Zero-day report: April 2024
CISA added 10 exploited vulnerabilities to its catalog in April 2024, 0 more than March (10). 8 were zero-days, listed within a week of going public. 1 is known to be used by ransomware. The most-hit vendor was Android, with 2.
By technology
Most-hit vendors
Every flaw added in April 2024
- Microsoft · SmartScreen PromptMicrosoft SmartScreen Prompt Security Feature Bypass Vulnerability
- Cisco · Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)Cisco ASA and FTD Denial of Service Vulnerability
- Cisco · Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)Cisco ASA and FTD Privilege Escalation Vulnerability
- CrushFTP · CrushFTPCrushFTP VFS Sandbox Escape Vulnerability
- Microsoft · WindowsMicrosoft Windows Print Spooler Privilege Escalation Vulnerability
- Palo Alto Networks · PAN-OSPalo Alto Networks PAN-OS Command Injection Vulnerability
- D-Link · Multiple NAS DevicesD-Link Multiple NAS Devices Use of Hard-Coded Credentials Vulnerability
- D-Link · Multiple NAS DevicesD-Link Multiple NAS Devices Command Injection Vulnerability
- Android · PixelAndroid Pixel Information Disclosure Vulnerability
- Android · PixelAndroid Pixel Privilege Escalation Vulnerability
Source: CISA's Known Exploited Vulnerabilities catalog, by the date CISA added each flaw. Ransomware use is CISA's flag.