The top ten most-commonly exploited vulnerabilities revealed

Vulnerabilities in a host of Microsoft applications including Office and Share Point are among the most commonly-exploited by cyber criminals, despite patches being widely available for these historical flaws.

US security agencies have identified the ten most widely-exploited software vulnerabilities between 2016 and 2019, with a view to encouraging organisations to prioritise patching these systems over others. Many of these vulnerabilities are a few years old and have already been patched.

Beyond Microsoft products, Apache Struts, Adobe Flash Player and the open-source Drupal content management system (CMS) are also affected.

The report, published by the Cybersecurity and Infrastructure Security Agency (CISA) wing of the Department of Homeland Security (DHS) and the FBI, details hacks carried out by state-backed groups and other cyber criminals.

The guidance has been published amid continued exploitation of known and historic software vulnerabilities against public and private sector organisations. It’s particularly alarming considering that exploiting these vulnerabilities often require fewer resources compared with zero-day exploits for which no patches are available.

Ramped up efforts to patch systems and implement programmes to keep routine patching in place would significantly disrupt foreign adversaries’ attempts to develop or acquire exploits, the agencies said.

The most widely-exploited vulnerabilities concern Microsoft’s Object Linking and Embedding (OLE) technology, which allows documents to contain embedded content from other applications, such as spreadsheets. Three attacks deployed most frequently by state-backed hackers from China, Iran, North Korea and Russia relate with OLE technology.

Chinese-backed cyber criminals were even exploiting the vulnerability dubbed CVE-2012-0158 as of December 2019, which found in a wide number of Microsoft products including Office 2003 and Visual Basic 6.0.

This flaw, incidentally, was assessed in 2015 as being the most used in the US government’s cyber operations. Its continued exploitation today suggests organisations haven’t yet widely-implemented patches for the vulnerability, with state-backed hackers continuing to incorporate dated flaws into their operations so long as they remain effective.

The second-most reported vulnerability was a widespread Web framework known as Apache Struts, dubbed CVE-2017-5638. For mitigation, users are encouraged to upgrade to Struts 2.3.32 or Struts 2.5.10.1.

The full list of the top ten most-commonly exploited vulnerabilities between 2016 and 2019 as determined by US security agencies are outlined in the table below: