“Joint Cybersecurity Advisory” Report Details Largest CVE Exposures

An international group composed of the U.S. Cybersecurity and Infrastructure Security Agency, U.S. Federal Bureau of Investigations, the Australian Cyber Security Center and the U.K.’s National Cyber Security Centre co-authored a new “Joint Cybersecurity Advisory” report, documenting the top 30 vulnerabilities in 2020 and 2021.

This document looks primarily at common vulnerabilities and exposures (CVEs) exploited by “malicious” cyber-actors.

“Cyber actor exploitation of more recently disclosed software flaws in 2020 probably stems, in part, from the expansion of remote work options amid the COVID-19 pandemic,” the group noted. “The rapid shift and increased use of remote work options, such as virtual private networks (VPNs) and cloud-based environments, likely placed additional burden on cyber defenders struggling to maintain and keep pace with routine software patching.”

The most-routinely exploited CVEs in 2020 included Citrix (arbitrary code execution), Pulse (arbitrary file reading), Fortinet (path traversal), F5- Big IP (remote code execution) and Microsoft (remote code execution and escalation of privilege), among others.