This Joint Cybersecurity Advisory was coauthored by the U.S. Cybersecurity and Infrastructure Security Agency (CISA), the Australian Cyber Security Centre (ACSC), the United Kingdom's National Cyber Security Centre (NCSC), and the U.S. Federal Bureau of Investigation (FBI).
This advisory provides details on the top 30 vulnerabilities—primarily Common Vulnerabilities and Exposures (CVEs)—routinely exploited by malicious cyber actors in 2020 and those being widely exploited thus far in 2021.
Cyber actors continue to exploit publicly known—and often dated—software vulnerabilities against broad target sets, including public and private sector organizations worldwide. However, entities worldwide can mitigate the vulnerabilities listed in this report by applying the available patches to their systems and implementing a centralized patch management system.
Click here for a PDF version of this report.
In 2020, cyber actors readily exploited recently disclosed vulnerabilities to compromise unpatched systems. Based on available data to the U.S. Government, a majority of the top vulnerabilities targeted in 2020 were disclosed during the past two years. Cyber actor exploitation of more recently disclosed software flaws in 2020 probably stems, in part, from the expansion of remote work options amid the COVID-19 pandemic. The rapid shift and increased use of remote work options, such as virtual private networks (VPNs) and cloud-based environments, likely placed additional burden on cyber defenders struggling to maintain and keep pace with routine software patching.
Four of the most targeted vulnerabilities in 2020 affected remote work, VPNs, or cloud-based technologies. Many VPN gateway devices remained unpatched during 2020, with the growth of remote work options challenging the ability of organizations to conduct rigorous patch management.
CISA, ACSC, the NCSC, and FBI consider the vulnerabilities listed in table 1 to be the topmost regularly exploited CVEs by cyber actors during 2020.
Table 1:Top Routinely Exploited CVEs in 2020
Vendor | CVE | Type |
|---|---|---|
Citrix | CVE-2019-19781 | arbitrary code execution |
Pulse | CVE 2019-11510 | arbitrary file reading |
Fortinet | CVE 2018-13379 | path traversal |
F5- Big IP | CVE 2020-5902 | remote code execution (RCE) |
MobileIron | CVE 2020-15505 | RCE |
Microsoft | CVE-2017-11882 | RCE |
Atlassian | CVE-2019-11580 | RCE |
Drupal | CVE-2018-7600 | RCE |
Telerik | CVE 2019-18935 | RCE |
Microsoft | CVE-2019-0604 | RCE |
Microsoft | CVE-2020-0787 | elevation of privilege |
Netlogon | CVE-2020-1472 | elevation of privilege |
In 2021, malicious cyber actors continued to target vulnerabilities in perimeter-type devices. Among those highly exploited in 2021 are vulnerabilities in Microsoft, Pulse, Accellion, VMware, and Fortinet.
CISA, ACSC, the NCSC, and FBI assess that public and private organizations worldwide remain vulnerable to compromise from the exploitation of these CVEs. Malicious cyber actors will most likely continue to use older known vulnerabilities, such as CVE-2017-11882 affecting Microsoft Office, as long as they remain effective and systems remain unpatched. Adversaries' use of known vulnerabilities complicates attribution, reduces costs, and minimizes risk because they are not investing in developing a zero-day exploit for their exclusive use, which they risk losing if it becomes known.
Organizations are encouraged to remediate or mitigate vulnerabilities as quickly as possible to reduce the risk of exploitation. Most can be remediated by patching and updating systems. Organizations that have not remediated these vulnerabilities should investigate for the presence of IOCs and, if compromised, initiate incident response and recovery plans. See the Contact Information section below for how to reach CISA to report an incident or request technical assistance.
