{"id":5763,"date":"2021-07-30T17:23:27","date_gmt":"2021-07-30T17:23:27","guid":{"rendered":"https:\/\/blog.gridinsoft.com\/?p=5763"},"modified":"2021-07-30T17:23:27","modified_gmt":"2021-07-30T17:23:27","slug":"most-attacked-vulnerabilities-in-2020-2021","status":"publish","type":"post","link":"https:\/\/gridinsoft.com\/blogs\/most-attacked-vulnerabilities-in-2020-2021\/","title":{"rendered":"Experts published a list of the most attacked vulnerabilities in 2020-2021"},"content":{"rendered":"<h4>Experts from the FBI, the US Department of Homeland Security (DHS CISA), the Australian Cybersecurity Center (ACSC), and the UK National Cybersecurity Center (NCSC) have published <a href=\"https:\/\/us-cert.cisa.gov\/ncas\/alerts\/aa21-209a\" rel=\"noopener nofollow\" target=\"_blank\">joint security advisories<\/a> that list the most attacked and most popular vulnerabilities among criminals in 2020 and 2021.<\/h4>\n<div class=\"su-quote su-quote-style-default su-quote-has-cite\"><div class=\"su-quote-inner su-u-clearfix su-u-trim\">Cybercriminals continue to exploit well-known, often old, software vulnerabilities against a wide range of targets, including organizations in the public and private sectors around the world.<span class=\"su-quote-cite\">the experts write.<\/span><\/div><\/div>\n<p>Based on data collected by the US government, most of the attacked vulnerabilities were discovered after early 2020, and many of the bugs are clearly related to the widespread transition to remote work. As a result, the four vulnerabilities most commonly exploited in 2020 were related to remote work, VPN and cloud services.<\/p>\n<p><a href=\"\/blogs\/wp-content\/uploads\/2021\/07\/bugs.png\"><img loading=\"lazy\" loading=\"lazy\" decoding=\"async\" src=\"\/blogs\/wp-content\/uploads\/2021\/07\/bugs.png\" alt=\"most attacked vulnerabilities\" width=\"883\" height=\"541\" class=\"alignnone size-full wp-image-5764\" title=\"\" srcset=\"https:\/\/gridinsoft.com\/blogs\/wp-content\/uploads\/2021\/07\/bugs.png 883w, https:\/\/gridinsoft.com\/blogs\/wp-content\/uploads\/2021\/07\/bugs-300x184.png 300w, https:\/\/gridinsoft.com\/blogs\/wp-content\/uploads\/2021\/07\/bugs-768x471.png 768w\" sizes=\"auto, (max-width: 883px) 100vw, 883px\" \/><\/a><\/p>\n<div class=\"su-quote su-quote-style-default su-quote-has-cite\"><div class=\"su-quote-inner su-u-clearfix su-u-trim\">In 2021, attackers continued to target vulnerabilities in perimeter devices. Among the vulnerabilities that were actively exploited in 2021 were problems in Microsoft products, Pulse, Accellion, VMware and Fortinet.<span class=\"su-quote-cite\"><a href=\"https:\/\/us-cert.cisa.gov\/ncas\/alerts\/aa21-209a\" target=\"_blank\" rel=\"nofollow noopener\">law enforcement officials say<\/a><\/span><\/div><\/div>\n<p>As a result, the list of the most &#8220;popular&#8221; bugs of 2021 looks like this:<\/p>\n<ul>\n<li><strong>Microsoft Exchange Server:<\/strong> CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 (<a href=\"\/blogs\/tag\/proxylogon\/\">ProxyLogon<\/a> vulnerabilities);<\/li>\n<li><strong>Pulse Secure:<\/strong> CVE-2021-22893, CVE-2021-22894, CVE-2021-22899 and CVE-2021-22900;<\/li>\n<li><strong>Accellion:<\/strong> CVE-2021-27101, CVE-2021-27102, CVE-2021-27103 and CVE-2021-27104;<\/li>\n<li><strong>VMware:<\/strong> CVE-2021-21985;<\/li>\n<li><strong>Fortinet:<\/strong> CVE-2018-13379, CVE-2020-12812, and CVE-2019-5591.<\/li>\n<\/ul>\n<div class=\"su-quote su-quote-style-default su-quote-has-cite\"><div class=\"su-quote-inner su-u-clearfix su-u-trim\">CISA, ACSC, NCSC and FBI believe that public and private organizations around the world remain vulnerable to compromise as a result of the exploitation of the listed CVEs. Attackers are likely to continue to exploit old and known vulnerabilities (such as CVE-2017-11882 affecting Microsoft Office) as long as they remain effective and systems do not receive patches. Attackers&#8217; exploitation of known vulnerabilities complicates the attribution of attacks, lowers costs and minimizes risks, since [hackers] do not invest in developing 0-day exploits for their own use, which they risk losing if they become known, \u201d <span class=\"su-quote-cite\">the experts conclude.<\/span><\/div><\/div>\n<p>Let me remind you that I also wrote that the <a href=\"\/blogs\/fbi-and-nsa-about-russian-hackers\/\">FBI and NSA release a statement about attacks by Russian hackers<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Experts from the FBI, the US Department of Homeland Security (DHS CISA), the Australian Cybersecurity Center (ACSC), and the UK National Cybersecurity Center (NCSC) have published joint security advisories that list the most attacked and most popular vulnerabilities among criminals in 2020 and 2021. Based on data collected by the US government, most of the [&hellip;]<\/p>\n","protected":false},"author":3,"featured_media":5766,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"content-type":"","_sitemap_exclude":false,"_sitemap_priority":"","_sitemap_frequency":"","footnotes":""},"categories":[15],"tags":[123,177,350,275,362],"class_list":{"0":"post-5763","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-security-news","8":"tag-fbi","9":"tag-microsoft-exchange-server","10":"tag-proxylogon","11":"tag-pulse-secure","12":"tag-vulnerabilities"},"featured_image_src":"https:\/\/gridinsoft.com\/blogs\/wp-content\/uploads\/2021\/07\/top_bugs.jpg","author_info":{"display_name":"Vladimir Krasnogolovy","author_link":"https:\/\/gridinsoft.com\/blogs\/author\/krasnogolovy\/"},"_links":{"self":[{"href":"https:\/\/gridinsoft.com\/blogs\/wp-json\/wp\/v2\/posts\/5763","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/gridinsoft.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/gridinsoft.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/gridinsoft.com\/blogs\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/gridinsoft.com\/blogs\/wp-json\/wp\/v2\/comments?post=5763"}],"version-history":[{"count":0,"href":"https:\/\/gridinsoft.com\/blogs\/wp-json\/wp\/v2\/posts\/5763\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/gridinsoft.com\/blogs\/wp-json\/wp\/v2\/media\/5766"}],"wp:attachment":[{"href":"https:\/\/gridinsoft.com\/blogs\/wp-json\/wp\/v2\/media?parent=5763"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/gridinsoft.com\/blogs\/wp-json\/wp\/v2\/categories?post=5763"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/gridinsoft.com\/blogs\/wp-json\/wp\/v2\/tags?post=5763"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}