logo
DATABASE RESOURCES PRICING ABOUT US

2021 Top Routinely Exploited Vulnerabilities

2022-04-28T12:00:00

Description

### Summary This joint Cybersecurity Advisory (CSA) was coauthored by cybersecurity authorities of the United States, Australia, Canada, New Zealand, and the United Kingdom: the Cybersecurity and Infrastructure Security Agency ([CISA](<https://www.cisa.gov/>)), National Security Agency ([NSA](<https://www.nsa.gov/Cybersecurity/>)), Federal Bureau of Investigation ([FBI](<https://www.fbi.gov/investigate/cyber>)), Australian Cyber Security Centre ([ACSC](<https://www.cyber.gov.au/>)), Canadian Centre for Cyber Security ([CCCS](<https://www.cyber.gc.ca/en/>)), New Zealand National Cyber Security Centre ([NZ NCSC](<https://www.gcsb.govt.nz/>)), and United Kingdom’s National Cyber Security Centre ([NCSC-UK](<https://www.ncsc.gov.uk/>)). This advisory provides details on the top 15 Common Vulnerabilities and Exposures (CVEs) routinely exploited by malicious cyber actors in 2021, as well as other CVEs frequently exploited. U.S., Australian, Canadian, New Zealand, and UK cybersecurity authorities assess, in 2021, malicious cyber actors aggressively targeted newly disclosed critical software vulnerabilities against broad target sets, including public and private sector organizations worldwide. To a lesser extent, malicious cyber actors continued to exploit publicly known, dated software vulnerabilities across a broad spectrum of targets. The cybersecurity authorities encourage organizations to apply the recommendations in the Mitigations section of this CSA. These mitigations include applying timely patches to systems and implementing a centralized patch management system to reduce the risk of compromise by malicious cyber actors. Download the Joint Cybersecurity Advisory: 2021 top Routinely Exploited Vulnerabilities (pdf, 777kb). ### Technical Details #### **Key Findings** Globally, in 2021, malicious cyber actors targeted internet-facing systems, such as email servers and virtual private network (VPN) servers, with exploits of newly disclosed vulnerabilities. For most of the top exploited vulnerabilities, researchers or other actors released proof of concept (POC) code within two weeks of the vulnerability’s disclosure, likely facilitating exploitation by a broader range of malicious actors. To a lesser extent, malicious cyber actors continued to exploit publicly known, dated software vulnerabilities—some of which were also [routinely exploited in 2020](<https://www.cisa.gov/uscert/ncas/alerts/aa21-209a>) or earlier. The exploitation of older vulnerabilities demonstrates the continued risk to organizations that fail to patch software in a timely manner or are using software that is no longer supported by a vendor. #### **Top 15 Routinely Exploited Vulnerabilities** Table 1 shows the top 15 vulnerabilities U.S., Australian, Canadian, New Zealand, and UK cybersecurity authorities observed malicious actors routinely exploiting in 2021, which include: * **CVE-2021-44228.** This vulnerability, known as Log4Shell, affects Apache’s Log4j library, an open-source logging framework. An actor can exploit this vulnerability by submitting a specially crafted request to a vulnerable system that causes that system to execute arbitrary code. The request allows a cyber actor to take full control over the system. The actor can then steal information, launch ransomware, or conduct other malicious activity.[1] Log4j is incorporated into thousands of products worldwide. This vulnerability was disclosed in December 2021; the rapid widespread exploitation of this vulnerability demonstrates the ability of malicious actors to quickly weaponize known vulnerabilities and target organizations before they patch. * **CVE-2021-26855, CVE-2021-26858, CVE-2021-26857, CVE-2021-27065.** These vulnerabilities, known as ProxyLogon, affect Microsoft Exchange email servers. Successful exploitation of these vulnerabilities in combination (i.e., “vulnerability chaining”) allows an unauthenticated cyber actor to execute arbitrary code on vulnerable Exchange Servers, which, in turn, enables the actor to gain persistent access to files and mailboxes on the servers, as well as to credentials stored on the servers. Successful exploitation may additionally enable the cyber actor to compromise trust and identity in a vulnerable network. * **CVE-2021-34523, CVE-2021-34473, CVE-2021-31207.** These vulnerabilities, known as ProxyShell, also affect Microsoft Exchange email servers. Successful exploitation of these vulnerabilities in combination enables a remote actor to execute arbitrary code. These vulnerabilities reside within the Microsoft Client Access Service (CAS), which typically runs on port 443 in Microsoft Internet Information Services (IIS) (e.g., Microsoft’s web server). CAS is commonly exposed to the internet to enable users to access their email via mobile devices and web browsers. * **CVE-2021-26084.** This vulnerability, affecting Atlassian Confluence Server and Data Center, could enable an unauthenticated actor to execute arbitrary code on vulnerable systems. This vulnerability quickly became one of the most routinely exploited vulnerabilities after a POC was released within a week of its disclosure. Attempted mass exploitation of this vulnerability was observed in September 2021. Three of the top 15 routinely exploited vulnerabilities were also [routinely exploited in 2020](<https://www.cisa.gov/uscert/ncas/alerts/aa21-209a>): CVE-2020-1472, CVE-2018-13379, and CVE-2019-11510. Their continued exploitation indicates that many organizations fail to patch software in a timely manner and remain vulnerable to malicious cyber actors. _Table 1: Top 15 Routinely Exploited Vulnerabilities in 2021_ CVE | Vulnerability Name | Vendor and Product | Type ---|---|---|--- [CVE-2021-44228](<https://nvd.nist.gov/vuln/detail/CVE-2021-44228>) | Log4Shell | Apache Log4j | Remote code execution (RCE) [CVE-2021-40539](<https://nvd.nist.gov/vuln/detail/CVE-2021-40539>) | | Zoho ManageEngine AD SelfService Plus | RCE [CVE-2021-34523](<https://nvd.nist.gov/vuln/detail/CVE-2021-34523>) | ProxyShell | Microsoft Exchange Server | Elevation of privilege [CVE-2021-34473](<https://nvd.nist.gov/vuln/detail/CVE-2021-34473>) | ProxyShell | Microsoft Exchange Server | RCE [CVE-2021-31207](<https://nvd.nist.gov/vuln/detail/CVE-2021-31207>) | ProxyShell | Microsoft Exchange Server | Security feature bypass [CVE-2021-27065](<https://nvd.nist.gov/vuln/detail/CVE-2021-27065>) | ProxyLogon | Microsoft Exchange Server | RCE [CVE-2021-26858](<https://nvd.nist.gov/vuln/detail/CVE-2021-26858>) | ProxyLogon | Microsoft Exchange Server | RCE [CVE-2021-26857](<https://nvd.nist.gov/vuln/detail/CVE-2021-26857>) | ProxyLogon | Microsoft Exchange Server | RCE [CVE-2021-26855](<https://nvd.nist.gov/vuln/detail/CVE-2021-26855>) | ProxyLogon | Microsoft Exchange Server | RCE [CVE-2021-26084](<https://nvd.nist.gov/vuln/detail/CVE-2021-26084>) | | Atlassian Confluence Server and Data Center | Arbitrary code execution [CVE-2021-21972](<https://nvd.nist.gov/vuln/detail/CVE-2021-21972>) | | VMware vSphere Client | RCE [CVE-2020-1472](<https://nvd.nist.gov/vuln/detail/CVE-2020-1472>) | ZeroLogon | Microsoft Netlogon Remote Protocol (MS-NRPC) | Elevation of privilege [CVE-2020-0688](<https://nvd.nist.gov/vuln/detail/CVE-2020-0688>) | | Microsoft Exchange Server | RCE [CVE-2019-11510](<https://nvd.nist.gov/vuln/detail/CVE-2019-11510>) | | Pulse Secure Pulse Connect Secure | Arbitrary file reading [CVE-2018-13379](<https://nvd.nist.gov/vuln/detail/CVE-2018-13379>) | | Fortinet FortiOS and FortiProxy | Path traversal #### **Additional Routinely Exploited Vulnerabilities** In addition to the 15 vulnerabilities listed in table 1, U.S., Australian, Canadian, New Zealand, and UK cybersecurity authorities identified vulnerabilities, listed