Top CVEs to Patch: Insights from the 2022 Unit 42 Network Threat Trends Research Report

CVE-2017-5638 is an improper input validation flaw (CWE-20) in the Jakarta Multipart parser of Apache Struts, in which the parser mishandles the Content-Type value of a file upload and allows malicious upload leading to remote code execution. It is triggered remotely without authentication by sending a crafted Content-Type header in a multipart request to a Struts endpoint; no valid upload or credentials are required. A successful attacker gains code execution in the security context of the application server, which typically enables host compromise, data theft, or ransomware deployment. Any organization running Apache Struts applications that use the Jakarta Multipart parser is affected; the provided data specifies only "Apache Struts" and gives no version ranges. Exploitation is confirmed in the wild: the flaw is listed in CISA KEV (added 2021-11-03) with known ransomware use, EPSS assigns it roughly a 100% exploitation probability (100th percentile), and no public PoC is catalogued in the source data.

Do: Apply updates per vendor instructions: upgrade Apache Struts to the releases that fix this flaw (2.3.32 / 2.5.10.1 or later, per Apache advisory S2-045), and check for Struts jars bundled inside application packages and vendor appliances. Prioritize internet-facing apps, and as an interim mitigation validate or filter the Content-Type header on multipart requests. Because exploitation is in the wild and ransomware use is known, also review web and application server logs for evidence of successful compromise.

PHPUnit ships a utility script (eval-stdin.php under /vendor/phpunit/phpunit/src/Util/PHP/) that reads HTTP POST data and evaluates it as PHP code with no authentication. The flaw is triggered when a site's /vendor folder is web-accessible and an attacker sends a POST request whose body begins with '<?php ' directly to that URI. Doing so lets the attacker execute arbitrary PHP code on the server under the web server account, giving unauthenticated remote code execution (CWE-94 code injection). Anyone running a PHP application installed with Composer, where PHPUnit is present in the vendor tree and that directory is reachable over HTTP, is affected. The flaw is under active exploitation: CISA added it to the Known Exploited Vulnerabilities catalog on 2022-02-15 and its EPSS probability of exploitation is 100% (top percentile).

Do: Apply the CISA KEV required action by updating PHPUnit per vendor instructions, which in practice means updating the CMS/framework or running a Composer update that pulls a patched PHPUnit release. Until patched, block web access to the /vendor directory (e.g., deny /vendor/ or at least /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php in your web server configuration) and verify the endpoint is no longer reachable. Check access logs for POST requests to eval-stdin.php and investigate affected servers for webshells or other signs of compromise.

In the /HNAP1/SetRouterSettings message, the RemotePort parameter is vulnerable, and the vulnerability affects D-Link DIR-818LW Rev.A 2.05.B03 and DIR-822 B1 202KRb06 devices. In the SetRouterSettings.php source code, the RemotePort parameter is saved in the $path_inf_wan1."/web" internal configuration memory without any regex checking. And in the IPTWAN_build_command function of the iptwan.php source code, the data in $path_inf_wan1."/web" is used with the iptables command without any regex checking. A vulnerable /HNAP1/SetRouterSettings XML message could have shell metacharacters in the RemotePort element such as the `telnetd` string.

D-Link DAP-1860 devices before v1.04b03 Beta allow arbitrary remote code execution as root without authentication via shell metacharacters within an HNAP_AUTH HTTP header.

CVE-2019-2725 is an easily exploitable injection flaw (CWE-74) in the Web Services subcomponent of Oracle WebLogic Server within Oracle Fusion Middleware, publicly documented as affecting WebLogic 10.3.6.0, 12.1.3.0, 12.2.1.1 and 12.2.1.3. It is triggered when an unauthenticated remote attacker sends attacker-controlled XML over HTTP to the WebLogic Web Services async response endpoint (the /_async/AsyncResponseService servlet), which processes the input unsafely. Successful attacks give the attacker takeover of the affected WebLogic server (remote code execution); in the 2019 exploitation wave this was used to install cryptocurrency miners and deploy ransomware. Any organization running affected Oracle WebLogic Server versions is exposed, with the greatest risk where the async/Web Services endpoints are reachable, especially on internet-facing servers. Exploitation is confirmed in the wild: CISA added the CVE to its KEV catalog on 2022-01-10 with ransomware use known and requires applying vendor updates, the EPSS probability of exploitation is 100% (100th percentile), and no public PoC is catalogued.

