Zero-day report: March 2024
CISA added 10 exploited vulnerabilities to its catalog in March 2024, 1 more than February (9). 3 were zero-days, listed within a week of going public. 5 are known to be used by ransomware. The most-hit vendor was Apple, with 2.
By technology
Most-hit vendors
Every flaw added in March 2024
- Microsoft · SharePoint ServerMicrosoft SharePoint Server Code Injection Vulnerability
- Nice · Linear eMerge E3-SeriesNice Linear eMerge E3-Series OS Command Injection Vulnerability
- Ivanti · Endpoint Manager Cloud Service Appliance (EPM CSA)Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection Vulnerability
- Fortinet · FortiClient EMSFortinet FortiClient EMS SQL Injection Vulnerability
- JetBrains · TeamCityJetBrains TeamCity Authentication Bypass Vulnerability
- Apple · Multiple ProductsApple Multiple Products Memory Corruption Vulnerability
- Apple · Multiple ProductsApple Multiple Products Memory Corruption Vulnerability
- Sunhillo · SureLineSunhillo SureLine OS Command Injection Vulnerablity
- Android · PixelAndroid Pixel Information Disclosure Vulnerability
- Microsoft · WindowsMicrosoft Windows Kernel Exposed IOCTL with Insufficient Access Control Vulnerability
Source: CISA's Known Exploited Vulnerabilities catalog, by the date CISA added each flaw. Ransomware use is CISA's flag.