Zero-day report: July 2023
CISA added 16 exploited vulnerabilities to its catalog in July 2023, 8 fewer than June (24). 12 were zero-days, listed within a week of going public. 4 are known to be used by ransomware. The most-hit vendor was Microsoft, with 5.
By technology
Most-hit vendors
Every flaw added in July 2023
- Ivanti · Endpoint Manager Mobile (EPMM)Ivanti Endpoint Manager Mobile (EPMM) Path Traversal Vulnerability
- Synacor · Zimbra Collaboration Suite (ZCS)Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability
- Apple · Multiple ProductsApple Multiple Products Kernel Unspecified Vulnerability
- Ivanti · Endpoint Manager Mobile (EPMM)Ivanti Endpoint Manager Mobile Authentication Bypass Vulnerability
- Adobe · ColdFusionAdobe ColdFusion Improper Access Control Vulnerability
- Adobe · ColdFusionAdobe ColdFusion Improper Access Control Vulnerability
- Citrix · NetScaler ADC and NetScaler GatewayCitrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability
- Microsoft · WindowsMicrosoft Windows Search Remote Code Execution Vulnerability
- SolarView · CompactSolarView Compact Command Injection Vulnerability
- Apple · Multiple ProductsApple Multiple Products WebKit Code Execution Vulnerability
- Netwrix · AuditorNetwrix Auditor Insecure Object Deserialization Vulnerability
- Microsoft · WindowsMicrosoft Windows MSHTML Platform Privilege Escalation Vulnerability
- Microsoft · WindowsMicrosoft Windows Defender SmartScreen Security Feature Bypass Vulnerability
- Microsoft · OutlookMicrosoft Outlook Security Feature Bypass Vulnerability
- Microsoft · WindowsMicrosoft Windows Error Reporting Service Privilege Escalation Vulnerability
- Arm · Mali Graphics Processing Unit (GPU)Arm Mali GPU Kernel Driver Use-After-Free Vulnerability
Source: CISA's Known Exploited Vulnerabilities catalog, by the date CISA added each flaw. Ransomware use is CISA's flag.