2023 Top Routinely Exploited Vulnerabilities

Technical Details

Key Findings

In 2023, malicious cyber actors exploited more zero-day vulnerabilities to compromise enterprise networks compared to 2022, allowing them to conduct cyber operations against higher-priority targets. In 2023, the majority of the most frequently exploited vulnerabilities were initially exploited as a zero-day, which is an increase from 2022, when less than half of the top exploited vulnerabilities were exploited as a zero-day. 

Malicious cyber actors continue to have the most success exploiting vulnerabilities within two years after public disclosure of the vulnerability. The utility of these vulnerabilities declines over time as more systems are patched or replaced. Malicious cyber actors find less utility from zero-day exploits when international cybersecurity efforts reduce the lifespan of zero-day vulnerabilities.

Cybersecurity Efforts to Include

Implementing security-centered product development lifecycles. Software developers deploying patches to fix software vulnerabilities is often a lengthy and expensive process, particularly for zero-days. The use of more robust testing environments and implementing threat modeling throughout the product development lifecycle will likely reduce overall product vulnerabilities.

Increasing incentives for responsible vulnerability disclosure. Global efforts to reduce barriers to responsible vulnerability disclosure could restrict the utility of zero-day exploits used by malicious cyber actors. For example, instituting vulnerability reporting bug bounty programs that allow researchers to receive compensation and recognition for their contributions to vulnerability research may boost disclosures.

Using sophisticated endpoint detection and response (EDR) tools. End users leveraging EDR solutions may improve the detection rate of zero-day exploits. Most zero-day exploits, including at least three of the top 15 vulnerabilities from last year, have been discovered when an end user or EDR system reports suspicious activity or unusual device malfunctions.

Top Routinely Exploited Vulnerabilities

Listed in Table 1 are the top 15 vulnerabilities the authoring agencies observed malicious cyber actors routinely exploiting in 2023 with details also discussed below.

• : This vulnerability affects Citrix NetScaler ADC and NetScaler Gateway.
  
  
  
  • Allows session token leakage; a proof-of-concept for this exploit was revealed in October 2023.
  
  
  
  


• : This vulnerability affects Cisco IOS XE, following activity from CVE-2023-20198.
  
  
  
  • Allows privilege escalation, once a local user has been created, to root privileges.
  
  
  
  


• : This vulnerability affects Progress MOVEit Transfer.
  
  
  
  • Allows abuse of an SQL injection vulnerability to obtain a sysadmin API access token.
  
  
  • Allows a malicious cyber actor to obtain remote code execution via this access by abusing a deserialization call.
  
  
  
  


• : This vulnerability, known as Log4Shell, affects Apache’s Log4j library, an open source logging framework incorporated into thousands of products worldwide.
  
  
  
  •  Allows the execution of arbitrary code.
    
    
    
    • An actor can exploit this vulnerability by submitting a specially crafted request to a vulnerable system, causing the execution of arbitrary code.
    
    
    • The request allows a cyber actor to take full control of a system.
    
    
    • The actor can then steal information, launch ransomware, or conduct other malicious activity.
    
    
    • Malicious cyber actors began exploiting the vulnerability after it was publicly disclosed in December 2021.
    
    
    
    
  
  
  
  


• : This is an unauthenticated remote code execution vulnerability that affects multiple products using Zoho ManageEngine.
  
  
  
  • Allows an unauthenticated user to execute arbitrary code by providing a crafted samlResponse XML to the ServiceDesk Plus SAML endpoint.
  
  
  
  


• : This vulnerability affects Microsoft Netlogon.
  
  
  
  • Allows privilege escalation.
    
    
    
    • An unauthorized user may use non-default configurations to establish a vulnerable Netlogon secure channel connection to a domain controller by using the Netlogon Remote Protocol.
      Note: This CVE has been included in top routinely exploited vulnerabilities lists since 2021.
    
    
    
    
  
  
  
  


• : This vulnerability affects Microsoft Office Outlook.
  
  
  
  • Allows elevation of privilege.
    
    
    
    • A threat actor can send a specially crafted email that the Outlook client will automatically trigger when Outlook processes it.
    
    
    • This exploit occurs even without user interaction.
    
    
    
    
  
  
  
  


• 
  Citrix
  
  

  NetScaler ADC 

  
  

  NetScaler Gateway

  
  
  Code Injection
  
  Citrix
  
  

  NetScaler ADC 

  
  

  NetScaler Gateway

  
  
  Buffer Overflow
  
  Cisco
  IOS XE Web UI
  Privilege Escalation
  
  Cisco
  IOS XE
  Web UI Command Injection
  
  Fortinet
  
  

  FortiOS 

  
  

  FortiProxy SSL-VPN

  
  
  Heap-Based Buffer Overflow
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  

  
  Barracuda Networks
  ESG Appliance
  Improper Input Validation
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  

  
  

  
  ownCloud
  graphapi
  Information Disclosure
  
  Atlassian 
  Confluence Data Center and Server 
  Improper Authorization
  
  Novi
  Novi Survey
  Insecure Deserialization
   
  FatPipe 
  WARP, IPVPN, and MPVPN 
  Configuration Upload Exploit
   
  Zoho 
  ManageEngine ADSelfService Plus 
  Authentication Bypass
  
  Fortra 
  GoAnywhere MFT 
  RCE
  
  F5 
  BIG-IP and BIG-IQ Centralized Management iControl REST 
  RCE
  
  Microsoft 
  Remote Desktop Services
  RCE
  
  Fortinet 
  FortiOS SSL VPN 
  Path Traversal
   
  Netwrix 
  Auditor 
  Insecure Object Deserialization
   
  Ivanti 
  Endpoint Manager Mobile 
  Authentication Bypass
   
  Ivanti 
  Endpoint Manager Mobile (EPMM) 
  Path Traversal
   
  N/A
  HTTP/2 
  Rapid Reset Attack
  
  Juniper
  Junos OS EX Series PHP 
  External Variable Modification
  
  Juniper 
  Junos OS EX Series and SRX Series PHP 
  External Variable Modification
  
  Juniper 
  Junos OS SRX Series
  Missing Authentication for Critical Function
  
  Juniper 
  Junos OS EX Series 
  Missing Authentication for Critical Function
   
  Apple
  iOS, iPadOS, and macOS ImageIO
  Buffer Overflow
  
  Apple
  Apple iOS, iPadOS, and watchOS Wallet 
  Code Execution
  
  GitLab 
  Community and Enterprise Editions 
  RCE
  
  Ivanti
  Pulse Connect Secure 
  Arbitrary File Read
  
  Unitronics 
  Vision PLC and HMI
  Insecure Default Password
  
  
  
  
  
  
  
  
  

  
  

  
  Atlassian 
  Confluence Server and Data Center 
  Object-Graph Navigation Language (OGNL) Injection
  
  Dahua
  Various products
  Authentication Bypass
  
  Dahua
  Various products
  Authentication Bypass
  
  Sophos 
  Firewall
  Code Injection
  
  Atlassian
  Confluence Server and Data Center 
  RCE
  
  Microsoft
  Exchange Server
  Server-Side Request Forgery
  
  RARLAB
  WinRAR
  Code Execution