Do: Apply Oracle's updates per vendor instructions: this CVE was fixed by Oracle's April 2019 out-of-band WebLogic patch and is covered by subsequent Critical Patch Updates, so bring affected WebLogic 10.3.6.0/12.1.3.0/12.2.1.x servers to a patched level (CISA KEV requires this action). Until patched, restrict or remove the async response service deployments (wls9_async_response.war / wls_wsee_async_response.war, exposing the /_async/AsyncResponseService endpoint) and keep WebLogic ports off the internet. Also review logs for unsolicited POSTs to /_async/AsyncResponseService and for signs of dropped miners or ransomware payloads.

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

CVE-2019-9082 is an unauthenticated remote code execution flaw (CWE-94 code injection, CWE-306 missing authentication) in ThinkPHP versions before 3.2.4, as shipped in Open Source BMS v1.1.1 and other ThinkPHP-based products. An attacker triggers it by sending a crafted HTTP GET request to the route public/?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=<command>, which makes the framework invoke the system function with attacker-controlled arguments. Because no authentication is required, any remote attacker who can reach the web application can execute arbitrary operating-system commands with the privileges of the web server, typically gaining a foothold for data theft, ransomware, or botnet/cryptomining implants. Affected users are operators of ThinkPHP-based sites and applications, specifically ThinkPHP prior to 3.2.4, Open Source BMS v1.1.1, and ZzzCMS zzzphp as listed by CISA. Exploitation is confirmed in the wild: the flaw is in CISA KEV (added 2021-11-03), has a 97.4% EPSS probability of exploitation within 30 days, and threat-actor activity against old ThinkPHP flaws — including a Chinese threat actor since October 2023 and the DirtyMoe wormable botnet — keeps pressure on unpatched servers.

Do: Upgrade ThinkPHP to version 3.2.4 or later (or a currently supported maintained branch) and update Open Source BMS beyond v1.1.1 and zzzphp to vendor-patched releases, per CISA's required action. Check access logs for requests to the invokefunction route (public/?s=index/\think\app/invokefunction with call_user_func_array/system) and hunt for signs of follow-on webshell, botnet, or cryptomining activity, given active abuse by Chinese-linked actors and the DirtyMoe botnet. As interim mitigation, block or restrict the invokefunction route at a WAF/reverse proxy for unauthenticated users; remediation is mandatory under BOD 22-01 because the flaw is in KEV.

CVE-2020-14882 is a remote code execution vulnerability in Oracle WebLogic Server; its relationship to CVE-2020-14750 (a WebLogic administration console flaw) indicates it is reachable over the network, likely without authentication. An attacker who can reach a vulnerable WebLogic instance can trigger the flaw and execute arbitrary code in the context of the server. Successful exploitation can yield full control of the affected host, enabling data theft, lateral movement, and potentially ransomware deployment (ransomware use is currently unknown). Any organization running Oracle WebLogic Server is affected; WebLogic is widely deployed as a Java application server in large enterprises and government networks, and instances are frequently exposed to the internet. The vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03) and carries a maximum EPSS score of 100%, indicating confirmed in-the-wild exploitation.

Do: Apply Oracle's WebLogic Server updates per vendor instructions immediately, as this is a required action under the CISA KEV listing. Inventory environments for WebLogic deployments (commonly listening on ports 7001/7002), prioritize patching internet-facing instances, and restrict or firewall access to the WebLogic administration console until patched. Review access logs for signs of exploitation, and treat unpatched, externally reachable WebLogic servers as high risk given the 100% EPSS score and confirmed in-the-wild exploitation.

