NewsCompaniesFlawsGuides
Get the app

Flaws added in January 2022

From Exploited flaws, HARD’s guide to the flaws being used in attacks
This article lists the flaws CISA added in January 2022. For the newest, see Exploited flaws.

In January 2022, CISA added 40 flaws to its list of vulnerabilities being used in attacks, 7 of them in things people have at home; 9 have been used by ransomware gangs. Most came from Microsoft (6), Apache (4) and Nagios (3).[1]

Most let an attacker take over the product, running their own code or taking full control.

List of flaws

Every flaw CISA added in January 2022, newest first, in plain English, each with an article of its own.[2] marks the ones used in ransomware.

8 added

CVEFlawFound
CVE-2022-22587At home Apple iOS and macOS. Attackers can run their own code on Apple iOS and macOS. At home
CVE-2021-20038† Used in ransomwareAt work SonicWall SMA 100 Appliances. Attackers can run their own code on SonicWall SMA 100 Appliances from anywhere, without logging in. At work
CVE-2020-5722At work Grandstream UCM6200. Attackers can run their own code on Grandstream UCM6200 from anywhere, without logging in. At work
CVE-2020-0787† Used in ransomwareAt home Microsoft Windows. Attackers can run their own code on Microsoft Windows. At home
CVE-2017-5689At work Intel Active Management Technology (AMT), Small Business Technology (SBT), and Standard Manageability. Someone who already has a foothold can use Intel Active Management Technology (AMT), Small Business Technology (SBT), and Standard Manageability to take full control of the machine. At work
CVE-2014-7169At work GNU Bourne-Again Shell (Bash). Attackers can run their own code on GNU Bourne-Again Shell (Bash). At work
CVE-2014-6271At work GNU Bourne-Again Shell (Bash). Attackers can run their own code on GNU Bourne-Again Shell (Bash). At work
CVE-2014-1776At home Microsoft Internet Explorer. Attackers can run their own code on Microsoft Internet Explorer. At home

4 added

CVEFlawFound
CVE-2021-35247At work SolarWinds Serv-U. Attackers are using a flaw in SolarWinds Serv-U. At work
CVE-2018-8453† Used in ransomwareAt home Microsoft Win32k. Someone who already has a foothold can use Microsoft Win32k to take full control of the machine. At home
CVE-2012-0391At work Apache Struts 2. Attackers can run their own code on Apache Struts 2. At work
CVE-2006-1547At work Apache Struts 1. Attackers can crash Apache Struts 1 or stop it working. At work

13 added

CVEFlawFound
CVE-2021-40870At work Aviatrix Controller. Attackers can run their own code on Aviatrix Controller from anywhere, without logging in. At work
CVE-2021-33766At work Microsoft Exchange Server. Attackers can read information from Microsoft Exchange Server that should be private from anywhere, without logging in. At work
CVE-2021-32648At work October CMS. Attackers can get into October CMS without a valid password. At work
CVE-2021-25298At work Nagios XI. Someone who already has a way in can use Nagios XI to run their own code. At work
CVE-2021-25297At work Nagios XI. Someone who already has a way in can use Nagios XI to run their own code. At work
CVE-2021-25296At work Nagios XI. Someone who already has a way in can use Nagios XI to run their own code. At work
CVE-2021-22991At work F5 BIG-IP Traffic Management Microkernel. Attackers can run their own code on F5 BIG-IP Traffic Management Microkernel. At work
CVE-2021-21975† Used in ransomwareAt work VMware vRealize Operations Manager API. Attackers can make VMware vRealize Operations Manager API send requests into the network behind it. At work
CVE-2021-21315At work Npm package System Information Library for Node.JS. Attackers can run commands on Npm package System Information Library for Node.JS. At work
CVE-2020-14864At work Oracle Intelligence Enterprise Edition. Attackers can read files on Oracle Intelligence Enterprise Edition that should be out of reach from anywhere, without logging in. At work
CVE-2020-13927At work Apache Airflow's Experimental API. Attackers can get into Apache Airflow's Experimental API without a valid password. At work
CVE-2020-13671At work Drupal core. Attackers are using a flaw in Drupal core. At work
CVE-2020-11978At work Apache Airflow. Someone who already has a way in can use Apache Airflow to run their own code. At work

