Network Security Trends: Recent Exploits Observed in the Wild Include Remote Code Execution, Cross-Site Scripting and More
Summary: Unit 42 analyzed 93 million valid malicious sessions observed through Palo Alto Networks firewalls from February to April 2022, alongside 5,962 newly registered CVEs, of which 73.6% are remotely exploitable and almost 13.3% involve cross-site scripting. The exploits it highlights include remote code execution in VMware Workspace ONE Access and Identity Manager (CVE-2022-22954), Spring Cloud Function (CVE-2022-22963), Spring MVC and WebFlux (CVE-2022-22965), and Spring Cloud Gateway (CVE-2022-22947), plus SQL injection in VoIPmonitor GUI (CVE-2022-24260) and stored cross-site scripting in WordPress core (CVE-2022-21662).
Bottom line: Nearly three-quarters of the newly published vulnerabilities can be attacked over a network from anywhere, and the researchers note attackers frequently used flaws disclosed in 2021-22, so the patch window is the exposure window.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026