CVE-2020-15505 is a critical, unauthenticated remote code execution vulnerability in Ivanti MobileIron's Core and Enterprise Connector, Sentry, and Monitor and Reporting Database (RDB) products, which public proof-of-concept exploits identify as a Hessian-based Java deserialization flaw. An unauthenticated attacker can send crafted requests to an affected MobileIron server over the network, with no privileges or user interaction required, and execute arbitrary code, gaining full control of the MDM server with high impact on confidentiality, integrity, and availability. Any organization running the affected versions of these enterprise mobile device management products is at risk, particularly internet-facing MobileIron Core and Sentry instances. Exploitation is confirmed and widespread: the flaw is on CISA's Known Exploited Vulnerabilities catalog (added November 3, 2021), carries a 99.7% EPSS score, and was named among the top flaws exploited by Chinese state-sponsored hackers, prompting urgent UK NCSC patching alerts. It is also being observed chained with other exploited vulnerabilities (e.g., VPN flaws and Zerologon) as an initial-access vector, so defenders should treat it as actively exploited.

Do: Apply the vendor updates immediately per Ivanti's security advisory for MobileIron Core, Enterprise Connector, Sentry, and RDB (this is CISA's required action for KEV entries). Until patched, reduce internet exposure of MobileIron interfaces and monitor for exploitation; because the flaw was mass-exploited (including by Chinese state-sponsored actors), hunt for signs of compromise such as unexpected processes, persistence mechanisms, or webshells on affected MDM servers.

An authentication bypass vulnerability in MobileIron Core & Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1, 10.4.0.2, 10.4.0.3, 10.5.1.0, 10.5.2.0 and 10.6.0.0 that allows remote attackers to bypass authentication mechanisms via unspecified vectors.

CVE-2020-25078 is an information-disclosure flaw in the unauthenticated /config/getuser endpoint of D-Link DCS-2530L and DCS-2670L network cameras, which allows a remote, unauthenticated attacker to retrieve the device's administrator password. It is triggered simply by sending a crafted request to that HTTP endpoint over the network, with no login or user interaction required. An attacker who obtains the administrator password can log into the camera's web interface to view footage, change settings, or pivot further into the network. Owners of a DCS-2530L running firmware before 1.06.01 Hotfix or a DCS-2670L running firmware through 2.02 with the camera's web interface reachable are affected. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2025-08-05 amid active-exploitation evidence (with FBI/CISA alerts on HiatusRAT campaigns targeting webcams and DVRs), and its EPSS score of 97.9% indicates a very high near-term exploitation probability.

Do: Upgrade DCS-2530L cameras to firmware 1.06.01 Hotfix or later, and for DCS-2670L apply the latest vendor hotfix release newer than 2.02 (check D-Link's support page, as the exact fixed version is not specified in this data). Do not expose the camera web interface directly to the internet (remove port forwards/UPnP mappings or restrict access via firewall), and check device logs or perimeter traffic for unauthenticated requests to /config/getuser. Because these devices are end-of-life, plan replacement if current mitigations or firmware updates are unavailable, consistent with BOD 22-01 guidance.

CVE-2020-5902 is a critical, unauthenticated remote code execution flaw in the F5 BIG-IP Traffic Management User Interface (TMUI), the appliance's web management console, rooted in a directory/path traversal issue (CWE-22) in undisclosed TMUI pages. It is triggered by sending crafted HTTP(S) requests to the management interface — classically path-traversal URLs beneath the TMUI application on the management port — which lets an attacker bypass authentication, read or delete arbitrary files, and execute commands without credentials. Successful exploitation yields full control of the BIG-IP system, which attackers can use to pivot into networks the appliance fronts, maintain persistence, and deploy ransomware. Any organization running an affected F5 BIG-IP appliance or virtual edition whose TMUI is reachable, or whose management network can be reached, is exposed; F5's installed base spans large enterprises and service providers, so the footprint is broad. Exploitation is confirmed in the wild: the flaw was mass-scanned and exploited within days of its July 2020 disclosure, it is listed in CISA KEV with known ransomware use, and EPSS assigns a ~100% probability of exploitation within 30 days.

