Zero-day report: October 2023
CISA added 18 exploited vulnerabilities to its catalog in October 2023, 1 fewer than September (19). 11 were zero-days, listed within a week of going public. 5 are known to be used by ransomware. The most-hit vendor was Cisco, with 3.
By technology
Most-hit vendors
Every flaw added in October 2023
- F5 · BIG-IP Configuration UtilityF5 BIG-IP Configuration Utility Authentication Bypass Vulnerability
- F5 · BIG-IP Configuration UtilityF5 BIG-IP Configuration Utility SQL Injection Vulnerability
- Roundcube · WebmailRoundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability
- Cisco · Cisco IOS XE Web UICisco IOS XE Web UI Command Injection Vulnerability
- Citrix · NetScaler ADC and NetScaler GatewayCitrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability
- Cisco · IOS XE Web UICisco IOS XE Web UI Privilege Escalation Vulnerability
- Cisco · IOS and IOS XECisco IOS and IOS XE Group Encrypted Transport VPN Out-of-Bounds Write Vulnerability
- Adobe · Acrobat and ReaderAdobe Acrobat and Reader Use-After-Free Vulnerability
- Microsoft · WordPadMicrosoft WordPad Information Disclosure Vulnerability
- Microsoft · Skype for BusinessMicrosoft Skype for Business Privilege Escalation Vulnerability
- IETF · HTTP/2HTTP/2 Rapid Reset Attack Vulnerability
- Atlassian · Confluence Data Center and ServerAtlassian Confluence Data Center and Server Broken Access Control Vulnerability
- Progress · WS_FTP ServerProgress WS_FTP Server Deserialization of Untrusted Data Vulnerability
- Apple · iOS and iPadOSApple iOS and iPadOS Kernel Privilege Escalation Vulnerability
- Microsoft · Windows CNG Key Isolation ServiceMicrosoft Windows CNG Key Isolation Service Privilege Escalation Vulnerability
- JetBrains · TeamCityJetBrains TeamCity Authentication Bypass Vulnerability
- Arm · Mali GPU Kernel DriverArm Mali GPU Kernel Driver Use-After-Free Vulnerability
- Google · Chromium libvpxGoogle Chromium libvpx Heap Buffer Overflow Vulnerability
← September 2023November 2023 →
Source: CISA's Known Exploited Vulnerabilities catalog, by the date CISA added each flaw. Ransomware use is CISA's flag.