NCSC and allies reveal most common cyber vulnerabilities exploited in 2022
Above:
The National Cyber Security Centre (NCSC), Nova South, London.
Image by Simona Flamigni / copyright Shutterstock
In a new joint advisory, the National Cyber Security Centre (NCSC) – a part of GCHQ – and agencies in the US, Australia, Canada and New Zealand, have revealed a list of the top 12 vulnerabilities that were routinely exploited last year.
More than half of the top vulnerabilities listed for 2022 also appeared on the previous year’s list, highlighting how malicious cyber actors continued targeting previously disclosed flaws in internet-facing systems – despite security updates being available to fix them.
Attackers generally see the most success exploiting known vulnerabilities within the first two years of public disclosure and likely target their exploits to maximise impact, emphasising the benefit of organisations applying security updates promptly.
In addition to the top 12 list, the advisory also provides technical details about 30 other routinely exploited vulnerabilities, alongside mitigation advice to help organisations and software developers reduce the risk of compromise.
UK organisations are also encouraged to sign up for the NCSC’s Early Warning service to receive alerts about potential issues, including vulnerabilities, affecting their networks.
Jonathon Ellison, NCSC Director of Resilience and Future Technology, said: “Vulnerabilities are sadly part and parcel of our online world and we see threat actors continue to take advantage of these weaknesses to compromise systems.
“This joint advisory with our allies raises awareness of the most routinely exploited vulnerabilities in 2022 to help organisations identify where they might be at risk and take action.
“To bolster resilience, we encourage organisations to apply all security updates promptly and call on software vendors to ensure security is at the core of their product design to help shift the burden of responsibility away from consumers.”
All UK organisations are eligible to sign up for Early Warning and can register via the NCSC website . The NCSC also has guidance to help organisations with vulnerability management .
Software vendors, designers and developers are encouraged to embed secure-by-design practices into every stage of the development life cycle to help identify root causes of vulnerabilities and address them.
The new advisory has been jointly issued by the NCSC, the US Cybersecurity and Infrastructure Security Agency (CISA), the US National Security Agency (NSA), the US Federal Bureau of Investigation (FBI), the Australian Signals Directorate's Australian Cyber Security Centre (ACSC), the Canadian Centre for Cyber Security (CCCS), the Computer Emergency Response Team New Zealand (CERT NZ) and the New Zealand National Cyber Security Centre (NCSC-NZ).
It can be read on CISA’s website .
