The top ten most-commonly exploited vulnerabilities revealed

Flaws in Microsoft’s OLE technology are at the heart of some of the most widely-used attacks since 2016

Vulnerabilities in a host of Microsoft applications including Office and Share Point are among the most commonly-exploited by cyber criminals, despite patches being widely available for these historical flaws. 

US security agencies have identified the ten most widely-exploited software vulnerabilities between 2016 and 2019, with a view to encouraging organisations to prioritise patching these systems over others. Many of these vulnerabilities are a few years old and have already been patched.

Beyond Microsoft products, Apache Struts, Adobe Flash Player and the open-source Drupal content management system (CMS) are also affected. 

The report, published by the Cybersecurity and Infrastructure Security Agency (CISA) wing of the Department of Homeland Security (DHS) and the FBI, details hacks carried out by state-backed groups and other cyber criminals.

The guidance has been published amid continued exploitation of known and historic software vulnerabilities against public and private sector organisations. It’s particularly alarming considering that exploiting these vulnerabilities often require fewer resources compared with zero-day exploits for which no patches are available.

Ramped up efforts to patch systems and implement programmes to keep routine patching in place would significantly disrupt foreign adversaries’ attempts to develop or acquire exploits, the agencies said.

The most widely-exploited vulnerabilities concern Microsoft’s Object Linking and Embedding (OLE) technology, which allows documents to contain embedded content from other applications, such as spreadsheets. Three attacks deployed most frequently by state-backed hackers from China, Iran, North Korea and Russia relate with OLE technology.

Chinese-backed cyber criminals were even exploiting the vulnerability dubbed CVE-2012-0158 as of December 2019, which found in a wide number of Microsoft products including Office 2003 and Visual Basic 6.0.

This flaw, incidentally, was assessed in 2015 as being the most used in the US government’s cyber operations. Its continued exploitation today suggests organisations haven’t yet widely-implemented patches for the vulnerability, with state-backed hackers continuing to incorporate dated flaws into their operations so long as they remain effective.

The second-most reported vulnerability was a widespread Web framework known as Apache Struts, dubbed CVE-2017-5638. For mitigation, users are encouraged to upgrade to Struts 2.3.32 or Struts 2.5.10.1.

The full list of the top ten most-commonly exploited vulnerabilities between 2016 and 2019 as determined by US security agencies are outlined in the table below:

CVE CodeVulnerable ProductsAssociated MalwareMitigation
CVE-2017-11882 Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, 2016Loki, Formbook, Pony/FAREIT

Update affected products with the latest patches

CVE-2017-0199Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, 2016, Vista SP2, Server 2008 SP2, Windows 7 SP1, Windows 8.1FINSPY, LATENTBOT, Dridex

Update affected products with the latest patches

CVE-2017-5638Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1JexBoss

Upgrade to Struts 2.3.32 or Struts 2.5.10.1

CVE-2012-0158

Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Office 2003 Web Components SP3; SQL Server 2000 SP4, 2005 SP4, and 2008 SP2, SP3, and R2; BizTalk Server 2002 SP1; Commerce Server 2002 SP4, 2007 SP2, and 2009 Gold and R2; Visual FoxPro 8.0 SP1 and 9.0 SP2; and Visual Basic 6.0

Dridex

Update affected products with the latest patches

CVE-2019-0604Microsoft SharePointChina Chopper

Update affected products with the latest patches

CVE-2017-0143

Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016

Multiple using the EternalSynergy and EternalBlue Exploit Kit

Update affected products with the latest patches

CVE-2018-4878

Adobe Flash Player before 28.0.0.161

DOGCALL

Update Adobe Flash Player installation to the latest version

CVE-2017-8759

Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7

FINSPY, FinFisher, WingBird

Update affected products with the latest security patches

CVE-2015-1641

Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word for Mac 2011, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2 and 2013 SP1, and Office Web Apps Server 2010 SP2 and 2013 SP1

Toshliph, UWarrior

Upate affected products with the latest security patches 

CVE-2018-7600Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1Kitty

Upgrade to the most recent version of Drupal 7 or 8 core

Featured Resources

Managing security risk and compliance in a challenging landscape

How key technology partners grow with your organisation

Download now

Evaluate your order-to-cash process

15 recommended metrics to benchmark your O2C operations

Download now

AI 360: Hold, fold, or double down?

How AI can benefit your business

Download now

Getting started with Azure Red Hat OpenShift

A developer’s guide to improving application building and deployment capabilities

Download now

Most Popular

IT retailer faces €10.4m GDPR fine for employee surveillance
General Data Protection Regulation (GDPR)

IT retailer faces €10.4m GDPR fine for employee surveillance

18 Jan 2021
Should IT departments call time on WhatsApp?
communications

Should IT departments call time on WhatsApp?

15 Jan 2021
BT faces £600m class-action lawsuit for 'overcharging'
Policy & legislation

BT faces £600m class-action lawsuit for 'overcharging'

18 Jan 2021