Top 12 Security Flaws Russian Spy Hackers Are Exploiting in the Wild

CVE-2018-13379 is a path traversal flaw (CWE-22) in the Fortinet FortiOS SSL VPN web portal that allows an unauthenticated attacker to download FortiOS system files via specially crafted HTTP resource requests. By traversing directories through crafted requests to the exposed web portal, the attacker can retrieve sensitive files, a technique publicly documented as yielding the SSL VPN session file containing usernames and passwords in plaintext. Any organization running the SSL VPN web portal on a FortiGate appliance is affected, and risk is highest where the portal is directly reachable from the internet. The flaw is confirmed in the wild: it was added to the CISA KEV catalog on 2021-11-03 with known ransomware use, and EPSS assigns it a 100% probability of exploitation within 30 days. No public PoC is listed in the provided data, but credential theft tied to this bug has been widely reused by threat actors.

Do: Apply the patched FortiOS release per Fortinet's vendor advisory immediately, as this is a CISA KEV required action; if the fixed version is not known from this data, follow Fortinet's FG-IR-18-384 advisory for the correct upgrade path. Rotate SSL VPN credentials and review VPN access logs for path-traversal requests, since successful exploitation exposes plaintext session credentials, and restrict SSL VPN portal exposure to trusted sources where possible.

Ivanti Pulse Connect Secure, an enterprise SSL VPN appliance, contains an arbitrary file read vulnerability (CWE-22, path traversal) that requires no authentication. An unauthenticated remote attacker with network access to the appliance over HTTPS can send a specially crafted URI containing traversal sequences to read arbitrary files from the device. The attacker gains access to sensitive appliance files, potentially including configuration or credential material useful for further compromise, and CISA records known ransomware use of this flaw. Any organization running Pulse Connect Secure, especially gateways exposed to the internet for remote access, is affected. Exploitation is established: CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2021-11-03 with known ransomware use, EPSS assigns a 100% probability of exploitation in the next 30 days, and no public PoC is known.

Do: Apply updates per Ivanti's instructions, the required action in the CISA KEV entry, prioritizing internet-facing Pulse Connect Secure gateways, and consult the vendor advisory for the applicable fixed release since no version range is provided here. Where patching is not immediate, restrict HTTPS access to the appliance and hunt for signs of exploitation (unexpected file reads, anomalous VPN logins or sessions, and follow-on ransomware activity), as CISA reports known ransomware use.

CVE-2019-1653 is an improper access control flaw (CWE-284) in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN routers. It is triggered by sending requests to vulnerable URLs on the management interface without authentication, bypassing the intended access controls. An attacker gains the ability to download the full router configuration — which can expose credentials and VPN/VPN-tunnel settings — as well as detailed diagnostic information about the device. Any Cisco RV320 or RV325 router whose management interface is reachable, particularly over the internet, is affected. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03) and carries a 99.9% EPSS score, though no public proof-of-concept is known and no ransomware association has been confirmed.

Do: Apply the updated router firmware from Cisco as instructed in the vendor advisory, per the CISA KEV required action. If updating is not immediately possible, restrict or disable WAN-side access to the web management interface and limit it to trusted management hosts. Because the downloaded configuration can contain credentials, change administrative and VPN passwords after patching, and review logs for signs of unauthenticated configuration downloads.

CVE-2019-19781 is a path-traversal flaw (classified CWE-22, though CISA's description calls it unspecified) in Citrix ADC (formerly NetScaler ADC), Citrix Gateway, and Citrix SD-WAN WANOP appliances that lets an unauthenticated remote attacker traverse directories via crafted requests and execute arbitrary commands on the appliance, typically with root privileges. It is triggered by sending specially crafted directory-traversal requests (crafted URLs/requests to the appliance's management or VPN endpoints), which lets the attacker write files and run commands with no credentials. Successful exploitation yields arbitrary code execution on the appliance, enabling theft of VPN/ADC credentials, lateral movement into the corporate network, and installation of persistent backdoors. Any organization running affected ADC, Gateway, or SD-WAN WANOP firmware is affected, with internet-facing gateways used for remote access at the highest risk. Exploitation is confirmed in the wild: the vulnerability is on CISA's KEV (added 2021-11-03) with known ransomware use, EPSS assigns near-certain (100.0%) probability of exploitation within 30 days, and no public PoC is listed despite confirmed abuse.