in table 2, that were also routinely exploited by malicious cyber actors in 2021. These vulnerabilities include multiple vulnerabilities affecting internet-facing systems, including Accellion File Transfer Appliance (FTA), Windows Print Spooler, and Pulse Secure Pulse Connect Secure. Three of these vulnerabilities were also [routinely exploited in 2020](<https://www.cisa.gov/uscert/ncas/alerts/aa21-209a>): CVE-2019-19781, CVE-2019-18935, and CVE-2017-11882. _Table 2: Additional Routinely Exploited Vulnerabilities in 2021_ CVE | Vendor and Product | Type ---|---|--- [CVE-2021-42237](<https://nvd.nist.gov/vuln/detail/CVE-2021-42237>) | Sitecore XP | RCE [CVE-2021-35464](<https://nvd.nist.gov/vuln/detail/CVE-2021-35464>) | ForgeRock OpenAM server | RCE [CVE-2021-27104](<https://nvd.nist.gov/vuln/detail/CVE-2021-27104>) | Accellion FTA | OS command execution [CVE-2021-27103](<https://nvd.nist.gov/vuln/detail/CVE-2021-27103>) | Accellion FTA | Server-side request forgery [CVE-2021-27102](<https://nvd.nist.gov/vuln/detail/CVE-2021-27102>) | Accellion FTA | OS command execution [CVE-2021-27101](<https://nvd.nist.gov/vuln/detail/CVE-2021-27101>) | Accellion FTA | SQL injection [CVE-2021-21985](<https://nvd.nist.gov/vuln/detail/CVE-2021-21985>) | VMware vCenter Server | RCE [CVE-2021-20038](<https://nvd.nist.gov/vuln/detail/CVE-2021-20038>) | SonicWall Secure Mobile Access (SMA) | RCE [CVE-2021-40444](<https://nvd.nist.gov/vuln/detail/CVE-2021-40444>) | Microsoft MSHTML | RCE [CVE-2021-34527](<https://nvd.nist.gov/vuln/detail/CVE-2021-34527>) | Microsoft Windows Print Spooler | RCE [CVE-2021-3156](<https://nvd.nist.gov/vuln/detail/CVE-2021-3156>) | Sudo | Privilege escalation [CVE-2021-27852](<https://nvd.nist.gov/vuln/detail/CVE-2021-27852>) | Checkbox Survey | Remote arbitrary code execution [CVE-2021-22893](<https://nvd.nist.gov/vuln/detail/CVE-2021-22893>) | Pulse Secure Pulse Connect Secure | Remote arbitrary code execution [CVE-2021-20016](<https://nvd.nist.gov/vuln/detail/CVE-2021-20016>) | SonicWall SSLVPN SMA100 | Improper SQL command neutralization, allowing for credential access [CVE-2021-1675](<https://nvd.nist.gov/vuln/detail/CVE-2021-1675>) | Windows Print Spooler | RCE [CVE-2020-2509](<https://nvd.nist.gov/vuln/detail/CVE-2020-2509>) | QNAP QTS and QuTS hero | Remote arbitrary code execution [CVE-2019-19781](<https://nvd.nist.gov/vuln/detail/CVE-2019-19781>) | Citrix Application Delivery Controller (ADC) and Gateway | Arbitrary code execution [CVE-2019-18935](<https://nvd.nist.gov/vuln/detail/CVE-2019-18935>) | Progress Telerik UI for ASP.NET AJAX | Code execution [CVE-2018-0171](<https://nvd.nist.gov/vuln/detail/CVE-2018-0171>) | Cisco IOS Software and IOS XE Software | Remote arbitrary code execution [CVE-2017-11882](<https://nvd.nist.gov/vuln/detail/CVE-2017-11882>) | Microsoft Office | RCE [CVE-2017-0199](<https://nvd.nist.gov/vuln/detail/CVE-2017-0199>) | Microsoft Office | RCE ### Mitigations #### **Vulnerability and Configuration Management** * Update software, operating systems, applications, and firmware on IT network assets in a timely manner. Prioritize patching [known exploited vulnerabilities](<https://www.cisa.gov/known-exploited-vulnerabilities-catalog>), especially those CVEs identified in this CSA, and then critical and high vulnerabilities that allow for remote code execution or denial-of-service on internet-facing equipment. For patch information on CVEs identified in this CSA, refer to the appendix. * If a patch for a known exploited or critical vulnerability cannot be quickly applied, implement vendor-approved workarounds. * Use a centralized patch management system. * Replace end-of-life software, i.e., software that is no longer supported by the vendor. For example, Accellion FTA was retired in April 2021. * Organizations that are unable to perform rapid scanning and patching of internet-facing systems should consider moving these services to mature, reputable cloud service providers (CSPs) or other managed service providers (MSPs). Reputable MSPs can patch applications—such as webmail, file storage, file sharing, and chat and other employee collaboration tools—for their customers. However, as MSPs and CSPs expand their client organization's attack surface and may introduce unanticipated risks, organizations should proactively collaborate with their MSPs and CSPs to jointly reduce that risk. For more information and guidance, see the following resources. * CISA Insights [Risk Considerations for Managed Service Provider Customers](<https://cisa.gov/sites/default/files/publications/cisa-insights_risk-considerations-for-msp-customers_508.pdf>) * CISA Insights [Mitigations and Hardening Guidance for MSPs and Small- and Mid-sized Businesses](<https://cisa.gov/sites/default/files/publications/CISA%20Insights_Guidance-for-MSPs-and-Small-and-Mid-sized-Businesses_S508C.pdf>) * ACSC advice on [How to Manage Your Security When Engaging a Managed Service Provider](<https://www.cyber.gov.au/acsc/view-all-content/publications/how-manage-your-security-when-engaging-managed-service-provider>) #### **Identity and Access Management** * Enforce multifactor authentication (MFA) for all users, without exception. * Enforce MFA on all VPN connections. If MFA is unavailable, require employees engaging in remote work to use strong passwords. * Regularly review, validate, or remove privileged accounts (annually at a minimum). * Configure access control under the concept of least privilege principle. * Ensure software service accounts only provide necessary permissions (least privilege) to perform intended functions (non-administrative privileges). **Note:** see [CISA Capacity Enhancement Guide – Implementing Strong Authentication](<https://cisa.gov/sites/default/files/publications/CISA_CEG_Implementing_Strong_Authentication_508_1.pdf>) and ACSC guidance on [Implementing Multi-Factor Authentication](<https://www.cyber.gov.au/acsc/view-all-content/publications/implementing-multi-factor-authentication>) for more information on hardening authentication systems. #### **Protective Controls and Architecture ** * Properly configure and secure internet-facing network devices, disable unused or unnecessary network ports and protocols, encrypt network traffic, and disable unused network services and devices. * Harden commonly exploited enterprise network services, including Link-Local Multicast Name Resolution (LLMNR) protocol, Remote Desktop Protocol (RDP), Common Internet File System (CIFS), Active Directory, and OpenLDAP. * Manage Windows Key Distribution Center (KDC) accounts (e.g., KRBTGT) to minimize Golden Ticket attacks and Kerberoasting. * Strictly control the use of native scripting applications, such as command-line, PowerShell, WinRM, Windows Management Instrumentation (WMI), and Distributed Component Object Model (DCOM). * Segment networks to limit or block lateral movement by controlling access to applications, devices, and databases. Use private virtual local area networks. * Continuously monitor the attack surface and investigate abnormal activity that may indicate lateral movement of a threat actor or malware. * Use security tools, such as endpoint detection and response (EDR) and security information and event management (SIEM) tools. Consider using an information technology asset management (ITAM) solution to ensure your EDR, SIEM, vulnerability scanner etc., are reporting the same number of assets. * Monitor the environment for potentially unwanted programs. * Reduce third-party applications and unique system/application builds; provide exceptions only if required to support business critical functions. * Implement application allowlisting. ### **Resources** * For the top vulnerabilities exploited in 2020, see joint CSA [Top Routinely Exploited Vulnerabilities](<https://www.cisa.gov/uscert/ncas/alerts/aa21-209a>) * For the top exploited