CISA, ACSC, the NCSC, and FBI have identified the following as the topmost exploited vulnerabilities by malicious cyber actors from 2020: CVE-2019-19781, CVE-2019-11510, CVE-2018-13379, CVE-2020-5902, CVE-2020-15505, CVE-2020-0688, CVE-2019-3396, CVE-2017-11882, CVE-2019-11580, CVE-2018-7600, CVE 2019-18935, CVE-2019-0604, CVE-2020-0787, CVE-2020-1472.[1][2][3] Among these vulnerabilities, CVE-2019-19781 was the most exploited flaw in 2020, according to U.S. Government technical analysis.CVE-2019-19781 is a recently disclosed critical vulnerability in Citrix's Application Delivery Controller (ADC)—a load balancing application for web, application, and database servers widely use throughout the United States.[4][5] Nation-state and criminal cyber actors most likely favor using this vulnerability because it is easy to exploit, Citrix servers are widespread, and exploitation enables the actors to perform unauthorized RCE on a target system.[6]
Identified as emerging targets in early 2020,[7] unremediated instances of CVE-2019-19781 and CVE-2019-11510 continued to be exploited throughout the year by nation-state advanced persistent threat actors (APTs) who leveraged these and other vulnerabilities, such as CVE-2018-13379[8][9], in VPN services[10][11] to compromise an array of organizations, including those involved in COVID-19 vaccine development.[12][13]
The CVE-2019-11510 vulnerability in Pulse Connect Secure VPN was also frequently targeted by nation-state APTs. Actors can exploit the vulnerability to steal the unencrypted credentials for all users on a compromised Pulse VPN server and retain unauthorized credentials for all users on a compromised Pulse VPN server and can retain unauthorize access after the system is patched unless all compromised credentials are changed. Nation-state APTs also commonly exploited CVE-2020-15505 and CVE-2020-5902.[14][15][16][17]
In 2021, cyber actors continued to target vulnerabilities in perimeter-type devices. In addition to the 2020 CVEs listed above, organizations should prioritize patching for the following CVEs known to be exploited.
One of the most effective best practices to mitigate many vulnerabilities is to update software versions once patches are available and as soon as is practicable. If this is not possible, consider applying temporary workarounds or other mitigations, if provided by the vendor. If an organization is unable to update all software shortly after a patch is released, prioritize implementing patches for CVEs that are already known to be exploited or that would be accessible to the largest number of potential attackers (such as internet-facing systems). This advisory highlights vulnerabilities that should be considered as part of the prioritization process. To further assist remediation, automatic software updates should be enabled whenever possible.
Focusing scarce cyber defense resources on patching those vulnerabilities that cyber actors most often use offers the potential of bolstering network security while impeding our adversaries' operations. For example, nation-state APTs in 2020 extensively relied on a single RCE vulnerability discovered in the Atlassian Crow, a centralized identity management and application (CVE-2019-11580) in its reported operations. A concerted focus on patching this vulnerability could have a relative broad impact by forcing the actors to find alternatives, which may not have the same broad applicability to their target set.
Additionally, attackers commonly exploit weak authentication processes, particularly in external-facing devices. Organizations should require multi-factor authentication to remotely access networks from external sources, especially for administrator or privileged accounts.
Tables 2–14 provide more details about, and specific mitigations for, each of the top exploited CVEs in 2020.
Note: The lists of associated malware corresponding to each CVE below are not meant to be exhaustive but intended to identify a malware family commonly associated with exploiting the CVE.