15 added

CVEFlawFound
CVE-2021-36260At home Hikvision Security cameras web server. Attackers can run commands on Hikvision Security cameras web server. At home
CVE-2021-27860At work FatPipe WARP, IPVPN, and MPVPN software. Attackers are using a flaw in FatPipe WARP, IPVPN, and MPVPN software. At work
CVE-2021-22017At work VMware vCenter Server. Attackers can reach parts of VMware vCenter Server that should be locked to them. At work
CVE-2020-6572At home Google Chrome Media. A booby-trapped web page can run an attacker's code through Google Chrome Media. At home
CVE-2019-9670At work Synacor Zimbra Collaboration Suite (ZCS). Attackers can read files on Synacor Zimbra Collaboration Suite (ZCS) that should be out of reach. At work
CVE-2019-7609At work Elastic Kibana. Attackers can run their own code on Elastic Kibana. At work
CVE-2019-2725† Used in ransomwareAt work Oracle WebLogic Server. Attackers are using a flaw in Oracle WebLogic Server. At work
CVE-2019-1579† Used in ransomwareAt work Palo Alto Networks PAN-OS. Attackers can run their own code on Palo Alto Networks PAN-OS from anywhere, without logging in. At work
CVE-2019-1458† Used in ransomwareAt home Microsoft Win32k. Someone who already has a foothold can use Microsoft Win32k to take full control of the machine. At home
CVE-2019-10149At work Exim Mail Transfer Agent (MTA). Attackers are using a flaw in Exim Mail Transfer Agent (MTA). At work
CVE-2018-13383† Used in ransomwareAt work Fortinet FortiOS and FortiProxy. Attackers can corrupt memory in Fortinet FortiOS and FortiProxy, which they use to take it over. At work
CVE-2018-13382† Used in ransomwareAt work Fortinet FortiOS and FortiProxy. Attackers are using a flaw in Fortinet FortiOS and FortiProxy. At work
CVE-2017-1000486At work Primetek Primefaces Application. Attackers can run their own code on Primetek Primefaces Application. At work
CVE-2015-7450At work IBM WebSphere Application Server and Server Hypervisor Edition. Attackers can run their own code on IBM WebSphere Application Server and Server Hypervisor Edition. At work
CVE-2013-3900At work Microsoft WinVerifyTrust function. Attackers can run their own code on Microsoft WinVerifyTrust function. At work

Companies

The flaws were in 26 companies’ products; the most were in Microsoft’s (6).

CompanyFlawsRansomware
Microsoft63
Apache4–
Nagios3–
Fortinet22
GNU2–
Oracle21
VMware21
Apple1–
Aviatrix1–
Drupal1–
Elastic1–
Exim1–
F51–
FatPipe1–
Google1–
11 others11

Other months

Every month since CISA started the list; January 2022 is outlined.

Flaws added to CISA’s list each month
YearJanFebMarAprMayJunJulAugSepOctNovDecTotal
2026 17282631212326314336 282
2025 142732152420201516311120 245
2024 2191010149141925172216 186
2023 5141817192416819181811 187
2022 40322264583483232412109 555
2021 29120 311
2026282 flaws
Jan17Feb28Mar26Apr31May21Jun23Jul26Aug31Sep43Oct36NovDec
2025245 flaws
Jan14Feb27Mar32Apr15May24Jun20Jul20Aug15Sep16Oct31Nov11Dec20
2024186 flaws
Jan21Feb9Mar10Apr10May14Jun9Jul14Aug19Sep25Oct17Nov22Dec16
2023187 flaws
Jan5Feb14Mar18Apr17May19Jun24Jul16Aug8Sep19Oct18Nov18Dec11
2022555 flaws
Jan40Feb32Mar226Apr45May83Jun48Jul3Aug23Sep24Oct12Nov10Dec9
2021311 flaws
JanFebMarAprMayJunJulAugSepOctNov291Dec20

References

  1. ^ Cybersecurity and Infrastructure Security Agency. “Known Exploited Vulnerabilities Catalog”. Version 2026.10.30, updated 30 Oct 2026. CISA adds a flaw when it has reliable evidence of it being used in attacks; the date is when it was added, not when the attacks began.
  2. ^ HARD. Plain-English summaries written from CISA’s and NVD’s text, on each flaw’s page.

See also Exploited flaws, Companies, and Search for any app or company.