vulnerabilities 2016 through 2019, see joint CSA [Top 10 Routinely Exploited Vulnerabilities](<https://www.cisa.gov/uscert/ncas/alerts/aa20-133a>). * See the appendix for additional partner resources on the vulnerabilities mentioned in this CSA. ### **Disclaimer** The information in this report is being provided “as is” for informational purposes only. CISA, the FBI, NSA, ACSC, CCCS, NZ NCSC, and NCSC-UK do not endorse any commercial product or service, including any subjects of analysis. Any reference to specific commercial products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring. ### **Purpose ** This document was developed by U.S., Australian, Canadian, New Zealand, and UK cybersecurity authorities in furtherance of their respective cybersecurity missions, including their responsibilities to develop and issue cybersecurity specifications and mitigations. ### **References** [1] [CISA’s Apache Log4j Vulnerability Guidance](<https://www.cisa.gov/uscert/apache-log4j-vulnerability-guidance>) ### **Appendix: Patch Information and Additional Resources for Top Exploited Vulnerabilities** CVE | Vendor | Affected Products | Patch Information | Resources ---|---|---|---|--- [CVE-2021-42237](<https://nvd.nist.gov/vuln/detail/CVE-2021-42237>) | Sitecore | Sitecore XP 7.5.0 - Sitecore XP 7.5.2 Sitecore XP 8.0.0 - Sitecore XP 8.2.7 | [Sitecore Security Bulletin SC2021-003-499266](<https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1000776#HistoryOfUpdates>) | ACSC Alert [Active Exploitation of vulnerable Sitecore Experience Platform Content Management Systems](<https://www.cyber.gov.au/acsc/view-all-content/alerts/active-exploitation-vulnerable-sitecore-experience-platform-content-management-systems>) [CVE-2021-35464](<https://nvd.nist.gov/vuln/detail/CVE-2021-35464>) | ForgeRock | Access Management (AM) 5.x, 6.0.0.x, 6.5.0.x, 6.5.1, 6.5.2.x and 6.5.3 OpenAM 9.x, 10.x, 11.x, 12.x and 13.x | [ForgeRock AM Security Advisory #202104](<https://backstage.forgerock.com/knowledge/kb/article/a47894244>) | ACSC Advisory [Active exploitation of ForgeRock Access Manager / OpenAM servers](<https://www.cyber.gov.au/acsc/view-all-content/advisories/advisory-2021-004-active-exploitation-forgerock-access-manager-openam-servers>) CCCS [ForgeRock Security Advisory](<https://www.cyber.gc.ca/en/alerts/forgerock-security-advisory>) [CVE-2021-27104](<https://nvd.nist.gov/vuln/detail/CVE-2021-27104>) | Accellion | FTA 9_12_370 and earlier | [Accellion Press Release: Update to Recent FTA Security Incident](<https://www.accellion.com/company/press-releases/accellion-provides-update-to-recent-fta-security-incident/>) | Joint CSA [Exploitation of Accellion File Transfer Appliance](<https://www.cisa.gov/uscert/ncas/alerts/aa21-055a>) ACSC Alert [Potential Accellion File Transfer Appliance compromise](<https://www.cyber.gov.au/acsc/view-all-content/alerts/potential-accellion-file-transfer-appliance-compromise>) [CVE-2021-27103](<https://nvd.nist.gov/vuln/detail/CVE-2021-27103>) | FTA 9_12_411 and earlier [CVE-2021-27102](<https://nvd.nist.gov/vuln/detail/CVE-2021-27102>) | FTA versions 9_12_411 and earlier [CVE-2021-27101](<https://nvd.nist.gov/vuln/detail/CVE-2021-27101>) | FTA 9_12_370 and earlier | [CVE-2021-21985](<https://nvd.nist.gov/vuln/detail/CVE-2021-21985>) | VMware | vCenter Server 7.0, 6.7, 6.5 Cloud Foundation (vCenter Server) 4.x and 3.x | [VMware Advisory VMSA-2021-0010](<https://www.vmware.com/security/advisories/VMSA-2021-0010.html>) | CCCS [VMware Security Advisory](<https://www.cyber.gc.ca/en/alerts/vmware-security-advisory-41>) [CVE-2021-21972](<https://nvd.nist.gov/vuln/detail/CVE-2021-21972>) | VMware | vCenter Server 7.0, 6.7, 6.5 Cloud Foundation (vCenter Server) 4.x and 3.x | [VMware Advisory VMSA-2021-0002](<https://www.vmware.com/security/advisories/VMSA-2021-0002.html>) | ACSC Alert [VMware vCenter Server plugin remote code execution vulnerability](<https://www.cyber.gov.au/acsc/view-all-content/alerts/vmware-vcenter-server-plugin-remote-code-execution-vulnerability-cve-2021-21972>) CCCS [VMware Security Advisory](<https://www.cyber.gc.ca/en/alerts/vmware-security-advisory-35>) CCCS Alert [APT Actors Target U.S. and Allied Networks - Update 1](<https://www.cyber.gc.ca/en/alerts/apt-actors-target-us-and-allied-networks-nsacisafbi>) [CVE-2021-20038](<https://nvd.nist.gov/vuln/detail/CVE-2021-20038>) | SonicWall | SMA 100 Series (SMA 200, 210, 400, 410, 500v), versions 10.2.0.8-37sv, 10.2.1.1-19sv, 10.2.1.2-24sv | [SonicWall Security Advisory SNWLID-2021-0026](<https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0026>) | ACSC Alert [Remote code execution vulnerability present in SonicWall SMA 100 series appliances](<https://www.cyber.gov.au/acsc/view-all-content/alerts/remote-code-execution-vulnerability-present-sonicwall-sma-100-series-appliances>) CCCS [SonicWall Security Advisory](<https://www.cyber.gc.ca/en/alerts/sonicwall-security-advisory-4>) [CVE-2021-44228](<https://nvd.nist.gov/vuln/detail/CVE-2021-44228>) | Apache | Log4j, all versions from 2.0-beta9 to 2.14.1 For other affected vendors and products, see [CISA's GitHub repository](<https://github.com/cisagov/log4j-affected-db>). | [Log4j: Apache Log4j Security Vulnerabilities](<https://logging.apache.org/log4j/2.x/security.html>) For additional information, see joint CSA: [Mitigating Log4Shell and Other Log4j-Related Vulnerabilities](<https://www.cisa.gov/uscert/ncas/alerts/aa21-356a>) | CISA webpage [Apache Log4j Vulnerability Guidance](<https://www.cisa.gov/uscert/apache-log4j-vulnerability-guidance>) CCCS [Active exploitation of Apache Log4j vulnerability - Update 7](<https://www.cyber.gc.ca/en/alerts/active-exploitation-apache-log4j-vulnerability>) [CVE-2021-40539](<https://nvd.nist.gov/vuln/detail/CVE-2021-40539>) | Zoho ManageEngine | ADSelfService Plus version 6113 and prior | [Zoho ManageEngine: ADSelfService Plus 6114 Security Fix Release ](<https://pitstop.manageengine.com/portal/en/community/topic/adselfservice-plus-6114-security-fix-release>) | Joint CSA [APT Actors Exploiting Newly Identified Vulnerability in ManageEngine ADSelfService Plus](<https://www.cisa.gov/uscert/ncas/alerts/aa21-259a>) CCCS [Zoho Security Advisory](<https://www.cyber.gc.ca/en/alerts/zoho-security-advisory>) [CVE-2021-40444](<https://nvd.nist.gov/vuln/detail/CVE-2021-40444>) | Microsoft | Multiple Windows products; see [Microsoft Security Update Guide: MSHTML Remote Code Execution Vulnerability, CVE-2021-40444](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-40444>) | [Microsoft Security Update Guide: MSHTML Remote Code Execution Vulnerability, CVE-2021-40444](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-40444>) | [CVE-2021-34527](<https://nvd.nist.gov/vuln/detail/CVE-2021-34527>) | Microsoft | Multiple Windows products; see [Microsoft Security Update Guide: Windows Print Spooler Remote Code Execution Vulnerability, CVE-2021-34527](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-34527>) | [Microsoft Security Update Guide: Windows Print Spooler Remote Code Execution Vulnerability, CVE-2021-34527](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-34527>) | Joint CSA [Russian State-Sponsored Cyber Actors Gain Network Access by Exploiting Default Multifactor Authentication Protocols and “PrintNightmare” Vulnerability](<https://www.cisa.gov/uscert/ncas/alerts/aa22-074a>) CCCS [Alert Windows Print Spooler Vulnerability Remains Unpatched – Update 3](<https://www.cyber.gc.ca/en/alerts/windows-print-spooler-vulnerability-remains-unpatched>) [CVE-2021-34523](<https://nvd.nist.gov/vuln/detail/CVE-2021-34523>) | Microsoft | Microsoft Exchange Server 2013 Cumulative Update 23 Microsoft Exchange Server 2016 Cumulative Updates 19 and 20 Microsoft Exchange Server 2019 Cumulative Updates 8 and 9 | [Microsoft Security Update Guide: Microsoft Exchange Server Elevation of Privilege