CISA: Top Exploited Vulnerabilities 2021

CISA has published the list of 2021’s top 15 most exploited software vulnerabilities. This joint Cybersecurity Advisory (CSA) was co-authored by cybersecurity agencies of the United States, Australia, Canada, New Zealand, and the United Kingdom: The Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), Federal Bureau of Investigation (FBI), Australian Cyber Security Centre (ACSC), Canadian Centre for Cyber Security (CCCS), New Zealand National Cyber Security Centre (NZ NCSC), and United Kingdom’s National Cyber Security Centre (NCSC-UK). This advisory also includes other frequently exploited vulnerabilities.

Globally, in 2021, malicious cyber actors targeted internet-facing systems, such as email servers and virtual private network (VPN) servers, with exploits of newly disclosed vulnerabilities. For most of the top exploited vulnerabilities, researchers or other actors released proof of concept (POC) code within two weeks of the vulnerability’s disclosure, likely facilitating exploitation by a broader range of malicious actors.

CISA Statement

The list includes CVE-2021-21972 affecting VMware vSphere Client, CVE-2021-26084 in Atlassian Confluence, CVE-2021-40539 in Zoho ManageEngine AD SelfService Plus, CVE-2018-13379 in Fortinet FortiOS and FortiProxy, CVE-2019-11510 in Pulse Secure Pulse Connect Secure CVE-2019-11510), Log4Shell, ProxyLogon ProxyShell, and ZeroLogon.

In addition to the 15 vulnerabilities listed above table, U.S., Australian, Canadian, New Zealand, and UK cybersecurity authorities identified vulnerabilities listed below, that were also routinely exploited by malicious cyber actors in 2021.

2021 Top Exploits

These vulnerabilities include multiple vulnerabilities affecting internet-facing systems, including Accellion File Transfer Appliance (FTA), Windows Print Spooler, and Pulse Secure Pulse Connect Secure. Three of these vulnerabilities were also routinely exploited in 2020: CVE-2019-19781, CVE-2019-18935, and CVE-2017-11882.

Vulnerability management, Identity, and access management, and Proactive controls such as Network segmentation, application whitelisting, IAM, and EDR are suggested as mitigation controls.