Top 20 Vulnerabilities Exploited by Cyber Attackers | Qualys
Summary: Qualys published a Top Twenty list of vulnerabilities targeted by threat actors, malware, and ransomware, drawn from sightings over recent years and the current year, with several entries also appearing in CISA's August 3, 2023 Joint Cybersecurity Advisory. The entries include CVE-2017-11882 in Microsoft Office's Equation Editor, exploited by 467 malware, 53 threat actors, and 14 ransomware and trending as recently as August 31, 2023, and Log4Shell (CVE-2021-44228), trending 77 times and exploited by 10 malware, 26 threat actors, and 5 ransomware as recently as September 4, 2023.
What you should know: These are not new flaws: CVE-2012-0158 and CVE-2012-1723 are still drawing exploitation more than a decade after disclosure, and Log4Shell alone is tied to 26 threat actors and 5 ransomware families. The list also notes CISA's time to add a vulnerability to its catalog is down to 8 days, which sets the pace your patching has to match.
Read the original at Qualys Blog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2012-0158CVE-2017-0199CVE-2017-11882CVE-2017-8570
- Related
- CVE-2017-8570: Microsoft Office Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Feb 25, 2022CVE-2017-0199: Microsoft Office and Word Pad Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021CVE-2017-11882: Microsoft Office Memory Corruption Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021