Zero-day report: February 2024
CISA added 9 exploited vulnerabilities to its catalog in February 2024, 12 fewer than January (21). 5 were zero-days, listed within a week of going public. 4 are known to be used by ransomware. The most-hit vendor was Microsoft, with 4.
By technology
Most-hit vendors
Every flaw added in February 2024
- Microsoft · Streaming ServiceMicrosoft Streaming Service Untrusted Pointer Dereference Vulnerability
- ConnectWise · ScreenConnectConnectWise ScreenConnect Authentication Bypass Vulnerability
- Cisco · Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)Cisco ASA and FTD Information Disclosure Vulnerability
- Microsoft · Exchange ServerMicrosoft Exchange Server Privilege Escalation Vulnerability
- Microsoft · WindowsMicrosoft Windows SmartScreen Security Feature Bypass Vulnerability
- Microsoft · WindowsMicrosoft Windows Internet Shortcut Files Security Feature Bypass Vulnerability
- Roundcube · WebmailRoundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability
- Fortinet · FortiOSFortinet FortiOS Out-of-Bound Write Vulnerability
- Google · Chromium V8Google Chromium V8 Type Confusion Vulnerability
Source: CISA's Known Exploited Vulnerabilities catalog, by the date CISA added each flaw. Ransomware use is CISA's flag.