U.S Cybersecurity Agency Lists 2021’s Top 15 Most Exploited Software Vulnerabilities

Log4Shell^[1], ProxyShell^[2], ProxyLogon^[3], ZeroLogon^[4], and flaws in Zoho ManageEngine AD SelfService
Plus^[5], Atlassian Confluence^[6], and VMware vSphere Client^[7]
emerged as some of the top exploited security vulnerabilities in
2021.

That’s according to a “Top Routinely Exploited
Vulnerabilities^[8]” report released by
cybersecurity authorities from the Five Eyes nations Australia,
Canada, New Zealand, the U.K., and the U.S.

Other frequently weaponized flaws included a remote code
execution bug in Microsoft Exchange Server (CVE-2020-0688^[9]), an arbitrary file read
vulnerability in Pulse Secure Pulse Connect Secure (CVE-2019-11510^[10]), and a path traversal
defect in Fortinet FortiOS and FortiProxy (CVE-2018-13379^[11]).

Nine of the top 15 routinely exploited flaws were remote code
execution vulnerabilities, followed by two privilege escalation
weaknesses, and one each of security feature bypass, arbitrary code
execution, arbitrary file read, and path traversal flaws.

“Globally, in 2021, malicious cyber actors targeted
internet-facing systems, such as email servers and virtual private
network (VPN) servers, with exploits of newly disclosed
vulnerabilities,” the agencies said in a joint advisory.

“For most of the top exploited vulnerabilities, researchers or
other actors released proof of concept (PoC) code within two weeks
of the vulnerability’s disclosure, likely facilitating exploitation
by a broader range of malicious actors.”

To mitigate the risk of exploitation of publicly known software
vulnerabilities, the agencies are recommending organizations to
apply patches in a timely fashion and implement a centralized patch
management system.