Do: Patch immediately using F5's advisory K52145254 — upgrade BIG-IP to a fixed release per the vendor's version matrix, since CISA's required action is applying vendor updates. Until patched, restrict TMUI/management-interface access to trusted source IPs or a VPN (or disable TMUI if unused) and apply F5's published interim workaround. Because ransomware use is confirmed, hunt for indicators of compromise on both patched and unpatched appliances (unexpected files, webshells, modified login pages, new accounts or scheduled tasks) before treating systems as clean.

The systeminformation npm package, a widely used Node.js library for retrieving hardware, system, and OS details, contains a command injection flaw (CWE-78) in versions before 5.3.1. The flaw is triggered when untrusted, user-controlled parameters are passed to functions such as si.inetLatency(), si.inetChecksite(), si.services(), and si.processLoad(), allowing injected commands to be executed by the underlying operating system. A successful attacker gains the ability to run arbitrary commands with the privileges of the Node.js process on the affected host, potentially enabling further compromise. Any application or service built on the npm package that forwards attacker-influenced input into these functions is affected, including deployments where the library is bundled into other products (e.g., Apache Cordova applications per the CPE data). The vulnerability was added to CISA's Known Exploited Vulnerabilities Catalog on 2022-01-18, indicating exploitation in the wild, and its EPSS score of 90.7% places it in the top percentile for near-term exploitation probability.

Do: Upgrade the systeminformation npm package to version 5.3.1 or later wherever it appears in your Node.js dependency trees. If upgrading is not immediately possible, sanitize all parameters passed to si.inetLatency(), si.inetChecksite(), si.services(), and si.processLoad(), accepting only plain strings and rejecting arrays. Audit internet-facing Node.js applications (including any Cordova-packaged deployments) for use of these functions and confirm they are patched, per the CISA KEV required action.

F5 BIG-IP and BIG-IQ Centralized Management contain a remote code execution vulnerability (CWE-863, improper authorization check) in the iControl REST interface. An unauthenticated attacker with network access to the REST endpoint can send crafted requests to execute arbitrary system commands, create or delete files, and disable services on the appliance or virtual instance. Successful exploitation effectively gives the attacker command-level control of the underlying F5 system, which is sufficient for account creation, persistence, lateral movement, and ransomware staging. Any organization running affected BIG-IP or BIG-IQ releases is exposed, particularly where the management interface or iControl REST is reachable from untrusted networks. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV on 2021-11-03 with known ransomware use, EPSS places the 30-day exploitation probability at 99.9% (top percentile), though no public PoC is cataloged.

Do: Upgrade BIG-IP and BIG-IQ to the fixed releases identified in F5's advisory (K03051234) on an urgent basis, since exploitation is in the wild and ransomware actors use this flaw. Until patched, restrict network access to the management interface and iControl REST to trusted administration networks. Because ransomware use is known, review affected devices for indicators of compromise such as unexpected commands, created or deleted files, and disabled services.

CVE-2021-26855 is a server-side request forgery flaw (CWE-918) in Microsoft Exchange Server that allows an unauthenticated remote attacker to send specially crafted HTTP requests and have the Exchange server process them as itself, disclosing sensitive session information. When chained with sibling Exchange flaws (the 'ProxyLogon' chain), it yields authentication bypass and arbitrary file write, escalating to full remote code execution with SYSTEM-level privileges on the on-premises Exchange server. Any organization running an affected on-premises Exchange server reachable over HTTP/HTTPS (typically outbound webmail) is exposed; Exchange Online was not affected. Exploitation is confirmed in the wild at large scale: the flaw was mass-exploited beginning in early 2021 (notably by the HAFNIUM group), is on the CISA KEV with documented ransomware use, and has a maximum EPSS score of 100% (100th percentile), despite no public PoC listing.