Do: Upgrade Citrix ADC, Gateway, and SD-WAN WANOP appliances to the fixed firmware builds listed in Citrix advisory CTX267020; if patching cannot be done immediately, apply Citrix's published interim mitigation and restrict internet exposure to the appliance. Because exploitation grants root code execution and persistence, after patching hunt for indicators of compromise (unexpected nsroot account, modified system files, crontab/scheduled entries), kill all active and inactive sessions, and rotate appliance and VPN credentials. Prioritize internet-facing gateways and comply with CISA's required action to apply vendor updates.

CVE-2019-2725 is an easily exploitable injection flaw (CWE-74) in the Web Services subcomponent of Oracle WebLogic Server within Oracle Fusion Middleware, publicly documented as affecting WebLogic 10.3.6.0, 12.1.3.0, 12.2.1.1 and 12.2.1.3. It is triggered when an unauthenticated remote attacker sends attacker-controlled XML over HTTP to the WebLogic Web Services async response endpoint (the /_async/AsyncResponseService servlet), which processes the input unsafely. Successful attacks give the attacker takeover of the affected WebLogic server (remote code execution); in the 2019 exploitation wave this was used to install cryptocurrency miners and deploy ransomware. Any organization running affected Oracle WebLogic Server versions is exposed, with the greatest risk where the async/Web Services endpoints are reachable, especially on internet-facing servers. Exploitation is confirmed in the wild: CISA added the CVE to its KEV catalog on 2022-01-10 with ransomware use known and requires applying vendor updates, the EPSS probability of exploitation is 100% (100th percentile), and no public PoC is catalogued.

Do: Apply Oracle's updates per vendor instructions: this CVE was fixed by Oracle's April 2019 out-of-band WebLogic patch and is covered by subsequent Critical Patch Updates, so bring affected WebLogic 10.3.6.0/12.1.3.0/12.2.1.x servers to a patched level (CISA KEV requires this action). Until patched, restrict or remove the async response service deployments (wls9_async_response.war / wls_wsee_async_response.war, exposing the /_async/AsyncResponseService endpoint) and keep WebLogic ports off the internet. Also review logs for unsolicited POSTs to /_async/AsyncResponseService and for signs of dropped miners or ransomware payloads.

CVE-2019-7609 is an arbitrary code execution flaw in the Timelion visualizer of Elastic Kibana, a JavaScript injection flaw (CWE-94) driven by prototype pollution. An attacker with access to the Timelion application can send a crafted request that executes JavaScript, potentially leading to arbitrary commands running on the host with the permissions of the Kibana process. All Kibana releases before 5.6.15 and before 6.6.1 are affected, and the flaw also applies to the Kibana component bundled with Red Hat OpenShift Container Platform. Exploitation requires only network access to a vulnerable Timelion endpoint, making internet-exposed or broadly shared Kibana instances the primary targets. The flaw is actively exploited: it was added to CISA's Known Exploited Vulnerabilities catalog on 2022-01-10, carries a 95.3% EPSS score, and is among the top flaws recently leveraged by Russia-linked APT29 hackers against critical infrastructure according to recent US/UK advisories.

Do: Upgrade Kibana to 5.6.15 or later (5.x) or 6.6.1 or later (6.x) per Elastic's instructions, and apply Red Hat's updated logging/Kibana packages for OpenShift. As interim mitigation, restrict access to the Timelion application, especially on internet-facing Kibana instances, and hunt for unexpected child processes or outbound connections spawned by the Kibana service indicating exploitation. Prioritize patching anything listed as internet-exposed, given the flaw's presence in CISA KEV and documented APT29 use.

