Top 30 Critical Security Vulnerabilities Most Exploited by Hackers

Intelligence agencies in Australia, the U.K., and the U.S.
issued a joint advisory on Wednesday detailing the most exploited
vulnerabilities in 2020 and 2021, once again demonstrating how
threat actors are able to weaponize publicly disclosed flaws to
their advantage swiftly.

“Cyber actors continue to exploit publicly known—and often
dated—software vulnerabilities against broad target sets, including
public and private sector organizations worldwide,” the U.S.
Cybersecurity and Infrastructure Security Agency (CISA), the
Australian Cyber Security Centre (ACSC), the United Kingdom’s
National Cyber Security Centre (NCSC), and the U.S. Federal Bureau
of Investigation (FBI) noted^[1].

“However, entities worldwide can mitigate the vulnerabilities
listed in this report by applying the available patches to their
systems and implementing a centralized patch management
system.”

The top 30 vulnerabilities span a wide range of software,
including remote work, virtual private networks (VPNs), and
cloud-based technologies, that cover a broad spectrum of products
from Microsoft, VMware, Pulse Secure, Fortinet, Accellion, Citrix,
F5 Big IP, Atlassian, and Drupal.

The most routinely exploited flaws in 2020 are as follows –

• CVE-2019-19781^[2] (CVSS score: 9.8) –
  Citrix Application Delivery Controller (ADC) and Gateway directory
  traversal vulnerability
• CVE-2019-11510^[3] (CVSS score: 10.0) –
  Pulse Connect Secure arbitrary file reading vulnerability
• CVE-2018-13379^[4] (CVSS score: 9.8) –
  Fortinet FortiOS path traversal vulnerability leading to system
  file leak
• CVE-2020-5902^[5] (CVSS score: 9.8) – F5
  BIG-IP remote code execution vulnerability
• CVE-2020-15505^[6] (CVSS score: 9.8) –
  MobileIron Core & Connector remote code execution
  vulnerability
• CVE-2020-0688^[7] (CVSS score: 8.8) –
  Microsoft Exchange memory corruption vulnerability
• CVE-2019-3396^[8] (CVSS score: 9.8) –
  Atlassian Confluence Server remote code execution
  vulnerability
• CVE-2017-11882^[9] (CVSS score: 7.8) –
  Microsoft Office memory corruption vulnerability
• CVE-2019-11580^[10] (CVSS score: 9.8) –
  Atlassian Crowd and Crowd Data Center remote code execution
  vulnerability
• CVE-2018-7600^[11] (CVSS score: 9.8) –
  Drupal remote code execution vulnerability
• CVE-2019-18935^[12] (CVSS score: 9.8) –
  Telerik .NET deserialization vulnerability resulting in remote code
  execution
• CVE-2019-0604^[13] (CVSS score: 9.8) –
  Microsoft SharePoint remote code execution vulnerability
• CVE-2020-0787^[14] (CVSS score: 7.8) –
  Windows Background Intelligent Transfer Service (BITS) elevation of
  privilege vulnerability
• CVE-2020-1472^[15] (CVSS score: 10.0) –
  Windows Netlogon elevation of privilege^[16] vulnerability

The list of vulnerabilities that have come under active attack
thus far in 2021 are listed below –

• Microsoft Exchange Server^[17]: CVE-2021-26855^[18], CVE-2021-26857^[19], CVE-2021-26858^[20], and CVE-2021-27065^[21] (aka “ProxyLogon”)
• Pulse Secure: CVE-2021-22893, CVE-2021-22894, CVE-2021-22899, and CVE-2021-22900^{[22][23][24][25][26]}
• Accellion: CVE-2021-27101, CVE-2021-27102, CVE-2021-27103, and CVE-2021-27104^{[27][28][29][30][31]}
• VMware: CVE-2021-21985^[32][33]
• Fortinet: CVE-2018-13379, CVE-2020-12812, and CVE-2019-5591^[34][35][36]

The development also comes a week after MITRE published^[37] a list of top 25 “most
dangerous” software errors that could lead to serious
vulnerabilities that could be exploited by an adversary to take
control of an affected system, obtain sensitive information, or
cause a denial-of-service condition.

“The advisory […] puts the power in every organisation’s hands
to fix the most common vulnerabilities, such as unpatched VPN
gateway devices,” NCSC Director for Operations, Paul Chichester,
said^[38], while urging the need
to prioritize patching to minimize the risk of being exploited by
malicious actors.