Do: Apply the vendor's March 2021 Exchange security updates (or later cumulative updates) immediately, per the CISA required action; until patched, limit Exchange (ECP/OWA) exposure to the internet via firewall/VPN rules. Hunt for compromise: review IIS logs for unrecognized authenticated activity against FrontEnd HttpProxy endpoints, and check for malicious files or webshells under inetpub\wwwroot\aspnet_client, given the known ransomware use.

The fix issued for CVE-2020-17530 was incomplete. So from Apache Struts 2.0.0 to 2.5.29, still some of the tag’s attributes could perform a double evaluation if a developer applied forced OGNL evaluation by using the %{...} syntax. Using forced OGNL evaluation on untrusted user input can lead to a Remote Code Execution and security degradation.

Microsoft Exchange Server contains a server-side request forgery (SSRF, CWE-918) in the Autodiscover service that unauthenticated remote attackers can reach over HTTP. This flaw is the first stage of the widely documented 'ProxyShell' chain, in which the SSRF is combined with privilege escalation and an arbitrary file write in the Exchange PowerShell backend to achieve unauthenticated remote code execution on the server. An attacker who successfully exploits it gains the ability to run code on the Exchange server, and ransomware operators (e.g., Cuba ransomware) leveraged this chain to deploy payloads. Organizations running on-premises Microsoft Exchange Server (2013, 2016, and 2019 per the vendor's advisories) are affected; hosted Exchange Online is a separately managed cloud service. Exploitation is confirmed in the wild: CISA added the flaw to the KEV catalog on 2021-11-03 with known ransomware use, and EPSS assigns it a 100% probability of exploitation within 30 days (100th percentile).

Do: Apply Microsoft's July 2021 (or later) Exchange Server security updates, which include the ProxyShell fixes, to all on-premises servers. If patching is delayed, restrict internet access to the Autodiscover/EWS frontend endpoints and consider the URL Rewrite mitigation Microsoft published for ProxyShell. Given the KEV listing and known ransomware use, treat internet-facing, unpatched Exchange servers as potentially compromised and hunt for webshells, unusual Exchange processes, and suspicious account or mailbox activity.

ForgeRock Access Management (AM) Core Server contains a Java deserialization flaw (CWE-502, deserialization of untrusted data) that allows remote code execution. An attacker triggers it by sending a specially crafted HTTP request carrying malicious serialized data to one of three web endpoints: /ccversion/Version, /ccversion/Masthead, or /ccversion/ButtonFrame. Successful exploitation executes arbitrary code in the context of the AM service account, which per the vendor is typically a non-root user, so the attacker gains the privileges of the application process on that server. Any organization running ForgeRock AM Core Server is affected, especially where the /ccversion/ endpoints are reachable by untrusted networks. The flaw is being actively exploited in the wild: it was added to CISA's Known Exploited Vulnerabilities catalog on 2021-11-03 with known ransomware use, EPSS assigns a 100% probability of exploitation within 30 days, and no public PoC is tracked in the source data.

Do: Apply ForgeRock's update per vendor instructions (the CISA KEV required action), prioritizing internet-facing AM servers. As an interim mitigation, block or restrict access to the /ccversion/ endpoints (e.g., /ccversion/*) at a reverse proxy or WAF, and ensure AM runs under a non-root service account. Because ransomware use is known, review access logs for requests to /ccversion/Version, /ccversion/Masthead, and /ccversion/ButtonFrame and treat any exposed, unpatched host as potentially compromised.

