Flaws added in September 2022
From Exploited flaws, HARD’s guide to the flaws being used in attacks
This article lists the flaws CISA added in September 2022. For the newest, see Exploited flaws.
In September 2022, CISA added 24 flaws to its list of vulnerabilities being used in attacks, 11 of them in things people have at home; 6 have been used by ransomware gangs. Most came from Microsoft (4), Linux (3) and D-Link (3).[1]
Most let an attacker take over the product, running their own code or taking full control.
List of flaws
Every flaw CISA added in September 2022, newest first, in plain English, each with an article of its own.[2] marks the ones used in ransomware.
Show
3 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2022-41082† Used in ransomwareAt work |
Microsoft Exchange Server. Attackers can run their own code on Microsoft Exchange Server. | At work |
CVE-2022-41040† Used in ransomwareAt work |
Microsoft Exchange Server. Attackers can run their own code on Microsoft Exchange Server. | At work |
CVE-2022-36804At work |
Atlassian Bitbucket Server and Data Center. Attackers can run their own code on Atlassian Bitbucket Server and Data Center. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2022-3236At work |
Sophos Firewall. Attackers can run their own code on Sophos Firewall. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2022-35405At work |
Zoho ManageEngine. Attackers can run their own code on Zoho ManageEngine from anywhere, without logging in. | At work |
6 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2022-40139At work |
Trend Micro Apex One and Apex One as a Service. Attackers can run their own code on Trend Micro Apex One and Apex One as a Service. | At work |
CVE-2013-6282At work |
Linux Kernel. Someone who already has a foothold can use Linux Kernel to take full control of the machine. | At work |
CVE-2013-2597At work |
Code Aurora ACDB Audio Driver. Someone who already has a foothold can use Code Aurora ACDB Audio Driver to take full control of the machine. | At work |
CVE-2013-2596At work |
Linux Kernel. Someone who already has a foothold can use Linux Kernel to take full control of the machine. | At work |
CVE-2013-2094At work |
Linux Kernel. Someone who already has a foothold can use Linux Kernel to take full control of the machine. | At work |
CVE-2010-2568At home |
Microsoft Windows. Opening a booby-trapped file can let an attacker run their own code through Microsoft Windows. | At home |
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2022-37969† Used in ransomwareAt home |
Microsoft Windows. Someone who already has a foothold can use Microsoft Windows to take full control of the machine. | At home |
CVE-2022-32917At home |
Apple iOS, iPadOS, and macOS. Attackers can run their own code on Apple iOS, iPadOS, and macOS. | At home |
11 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2022-3075At home |
Chrome and other Chromium browsers. Attackers can get past a security protection in Chrome and other Chromium browsers. | At home |
CVE-2022-27593† Used in ransomwareAt home |
QNAP Photo Station. Attackers are using a flaw in QNAP Photo Station. | At home |
CVE-2022-26258At home |
D-Link DIR-820L. Attackers can run their own code on D-Link DIR-820L. | At home |
CVE-2020-9934At home |
Apple iOS, iPadOS, and macOS. Attackers are using a flaw in Apple iOS, iPadOS, and macOS that its maker hasn't described in detail. | At home |
CVE-2018-7445At work |
MikroTik RouterOS. Attackers can run their own code on MikroTik RouterOS from anywhere, without logging in. | At work |
CVE-2018-6530† Used in ransomwareAt home |
D-Link Multiple Routers. Attackers can run commands on D-Link Multiple Routers. | At home |
CVE-2018-2628At work |
Oracle WebLogic Server. Attackers are using a flaw in Oracle WebLogic Server that its maker hasn't described in detail. | At work |
CVE-2018-13374† Used in ransomwareAt work |
Fortinet FortiOS and FortiADC. Attackers can reach parts of Fortinet FortiOS and FortiADC that should be locked to them. | At work |
CVE-2017-5521At home |
NETGEAR Multiple Devices. Attackers can read information from NETGEAR Multiple Devices that should be private. | At home |
CVE-2011-4723At home |
D-Link DIR-300 Router. Attackers can read information from D-Link DIR-300 Router that should be private. | At home |
CVE-2011-1823At home |
Android OS. Someone who already has a way in can use Android OS to run their own code. | At home |
Companies
The flaws were in 16 companies’ products; the most were in Microsoft’s (4).
| Company | Flaws | Ransomware |
|---|---|---|
| Microsoft | 4 | 3 |
| D-Link | 3 | 1 |
| Linux | 3 | – |
| Apple | 2 | – |
| Android | 1 | – |
| Atlassian | 1 | – |
| Code Aurora | 1 | – |
| Fortinet | 1 | 1 |
| 1 | – | |
| MikroTik | 1 | – |
| NETGEAR | 1 | – |
| Oracle | 1 | – |
| QNAP | 1 | 1 |
| Sophos | 1 | – |
| Trend Micro | 1 | – |
| 1 others | 1 |
Other months
Every month since CISA started the list; September 2022 is outlined.
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2026 | 17 | 28 | 26 | 31 | 21 | 23 | 26 | 31 | 43 | 36 | 282 | ||
| 2025 | 14 | 27 | 32 | 15 | 24 | 20 | 20 | 15 | 16 | 31 | 11 | 20 | 245 |
| 2024 | 21 | 9 | 10 | 10 | 14 | 9 | 14 | 19 | 25 | 17 | 22 | 16 | 186 |
| 2023 | 5 | 14 | 18 | 17 | 19 | 24 | 16 | 8 | 19 | 18 | 18 | 11 | 187 |
| 2022 | 40 | 32 | 226 | 45 | 83 | 48 | 3 | 23 | 24 | 12 | 10 | 9 | 555 |
| 2021 | 291 | 20 | 311 |
References
- ^ Cybersecurity and Infrastructure Security Agency. “Known Exploited Vulnerabilities Catalog”. Version 2026.10.30, updated 30 Oct 2026. CISA adds a flaw when it has reliable evidence of it being used in attacks; the date is when it was added, not when the attacks began.
- ^ HARD. Plain-English summaries written from CISA’s and NVD’s text, on each flaw’s page.
See also Exploited flaws, Companies, and Search for any app or company.