Vulnerability, CVE-2021-34523](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-34523>) | Joint CSA [Iranian Government-Sponsored APT Cyber Actors Exploiting Microsoft Exchange and Fortinet Vulnerabilities in Furtherance of Malicious Activities](<https://www.cisa.gov/uscert/ncas/alerts/aa21-321a>) ACSC Alert [Microsoft Exchange ProxyShell Targeting in Australia](<https://www.cyber.gov.au/acsc/view-all-content/alerts/microsoft-exchange-proxyshell-targeting-australia>) [CVE-2021-34473](<https://nvd.nist.gov/vuln/detail/CVE-2021-34473>) | Microsoft | Multiple Exchange Server versions; see: [Microsoft Security Update Guide: Microsoft Exchange Server Remote Code Execution Vulnerability, CVE-2021-34473](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-34473>) | [Microsoft Security Update Guide: Microsoft Exchange Server Remote Code Execution Vulnerability, CVE-2021-34473](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-34473>) [CVE-2021-31207](<https://nvd.nist.gov/vuln/detail/CVE-2021-31207>) | Microsoft | Multiple Exchange Server versions; see [Microsoft Update Guide: Microsoft Exchange Server Security Feature Bypass Vulnerability, CVE-2021-31207](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-31207>) | [Microsoft Update Guide: Microsoft Exchange Server Security Feature Bypass Vulnerability, CVE-2021-31207](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-31207>) [CVE-2021-3156](<https://nvd.nist.gov/vuln/detail/CVE-2021-3156>) | Sudo | Sudo before 1.9.5p2 | [Sudo Stable Release 1.9.5p2](<https://www.sudo.ws/releases/stable/#1.9.5p2>) | [CVE-2021-27852](<https://nvd.nist.gov/vuln/detail/CVE-2021-27852>) | Checkbox Survey | Checkbox Survey versions prior to 7 | | [CVE-2021-27065](<https://nvd.nist.gov/vuln/detail/CVE-2021-27065>) | Microsoft Exchange Server | Multiple versions; see: [Microsoft Security Update Guide: Microsoft Exchange Server Remote Code Execution Vulnerability, CVE-2021-27065](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-27065>) | [Microsoft Security Update Guide: Microsoft Exchange Server Remote Code Execution Vulnerability, CVE-2021-27065](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-27065>) | CISA Alert: [Mitigate Microsoft Exchange Server Vulnerabilities](<https://www.cisa.gov/uscert/ncas/alerts/aa21-062a>) ACSC Advisory [Active exploitation of Vulnerable Microsoft Exchange servers](<https://www.cyber.gov.au/acsc/view-all-content/advisories/advisory-2021-002-active-exploitation-vulnerable-microsoft-exchange-servers>) CCCS Alert [Active Exploitation of Microsoft Exchange Vulnerabilities - Update 4](<https://www.cyber.gc.ca/en/alerts/active-exploitation-microsoft-exchange-vulnerabilities>) [CVE-2021-26858](<https://nvd.nist.gov/vuln/detail/CVE-2021-26858>) | Microsoft | Exchange Server, multiple versions; see [Microsoft Security Update Guide: Microsoft Exchange Server Remote Code Execution Vulnerability, CVE-2021-26858](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-26858>) | [Microsoft Security Update Guide: Microsoft Exchange Server Remote Code Execution Vulnerability, CVE-2021-26858](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-26858>) [CVE-2021-26857](<https://nvd.nist.gov/vuln/detail/CVE-2021-26857>) | Microsoft | Exchange Server, multiple versions; see [Microsoft Security Update Guide: Microsoft Exchange Server Remote Code Execution Vulnerability, CVE-2021-26857](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-26857>) | [Microsoft Security Update Guide: Microsoft Exchange Server Remote Code Execution Vulnerability, CVE-2021-26857](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-26857>) [CVE-2021-26855](<https://nvd.nist.gov/vuln/detail/CVE-2021-26855>) | Microsoft | Exchange Server, multiple versions; see [Microsoft Security Update Guide: Microsoft Exchange Server Remote Code Execution Vulnerability, CVE-2021-26855](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-26855>) | [Microsoft Security Update Guide: Microsoft Exchange Server Remote Code Execution Vulnerability, CVE-2021-26855](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-26855>) [CVE-2021-26084](<https://nvd.nist.gov/vuln/detail/CVE-2021-26084>) | Jira Atlassian | Confluence Server and Data Center, versions 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0 before 7.12.5. | [Jira Atlassian: Confluence Server Webwork OGNL injection - CVE-2021-26084](<https://jira.atlassian.com/browse/CONFSERVER-67940>) | ACSC Alert [Remote code execution vulnerability present in certain versions of Atlassian Confluence](<https://www.cyber.gov.au/acsc/view-all-content/alerts/remote-code-execution-vulnerability-present-certain-versions-atlassian-confluence>) CCCS [Atlassian Security Advisory](<https://www.cyber.gc.ca/en/alerts/atlassian-security-advisory>) [CVE-2021-22893](<https://nvd.nist.gov/vuln/detail/CVE-2021-22893>) | Pulse Secure | PCS 9.0R3/9.1R1 and Higher | [Pulse Secure SA44784 - 2021-04: Out-of-Cycle Advisory: Multiple Vulnerabilities Resolved in Pulse Connect Secure 9.1R11.4](<https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44784/>) | CCCS Alert [Active Exploitation of Pulse Connect Secure Vulnerabilities - Update 1](<https://www.cyber.gc.ca/en/alerts/active-exploitation-pulse-connect-secure-vulnerabilities>) [CVE-2021-20016](<https://nvd.nist.gov/vuln/detail/CVE-2021-20016>) | SonicWall | SMA 100 devices (SMA 200, SMA 210, SMA 400, SMA 410, SMA 500v) | [SonicWall Security Advisory SNWLID-2021-0001](<https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0001>) | [CVE-2021-1675](<https://nvd.nist.gov/vuln/detail/CVE-2021-1675>) | Microsoft | Multiple Windows products; see [Microsoft Security Update Guide Windows Print Spooler Remote Code Execution Vulnerability, CVE-2021-1675](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-1675>) | [Microsoft Security Update Guide: Windows Print Spooler Remote Code Execution Vulnerability, CVE-2021-1675](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-1675>) | CCCS [Alert Windows Print Spooler Vulnerability Remains Unpatched – Update 3](<https://www.cyber.gc.ca/en/alerts/windows-print-spooler-vulnerability-remains-unpatched>) [CVE-2020-2509](<https://nvd.nist.gov/vuln/detail/CVE-2020-2509>) | QNAP | QTS, multiple versions; see [QNAP: Command Injection Vulnerability in QTS and QuTS hero](<https://www.qnap.com/en/security-advisory/qsa-21-05>) QuTS hero h4.5.1.1491 build 20201119 and later | [QNAP: Command Injection Vulnerability in QTS and QuTS hero](<https://www.qnap.com/en/security-advisory/qsa-21-05>) | [CVE-2020-1472](<https://nvd.nist.gov/vuln/detail/CVE-2020-1472>) | Microsoft | Windows Server, multiple versions; see [Microsoft Security Update Guide: Netlogon Elevation of Privilege Vulnerability, CVE-2020-1472](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2020-1472>) | [Microsoft Security Update Guide: Netlogon Elevation of Privilege Vulnerability, CVE-2020-1472](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2020-1472>) | ACSC Alert [Netlogon elevation of privilege vulnerability (CVE-2020-1472)](<https://www.cyber.gov.au/acsc/view-all-content/alerts/netlogon-elevation-privilege-vulnerability-cve-2020-1472>) Joint CSA [APT Actors Chaining Vulnerabilities Against SLTT, Critical Infrastructure, and Elections Organizations](<https://www.cisa.gov/uscert/ncas/alerts/aa20-283a>) CCCS Alert [Microsoft Netlogon Elevation of Privilege Vulnerability - CVE-2020-1472 - Update 1](<https://www.cyber.gc.ca/en/alerts/microsoft-netlogon-elevation-privilege-vulnerability-cve-2020-1472>) [CVE-2020-0688](<https://nvd.nist.gov/vuln/detail/CVE-2020-0688>) | Microsoft | Exchange Server, multiple versions; see [Microsoft Security Update Guide: Microsoft Exchange Validation Key Remote Code Execution Vulnerability, CVE-2020-0688](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2020-0688>) | [Microsoft Security Update Guide: Microsoft Exchange