CVE-2021-38647 is an unauthenticated remote code execution flaw (CWE-1390, missing authentication) in Microsoft's Open Management Infrastructure (OMI), the open-source Linux management agent Microsoft bundles into Azure VM management extensions and System Center Operations Manager (SCOM) agents. When OMI is deployed through these extensions (for example the Log Analytics/OMS agent, Azure Monitor, or Azure Automation), its root-privileged server component listens for management traffic on the network (by default ports 5985/5986), and an attacker who can reach that port can send specially crafted, unauthenticated management requests that execute commands as root. Successful exploitation gives an attacker full root-level control of the affected Linux VM, turning network reachability into complete host compromise and a foothold for lateral movement. Any Azure Linux VM with an OMI-based management extension, plus standalone OMI or SCOM-agent deployments on Linux, is affected; CISA added the bug to the KEV on 2021-11-03 with known ransomware use, so exploitation is confirmed in the wild even though no public proof-of-concept is catalogued, and EPSS estimates a ~99.9% near-term exploitation probability.

Do: Upgrade OMI to version 1.6.8-1 or later on all Linux VMs, including updating the bundled OMI inside Azure management extensions (Log Analytics/OMS agent, Azure Monitor, Azure Automation) and applying patched SCOM agent builds. Restrict network access to OMI's listener ports (5985/5986) with NSGs or host firewalls and check whether omiserver runs as root while binding beyond localhost. Because the flaw is in CISA KEV with known ransomware use, prioritize patching hosts whose OMI listener is reachable from untrusted networks and hunt for unexplained root-level activity.

CVE-2021-40438 is a server-side request forgery flaw (CWE-918) in the mod_proxy module of Apache HTTP Server 2.4.48 and earlier. By sending a crafted request URI path, a remote attacker can cause the server to forward the request to an origin server chosen by the attacker instead of the intended backend. This lets the attacker use the web server as a proxy to reach internal network services, probe internal hosts, and bypass network access controls. Anyone running an affected Apache HTTP Server version with mod_proxy enabled in a proxying configuration is affected. The flaw is being actively exploited in the wild - it was added to CISA's Known Exploited Vulnerabilities catalog on 2021-12-01 with known ransomware use - and EPSS assigns it the highest probability of near-term exploitation.

Do: Upgrade Apache HTTP Server to a release newer than 2.4.48 per vendor instructions. As an interim mitigation, restrict mod_proxy so it forwards only to explicitly configured backends (avoiding attacker-controlled origin selection) or disable mod_proxy where it is not required, and audit internet-facing Apache servers for proxy configurations. Because this flaw is on the CISA KEV list with known ransomware use, prioritize patching internet-facing systems immediately.

CVE-2021-40539 is a critical (CVSS 9.8) authentication bypass in the REST API of Zoho ManageEngine ADSelfService Plus, caused by use of an incorrectly resolved name or reference (CWE-706). An unauthenticated, network-adjacent or internet-reachable attacker sends specially crafted requests to the product's REST API, bypassing authentication, and can chain the bypass to full remote code execution with no privileges or user interaction required. Successful exploitation yields complete compromise of the self-service portal server (high impact to confidentiality, integrity and availability); public reporting and vendor notes document attackers dropping malicious code and web shells onto vulnerable servers. Any organization running ManageEngine ADSelfService Plus build 6113 or earlier is affected, which typically means enterprise Microsoft Active Directory environments running this widely deployed self-service password/SSO portal. Exploitation is confirmed in the wild: the flaw was added to CISA KEV on 2021-11-03 with known ransomware use, EPSS puts the 30-day exploitation probability at 99% (100th percentile), Microsoft warned that Chinese threat actors were actively exploiting it, a public proof-of-concept is available, and it ranked among CISA's most routinely exploited vulnerabilities.

Do: Immediately upgrade ManageEngine ADSelfService Plus to a fixed build newer than 6113 per the vendor's update instructions, as required by CISA. Because exploitation predates patching and the flaw has been used to drop malicious code, check ADSelfService Plus servers for web shells, unexpected scheduled tasks, and unexplained accounts/processes, and hunt for indicators from the published analyses. Where possible, restrict internet exposure of the ADSelfService Plus REST API while patching, prioritized for externally reachable instances.

