Flaws added in February 2023
From Exploited flaws, HARD’s guide to the flaws being used in attacks
This article lists the flaws CISA added in February 2023. For the newest, see Exploited flaws.
In February 2023, CISA added 14 flaws to its list of vulnerabilities being used in attacks, 4 of them in things people have at home; 9 have been used by ransomware gangs. Most came from Microsoft (3), Mitel (2) and ZK Framework (1).[1]
Most let an attacker take over the product, running their own code or taking full control.
List of flaws
Every flaw CISA added in February 2023, newest first, in plain English, each with an article of its own.[2] marks the ones used in ransomware.
Show
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2022-36537† Used in ransomwareAt work |
ZK Framework AuUploader. Attackers can read information from ZK Framework AuUploader that should be private. | At work |
3 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2022-47986† Used in ransomwareAt work |
IBM Aspera Faspex. Attackers can run their own code on IBM Aspera Faspex. | At work |
CVE-2022-41223† Used in ransomwareAt work |
Mitel MiVoice Connect. Someone who already has a way in can use Mitel MiVoice Connect to run their own code. | At work |
CVE-2022-40765† Used in ransomwareAt work |
Mitel MiVoice Connect. Someone who already has a way in can use Mitel MiVoice Connect to run their own code. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2022-46169At work |
Cacti. Attackers can run their own code on Cacti from anywhere, without logging in. | At work |
4 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2023-23529At home |
Apple devices. Attackers can run their own code on Apple devices. | At home |
CVE-2023-23376† Used in ransomwareAt home |
Microsoft Windows. Someone who already has a foothold can use Microsoft Windows to take full control of the machine. | At home |
CVE-2023-21823At home |
Microsoft Windows. Attackers can run their own code on Microsoft Windows. | At home |
CVE-2023-21715At home |
Microsoft Office. Attackers can get past a security protection in Microsoft Office. | At home |
3 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2023-0669† Used in ransomwareAt work |
Fortra GoAnywhere MFT. Attackers can run their own code on Fortra GoAnywhere MFT from anywhere, without logging in. | At work |
CVE-2022-24990† Used in ransomwareAt work |
TerraMaster OS. Attackers can run commands on TerraMaster OS from anywhere, without logging in. | At work |
CVE-2015-2291† Used in ransomwareAt work |
Intel Ethernet Diagnostics Driver for Windows. Someone who already has a way in can use Intel Ethernet Diagnostics Driver for Windows to run their own code. | At work |
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2023-22952At work |
SugarCRM products. Attackers can run their own code on SugarCRM products. | At work |
CVE-2022-21587† Used in ransomwareAt work |
Oracle E-Business Suite. Attackers are using a flaw in Oracle E-Business Suite that its maker hasn't described in detail. | At work |
Companies
The flaws were in eleven companies’ products; the most were in Microsoft’s (3).
| Company | Flaws | Ransomware |
|---|---|---|
| Microsoft | 3 | 1 |
| Mitel | 2 | 2 |
| Apple | 1 | – |
| Cacti | 1 | – |
| Fortra | 1 | 1 |
| IBM | 1 | 1 |
| Intel | 1 | 1 |
| Oracle | 1 | 1 |
| SugarCRM | 1 | – |
| TerraMaster | 1 | 1 |
| ZK Framework | 1 | 1 |
Other months
Every month since CISA started the list; February 2023 is outlined.
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2026 | 17 | 28 | 26 | 31 | 21 | 23 | 26 | 31 | 43 | 36 | 282 | ||
| 2025 | 14 | 27 | 32 | 15 | 24 | 20 | 20 | 15 | 16 | 31 | 11 | 20 | 245 |
| 2024 | 21 | 9 | 10 | 10 | 14 | 9 | 14 | 19 | 25 | 17 | 22 | 16 | 186 |
| 2023 | 5 | 14 | 18 | 17 | 19 | 24 | 16 | 8 | 19 | 18 | 18 | 11 | 187 |
| 2022 | 40 | 32 | 226 | 45 | 83 | 48 | 3 | 23 | 24 | 12 | 10 | 9 | 555 |
| 2021 | 291 | 20 | 311 |
References
- ^ Cybersecurity and Infrastructure Security Agency. “Known Exploited Vulnerabilities Catalog”. Version 2026.10.30, updated 30 Oct 2026. CISA adds a flaw when it has reliable evidence of it being used in attacks; the date is when it was added, not when the attacks began.
- ^ HARD. Plain-English summaries written from CISA’s and NVD’s text, on each flaw’s page.
See also Exploited flaws, Companies, and Search for any app or company.