An international group composed of the U.S. Cybersecurity and Infrastructure Security Agency, U.S. Federal Bureau of Investigations, the Australian Cyber Security Center and the U.K.’s National Cyber Security Centre co-authored a new “Joint Cybersecurity Advisory” report, documenting the top 30 vulnerabilities in 2020 and 2021.
This document looks primarily at common vulnerabilities and exposures (CVEs) exploited by “malicious” cyber-actors.
“Cyber actor exploitation of more recently disclosed software flaws in 2020 probably stems, in part, from the expansion of remote work options amid the COVID-19 pandemic,” the group noted. “The rapid shift and increased use of remote work options, such as virtual private networks (VPNs) and cloud-based environments, likely placed additional burden on cyber defenders struggling to maintain and keep pace with routine software patching.”
The most-routinely exploited CVEs in 2020 included Citrix (arbitrary code execution), Pulse (arbitrary file reading), Fortinet (path traversal), F5- Big IP (remote code execution) and Microsoft (remote code execution and escalation of privilege), among others.