Synacor Zimbra Collaboration Suite (ZCS) contains an improper restriction of XML external entity (XXE) vulnerability (CWE-611) in its mailboxd component, meaning XML parsing accepts external entity references that the parser should restrict. By submitting crafted XML that ZCS parses in mailboxd, an attacker can typically direct the server to fetch external entities, potentially disclosing local files or issuing server-side requests; the available data does not specify authentication requirements or exact affected version ranges. Organizations running Synacor Zimbra Collaboration Suite are affected. The flaw is confirmed as exploited in the wild: CISA added CVE-2019-9670 to the Known Exploited Vulnerabilities catalog on 2022-01-10, and EPSS assigns a 100% probability of exploitation within 30 days; no public PoC is listed and ransomware association is listed as unknown.

Do: Apply updates per Synacor/Zimbra instructions, as required by the CISA KEV catalog; because no fixed version numbers are provided in the available data, administrators of all ZCS deployments should consult current vendor advisories and patch promptly. As interim mitigation, restrict or disable external entity resolution in XML processing and limit exposure of mailboxd-facing services. Check mailboxd logs and outbound network activity for signs of entity resolution or unexpected connections, and prioritize this fix given the 2022-01-10 KEV listing and 100% EPSS score.

CVE-2020-14882 is a remote code execution vulnerability in Oracle WebLogic Server; its relationship to CVE-2020-14750 (a WebLogic administration console flaw) indicates it is reachable over the network, likely without authentication. An attacker who can reach a vulnerable WebLogic instance can trigger the flaw and execute arbitrary code in the context of the server. Successful exploitation can yield full control of the affected host, enabling data theft, lateral movement, and potentially ransomware deployment (ransomware use is currently unknown). Any organization running Oracle WebLogic Server is affected; WebLogic is widely deployed as a Java application server in large enterprises and government networks, and instances are frequently exposed to the internet. The vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03) and carries a maximum EPSS score of 100%, indicating confirmed in-the-wild exploitation.

Do: Apply Oracle's WebLogic Server updates per vendor instructions immediately, as this is a required action under the CISA KEV listing. Inventory environments for WebLogic deployments (commonly listening on ports 7001/7002), prioritize patching internet-facing instances, and restrict or firewall access to the WebLogic administration console until patched. Review access logs for signs of exploitation, and treat unpatched, externally reachable WebLogic servers as high risk given the 100% EPSS score and confirmed in-the-wild exploitation.

CVE-2020-4006 is a command injection flaw (CWE-78, CVSS 3.1 9.1) in the admin consoles of VMware Workspace ONE Access, Workspace ONE Access Connector, VMware Identity Manager, and VMware Identity Manager Connector, with the affected components also shipped inside VMware Cloud Foundation and vRealize Suite Lifecycle Manager. An attacker who gains privileged access to an admin console, which is typically reachable over the network, can inject and run arbitrary commands on the appliance, achieving full compromise of the host with high confidentiality, integrity, and availability impact and a changed scope. Organizations running the affected identity products are exposed, especially where the admin console is internet-facing or reachable from untrusted networks. The bug was actively exploited by Russian state-sponsored (SVR/APT29) actors against unpatched deployments, prompting a CISA emergency directive, NSA and FBI joint warnings, and inclusion in the KEV catalog; EPSS estimates a 17.3% probability of exploitation within 30 days, and no public proof-of-concept is known.

Do: Apply the patches VMware released in its November 2020 advisory (VMSA-2020-0027) for all affected products, connectors, and any Cloud Foundation or vRealize Suite Lifecycle Manager deployments that embed the components — this is a KEV-required action. As an interim mitigation, restrict network access to the admin console (typically port 8443) to trusted users and networks only. Review admin-console and system logs for signs of command injection or SVR/APT29 activity, since the bug was exploited in the wild by Russian state-sponsored actors.