Table 2: CVE-2019-19781 Vulnerability Details
Citrix Netscaler Directory Traversal (CVE-2019-19781) | |
|---|---|
Vulnerability Description | CVSS 3.02 Critical |
Vulnerability Discussion, IOCs, and Malware Campaigns The lack of adequate access controls allows an attacker to enumerate system directories for vulnerable code (directory traversal). In this instance, Citrix ADC maintains a vulnerable Perl script ( Multiple malware campaigns, including NOTROBIN, have taken advantage of this vulnerability. | Fix |
Recommended Mitigations
| |
Detection Methods
| |
Vulnerable Technologies and Versions | |
References and Additional Guidance
| |
Table 3: CVE 2019-11510 Vulnerability Details
| Pulse Secure Connect VPN (CVE 2019-11510) | |
|---|---|
Vulnerability Description | CVSS 3.0 Critical |
Vulnerability Discussion, IOCs, and Malware Campaigns Multiple malware campaigns have taken advantage of this vulnerability, most notably REvil/Sodinokibi ransomware. | Fix |
Recommended Mitigations
| |
Detection Methods
| |
Vulnerable Technologies and Versions | |
References
| |
Table 4: CVE 2018-13379 Vulnerability Details
| Fortinet FortioOS Secure Socket Layer VPN (CVE 2018-13379) | |
|---|---|
Vulnerability Description | CVSS 3.0 Critical |
Vulnerability Discussion, IOCs, and Malware Campaigns Multiple malware campaigns have taken advantage of this vulnerability. The most notable being Cring ransomware (also known as Crypt3, Ghost, Phantom, and Vjszy1lo). | Fix |
Recommended Mitigations
| |
Detection Methods
| |
Vulnerable Technologies and Versions | |
References
| |
Table 5: CVE-2020-5902 Vulnerability Details
| F5 Big IP Traffic Management User Interface (CVE-2020-5902) | |
|---|---|
Vulnerability Description | CVSS 3.0 |
Vulnerability Discussion, IOCs, and Malware Campaigns | Fix Upgrade to Secure Versions Available |
Recommended Mitigations
| |
Detection Methods
| |
Vulnerable Technologies and Versions | |
References
| |
Table 6: CVE-2020-15505 Vulnerability Details
| MobileIron Core & Connector (CVE-2020-15505) | |
Vulnerability Description MobileIron Core & Connector, Sentry, and Monitoring and Reporting Database (RDB) software are vulnerable to RCE via unspecified vectors. | CVSS 3.0 Critical |
Vulnerability Discussion, IOCs, and Malware Campaigns CVE-2020-15505 is an RCE vulnerability in MobileIron Core & Connector versions 10.3 and earlier. This vulnerability allows an external attacker, with no privileges, to execute code of their choice on the vulnerable system. As mobile device management (MDM) systems are critical to configuration management for external devices, they are usually highly permissioned and make a valuable target for threat actors. Multiple APTs have been observed exploiting this vulnerability to gain unauthorized access. | Fix |
Recommended Mitigations
| |
Detection Methods
| |
Vulnerable Technologies and Versions MobileIron Core & Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1, 10.4.0.2, 10.4.0.3, 10.5.1.0, 10.5.2.0, and 10.6.0.0; Sentry versions 9.7.2 and earlier and 9.8.0; and Monitor and Reporting Database (RDB) version 2.0.0.1 and earlier are vulnerable. | |
References
| |
Table 7: CVE-2020-0688 Vulnerability Details
| Microsoft Exchange Memory Corruption (CVE-2020-0688) | |
Vulnerability Description An RCE vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory. | CVSS 3.0 High |
Vulnerability Discussion, IOCs, and Malware Campaigns A nation-state APT actor has been observed exploiting this vulnerability to conduct widespread, distributed, and anonymized brute force access attempts against hundreds of government and private sector targets worldwide. | Fix |
Recommended Mitigations
| |
Detection Methods
| |
Vulnerable Technologies and Versions Microsoft Exchange Server 2019 Cumulative Update 3 and 4, 2016 Cumulative Update 14 and 15, 2013 Cumulative Update 23, and 2010 Service Pack 3 Update Rollup 30 are vulnerable. | |
References
| |
Table 8: CVE-2019-3396 Vulnerability Details
| Microsoft Office Memory Corruption (CVE 2017-11882) | |
Vulnerability Description Atlassian Confluence Server and Data Center Widget Connector is vulnerable to a server-side template injection attack. | CVSS Critical |
