Cybersecurity Agencies Reveal the Top Exploited Vulnerabilities of 2021

eSecurity Planet content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.

U.S. cybersecurity agencies joined their counterparts around the globe to urge organizations to address the top 15 vulnerabilities exploited in 2021.

Topping the list were the Log4Shell vulnerability and Microsoft bugs ProxyShell and ProxyLogon. Microsoft occupied more than half the list, with Exchange Server accounting for eight of the vulnerabilities. VMware, Atlassian, Pulse Secure and Fortinet rounded out the list.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA), NSA and FBI joined their “Five Eyes” counterparts in issuing the alert: the Australian Cyber Security Centre (ACSC), the Canadian Centre for Cyber Security (CCCS), the New Zealand National Cyber Security Centre (NZ NCSC), and the UK’s National Cyber Security Centre (NCSC UK).

The advisory entails the top 15 Common Vulnerabilities and Exposures (CVEs) that were routinely exploited by malicious cyber actors in 2021, plus another 21 frequently exploited CVEs. The cybersecurity authorities urged organizations to immediately apply timely patches to their systems and implement a centralized patch management system in order to reduce their attack surface.

Also read: Best Patch Management Software & Tools

Web-Facing Systems at Risk

Malicious actors tend to focus on internet-facing systems to gain entry into a network, such as email and virtual private network (VPN) servers, using exploits targeting newly disclosed vulnerabilities.

“U.S., Australian, Canadian, New Zealand, and UK cybersecurity authorities assess, in 2021, malicious cyber actors aggressively targeted newly disclosed critical software vulnerabilities against broad target sets, including public and private sector organizations worldwide,” said the advisory.

It could be because of the malicious actors and security researchers releasing proof of concept (POC) exploits within two weeks of the initial disclosure of most of the top exploited bugs in 2021. However, some of the attacks were focused on older vulnerabilities patched years before, indicating that some organizations fail to update their systems even if they detect a patch.

See the Top Secure Email Gateways

Top 15 Routinely Exploited Vulnerabilities

The table below shows the top 15 vulnerabilities observed by the US, Australian, Canadian, New Zealand, and UK cybersecurity authorities, linked to National Vulnerability Database entries and associated malware.

Other Routinely Exploited Vulnerabilities

In addition to the 15 vulnerabilities listed in the table above, the alert also listed 21 additional security vulnerabilities identified by the cybersecurity agencies that were routinely exploited by malicious cyber actors in 2021.

It includes multiple vulnerabilities that affect internet-facing systems, including Accellion File Transfer Appliance (FTA), Pulse Secure Pulse Connect Secure, and Windows Print Spooler. Three of these vulnerabilities — CVE-2019-19781, CVE-2019-18935, and CVE-2017-11882 — were also routinely exploited in 2020.

Mitigation Measures

The advisory also includes some mitigation measures to reduce the risk associated with the most abused flaws detailed above. It suggests that companies should use a centralized patch management system while regularly updating their software, applications, operating systems, and firmware on IT network assets. They should also enforce multifactor authentication (MFA) for all users, without exception, and must review, validate, or remove privileged accounts in a timely manner (annually at a minimum).

Read next: Best Privileged Access Management (PAM) Software