CVE-2020-5902 is a critical, unauthenticated remote code execution flaw in the F5 BIG-IP Traffic Management User Interface (TMUI), the appliance's web management console, rooted in a directory/path traversal issue (CWE-22) in undisclosed TMUI pages. It is triggered by sending crafted HTTP(S) requests to the management interface — classically path-traversal URLs beneath the TMUI application on the management port — which lets an attacker bypass authentication, read or delete arbitrary files, and execute commands without credentials. Successful exploitation yields full control of the BIG-IP system, which attackers can use to pivot into networks the appliance fronts, maintain persistence, and deploy ransomware. Any organization running an affected F5 BIG-IP appliance or virtual edition whose TMUI is reachable, or whose management network can be reached, is exposed; F5's installed base spans large enterprises and service providers, so the footprint is broad. Exploitation is confirmed in the wild: the flaw was mass-scanned and exploited within days of its July 2020 disclosure, it is listed in CISA KEV with known ransomware use, and EPSS assigns a ~100% probability of exploitation within 30 days.

Do: Patch immediately using F5's advisory K52145254 — upgrade BIG-IP to a fixed release per the vendor's version matrix, since CISA's required action is applying vendor updates. Until patched, restrict TMUI/management-interface access to trusted source IPs or a VPN (or disable TMUI if unused) and apply F5's published interim workaround. Because ransomware use is confirmed, hunt for indicators of compromise on both patched and unpatched appliances (unexpected files, webshells, modified login pages, new accounts or scheduled tasks) before treating systems as clean.

CVE-2021-21972 is a remote code execution vulnerability in a plugin of the vSphere Client in VMware vCenter Server, underpinned by a path traversal flaw (CWE-23) in the plugin's file-upload functionality. It is triggered over the network through port 443: an attacker who can reach the vCenter web interface can submit crafted file-upload requests, traverse to arbitrary filesystem paths, and plant executable files on the underlying operating system. Successful exploitation yields unrestricted privileges on the vCenter host OS, giving attackers control of the central management platform for an organization's entire VMware vSphere virtualized estate. Any organization running an affected vCenter Server release whose port 443 is reachable from untrusted networks is exposed. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03) with known ransomware use and a 99.9% EPSS score (100th percentile), indicating active, widespread exploitation in the wild, though no public PoC is recorded in this data.

Do: Apply the vCenter Server updates published in VMware's advisory for CVE-2021-21972 as soon as possible, prioritizing internet-facing or partner-reachable vCenter instances. Until patched, restrict access to vCenter on port 443 to trusted management networks and review access logs for unauthenticated file-upload activity against the vSphere Client upload endpoint. Because ransomware operators have actively exploited this bug, hunt for signs of compromise such as webshells or unexpected new local accounts on vCenter appliances.

CVE-2021-26855 is a server-side request forgery flaw (CWE-918) in Microsoft Exchange Server that allows an unauthenticated remote attacker to send specially crafted HTTP requests and have the Exchange server process them as itself, disclosing sensitive session information. When chained with sibling Exchange flaws (the 'ProxyLogon' chain), it yields authentication bypass and arbitrary file write, escalating to full remote code execution with SYSTEM-level privileges on the on-premises Exchange server. Any organization running an affected on-premises Exchange server reachable over HTTP/HTTPS (typically outbound webmail) is exposed; Exchange Online was not affected. Exploitation is confirmed in the wild at large scale: the flaw was mass-exploited beginning in early 2021 (notably by the HAFNIUM group), is on the CISA KEV with documented ransomware use, and has a maximum EPSS score of 100% (100th percentile), despite no public PoC listing.

Do: Apply the vendor's March 2021 Exchange security updates (or later cumulative updates) immediately, per the CISA required action; until patched, limit Exchange (ECP/OWA) exposure to the internet via firewall/VPN rules. Hunt for compromise: review IIS logs for unrecognized authenticated activity against FrontEnd HttpProxy endpoints, and check for malicious files or webshells under inetpub\wwwroot\aspnet_client, given the known ransomware use.