Cybersecurity firm Qualys has released an analysis of the top 20 vulnerabilities most exploited by threat actors, malware and ransomware families in the past few years. Notably, 15 out of these 20 bugs are associated with Microsoft products.

Some of these top 20 vulnerabilities are also included in the Cybersecurity and Infrastructure Security Agency (CISA) 2022 top routinely exploited vulnerabilities list, published earlier on Aug 3, 2023.

According to Qualys, the five most targeted vulnerabilities are all related to Microsoft’s products including Office (also known as Microsoft 365), WordPad word processor software and Windows operating systems.

1. Microsoft Office memory corruption vulnerability (CVE-2017-11882): This bug, also included in the CISA’s “Additional Routinely Exploited Vulnerabilities in 2022” list, was exploited by 467 malware, 53 threat actors and 14 ransomware. It was trending over the years as recently as August 31, 2023. Qualys researchers noted the vulnerability involves significant memory corruption in Microsoft Office’s Equation Editor, which allows an attacker to execute arbitrary code under the current user's permissions. And if the user has administrative rights, this could lead to a full system takeover.
2. Microsoft WordPad remote code execution (RCE) vulnerability (CVE-2017-0199): This vulnerability was exploited by 93 malware, 53 threat actors and 5 ransomware, and was included in the CISA’s list. This remote code execution flaw affects certain Microsoft Office and WordPad versions, especially when they parse specially crafted files. Successful exploitation enables arbitrary code execution under the current user's security context, potentially granting control of the system to the attacker.
3. Vulnerability in Windows common controls (CVE-2012-0158): This flaw was exploited by 63 malware, 45 threat actors and 2 ransomware. An attacker can exploit this vulnerability in Windows standard controls to gain remote code execution by tricking a user into visiting a specially crafted webpage.
4. Microsoft Office RCE vulnerability (CVE-2017-8570): This vulnerability was exploited by 52 malware and 11 threat actors. If successfully exploited, this flaw in Microsoft Office and WordPad permits the attacker to run arbitrary code with the same privileges as the logged-in user.
5. Zerologon – an unauthenticated privilege escalation to full domain privileges (CVE-2020-1472): Known as Zerologon, this severe vulnerability in Microsoft’s Netlogon Remote Protocol was exploited by 18 malware, 16 threat actors and 11 ransomware, and was included in the CISA’s list. Through certain setups, it could allow an attacker to impersonate a server and compromise the entire Windows domain and take control over all the Active Directory identity services.

Other Microsoft-related vulnerabilities included in the list include Windows SMBv1 RCE vulnerability — WannaCry, Petya (CVE-2017-0144, CVE-2017-0145, CVE-2017-0143), Microsoft Exchange server RCE — ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207), Windows VBScript Engine RCE vulnerability (CVE-2018-8174), Microsoft Silverlight could allow RCE (CVE-2013-0074), Microsoft Office memory corruption vulnerability(CVE-2018-0802) and Microsoft Exchange server authentication bypass/RCE (CVE-2021-26855).

The top 20 most exploited vulnerabilities list also included two Oracle-related bugs and one each from Unix/Linux, Jira Atlassian, Apache, Citrix, Ivanti and Fortinet.

Qualys’s research team noted the severe vulnerability in the popular Apache’s log4j Java library, also known as Log4Shell, was exploited by 10 malware, 26 threat actors and 5 ransomware, and was trending in the wild as recently as September 4, 2023.

“The flaw exploits the ‘lookups’ feature of log4j, enabling an attacker to use a specially crafted input to trigger the execution of a remote Java class on an LDAP [lightweight directory access protocol] server, leading to remote code execution,” the team wrote.

In today's cybersecurity landscape, identifying and mitigating high-risk vulnerabilities that are actively targeted by threat actors, malware and ransomware families is crucial for organizations and security teams, researchers warned in the blog post.

They recommended using multidimensional threat intelligence to prioritize vulnerabilities, instead of implementing multiple, but siloed, threat approaches.