AA23-215A: 2022’s Top Routinely Exploited Vulnerabilities

A joint Cybersecurity Advisory collaborated on by multiple international agencies highlights the top routinely exploited vulnerabilities of 2022

Background

On August 3, a joint Cybersecurity Advisory (CSA) AA23-215A coauthored by multiple U.S. and international agencies was released to highlight the top routinely exploited vulnerabilities of 2022. The list contains 42 Common Vulnerabilities and Exposures (CVEs) known to be exploited by malicious actors. The alert urges organizations to patch these known and exploitable vulnerabilities as soon as possible and provides some mitigation recommendations as well. For CVEs that remain unpatched, the CSA encourages organizations to begin investigating for indicators of compromise on unpatched devices.

As we’ve explored in our 2022 Threat Landscape Report (TLR), known and exploitable vulnerabilities remain one of the most persistent threats to organizations. Known vulnerabilities took the top spot in our list of the top five vulnerabilities of 2022 because of the prevalence with which attackers have successfully exploited these unpatched flaws. The joint CSA recognizes this as well, adding that these malicious attackers have targeted “older software vulnerabilities rather than recently disclosed vulnerabilities,” while also highlighting the significance of vulnerabilities in internet-facing systems.

Analysis

As we examined the list of 42 CVEs in the CSA, many have been featured in past blogs and alerts from Tenable Research as well as included in our 2020, 2021 and 2022 TLR. In the tables below, we have split up the vulnerabilities into sections based on vendor or product types.

Microsoft Exchange Server

Vulnerabilities in Microsoft Exchange Server, frequently leading to privilege escalation (elevation of privilege or EoP) or remote code execution (RCE), are particularly useful for initial access into targeted networks and have been leveraged by multiple unique ransomware groups/strains and numerous advanced persistent threat (APT) actors. In fact, CVE-2021-26855 (ProxyLogon) was the number one vulnerability in the top five vulnerabilities in our 2021 TLR while CVE-2021-34473 (ProxyShell) took fifth place in the 2022 TLR.

*Please note: Tenable’sVulnerability Priority Rating (VPR) scores are calculated nightly. This blog post was published on August 3 and reflects VPR at that time.

Microsoft Office

Vulnerabilities in Microsoft Office products are frequently used by threat actors to gain a foothold into a target network by attaching malicious documents to phishing or spear phishing emails. While CVE-2017-0199 and CVE-2017-11882 are some of the oldest vulnerabilities in the alert (discovered five years ago), attackers are still attempting to exploit them, as many organizations have not patched these flaws despite patches being available for years.

Additional Microsoft Vulnerabilities

The other Microsoft CVEs on this list includes some of the most well known “named” vulnerabilities in recent years. CVE-2020-1472 (ZeroLogon) was the number one vulnerability in the top five vulnerabilities in our 2020 TLR and it also took fifth place in our 2021 TLR. CVE-2019-0708 (BlueKeep) had an honorable mention in our 2020 TLR while CVE-2022-30190 (Follina) took the third spot in the top 5 vulnerabilities in our 2022 TLR.

Apache Products

The CSA features five CVEs in Apache products, three of which were in Apache HTTP Server while the remaining two were vulnerabilities in the now infamous Log4j 2 logging library. While there’s much to be said about Log4j, for brevity we recommend visiting the Tenable Log4j page to view the blogs and resources associated with Log4Shell and its related vulnerabilities.

SSL VPN Devices

Vulnerabilities impacting SSL VPN devices continue to have a major impact, as they are routinely exploited by APTs and ransomware gangs against organizations around the world. Three of the top five vulnerabilities in the 2020 TLR were in SSL VPN devices. Many of these vulnerabilities have been included in multiple U.S. and international government agency alerts over the years, and because these devices are internet facing and critical to business operations, they are an ideal doorway into organizations. Therefore, patching these devices should be a top priority for any organization.

Many of the remaining flaws in the CSA are found in internet-facing devices, which make them more susceptible to attack. Therefore, organizations that utilize these products in their networks should prioritize remediating vulnerabilities in these products:

SonicWall Products

Atlassian Confluence Server and Data Center

VMware Products

Oracle WebLogic Server

Additional Vendors and Products

Solution

For all of the 42 CVEs featured in this CSA, patches are available from each of the respective vendors and patching all of the CVEs should be prioritized. In some instances, the CSA offers mitigation guidance when patching cannot be immediately performed as well as mitigation guidance for vendors and developers including recommendations and resources on how to secure your networks.

We recommend all organizations review the CSA and we emphasize the importance of prioritizing patching of all the vulnerabilities listed.

Identifying affected systems

A list of Tenable plugins to identify these vulnerabilities can be found here. This link uses a search filter to ensure that all matching plugin coverage will appear as it is released.

In addition to these plugins, many of these vulnerabilities have been featured in our annual TLR report. Our 2022 TLR scan template can be utilized to scan for all the vulnerabilities featured in our 2022 report:

While not all of these vulnerabilities listed in the CSA can be found in the scan template, for more targeted scanning, we recommend configuring a custom scan policy and enabling plugins specific to the devices on your respective networks to quickly identify those assets that remain unpatched.

Get more information

Additional Tenable Blog Coverage

Join Tenable’s Security Response Team on the Tenable Community.

Learn more about Tenable One, the Exposure Management Platform for the modern attack surface.