Loading story…
A multinational advisory from CISA, New Zealand’s National Cyber Security Centre and partner agencies identified the 15 vulnerabilities most routinely exploited in 2023, with more than half affecting network devices and infrastructure. Most were initially exploited as zero-days, reversing the pattern observed in 2022 and highlighting increased exploitation before public disclosure. Attackers continued to achieve the greatest success against vulnerabilities within two years of disclosure, although patching, system replacement and coordinated cybersecurity efforts reduced their usefulness. Vendor patches or fixes were available for every vulnerability listed.
Eclypsium highlighted detection gaps on network appliances, many of which cannot support endpoint detection and response agents—even when they perform security functions. Sophos firewall vulnerabilities and firmware security misconfigurations associated with the Pacific Rim attacks illustrate these risks. The agencies urged vigilant vulnerability management, while Eclypsium recommended regular patching, asset discovery, incident response planning, software supply-chain scrutiny and secure-by-design products with secure default configurations.
See which actors are running it and whether you're in range.
2 events from the most recent confirmed update back to the earliest known activity.
CISA and international partners issued an advisory identifying the top 15 vulnerabilities routinely exploited in 2023 and associated weaknesses. More than half affected network devices and infrastructure, and most were initially exploited as zero-days.
Following the Pacific Rim attacks, Eclypsium examined Sophos equipment and found disabled Intel Boot Guard on some vulnerable systems, unlocked System Management Mode and interrupt configuration, and missing BIOS write protections. These misconfigurations increased exposure to firmware-based attacks.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA’s Known Exploited Vulnerabilities (KEV) catalog saw a record 244 new entries in 2025, marking a 28% increase from the previous year and reflecting a significant escalation in actively exploited vulnerabilities. The majority of these additions targeted network devices, operating systems, and browsers, with Microsoft, Cisco, and Fortinet among the most affected vendors. The analysis highlights a shift in vulnerability management priorities, emphasizing the need to focus on real-world exploitation patterns rather than traditional CVSS scores, as attackers increasingly target network edge devices and critical infrastructure. In parallel, 2025 was characterized by a dramatic rise in network device exploitation, including high-profile incidents involving Cisco and F5, and the disclosure of three new network edge device vulnerabilities just before the year’s end. Notably, critical authentication bypass flaws (CVE-2025-59718 & CVE-2025-59719) in Fortinet’s FortiCloud SSO were identified, allowing unauthenticated attackers to gain access if the feature is enabled. These developments underscore the urgency for organizations to rapidly apply vendor patches and reassess vulnerability prioritization strategies, as attackers increasingly exploit both newly disclosed and older, medium-risk vulnerabilities in network infrastructure.
Jun 29, 2026
Threat actors have increasingly targeted remote access technologies in 2025 by exploiting a series of critical vulnerabilities, many of which were zero-days at the time of discovery. Security researchers have identified several high-impact vulnerabilities affecting widely deployed enterprise products, including Citrix NetScaler, Cisco IOS and IOS XE, Cisco ASA and FTD, Fortra GoAnywhere MFT, and Oracle E-Business Suite. These vulnerabilities have enabled remote code execution, authentication bypass, and other forms of unauthorized access, posing significant risks to organizations relying on these technologies for perimeter defense. Notably, some of these flaws, such as CVE-2025-7775 in Citrix NetScaler and CVE-2025-20352 in Cisco IOS/IOS XE, were exploited before public disclosure, highlighting the persistent threat of zero-day attacks. The threat actor group UAT4356, also known as ArcaneDoor, has been linked to the exploitation of certain Cisco vulnerabilities, demonstrating the involvement of sophisticated adversaries. In addition to newly discovered zero-days, attackers continue to leverage older, unpatched vulnerabilities, underscoring the ongoing challenge of maintaining effective patch management. Initial access brokers and both opportunistic and targeted threat actors have been observed using these exploits to gain footholds in enterprise environments, often as a precursor to further malicious activity such as extortion or data theft. Security bulletins from vendors like Ivanti and Fortinet have been referenced to provide guidance and mitigation steps for affected organizations. The prevalence of public proof-of-concept exploits for some vulnerabilities has accelerated their weaponization in the wild. The impact of these attacks is amplified by the critical role remote access technologies play in modern enterprise infrastructure, making timely detection and remediation essential. Security teams are urged to prioritize patching, monitor for signs of exploitation, and implement robust access controls to mitigate risk. The ongoing exploitation of both new and old vulnerabilities highlights the need for continuous vigilance and proactive security measures. Researchers emphasize the importance of machine-readable, well-vetted vulnerability intelligence to support rapid response. The trend of targeting remote access solutions is expected to persist, given their attractiveness as initial access vectors. Organizations are advised to review vendor advisories and apply recommended patches without delay. The evolving threat landscape requires a coordinated effort between vendors, security researchers, and enterprise defenders to reduce exposure and limit the impact of these attacks.
Jun 29, 2026
Security reporting and research highlighted accelerating exploitation pressure on enterprises, driven by both **zero-day** activity and the growing backlog of **known exploited vulnerabilities (KEVs)**. A Talos retrospective counted **48,196 CVEs in 2025** and **241 KEVs** (up from 186 in 2024), with a notable share of KEVs originating from older CVEs and even vulnerabilities dating back to 2007—reinforcing that attackers continue to monetize long-lived weaknesses when patching and asset visibility lag. Talos also noted disproportionate exploitation targeting **network edge infrastructure** (e.g., firewalls/VPNs), underscoring the operational risk of unpatched or hard-to-patch appliances and legacy systems. Separate threat reporting pointed to expanding attack volume and shifting attacker tradecraft that can amplify exploitation impact. Check Point data cited by Dark Reading said **Latin America** is seeing substantially higher weekly attack volume than the US (including higher proportions of **ransomware** and **infostealer** activity), consistent with adversaries concentrating on regions with faster digital adoption and lower security maturity. CSO Online also reported that the *Coruna* **iOS exploit kit** rapidly evolved from a targeted spyware capability into broader criminal use, illustrating how advanced exploitation tooling can commoditize quickly and increase the likelihood of opportunistic compromise across a wider victim set.
Jun 29, 2026