Apache HTTP Server contains a path traversal flaw (CWE-22) that lets crafted HTTP requests reach files outside directories configured via Alias-like directives. When files outside those aliased directories are not protected by the default 'require all denied' policy, attackers can read arbitrary files outside the intended root, and if CGI scripts are enabled the traversal can be escalated to remote code execution under the web server account. Anyone running an affected Apache HTTP Server release with such a configuration is exposed; the initial 2.4.50 patch was incomplete, so the flaw's full remediation is tracked under CVE-2021-42013. Exploitation is confirmed in the wild: CISA added the vulnerability to the KEV catalog on 2021-11-03 with known ransomware use, and EPSS assigns a ~100% probability of exploitation within 30 days (100th percentile).

Do: Upgrade to Apache HTTP Server 2.4.51 or later; do not stop at 2.4.50, since its fix was incomplete (see CVE-2021-42013). As an interim mitigation, ensure directories referenced by Alias-like directives are covered by 'require all denied' and disable or restrict CGI (mod_cgi/mod_cgid) on traversable paths. Review access logs for traversal patterns such as /icons/../ and unexpected CGI invocations, and hunt for webshells or ransomware staging given the known ransomware use.

Apache HTTP Server contains a path traversal flaw (CWE-22) that can lead to remote code execution; CVE-2021-42013 resolves an incomplete patch previously issued for CVE-2021-41773. The flaw is triggered when files outside directories mapped by Alias-like directives are not protected by the default 'require all denied' configuration, or when CGI scripts are enabled, allowing an attacker to traverse outside the intended directory roots. An attacker can read files outside the configured paths, and where CGI script execution is enabled, achieve remote code execution on the server. The affected product per CISA is Apache HTTP Server; the source data does not specify exact version ranges, so defenders should consult the vendor advisory for fixed releases. Exploitation is confirmed in the wild: the vulnerability was added to CISA KEV on 2021-11-03 with known ransomware use, EPSS estimates a 100% probability of exploitation within 30 days, and no public PoC is listed.

Do: Apply the Apache HTTP Server update per vendor instructions immediately, since this is a CISA KEV item with known ransomware use and near-certain near-term exploitation. Until patched, ensure directories targeted by Alias-like directives are covered by 'require all denied' defaults and disable CGI script execution where it is not required. Review access logs for path traversal probes and confirm no replaced version retains the incomplete earlier patch.

Apache Log4j2, an extremely widely used Java logging library, fails to protect its JNDI lookup feature against attacker-controlled JNDI-related endpoints (CWE-20, CWE-502), so crafted text processed by the logger causes the Java runtime to fetch and load attacker-supplied objects, leading to remote code execution. The flaw is triggered whenever attacker-controlled input reaches the logging API and is parsed for JNDI lookups, a pattern common in web servers and enterprise Java applications that log user-supplied fields such as headers or form values. Successful exploitation yields arbitrary code execution under the privileges of the affected application, giving attackers a foothold for lateral movement, data theft, and ransomware deployment. Any Java application or product that ships or bundles an affected Apache Log4j2 release is exposed, making this one of the most broadly deployed vulnerabilities ever disclosed. Exploitation is confirmed in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2021-12-10 with known ransomware use, and EPSS assigns a 100% probability of exploitation within 30 days.

Do: Inventory all Java applications and dependencies for Apache Log4j2 and apply the vendor's patched updates, or remove affected assets from the network, as required by CISA's KEV catalog. Where updates are not yet available, use the temporary mitigations in CISA's ED-22-02 recommended-mitigation guidance, such as disabling message lookups, only until patches are applied. Prioritize internet-facing and business-critical systems and hunt for exploitation activity given known ransomware use.