Validation Key Remote Code Execution Vulnerability, CVE-2020-0688](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2020-0688>) | CISA Alert [Chinese Ministry of State Security-Affiliated Cyber Threat Actor Activity](<https://www.cisa.gov/uscert/ncas/alerts/aa20-258a>) Joint CSA [Russian State-Sponsored Cyber Actors Target Cleared Defense Contractor Networks to Obtain Sensitive U.S. Defense Information and Technology](<https://www.cisa.gov/uscert/ncas/alerts/aa22-047a>) CCCS Alert [Microsoft Exchange Validation Key Remote Code Execution Vulnerability](<https://www.cyber.gc.ca/en/alerts/microsoft-exchange-validation-key-remote-code-execution-vulnerability>) [CVE-2019-19781](<https://nvd.nist.gov/vuln/detail/CVE-2019-19781>) | Citrix | ADC and Gateway version 13.0 all supported builds before 13.0.47.24 NetScaler ADC and NetScaler Gateway, version 12.1 all supported builds before 12.1.55.18; version 12.0 all supported builds before 12.0.63.13; version 11.1 all supported builds before 11.1.63.15; version 10.5 all supported builds before 10.5.70.12 SD-WAN WANOP appliance models 4000-WO, 4100-WO, 5000-WO, and 5100-WO all supported software release builds before 10.2.6b and 11.0.3b | [Citrix Security Bulletin CTX267027](<https://support.citrix.com/article/CTX267027>) | Joint CSA [APT Actors Chaining Vulnerabilities Against SLTT, Critical Infrastructure, and Elections Organizations](<https://www.cisa.gov/uscert/ncas/alerts/aa20-283a>) CISA Alert [Chinese Ministry of State Security-Affiliated Cyber Threat Actor Activity](<https://www.cisa.gov/uscert/ncas/alerts/aa20-258a>) CCCS Alert [Detecting Compromises relating to Citrix CVE-2019-19781](<https://www.cyber.gc.ca/en/alerts/detecting-compromises-relating-citrix-cve-2019-19781-0>) [CVE-2019-18935](<https://nvd.nist.gov/vuln/detail/CVE-2019-18935>) | Progress Telerik | UI for ASP.NET AJAX through 2019.3.1023 | [Telerik UI for ASP.NET AJAX Allows JavaScriptSerializer Deserialization](<https://docs.telerik.com/devtools/aspnet-ajax/knowledge-base/common-allows-javascriptserializer-deserialization>) | ACSC Alert [Active exploitation of vulnerability in Microsoft Internet Information Services](<https://www.cyber.gov.au/acsc/view-all-content/alerts/active-exploitation-vulnerability-microsoft-internet-information-services>) [CVE-2019-11510](<https://nvd.nist.gov/vuln/detail/CVE-2019-11510>) | Pulse Secure | Pulse Connect Secure 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4 | [Pulse Secure: SA44101 - 2019-04: Out-of-Cycle Advisory: Multiple vulnerabilities resolved in Pulse Connect Secure / Pulse Policy Secure 9.0RX](<https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101/>) | CISA Alert [Continued Exploitation of Pulse Secure VPN Vulnerability](<https://www.cisa.gov/uscert/ncas/alerts/aa20-010a>) CISA Alert [Chinese Ministry of State Security-Affiliated Cyber Threat Actor Activity](<https://www.cisa.gov/uscert/ncas/alerts/aa20-258a>) ACSC Advisory [Recommendations to mitigate vulnerability in Pulse Connect Secure VPN Software](<https://www.cyber.gov.au/acsc/view-all-content/advisories/2019-129-recommendations-mitigate-vulnerability-pulse-connect-secure-vpn-software>) Joint CSA [APT Actors Chaining Vulnerabilities Against SLTT, Critical Infrastructure, and Elections Organizations](<https://www.cisa.gov/uscert/ncas/alerts/aa20-283a>) CCCS [Alert APT Actors Target U.S. and Allied Networks - Update 1](<https://www.cyber.gc.ca/en/alerts/apt-actors-target-us-and-allied-networks-nsacisafbi>) [CVE-2018-13379](<https://nvd.nist.gov/vuln/detail/CVE-2018-13379>) | Fortinet | FortiProxy 2.0.2, 2.0.1, 2.0.0, 1.2.8, 1.2.7, 1.2.6, 1.2.5, 1.2.4, 1.2.3, 1.2.2, 1.2.1, 1.2.0, 1.1.6 | [Fortinet FortiGuard Labs: FG-IR-20-233](<https://www.fortiguard.com/psirt/FG-IR-20-233>) | Joint CSA [Russian State-Sponsored Cyber Actors Target Cleared Defense Contractor Networks to Obtain Sensitive U.S. Defense Information and Technology](<https://www.cisa.gov/uscert/ncas/alerts/aa22-047a>) Joint CSA [Iranian Government-Sponsored APT Cyber Actors Exploiting Microsoft Exchange and Fortinet Vulnerabilities in Furtherance of Malicious Activities](<https://www.cisa.gov/uscert/ncas/alerts/aa21-321a>) Joint CSA [APT Actors Chaining Vulnerabilities Against SLTT, Critical Infrastructure, and Elections Organizations](<https://www.cisa.gov/uscert/ncas/alerts/aa20-283a>) ACSC Alert [APT exploitation of Fortinet Vulnerabilities](<https://www.cyber.gov.au/acsc/view-all-content/alerts/apt-exploitation-fortinet-vulnerabilities>) CCCS Alert [Exploitation of Fortinet FortiOS vulnerabilities (CISA, FBI) - Update 1](<https://www.cyber.gc.ca/en/alerts/exploitation-fortinet-fortios-vulnerabilities-cisa-fbi>) [CVE-2018-0171](<https://nvd.nist.gov/vuln/detail/CVE-2018-0171>) | Cisco | See [Cisco Security Advisory: cisco-sa-20180328-smi2](<https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-smi2#fixed>) | [Cisco Security Advisory: cisco-sa-20180328-smi2](<https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-smi2#fixed>) | CCCS [Action Required to Secure the Cisco IOS and IOS XE Smart Install Feature](<https://www.cyber.gc.ca/en/alerts/action-required-secure-cisco-ios-and-ios-xe-smart-install-feature>) [CVE-2017-11882](<https://nvd.nist.gov/vuln/detail/CVE-2017-11882>) | Microsoft | Office, multiple versions; see [Microsoft Security Update Guide: Microsoft Office Memory Corruption Vulnerability, CVE-2017-11882](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2017-11882>) | [Microsoft Security Update Guide: Microsoft Office Memory Corruption Vulnerability, CVE-2017-11882](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2017-11882>) | CCCS Alert [Microsoft Office Security Update](<https://www.cyber.gc.ca/en/alerts/microsoft-office-security-update>) [CVE-2017-0199](<https://nvd.nist.gov/vuln/detail/CVE-2017-0199>) | Microsoft | Multiple products; see [Microsoft Security Update Guide: Microsoft Office/WordPad Remote Code Execution Vulnerability w/Windows, CVE-2017-0199](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2017-0199>) | [Microsoft Security Update Guide: Microsoft Office/WordPad Remote Code Execution Vulnerability w/Windows, CVE-2017-0199](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2017-0199>) | CCCS [Microsoft Security Updates](<https://www.cyber.gc.ca/en/alerts/microsoft-security-updates>) ### Contact Information **U.S. organizations: **all organizations should report incidents and anomalous activity to CISA 24/7 Operations Center at [report@cisa.gov ](<mailto:report@cisa.gov>)or (888) 282-0870 and/or to the FBI via your [local FBI field office](<https://www.fbi.gov/contact-us/field-offices>) or the FBI’s 24/7 CyWatch at (855) 292-3937 or CyWatch@fbi.gov. When available, please include the following information regarding the incident: date, time, and location of the incident; type of activity; number of people affected; type of equipment used for the activity; the name of the submitting company or organization; and a designated point of contact. For NSA client requirements or general cybersecurity inquiries, contact [Cybersecurity_Requests@nsa.gov](<mailto:Cybersecurity_Requests@nsa.gov>). **Australian organizations:** visit [cyber.gov.au](<https://www.cyber.gov.au/>) or call 1300 292 371 (1300 CYBER 1) to report cybersecurity incidents and access alerts and advisories. **Canadian organizations:** report incidents by emailing CCCS at [contact@cyber.gc.ca](<mailto:contact@cyber.gc.ca>). **New Zealand organizations:** report cyber security incidents to [incidents@ncsc.govt.nz](<mailto:incidents@ncsc.govt.nz>) or call 04 498 7654. **United Kingdom organizations:** report a significant cyber security incident: [ncsc.gov.uk/report-an-incident](<https://www.ncsc.gov.uk/section/about-this-website/contact-us>) (monitored 24 hours) or, for urgent assistance, call 03000 200 973. ### Revisions April 27, 2022: Initial Version