Vulnerability Discussion, IOCs, and Malware Campaigns Confluence Server and Data Center versions released before June 18, 2018, are vulnerable to this issue. A remote attacker is able to exploit a server-side request forgery (SSRF) vulnerability in the WebDAV plugin to send arbitrary HTTP and WebDAV requests from a Confluence Server or Data Center instance. A successful attack is able to exploit this issue to achieve server-side template injection, path traversal, and RCE on vulnerable systems. Multiple malware campaigns have taken advantage of this vulnerability; the most notable being GandCrab ransomware. | Fix |
Recommended Mitigations
| |
Detection Methods
| |
Vulnerable Technologies and Versions All versions of Confluence Server and Confluence Data Center before version 6.6.12, from version 6.7.0 before 6.12.3 (the fixed version for 6.12.x), from version 6.13.0 before 6.13.3 (the fixed version for 6.13.x), and from version 6.14.0 before 6.14.2 (the fixed version for 6.14.x) are vulnerable. | |
References
| |
Table 9: CVE 2017-11882 Vulnerability Details
| Microsoft Office Memory Corruption (CVE 2017-11882) | |
Vulnerability Description Microsoft Office is prone to a memory corruption vulnerability allowing an attacker to run arbitrary code, in the context of the current user, by failing to properly handle objects in memory. It is also known as the "Microsoft Office Memory Corruption Vulnerability." Cyber actors continued to exploit this four-year-old vulnerability in Microsoft Office that the U.S. Government publicly assessed last year was the most frequently targeted. Cyber actors most likely continue to exploit this vulnerability because Microsoft Office use is ubiquitous worldwide, the vulnerability is ideal for phasing campaigns, and it enables RCE on vulnerable systems. | CVSS 3.0 High |
Vulnerability Discussion, IOCs, and Malware Campaigns Microsoft Equation Editor, a component of Microsoft Office, contains a stack buffer overflow vulnerability that enables RCE on a vulnerable system. The component was compiled on November 9, 2000. Without any further recompilation, it was used in all currently supported versions of Microsoft Office. Microsoft Equation Editor is an out-of-process COM server that is hosted by Data execution prevention (DEP) and address space layout randomization (ASLR) should protect against such attacks. However, because of the manner in which Multiple cyber espionage campaigns have taken advantage of this vulnerability. CISA has noted CVE-2017-11882 being exploited to deliver LokiBot malware. | Fix |
Recommended Mitigations
| |
Detection Methods
| |
Vulnerable Technologies and Versions
| |
References
| |
Table 10: CVE 2019-11580 Vulnerability Details
| Atlassian Crowd and Crowd Data Center Remote Code Execution (CVE 2019-11580) | |
Vulnerability Description Atlassian Crowd and Crowd Data Center had the | CVSS 3.0 Critical |
Vulnerability Discussion, IOCs, and Malware Campaigns Attackers who can send unauthenticated or authenticated requests to a Crowd or Crowd Data Center instance can exploit this vulnerability to install arbitrary plugins, which permits RCE on systems running a vulnerable version of Crowd or Crowd Data Center. | Fix |
Recommended Mitigations
| |
Detection Methods
| |
Vulnerable Technologies and Versions All versions of Crowd from version 2.1.0 before 3.0.5 (the fixed version for 3.0.x), from version 3.1.0 before 3.1.6 (the fixed version for 3.1.x), from version 3.2.0 before 3.2.8 (the fixed version for 3.2.x), from version 3.3.0 before 3.3.5 (the fixed version for 3.3.x), and from version 3.4.0 before 3.4.4 (the fixed version for 3.4.x) are affected by this vulnerability. | |
References
| |
Table 11: CVE 2018-7600 Vulnerability Details
| Drupal Core Multiple Remote Code Execution (CVE 2018-7600) | |
Vulnerability Description Drupal versions before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allow remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations. | CVSS 3.0 Critical |
Vulnerability Discussion, IOCs, and Malware Campaigns An RCE vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being completely compromised. Failed exploit attempts may result in a denial-of-service condition. A remote user can send specially crafted data to trigger a flaw in the processing of renderable arrays in the Form Application Programming Interface, or API, and cause the target system to render the user-supplied data and execute arbitrary code on the target system. Malware campaigns include the Muhstik botnet and XMRig Monero Cryptocurrency mining. | Fix |
Recommended Mitigations
| |
Detection Methods
| |
Vulnerable Technologies and Versions | |