US, UK, and Australian agencies warn of top routinely exploited issues

CVE-2018-13379 is a path traversal flaw (CWE-22) in the Fortinet FortiOS SSL VPN web portal that allows an unauthenticated attacker to download FortiOS system files via specially crafted HTTP resource requests. By traversing directories through crafted requests to the exposed web portal, the attacker can retrieve sensitive files, a technique publicly documented as yielding the SSL VPN session file containing usernames and passwords in plaintext. Any organization running the SSL VPN web portal on a FortiGate appliance is affected, and risk is highest where the portal is directly reachable from the internet. The flaw is confirmed in the wild: it was added to the CISA KEV catalog on 2021-11-03 with known ransomware use, and EPSS assigns it a 100% probability of exploitation within 30 days. No public PoC is listed in the provided data, but credential theft tied to this bug has been widely reused by threat actors.

Do: Apply the patched FortiOS release per Fortinet's vendor advisory immediately, as this is a CISA KEV required action; if the fixed version is not known from this data, follow Fortinet's FG-IR-18-384 advisory for the correct upgrade path. Rotate SSL VPN credentials and review VPN access logs for path-traversal requests, since successful exploitation exposes plaintext session credentials, and restrict SSL VPN portal exposure to trusted sources where possible.

CVE-2019-5591 is a default-configuration flaw in Fortinet FortiOS (CWE-306, missing authentication for a critical function): when a FortiGate acts as an LDAP client over SSL/TLS for authentication purposes, the default configuration does not properly authenticate the LDAP server, allowing an unauthenticated attacker on the same subnet to impersonate the LDAP server. The attack requires adjacency (the attacker must be on the same network segment as the device's LDAP traffic) and only works where the device uses LDAP over TLS with the default, non-validating settings. A successful attacker can intercept sensitive authentication information, such as usernames and passwords, exchanged with the LDAP server, with high confidentiality impact but no integrity or availability impact per the CVSS score. Organizations running affected FortiOS releases with LDAP-over-TLS configured are exposed; FortiOS runs on one of the largest firewall/VPN installed bases, though the source data does not state exact affected version ranges or deployment counts. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03) with known in-the-wild and ransomware use; late-2021 CISA and FBI advisories warned that APT actors were exploiting Fortinet bugs, including this one, for initial access, and no public PoC is known.

Do: Upgrade affected FortiGate/FortiOS units to a fixed release (6.2.1+, 6.0.8+, 5.6.10+, or 5.4.12+) per Fortinet's instructions, as required by CISA's KEV listing. If patching is delayed, disable the use of SSL/TLS in the LDAP server configuration or restrict and monitor the network path between the FortiGate and the LDAP server. Inventory which devices use LDAPS for authentication and review authentication logs for signs of server impersonation or credential theft.

Fortinet FortiOS SSL VPN improperly validates the second factor of authentication (FortiToken), allowing a user with valid primary credentials to log in without being prompted for their one-time token. The bypass is triggered by changing the letter case of the username (e.g., typing 'Admin' instead of 'admin'), a case-sensitivity handling flaw (CWE-178) in the authentication logic (CWE-287). An attacker who has stolen, phished, or reused a user's primary credentials can therefore gain full SSL VPN access without the multi-factor protection defenders assume is enforced. Any organization running an affected FortiOS SSL VPN portal with FortiToken two-factor authentication for users is exposed. The flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03) with known ransomware use, and EPSS assigns a 49.3% probability of exploitation within 30 days (99th percentile); no public PoC is known.

Do: Apply the FortiOS update per Fortinet's advisory, as required by CISA's KEV listing. Until patched, audit SSL VPN logs for successful logins in which no FortiToken second-factor prompt occurred (especially sessions authenticating with altered username case), and consider restricting the SSL VPN portal to trusted source addresses or disabling it temporarily. Any accounts found with second-factor-free VPN logins should have credentials rotated and be checked for follow-on compromise, given known ransomware use.

CVE-2021-21985 is an improper input validation flaw (CWE-20, with related unsafe reflection CWE-470 and SSRF CWE-918 classifications) in the Virtual SAN Health Check plug-in of the VMware vSphere Client, which is enabled by default in vCenter Server. It is triggered by crafted requests sent to the plug-in over the network; VMware indicated that network access to vCenter's HTTPS port (443) is sufficient to reach the vulnerable component. A successful attacker gains remote code execution with unrestricted privileges on the underlying operating system hosting vCenter Server, a highly privileged position in the virtualization stack. Any organization running an affected VMware vCenter Server is affected; because vCenter is the default management plane for vSphere, this spans a very large share of enterprise virtualization estates, with tens of thousands of instances directly exposed to the internet. Exploitation is confirmed in the wild: CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2021-11-03 with known ransomware use and requires applying vendor updates, and EPSS puts the 30-day exploitation probability at essentially 100%, though the source data lists no public PoC.