Related


qualysblog
blog

CISA Alert: Top 15 Routinely Exploited Vulnerabilities

2022-05-06T12:19:24
qualysblog
blog

CISA Alert: Top Routinely Exploited Vulnerabilities

2021-07-29T00:20:27
qualysblog
blog

Part 2: An In-Depth Look at the Latest Vulnerability Threat Landscape (Attackers’ Edition)

2023-07-18T13:38:53
qualysblog
blog

Qualys Tackles 2022’s Top Routinely Exploited Cyber Vulnerabilities

2023-08-24T19:07:05
qualysblog
blog

Qualys Top 20 Most Exploited Vulnerabilities

2023-09-04T14:00:00
qualysblog
blog

NSA Alert: Topmost CVEs Actively Exploited By People’s Republic of China State-Sponsored Cyber Actors

2022-10-07T20:03:01
qualysblog
blog

AvosLocker Ransomware Behavior Examined on Windows & Linux

2022-03-07T05:18:46
qualysblog
blog

Russia-Ukraine Crisis: How to Strengthen Your Security Posture to Protect against Cyber Attack, based on CISA Guidelines

2022-02-26T20:20:32
qualysblog
blog

Microsoft Exchange Server Zero-Days (ProxyLogon) – Automatically Discover, Prioritize and Remediate Using Qualys VMDR

2021-03-03T22:12:19
ics
info

Exploitation of Accellion File Transfer Appliance

2021-06-17T12:00:00
ics
info

Mitigate Microsoft Exchange Server Vulnerabilities

2021-07-19T12:00:00
ics
info

Impacket and Exfiltration Tool Used to Steal Sensitive Information from Defense Industrial Base Organization

2022-10-05T12:00:00
ics
info

Top Routinely Exploited Vulnerabilities

2021-08-20T12:00:00
ics
info

Iranian Government-Sponsored Actors Conduct Cyber Operations Against Global Government and Commercial Networks

2022-02-24T12:00:00
ics
info

Russian State-Sponsored Advanced Persistent Threat Actor Compromises U.S. Government Targets

2020-12-01T12:00:00
ics
info

#StopRansomware: Vice Society

2022-09-08T12:00:00
ics
info

Chinese Ministry of State Security-Affiliated Cyber Threat Actor Activity

2020-10-24T12:00:00
ics
info

#StopRansomware: Vice Society

2022-09-08T12:00:00
ics
info

#StopRansomware: Hive Ransomware

2022-11-25T12:00:00
ics
info

Understanding and Mitigating Russian State-Sponsored Cyber Threats to U.S. Critical Infrastructure

2022-03-01T12:00:00
ics
info

Chinese State-Sponsored Cyber Operations: Observed TTPs

2021-08-20T12:00:00
ics
info

APT Actors Exploiting Newly Identified Vulnerability in ManageEngine ADSelfService Plus

2021-11-22T12:00:00
ics
info

Critical Vulnerability in Citrix Application Delivery Controller, Gateway, and SD-WAN WANOP

2020-05-21T12:00:00
ics
info

COVID-19 Exploited by Malicious Cyber Actors

2020-04-08T12:00:00
ics
info

Russian Foreign Intelligence Service (SVR) Cyber Operations: Trends and Best Practices for Network Defenders

2021-04-26T12:00:00
ics
info

Detecting Citrix CVE-2019-19781

2020-05-21T12:00:00
ics
info

APT Groups Target Healthcare and Essential Services

2022-01-25T12:00:00
ics
info

Continued Threat Actor Exploitation Post Pulse Secure VPN Patching

2020-10-24T12:00:00
ics
info

Russian State-Sponsored Cyber Actors Target Cleared Defense Contractor Networks to Obtain Sensitive U.S. Defense Information and Technology

2022-02-16T12:00:00
ics
info

Continued Exploitation of Pulse Secure VPN Vulnerability

2020-04-15T12:00:00
ics
info

2021 Top Malware Strains

2022-08-25T12:00:00
ics
info

Russian State-Sponsored Cyber Actors Gain Network Access by Exploiting Default Multifactor Authentication Protocols and “PrintNightmare” Vulnerability

2022-05-02T12:00:00
ics
info

#StopRansomware: BianLian Ransomware Group

2023-05-16T12:00:00
ics
info

Dridex Malware

2020-06-30T12:00:00
ics
info

APT Actors Chaining Vulnerabilities Against SLTT, Critical Infrastructure, and Elections Organizations

2020-10-24T12:00:00
ics
info

LokiBot Malware

2020-10-24T12:00:00
ics
info

Iranian Government-Sponsored APT Actors Compromise Federal Network, Deploy Crypto Miner, Credential Harvester

2022-11-25T12:00:00
ics
info

Multiple Nation-State Threat Actors Exploit CVE-2022-47966 and CVE-2022-42475

2023-09-07T12:00:00
ics
info

2022 Top Routinely Exploited Vulnerabilities

2023-08-03T12:00:00
ics
info

Iran-Based Threat Actor Exploits VPN Vulnerabilities

2020-09-15T12:00:00
ics
info

Iranian Government-Sponsored APT Cyber Actors Exploiting Microsoft Exchange and Fortinet Vulnerabilities in Furtherance of Malicious Activities

2021-11-19T12:00:00
ics
info

Top CVEs Actively Exploited By People’s Republic of China State-Sponsored Cyber Actors

2022-10-06T12:00:00
ics
info

Karakurt Data Extortion Group

2022-06-02T12:00:00
ics
info

People's Republic of China State-Sponsored Cyber Actor Living off the Land to Evade Detection

2023-05-24T12:00:00
ics
info

#StopRansomware: Cuba Ransomware

2023-01-05T12:00:00
ics
info

Understanding Ransomware Threat Actors: LockBit

2023-06-14T12:00:00
nessus
scanner

Accellion File Transfer Appliance < 9_12_416 Multiple Vulnerabilities

2021-11-05T00:00:00
nessus
scanner

Security Updates for Microsoft Exchange Server (March 2021)

2021-03-03T00:00:00
malwarebytes
blog

The top 5 most routinely exploited vulnerabilities of 2021

2022-04-29T16:28:20
malwarebytes
blog

AvosLocker ransomware uses Microsoft Exchange Server vulnerabilities, says FBI

2022-03-21T21:09:12
malwarebytes
blog

Patch now! Exchange servers attacked by Hafnium zero-days

2021-03-03T12:34:27
malwarebytes
blog

Patch now! Microsoft Exchange is being attacked via ProxyShell

2021-08-23T13:21:08
malwarebytes
blog

IIS extensions are on the rise as backdoors to servers

2022-07-27T13:58:06
malwarebytes
blog

2022's most routinely exploited vulnerabilities—history repeats

2023-08-07T18:30:00
malwarebytes
blog

Chinese APT's favorite vulnerabilities revealed

2022-10-13T16:15:00
malwarebytes
blog

Patch now! NSA, CISA, and FBI warn of Russian intelligence exploiting 5 vulnerabilities

2021-04-16T14:59:38
fireeye
info

Cyber Criminals Exploit Accellion FTA for Data Theft and Extortion

2021-02-22T00:00:00
fireeye
info

Detection and Response to Exploitation of Microsoft Exchange Zero-Day Vulnerabilities

