The US’s Cybersecurity and Infrastructure Security Agency (CISA), Australia’s Cyber Security Centre (ACSC), and the UK’s National Cyber Security Centre (NCSC), and the US FBI recently released an advisory detailing the top 30 most exploited vulnerabilities dating back to 2017. After seven months of 2021, the agencies found that CVE-2017-11882, a stack buffer overflow in the equation editor of Microsoft Office that can lead to remote code execution, was the most exploited vulnerability. Despite the date, the vulnerability has been actively exploited for years. The agencies stated that the easiest way to mitigate the risks of the vulnerability and the 29 others listed would be to patch systems immediately and upgrade software.
The advisory states that threat actors continue to exploit publicly known and often outdated software vulnerabilities against broad targets sets, assuming that at least a few will not have implemented the released fixes. The attacks are targeting the public and private sector organizations across the world. Malicious attackers will likely keep using these vulnerabilities despite their timeline as they complicate attribution, reduce costs, and minimize risks.
Read More: Get patching: US, UK, and Australia issue joint advisory on top 30 exploited vulnerabilities
