Flaws added in March 2023
From Exploited flaws, HARD’s guide to the flaws being used in attacks
This article lists the flaws CISA added in March 2023. For the newest, see Exploited flaws.
In March 2023, CISA added 18 flaws to its list of vulnerabilities being used in attacks, 8 of them in things people have at home; 2 have been used by ransomware gangs. Most came from Microsoft (3), Fortra (2) and Arm (2).[1]
Most let an attacker take over the product, running their own code or taking full control.
List of flaws
Every flaw CISA added in March 2023, newest first, in plain English, each with an article of its own.[2] marks the ones used in ransomware.
Show
9 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2023-0266At work |
Linux Kernel. Someone who already has a foothold can use Linux Kernel to take full control of the machine. | At work |
CVE-2022-42948At work |
Fortra Cobalt Strike. Attackers can run their own code on Fortra Cobalt Strike. | At work |
CVE-2022-39197At work |
Fortra Cobalt Strike. Attackers can run their own code on Fortra Cobalt Strike. | At work |
CVE-2022-38181At home |
Arm Mali Graphics Processing Unit (GPU). Someone who already has a foothold can use Arm Mali Graphics Processing Unit (GPU) to take full control of the machine. | At home |
CVE-2022-3038At home |
Chrome and other Chromium browsers. A booby-trapped web page can corrupt memory in Chrome and other Chromium browsers, which attackers use to take it over. | At home |
CVE-2022-22706At home |
Arm Mali Graphics Processing Unit (GPU). Attackers are using a flaw in Arm Mali Graphics Processing Unit (GPU) that its maker hasn't described in detail. | At home |
CVE-2021-30900At home |
Apple iOS, iPadOS, and macOS. Attackers can run their own code on Apple iOS, iPadOS, and macOS. | At home |
CVE-2017-7494† Used in ransomwareAt work |
Samba. Attackers can run their own code on Samba. | At work |
CVE-2013-3163At home |
Microsoft Internet Explorer. Attackers can run their own code on Microsoft Internet Explorer. | At home |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2023-26360At work |
Adobe ColdFusion. Attackers can run their own code on Adobe ColdFusion. | At work |
3 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2023-24880† Used in ransomwareAt home |
Microsoft Windows. Attackers can get past a security protection in Microsoft Windows. | At home |
CVE-2023-23397At home |
Microsoft Office. Someone who already has a foothold can use Microsoft Office to take full control of the machine. | At home |
CVE-2022-41328At work |
Fortinet FortiOS. Attackers can reach parts of Fortinet FortiOS that should be locked to them. | At work |
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2021-39144At work |
XStream. Attackers can run their own code on XStream. | At work |
CVE-2020-5741At home |
Plex Media Server. Opening a booby-trapped file can let an attacker run their own code through Plex Media Server. | At home |
3 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2022-35914At work |
Teclib GLPI. Attackers can run their own code on Teclib GLPI. | At work |
CVE-2022-33891At work |
Apache Spark. Attackers can run commands on Apache Spark. | At work |
CVE-2022-28810At work |
Zoho ManageEngine. Someone who already has a way in can use Zoho ManageEngine to run their own code. | At work |
Companies
The flaws were in 14 companies’ products; the most were in Microsoft’s (3).
| Company | Flaws | Ransomware |
|---|---|---|
| Microsoft | 3 | 1 |
| Arm | 2 | – |
| Fortra | 2 | – |
| Adobe | 1 | – |
| Apache | 1 | – |
| Apple | 1 | – |
| Fortinet | 1 | – |
| 1 | – | |
| Linux | 1 | – |
| Plex | 1 | – |
| Samba | 1 | 1 |
| Teclib | 1 | – |
| XStream | 1 | – |
| Zoho | 1 | – |
Other months
Every month since CISA started the list; March 2023 is outlined.
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2026 | 17 | 28 | 26 | 31 | 21 | 23 | 26 | 31 | 43 | 36 | 282 | ||
| 2025 | 14 | 27 | 32 | 15 | 24 | 20 | 20 | 15 | 16 | 31 | 11 | 20 | 245 |
| 2024 | 21 | 9 | 10 | 10 | 14 | 9 | 14 | 19 | 25 | 17 | 22 | 16 | 186 |
| 2023 | 5 | 14 | 18 | 17 | 19 | 24 | 16 | 8 | 19 | 18 | 18 | 11 | 187 |
| 2022 | 40 | 32 | 226 | 45 | 83 | 48 | 3 | 23 | 24 | 12 | 10 | 9 | 555 |
| 2021 | 291 | 20 | 311 |
References
- ^ Cybersecurity and Infrastructure Security Agency. “Known Exploited Vulnerabilities Catalog”. Version 2026.10.30, updated 30 Oct 2026. CISA adds a flaw when it has reliable evidence of it being used in attacks; the date is when it was added, not when the attacks began.
- ^ HARD. Plain-English summaries written from CISA’s and NVD’s text, on each flaw’s page.
See also Exploited flaws, Companies, and Search for any app or company.