Flaws added in June 2023
From Exploited flaws, HARD’s guide to the flaws being used in attacks
This article lists the flaws CISA added in June 2023. For the newest, see Exploited flaws.
In June 2023, CISA added 24 flaws to its list of vulnerabilities being used in attacks, 17 of them in things people have at home; 2 have been used by ransomware gangs. Most came from Samsung (6), Apple (3) and Zyxel (3).[1]
Most let an attacker take over the product, running their own code or taking full control. It was the most CISA added in any month of 2023.
List of flaws
Every flaw CISA added in June 2023, newest first, in plain English, each with an article of its own.[2] marks the ones used in ransomware.
Show
8 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2021-25489At home |
Samsung Mobile Devices. Attackers are using a flaw in Samsung Mobile Devices. | At home |
CVE-2021-25487At home |
Samsung Mobile Devices. Attackers can run their own code on Samsung Mobile Devices. | At home |
CVE-2021-25395At home |
Samsung Mobile Devices. Attackers can get past a security protection in Samsung Mobile Devices. | At home |
CVE-2021-25394At home |
Samsung Mobile Devices. Attackers can corrupt memory in Samsung Mobile Devices, which they use to take it over. | At home |
CVE-2021-25372At home |
Samsung Mobile Devices. Attackers can corrupt memory in Samsung Mobile Devices, which they use to take it over. | At home |
CVE-2021-25371At home |
Samsung Mobile Devices. Attackers are using a flaw in Samsung Mobile Devices that its maker hasn't described in detail. | At home |
CVE-2019-20500At home |
D-Link DWL-2600AP Access Point. Attackers can run commands on D-Link DWL-2600AP Access Point. | At home |
CVE-2019-17621At home |
D-Link DIR-859 Router. Attackers can run commands on D-Link DIR-859 Router from anywhere, without logging in. | At home |
5 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2023-32439At home |
Apple devices. Attackers can run their own code on Apple devices. | At home |
CVE-2023-32435At home |
Apple devices. Attackers can run their own code on Apple devices. | At home |
CVE-2023-32434At home |
Apple devices. Attackers can run their own code on Apple devices. | At home |
CVE-2023-27992At home |
Zyxel Multiple Network-Attached Storage (NAS) Devices. Attackers can run commands on Zyxel Multiple Network-Attached Storage (NAS) Devices from anywhere, without logging in. | At home |
CVE-2023-20867At work |
VMware Tools. Attackers can get into VMware Tools without a valid password. | At work |
6 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2023-20887At work |
VMware Aria Operations for Networks. Attackers can run their own code on VMware Aria Operations for Networks. | At work |
CVE-2021-44026At work |
Roundcube Webmail. Attackers can read or change the database behind Roundcube Webmail. | At work |
CVE-2020-35730At work |
Roundcube Webmail. Attackers can run code in the browser of someone using Roundcube Webmail and act as them. | At work |
CVE-2020-12641At work |
Roundcube Webmail. Attackers can run their own code on Roundcube Webmail. | At work |
CVE-2016-9079At home |
Mozilla Firefox, Firefox ESR, and Thunderbird. Attackers can corrupt memory in Mozilla Firefox, Firefox ESR, and Thunderbird, which they use to take it over. | At home |
CVE-2016-0165At home |
Microsoft Win32k. Someone who already has a foothold can use Microsoft Win32k to take full control of the machine. | At home |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2023-27997† Used in ransomwareAt work |
Fortinet FortiOS and FortiProxy SSL-VPN. Attackers can run their own code on Fortinet FortiOS and FortiProxy SSL-VPN from anywhere, without logging in. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2023-3079At home |
Chrome and other Chromium browsers. A booby-trapped web page can corrupt memory in Chrome and other Chromium browsers, which attackers use to take it over. | At home |
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2023-33010At home |
Zyxel Multiple Firewalls. Attackers can run their own code on Zyxel Multiple Firewalls from anywhere, without logging in. | At home |
CVE-2023-33009At home |
Zyxel Multiple Firewalls. Attackers can run their own code on Zyxel Multiple Firewalls from anywhere, without logging in. | At home |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2023-34362† Used in ransomwareAt work |
Progress MOVEit Transfer. Attackers can read or change the database behind Progress MOVEit Transfer from anywhere, without logging in. | At work |
Companies
The flaws were in eleven companies’ products; the most were in Samsung’s (6).
| Company | Flaws | Ransomware |
|---|---|---|
| Samsung | 6 | – |
| Apple | 3 | – |
| Roundcube | 3 | – |
| Zyxel | 3 | – |
| D-Link | 2 | – |
| VMware | 2 | – |
| Fortinet | 1 | 1 |
| 1 | – | |
| Microsoft | 1 | – |
| Mozilla | 1 | – |
| Progress | 1 | 1 |
Other months
Every month since CISA started the list; June 2023 is outlined.
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2026 | 17 | 28 | 26 | 31 | 21 | 23 | 26 | 31 | 43 | 36 | 282 | ||
| 2025 | 14 | 27 | 32 | 15 | 24 | 20 | 20 | 15 | 16 | 31 | 11 | 20 | 245 |
| 2024 | 21 | 9 | 10 | 10 | 14 | 9 | 14 | 19 | 25 | 17 | 22 | 16 | 186 |
| 2023 | 5 | 14 | 18 | 17 | 19 | 24 | 16 | 8 | 19 | 18 | 18 | 11 | 187 |
| 2022 | 40 | 32 | 226 | 45 | 83 | 48 | 3 | 23 | 24 | 12 | 10 | 9 | 555 |
| 2021 | 291 | 20 | 311 |
References
- ^ Cybersecurity and Infrastructure Security Agency. “Known Exploited Vulnerabilities Catalog”. Version 2026.10.30, updated 30 Oct 2026. CISA adds a flaw when it has reliable evidence of it being used in attacks; the date is when it was added, not when the attacks began.
- ^ HARD. Plain-English summaries written from CISA’s and NVD’s text, on each flaw’s page.
See also Exploited flaws, Companies, and Search for any app or company.