 Obfuscated Files or Information | 136 | 27.4% | |
| T1027.009 Embedded Payloads | 135 | 27.2% | |
| T1539 Steal Web Session Cookie | 128 | 25.8% | |
| T1553.002 Code Signing | 125 | 25.2% | |
| T1036.001 Invalid Code Signature | 123 | 24.7% | |
| T1027.006 HTML Smuggling | 93 | 18.7% | |
| T1564.009 Resource Forking | 93 | 18.7% | |
| T1083 File and Directory Discovery | 66 | 13.3% | |
| T1574.010 Services File Permissions Weakness | 64 | 12.9% | |
| T1548 Abuse Elevation Control Mechanism | 60 | 12.1% | |
| T1040 Network Sniffing | 53 | 10.7% | |
| T1134 Access Token Manipulation | 49 | 9.9% |
Against the only expert mapping that exists
For 115 KEV CVEs both the chain and CTID's expert mapping produce techniques. They share at least one technique for 10 of them (8.7%). For the other 105, the chain's entire output is disjoint from what the analysts wrote down.
Why it comes out like this
Three things compound. CAPEC has not been updated since 2023-01-24, so it does not know about anything ATT&CK has added or restructured since; only 177 of its 559 patterns reference ATT&CK at all, reaching 189 techniques. CWE describes a weakness class, not an exploitation behaviour — a buffer overflow in a VPN appliance and a buffer overflow in a PDF reader share a CWE and nothing else about how an adversary uses them. And the join fans out: a generic CWE links to many CAPEC patterns, each of which links to several techniques, so the output is a union of everything that is ever associated with that weakness class. The result is a list that is long, mostly wrong, and wrong in a way that looks authoritative because every element carries a real technique ID.
This is not a local artifact. The same explosion is reported independently in the literature on automated CVE → ATT&CK mapping (for instance arXiv 2607.25572, which also finds that a 122B-parameter language model reaches 0.39 micro-F1 against expert labels, with no reliable improvement from more training data). Automated expansion of this mapping has been tried; it did not work.
So kevmap shows 1250 CVEs as unmapped and keeps the chain on this page only. The numbers above are recomputed every build; if CAPEC is ever revived, this page will say so before anyone else does.