Do: Update vCenter Server per VMware's instructions; fixes shipped in May 2021 for the 6.5, 6.7, and 7.0 branches (e.g., 6.5 U3n, 6.7 U3o, and 7.0 U2c — verify your current build against the vendor advisory). Until patched, restrict access to vCenter's HTTPS (443) interface to trusted management networks rather than the open internet, and review appliance logs and running processes for indicators of exploitation, since ransomware operators are known to use this flaw after gaining network access.

Ivanti Pulse Connect Secure, a widely deployed SSL VPN appliance, contains a use-after-free vulnerability in its license services. A remote, unauthenticated attacker can trigger the flaw via the license services and gain arbitrary code execution on the appliance, which is a high-value target because it terminates VPN sessions for enterprise networks. Any organization running an affected Pulse Connect Secure release is potentially affected; the source data does not specify exact version ranges, so administrators should compare their release against Ivanti's advisory. Exploitation is confirmed in the wild: the flaw is on CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03) with known ransomware use, and its 47.2% EPSS score (99th percentile) indicates a high likelihood of exploitation within 30 days.

Do: Apply the updates per Ivanti's instructions immediately, as CISA's required action specifies. Because exploited appliances have often retained persistent webshells/backdoors even after patching, also hunt for indicators of compromise (modified appliance files, unexpected processes or accounts) and follow Ivanti's remediation guidance rather than only installing the update. Until patched, restrict or closely monitor internet access to the appliance.

CVE-2021-22894 is a buffer overflow in the Collaboration Suite (meeting room) functionality of Ivanti Pulse Connect Secure, classified under CWE-94 (improper control of code generation). A remote attacker who is already authenticated to the appliance can trigger the overflow by supplying a maliciously crafted meeting room, causing attacker-controlled code to run on the appliance. Successful exploitation yields code execution as the root user, giving the attacker full control of the VPN appliance at the operating-system level. Any organization running Pulse Connect Secure with the Collaboration Suite feature enabled is potentially affected; specific affected version ranges are not specified in the available data. The flaw is on CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03), confirming in-the-wild exploitation, with an elevated 41.3% EPSS probability of exploitation in the next 30 days and no public proof-of-concept known.

Do: Apply Ivanti's supplied updates for Pulse Connect Secure per vendor instructions immediately, as the flaw is on CISA's KEV list with a required-action deadline. Restrict or disable the Collaboration/meeting feature if not needed, ensure it is not reachable without authentication, and review appliance and authentication logs for signs of exploitation (unexpected processes, files, or sessions running as root).

CVE-2021-26855 is a server-side request forgery flaw (CWE-918) in Microsoft Exchange Server that allows an unauthenticated remote attacker to send specially crafted HTTP requests and have the Exchange server process them as itself, disclosing sensitive session information. When chained with sibling Exchange flaws (the 'ProxyLogon' chain), it yields authentication bypass and arbitrary file write, escalating to full remote code execution with SYSTEM-level privileges on the on-premises Exchange server. Any organization running an affected on-premises Exchange server reachable over HTTP/HTTPS (typically outbound webmail) is exposed; Exchange Online was not affected. Exploitation is confirmed in the wild at large scale: the flaw was mass-exploited beginning in early 2021 (notably by the HAFNIUM group), is on the CISA KEV with documented ransomware use, and has a maximum EPSS score of 100% (100th percentile), despite no public PoC listing.

Do: Apply the vendor's March 2021 Exchange security updates (or later cumulative updates) immediately, per the CISA required action; until patched, limit Exchange (ECP/OWA) exposure to the internet via firewall/VPN rules. Hunt for compromise: review IIS logs for unrecognized authenticated activity against FrontEnd HttpProxy endpoints, and check for malicious files or webshells under inetpub\wwwroot\aspnet_client, given the known ransomware use.

CVE-2021-27104 is an OS command injection flaw (CWE-78) in Accellion's File Transfer Appliance (FTA), affecting versions 9_12_370 and earlier. It is triggered by sending a crafted POST request to various admin endpoints, and the CVSS vector (no privileges, no user interaction, network-accessible) indicates it can be exploited by an unauthenticated remote attacker. Successful exploitation yields full OS command execution on the appliance, giving the attacker control sufficient for data theft, web shell deployment, and follow-on ransomware/extortion operations. Organizations running Accellion FTA appliances — typically deployed as internet-facing large-file transfer endpoints by enterprises, government agencies, and universities — are affected. The flaw is being actively exploited in the wild: it was added to CISA's KEV catalog on 2021-11-03 with known ransomware use (notably the Clop/FINEST data-theft extortion campaign, including the breach of security firm Qualys), and it carries a high EPSS score of 56.7% (99th percentile). The fixed version is FTA_9_12_380 and later.

Do: Upgrade Accellion FTA to version FTA_9_12_380 or later per vendor instructions; the flaw is on CISA's KEV list with known ransomware use, so patching is urgent for internet-facing appliances. Until patched, restrict or firewall access to FTA admin endpoints from the internet, and review logs and the appliance for signs of command injection or web shell (e.g., DEWMODE-related) compromise given the active data-theft extortion campaign.