2021-03-04T00:00:00
fireeye
info

PST, Want a Shell? ProxyShell Exploiting Microsoft Exchange Servers

2021-09-03T10:00:00
threatpost
info

Energy Giant Shell Is Latest Victim of Accellion Attacks

2021-03-23T14:16:14
threatpost
info

Accellion FTA Zero-Day Attacks Tied to Clop, FIN11

2021-02-22T17:51:20
threatpost
info

CISA’s Top 30 Bugs: One’s Old Enough to Buy Beer

2021-07-29T18:39:56
threatpost
info

Microsoft Exchange Servers See ProxyLogon Patching Frenzy

2021-03-24T18:39:26
threatpost
info

CISA Orders Fed Agencies to Patch Exchange Servers

2021-03-04T17:08:36
threatpost
info

Attackers Target ProxyLogon Exploit to Install Cryptojacker

2021-04-15T12:19:13
threatpost
info

Exchange Cyberattacks Escalate as Microsoft Rolls One-Click Fix

2021-03-16T16:56:26
threatpost
info

Microsoft Exchange 0-Day Attackers Spy on U.S. Targets

2021-03-03T15:30:52
threatpost
info

Microsoft Exchange Exploits Pave a Ransomware Path

2021-03-12T16:26:07
threatpost
info

Microsoft Exchange Servers Face APT Attack Tsunami

2021-03-11T18:01:16
threatpost
info

IKEA Hit by Email Reply-Chain Cyberattack

2021-11-29T21:22:12
threatpost
info

Microsoft Breaks Silence on Barrage of ProxyShell Attacks

2021-08-26T12:39:54
threatpost
info

Exchange Servers Under Active Attack via ProxyShell Bugs

2021-08-13T18:56:27
threatpost
info

Attackers Hijack Email Using Proxy Logon/Proxyshell Flaws

2021-11-22T19:26:25
threatpost
info

Microsoft Exchange 'ProxyToken' Bug Allows Email Snooping

2021-08-30T17:31:06
threatpost
info

Lemon Duck Cryptojacking Botnet Changes Up Tactics

2021-05-10T17:37:44
threatpost
info

Exchange, Fortinet Flaws Being Exploited by Iranian APT, CISA Warns

2021-11-17T17:04:01
threatpost
info

Hackers Look to Steal COVID-19 Vaccine Research

2020-07-16T18:05:20
threatpost
info

FBI Clears ProxyLogon Web Shells from Hundreds of Orgs

2021-04-14T17:31:13
threatpost
info

New APT ChamelGang Targets Russian Energy, Aviation Orgs

2021-10-01T12:36:25
threatpost
info

‘Tortilla’ Wraps Exchange Servers in ProxyShell Attacks

2021-11-03T18:16:37
threatpost
info

Election Systems Under Attack via Microsoft Zerologon Exploits

2020-10-13T16:39:01
threatpost
info

Top CVEs Trending with Cybercriminals

2021-07-16T21:07:15
threatpost
info

Phishers Delivering Increasingly Convincing Lures

2021-05-04T13:46:19
threatpost
info

Prometei Botnet Could Fire Up APT-Style Attacks

2021-04-23T17:15:23
mmpc
blog

Profiling DEV-0270: PHOSPHORUS’ ransomware operations

2022-09-07T21:00:00
mmpc
blog

Evolving trends in Iranian threat actor activity – MSTIC presentation at CyberWarCon 2021

2021-11-16T16:00:08
mmpc
blog

HAFNIUM targeting Exchange Servers with 0-day exploits

2021-03-02T21:07:53
mmpc
blog

Ransomware-as-a-service: Understanding the cybercrime gig economy and how to protect yourself

2022-05-09T13:00:00
mssecure
blog

Profiling DEV-0270: PHOSPHORUS’ ransomware operations

2022-09-07T21:00:00
mssecure
blog

Evolving trends in Iranian threat actor activity – MSTIC presentation at CyberWarCon 2021

2021-11-16T16:00:08
mssecure
blog

HAFNIUM targeting Exchange Servers with 0-day exploits

2021-03-02T21:07:53
mssecure
blog

Ransomware-as-a-service: Understanding the cybercrime gig economy and how to protect yourself

2022-05-09T13:00:00
thn
info

Hackers Exploit Accellion Zero-Days in Recent Data Theft and Extortion Attacks

2021-02-23T07:18:00
thn
info

Top 30 Critical Security Vulnerabilities Most Exploited by Hackers

2021-07-29T08:21:00
thn
info

URGENT — 4 Actively Exploited 0-Day Flaws Found in Microsoft Exchange

2021-03-03T07:28:00
thn
info

Microsoft Exchange Cyber Attack — What Do We Know So Far?

2021-03-08T10:15:00
thn
info

Hackers Actively Searching for Unpatched Microsoft Exchange Servers

2021-08-13T09:46:00
thn
info

Extortion Gang Breaches Cybersecurity Firm Qualys Using Accellion Exploit

2021-03-04T09:49:00
thn
info

New Incident Report Reveals How Hive Ransomware Targets Organizations

2022-04-21T10:00:00
thn
info

WARNING: Microsoft Exchange Under Attack With ProxyShell Flaws

2021-08-22T09:51:00
thn
info

Hackers Exploiting ProxyLogon and ProxyShell Flaws in Spam Campaigns

2021-11-22T11:47:00
thn
info

U.S. Cybersecurity Agency Lists 2021's Top 15 Most Exploited Software Vulnerabilities

2022-04-28T05:41:00
thn
info

Major Cybersecurity Agencies Collaborate to Unveil 2022's Most Exploited Vulnerabilities

2023-08-04T07:02:00
thn
info

A New APT Hacking Group Targeting Fuel, Energy, and Aviation Industries

2021-10-04T12:48:00
thn
info

Iranian Hackers Exploiting VPN Flaws to Backdoor Organizations Worldwide

2020-02-18T15:06:00
thn
info

CISA Warning: Nation-State Hackers Exploit Fortinet and Zoho Vulnerabilities

2023-09-08T05:36:00
thn
info

FBI, NSA and CISA Warns of Russian Hackers Targeting Critical Infrastructure

2022-01-12T09:14:00
thn
info

CISA: Chinese Hackers Exploiting Unpatched Devices to Target U.S. Agencies

2020-09-15T09:14:00
thn
info

Prometei Botnet Exploiting Unpatched Microsoft Exchange Servers

2021-04-23T07:42:00
thn
info

ALERT: Critical RCE Bug in VMware vCenter Server Under Active Attack

2021-06-05T10:58:00
thn
info

U.S. Charges 3 Iranian Hackers and Sanctions Several Others Over Ransomware Attacks

2022-09-15T06:49:00
thn
info

New APT Hacking Group Targets Microsoft IIS Servers with ASP.NET Exploits

2021-08-02T11:11:00
impervablog
blog

Protecting Your Data from Cyber Extortion: Lessons from the Latest Mega-hack

2021-03-09T19:39:36
impervablog
blog

Imperva Observes Hive of Activity Following Hafnium Microsoft Exchange Disclosures

2021-03-26T15:06:38
securelist
blog

Black Kingdom ransomware

2021-06-17T10:00:41
securelist
blog

Zero-day vulnerabilities in Microsoft Exchange Server

2021-03-04T17:20:57
securelist
blog

IT threat evolution Q3 2021

2021-11-26T12:00:36
securelist
blog

From Caribbean shores to your devices: analyzing Cuba ransomware

2023-09-11T10:00:26
securelist
blog

IT threat evolution Q1 2021

2021-05-31T10:00:37
msrc
blog

Guidance for responders: Investigating and remediating on-premises Exchange Server vulnerabilities

2021-03-16T07:00:00
msrc
blog

Guidance for responders: Investigating and remediating on-premises Exchange Server vulnerabilities

2021-03-16T07:00:00
msrc
blog

Guidance for responders: Investigating and remediating on-premises Exchange Server vulnerabilities

2021-03-16T18:44:28
cisa
info

Microsoft Releases Out-of-Band Security Updates for Exchange Server

2021-03-02T00:00:00
cisa
info

Urgent: Protect Against Active Exploitation of ProxyShell Vulnerabilities

2021-08-21T00:00:00
hivepro
info

Have you patched the vulnerabilities in Microsoft Exchange Server?

