View all newsletters
Receive our newsletter - data, insights and analysis delivered to you
  1. Technology
  2. Cybersecurity
August 5, 2023updated 07 Aug 2023 9:44am

Five Eyes nations reveal 12 most exploited cybersecurity vulnerabilities of 2022

Organisations are being urged to check their patches, with several old vulnerabilities making the list.

By Claudia Glover

Cybercriminals are increasingly targeting historical vulnerabilities, rather than exploiting new flaws, to gain access to systems, according to members of the Five Eyes security alliance, which includes the UK’s National Cyber Security Agency (NCSC) and its US counterpart CISA.

Five Eyes released a joint advisory warning against the most exploited bugs in 2022. (Photo by Daniel Heighton/Shutterstock)

A joint report from security agencies in the Five Eyes countries – the UK, the US, Australia, Canada and New Zealand – has highlighted the most commonly exploited vulnerabilities in the past year. They are urging companies to check they have patched the 12 top vulnerabilities, which have already led to some notable cyberattacks.

Five Eyes release joint warning on 12 most exploited vulnerabilities of 2022

More than half of the top vulnerabilities of 2022 were also highlighted on the previous year’s list, indicating that companies are still not applying the latest patches despite that, in some cases, they have been available for years.

Attackers generally see the most success exploiting known vulnerabilities within the first two years of public disclosure, according to the UK’s NCSC. They “likely target their exploits to maximise impact, emphasising the benefit of organisations applying security updates promptly,” an NCSC statement said.

Among the most popular of the bugs in the report are three exploits relating to Proxy Shell, affecting Microsoft Exchange, for which patches were released in 2021. The Atlassian Confluence bug has also been listed, a nasty vulnerability that affected 31 versions of the company’s products last year: CVE-2021-26084.

Another widely listed vulnerability is Log4j, the infamous bug that was discovered in 2021 and has affected thousands of businesses. The Apache open-source vulnerability is embedded in thousands of software products, triggering a global mitigation effort for much of 2022. The bug is so widely used, and so laborious to find and fix, that it continues to be fruitful to exploit to this day.

The advisory has provided mitigatory measures for “vendors, designers and developers” on implementing secure by design and default principles and tactics to reduce the prevalence of vulnerabilities in their software.

Content from our partners
Rethinking cloud: challenging assumptions, learning lessons
DTX Manchester welcomes leading tech talent from across the region and beyond
The hidden complexities of deploying AI in your business

“Organisations should share information about incidents and unusual cyber activity with their respective cybersecurity authorities because when cyber incidents are reported quickly, it can contribute to stopping further attacks,” the report warns.

Jonathan Ellison, NCSC director of resilience and future technology, said that “vulnerabilities are sadly part and parcel of our online world and we see [cybercriminals] continue to take advantage of these weaknesses to compromise systems.”

The advisory report should raise awareness of the most routinely exploited vulnerabilities in 2022 “to help organisations identify where they might be at risk and take action,” Ellison added. “To bolster resilience, we encourage organisations to apply all security updates promptly and call on software vendors to ensure security is at the core of their product design to help shift the burden of responsibility away from consumers,” he said.

Read more: Capita expects increased £25m cost from cyberattack

Topics in this article :
Websites in our network
Select and enter your corporate email address Tech Monitor's research, insight and analysis examines the frontiers of digital transformation to help tech leaders navigate the future. Our Changelog newsletter delivers our best work to your inbox every week.
  • CIO
  • CTO
  • CISO
  • CSO
  • CFO
  • CDO
  • CEO
  • Architect Founder
  • MD
  • Director
  • Manager
  • Other
Visit our privacy policy for more information about our services, how Progressive Media Investments may use, process and share your personal data, including information on your rights in respect of your personal data and how you can unsubscribe from future marketing communications. Our services are intended for corporate subscribers and you warrant that the email address submitted is your corporate email address.