The top ten most-commonly exploited vulnerabilities revealed

Flaws in Microsoft’s OLE technology are at the heart of some of the most widely-used attacks since 2016

Data on screen, viewed by shadowy hacker

Vulnerabilities in a host of Microsoft applications including Office and Share Point are among the most commonly-exploited by cyber criminals, despite patches being widely available for these historical flaws. 

US security agencies have identified the ten most widely-exploited software vulnerabilities between 2016 and 2019, with a view to encouraging organisations to prioritise patching these systems over others. Many of these vulnerabilities are a few years old and have already been patched.

Advertisement - Article continues below

Beyond Microsoft products, Apache Struts, Adobe Flash Player and the open-source Drupal content management system (CMS) are also affected. 

The report, published by the Cybersecurity and Infrastructure Security Agency (CISA) wing of the Department of Homeland Security (DHS) and the FBI, details hacks carried out by state-backed groups and other cyber criminals.

The guidance has been published amid continued exploitation of known and historic software vulnerabilities against public and private sector organisations. It’s particularly alarming considering that exploiting these vulnerabilities often require fewer resources compared with zero-day exploits for which no patches are available.

Ramped up efforts to patch systems and implement programmes to keep routine patching in place would significantly disrupt foreign adversaries’ attempts to develop or acquire exploits, the agencies said.

The most widely-exploited vulnerabilities concern Microsoft’s Object Linking and Embedding (OLE) technology, which allows documents to contain embedded content from other applications, such as spreadsheets. Three attacks deployed most frequently by state-backed hackers from China, Iran, North Korea and Russia relate with OLE technology.

Advertisement - Article continues below
Advertisement - Article continues below

Chinese-backed cyber criminals were even exploiting the vulnerability dubbed CVE-2012-0158 as of December 2019, which found in a wide number of Microsoft products including Office 2003 and Visual Basic 6.0.

This flaw, incidentally, was assessed in 2015 as being the most used in the US government’s cyber operations. Its continued exploitation today suggests organisations haven’t yet widely-implemented patches for the vulnerability, with state-backed hackers continuing to incorporate dated flaws into their operations so long as they remain effective.

The second-most reported vulnerability was a widespread Web framework known as Apache Struts, dubbed CVE-2017-5638. For mitigation, users are encouraged to upgrade to Struts 2.3.32 or Struts

The full list of the top ten most-commonly exploited vulnerabilities between 2016 and 2019 as determined by US security agencies are outlined in the table below:

CVE CodeVulnerable ProductsAssociated MalwareMitigation
CVE-2017-11882 Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, 2016Loki, Formbook, Pony/FAREIT

Update affected products with the latest patches

CVE-2017-0199Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, 2016, Vista SP2, Server 2008 SP2, Windows 7 SP1, Windows 8.1FINSPY, LATENTBOT, Dridex

Update affected products with the latest patches

CVE-2017-5638Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before

Upgrade to Struts 2.3.32 or Struts


Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Office 2003 Web Components SP3; SQL Server 2000 SP4, 2005 SP4, and 2008 SP2, SP3, and R2; BizTalk Server 2002 SP1; Commerce Server 2002 SP4, 2007 SP2, and 2009 Gold and R2; Visual FoxPro 8.0 SP1 and 9.0 SP2; and Visual Basic 6.0


Update affected products with the latest patches

CVE-2019-0604Microsoft SharePointChina Chopper

Update affected products with the latest patches


Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016

Multiple using the EternalSynergy and EternalBlue Exploit Kit

Update affected products with the latest patches


Adobe Flash Player before


Update Adobe Flash Player installation to the latest version


Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7

FINSPY, FinFisher, WingBird

Update affected products with the latest security patches


Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word for Mac 2011, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2 and 2013 SP1, and Office Web Apps Server 2010 SP2 and 2013 SP1

Toshliph, UWarrior

Upate affected products with the latest security patches 

CVE-2018-7600Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1Kitty

Upgrade to the most recent version of Drupal 7 or 8 core

Featured Resources

The case for a marketing content hub

Transform your digital marketing to deliver customer expectations

Download now

Fast, flexible and compliant e-signatures for global businesses

Be at the forefront of digital transformation with electronic signatures

Download now

Why CEOS should care about the move to SAP S/4HANA

And how they can accelerate business value

Download now

IT faces new security challenges in the wake of COVID-19

Beat the crisis by learning how to secure your network

Download now

Most Popular

Microsoft Windows

Microsoft warns users not to install Windows 10's May update

28 May 2020
data breaches

EasyJet faces class-action lawsuit over data breach

26 May 2020
cyber security

Microsoft bans Trend Micro driver from Windows 10 for "cheating" hardware tests

27 May 2020