2021-08-18T11:01:05
hivepro
info

Magic Hound Exploiting Old Microsoft Exchange ProxyShell Vulnerabilities

2022-03-25T04:05:09
hivepro
info

BlackByte ransomware exploits Microsoft Servers ProxyShell Vulnerabilities

2021-12-07T13:24:49
hivepro
info

AvosLocker Ransomware group has targeted 50+ Organizations Worldwide

2022-03-24T06:30:44
hivepro
info

Hive Ransomware targets organizations with ProxyShell exploit

2022-04-22T14:34:47
hivepro
info

ProxyShell and PetitPotam exploits weaponized by LockFile Ransomware Group

2021-08-24T10:35:48
talosblog
blog

Threat Advisory: HAFNIUM and Microsoft Exchange zero-day

2021-03-08T10:18:43
talosblog
blog

Incident Response trends Q2 2023: Data theft extortion rises, while healthcare is still most-targeted vertical

2023-07-26T12:00:57
akamaiblog
blog

How Akamai Can Help You Fight the Latest Exploitation Attempts Against Microsoft Exchange

2021-03-15T22:30:00
akamaiblog
blog

Authentication: Lessons Learned from Microsoft Exchange and F5 BIG-IP Hacks

2021-03-24T14:00:00
akamaiblog
blog

Microsoft Exchange and Verkada Hacks: Isolate Your Apps and APIs from the Internet Cesspool

2021-03-15T22:15:00
avleonov
blog

Vulnerability Management news and publications #2

2022-08-14T11:30:44
avleonov
blog

Joint Advisory AA22-279A and Vulristics

2022-10-21T20:10:13
githubexploit
exploit

Exploit for Vulnerability in Microsoft

2021-03-09T10:36:44
githubexploit
exploit

Exploit for Vulnerability in Microsoft

2021-03-05T08:22:07
githubexploit
exploit

Exploit for Vulnerability in Microsoft

2021-03-11T21:18:29
githubexploit
exploit

Exploit for Vulnerability in Microsoft

2021-10-02T07:29:24
githubexploit
exploit

Exploit for Vulnerability in Microsoft

2021-09-04T15:34:03
githubexploit
exploit

Exploit for Vulnerability in Microsoft

2021-05-23T17:09:30
githubexploit
exploit

Exploit for Deserialization of Untrusted Data in Apache Log4J

2022-01-09T08:22:24
githubexploit
exploit

Exploit for Vulnerability in Microsoft

2021-03-08T07:28:21
githubexploit
exploit

Exploit for Vulnerability in Microsoft

2021-03-03T17:36:18
githubexploit
exploit

Exploit for Vulnerability in Microsoft

2021-03-14T14:23:34
githubexploit
exploit

Exploit for Vulnerability in Microsoft

2021-03-16T07:31:25
githubexploit
exploit

Exploit for Vulnerability in Microsoft

2021-03-15T09:02:40
githubexploit
exploit

Exploit for Vulnerability in Microsoft

2021-04-19T09:33:52
githubexploit
exploit

Exploit for Path Traversal in Pulsesecure Pulse Connect Secure

2020-04-16T16:32:47
githubexploit
exploit

Exploit for Vulnerability in Microsoft

2021-03-11T19:35:35
carbonblack
blog

TAU Threat Advisory: Microsoft Exchange Servers Targeted with Four Zero-day Exploits

2021-03-08T21:05:13
krebs
blog

Microsoft: Chinese Cyberspies Used 4 Exchange Server Flaws to Plunder Emails

2021-03-02T21:19:17
rapid7blog
info

Defending Against the Zero Day: Analyzing Attacker Behavior Post-Exploitation of Microsoft Exchange

2021-03-23T14:04:36
rapid7blog
info

For Microsoft Exchange Server Vulnerabilities, Patching Remains Patchy

2021-10-06T14:07:12
rapid7blog
info

Rapid7’s InsightIDR Enables Detection And Response to Microsoft Exchange Zero-Day

2021-03-03T00:41:04
rapid7blog
info

What's New in InsightVM: Q3 2021 in Review

2021-10-08T13:30:00
rapid7blog
info

Conti Ransomware Group Internal Chats Leaked Over Russia-Ukraine Conflict

2022-03-01T19:15:58
rapid7blog
info

ProxyShell: More Widespread Exploitation of Microsoft Exchange Servers

2021-08-12T21:08:43
rapid7blog
info

Metasploit Wrap-Up

2021-08-20T19:12:00
rapid7blog
info

Opportunistic Exploitation of Zoho ManageEngine and Sitecore CVEs

2021-11-09T16:59:41
rapid7blog
info

CVE-2021-21985: What you need to know about the latest critical vCenter Server vulnerability

2021-05-26T18:57:20
rapid7blog
info

Mass Exploitation of Exchange Server Zero-Day CVEs: What You Need to Know

2021-03-03T19:23:42
attackerkb
info

Multiple Microsoft Exchange zero-day vulnerabilities - ProxyLogon Exploit Chain

2022-02-09T00:00:00
attackerkb
info

ProxyShell Exploit Chain

2021-08-20T00:00:00
attackerkb
info

CVE-2021-26855

2021-03-03T00:00:00
attackerkb
info

CVE-2021-26858

2021-03-03T00:00:00
attackerkb
info

CVE-2021-26857

2021-03-03T00:00:00
attackerkb
info

CVE-2021-27065

2021-03-03T00:00:00
packetstorm
exploit

Microsoft Exchange ProxyShell Remote Code Execution

2021-08-20T00:00:00
pentestpartners
blog

Hive Ransomware is on the rise. How should you deal with it?

2022-11-18T06:44:42
zdt
exploit

Microsoft Exchange ProxyShell Remote Code Execution Exploit

2021-08-21T00:00:00
zdt
exploit

Microsoft Exchange ProxyLogon Remote Code Execution Exploit

2021-03-23T00:00:00
metasploit
exploit

Microsoft Exchange ProxyShell RCE

2021-08-18T14:50:34
metasploit
exploit

Microsoft Exchange ProxyLogon RCE

2021-03-12T23:49:45
trellix
info

Trellix Global Defenders: Analysis and Protections for BlackByte Ransomware

2022-02-28T00:00:00
trellix
info

Beyond Memory Corruption Vulnerabilities – A Security Extinction and Future of Exploitation

2022-01-24T00:00:00
prion
NVD

CVE-2021-26412

2021-03-03T00:15:00
prion
NVD

CVE-2021-27065

2021-03-03T00:15:00
prion
NVD

CVE-2021-26858

2021-03-03T00:15:00
prion
NVD

CVE-2021-26854

2021-03-03T00:15:00
prion
NVD

CVE-2021-26855

2021-03-03T00:15:00
prion
NVD

CVE-2021-26857

2021-03-03T00:15:00
prion
NVD

CVE-2021-27078

2021-03-03T00:15:00
mscve
microsoft

Microsoft Exchange Server Remote Code Execution Vulnerability

2021-03-02T08:00:00
mscve
microsoft

Microsoft Exchange Server Remote Code Execution Vulnerability

2021-03-02T08:00:00
mscve
microsoft

Microsoft Exchange Server Remote Code Execution Vulnerability

2021-03-02T08:00:00
seebug
exploit

VMware vCenter Server远程代码执行漏洞（CVE-2021-21985）

2021-05-26T00:00:00
cve
NVD

CVE-2021-26854

2021-03-03T00:15:00
cve
NVD

CVE-2021-27065

2021-03-03T00:15:00
cve
NVD

CVE-2021-26858

2021-03-03T00:15:00
cve
NVD

CVE-2021-27078

2021-03-03T00:15:00
cve
NVD

CVE-2021-26857

2021-03-03T00:15:00
cve
NVD

CVE-2021-26412

2021-03-03T00:15:00
cve
NVD

CVE-2021-26855

2021-03-03T00:15:00
checkpoint_advisories
info

Microsoft Exchange Server Remote Code Execution (CVE-2021-34473; CVE-2021-34523)

2021-07-14T00:00:00
mskb
microsoft

Description of the security update for Microsoft Exchange Server 2019, 2016, and 2013: March 2, 2021 (KB5000871)

2021-03-02T08:00:00
kaspersky
info

KLA12103 ACE vulnerabilities in Microsoft Exchange Server

2021-03-02T00:00:00