CVE-2021-45046 is a remote code execution and information disclosure flaw in Apache Log4j2 (CWE-917) that resulted from an incomplete fix to CVE-2021-44228 (Log4Shell), leaving the Thread Context Lookup Pattern vulnerable in certain non-default configurations. It is triggered when an application logs attacker-controlled data using layouts or patterns that perform Thread Context (MDC) lookups, allowing crafted lookup expressions to be evaluated against untrusted input. A successful attacker can achieve remote code execution, or potentially information disclosure, on the affected service. Any deployment of Apache Log4j2 that relies on the affected non-default lookup configurations is exposed, which given Log4j2's ubiquity in Java applications and embedded products means a very large installed base. Exploitation is confirmed: the flaw is in CISA KEV (added 2023-05-01) with known ransomware use, and EPSS assigns a 100% probability of exploitation within 30 days.

Do: Upgrade Log4j2 to 2.17.0 or later per vendor instructions (or 2.12.3/2.3.1 for the legacy 2.12/2.3 branches), since the 2.16.0 fix was itself incomplete in some non-default configurations. Where upgrading is not immediately possible, remove the JndiLookup class from the Log4j2 jar or disable lookup processing, and audit applications and dependencies that bundle Log4j2 while following the CISA KEV required action to apply vendor updates.

VMware Tanzu's Spring Cloud Function contains a remote code execution flaw (CWE-94, expression-language code injection) in its routing functionality. When the routing feature evaluates an attacker-supplied Spring Expression Language (SpEL) routing-expression, a specially crafted expression is processed by the framework, resulting in arbitrary code execution on the server and access to local resources. Any deployment of Spring Cloud Function that evaluates untrusted routing-expressions, typically via exposed application endpoints, is affected. An attacker who can reach such an endpoint gains code execution in the context of the running application, which can lead to data theft, lateral movement, or ransomware. Exploitation is confirmed in the wild: CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2022-08-25 and EPSS rates the 30-day exploitation probability at 99.9% (100th percentile), although no public PoC is cataloged in this data.

Do: Apply the vendor update per VMware/Tanzu instructions immediately, as patching is the required action for this KEV-listed vulnerability. Until patched, prevent untrusted clients from supplying the routing-expression (restrict or disable the routing functionality) and limit network exposure of affected services. Review application logs for unexpected SpEL payloads in routing-expressions and check affected hosts for indicators of compromise, including ransomware staging.

CVE-2022-22965 ('Spring4Shell') is a critical (CVSS 9.8) remote code execution flaw in VMware's Spring Framework, caused by insecure data binding that lets unauthenticated attackers overwrite internal class and module properties through crafted request parameters (CWE-94, code injection). It affects Spring MVC and Spring WebFlux applications running on JDK 9 or later; the demonstrated exploit path requires a Tomcat WAR deployment, while applications packaged as Spring Boot executable jars are not exploitable that way, though the underlying issue may be reachable via other routes. A successful attack yields full remote code execution with the privileges of the application server, with no authentication or user interaction required. VMware Spring Framework 5.3.0-5.3.17 and 5.2.0-5.2.19 (plus older releases) are affected, and the flaw also impacts bundled products from Cisco, Oracle, Siemens and Veritas, including multiple Oracle Communications Cloud Native Core components. It is being actively exploited in the wild: added to CISA's KEV on 2022-04-04, EPSS puts 30-day exploitation probability at 99.6% (100th percentile), a public PoC is available, and mass scanning of vulnerable servers has been observed.

Do: Upgrade Spring Framework to 5.3.18, 5.2.20 or later (or apply vendor-supplied fixes for bundled products, e.g., via Oracle's patch release and Cisco's advisory), prioritizing internet-facing Tomcat WAR deployments on JDK 9+; this is a CISA KEV entry, so treat patching as urgent. If patching must wait, mitigate by running on JDK 8, deploying as a Spring Boot executable jar rather than a WAR on Tomcat, and applying the vendor-documented workaround that disallows 'class.*', 'Class.*' and 'module.*' fields in data binding. Inventory exposed Tomcat/Spring services and hunt for signs of exploitation given confirmed in-the-wild use.