Cybersecurity agencies reveal top exploited vulnerabilities of 2021

By Sergiu Gatlan, Bleeping Computer

In partnership with the NSA and the FBI, cybersecurity authorities worldwide have released today a list of the top 15 vulnerabilities routinely exploited by threat actors during 2021.

The cybersecurity authorities urged organizations in a joint advisory to promptly patch these security flaws and implement patch management systems to reduce their attack surface.

Globally, malicious actors have been observed focusing their attacks on internet-facing systems, including email and virtual private network (VPN) servers, using exploits targeting newly disclosed vulnerabilities.

"U.S., Australian, Canadian, New Zealand, and UK cybersecurity authorities assess, in 2021, malicious cyber actors aggressively targeted newly disclosed critical software vulnerabilities against broad target sets, including public and private sector organizations worldwide," the advisory reads.

This might be due to malicious actors and security researchers releasing proof of concept (POC) exploits within two weeks since the initial disclosure for most of the top exploited bugs throughout 2021.

However, attackers focused some of their attacks on older vulnerabilities patched years before, which shows that some organizations fail to update their systems even when a patch is available.

The list of the top 15 most exploited security flaws is available below, with links to National Vulnerability Database entries and associated malware.