Zero-day report: September 2023
CISA added 19 exploited vulnerabilities to its catalog in September 2023, 11 more than August (8). 12 were zero-days, listed within a week of going public. 3 are known to be used by ransomware. The most-hit vendor was Apple, with 5.
By technology
Most-hit vendors
Every flaw added in September 2023
- Red Hat · JBoss RichFaces FrameworkRed Hat JBoss RichFaces Framework Expression Language Injection Vulnerability
- Apple · Multiple ProductsApple Multiple Products Improper Certificate Validation Vulnerability
- Apple · Multiple ProductsApple Multiple Products Kernel Privilege Escalation Vulnerability
- Apple · Multiple ProductsApple Multiple Products WebKit Code Execution Vulnerability
- Trend Micro · Apex One and Worry-Free Business SecurityTrend Micro Apex One and Worry-Free Business Security Remote Code Execution Vulnerability
- MinIO · MinIOMinIO Security Feature Bypass Vulnerability
- Realtek · SDKRealtek SDK Improper Input Validation Vulnerability
- Zyxel · EMG2926 RoutersZyxel EMG2926 Routers Command Injection Vulnerability
- Laravel · IgnitionLaravel Ignition File Upload Vulnerability
- Samsung · Mobile DevicesSamsung Mobile Devices Use-After-Free Vulnerability
- Adobe · Acrobat and ReaderAdobe Acrobat and Reader Out-of-Bounds Write Vulnerability
- Cisco · Adaptive Security Appliance and Firepower Threat DefenseCisco Adaptive Security Appliance and Firepower Threat Defense Unauthorized Access Vulnerability
- Android · FrameworkAndroid Framework Privilege Escalation Vulnerability
- Google · Chromium WebPGoogle Chromium WebP Heap-Based Buffer Overflow Vulnerability
- Microsoft · WordMicrosoft Word Information Disclosure Vulnerability
- Microsoft · Streaming Service ProxyMicrosoft Streaming Service Proxy Privilege Escalation Vulnerability
- Apple · iOS, iPadOS, and watchOSApple iOS, iPadOS, and watchOS Wallet Code Execution Vulnerability
- Apple · iOS, iPadOS, and macOSApple iOS, iPadOS, and macOS ImageIO Buffer Overflow Vulnerability
- Apache · RocketMQApache RocketMQ Command Execution Vulnerability
Source: CISA's Known Exploited Vulnerabilities catalog, by the date CISA added each flaw. Ransomware use is CISA's flag.