Flaws added in September 2023
From Exploited flaws, HARD’s guide to the flaws being used in attacks
This article lists the flaws CISA added in September 2023. For the newest, see Exploited flaws.
In September 2023, CISA added 19 flaws to its list of vulnerabilities being used in attacks, 12 of them in things people have at home; 3 have been used by ransomware gangs. Most came from Apple (5), Microsoft (2) and Red Hat (1).[1]
Most let an attacker take over the product, running their own code or taking full control. It was the second most CISA added in any month of 2023.
List of flaws
Every flaw CISA added in September 2023, newest first, in plain English, each with an article of its own.[2] marks the ones used in ransomware.
Show
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2018-14667At work |
Red Hat JBoss RichFaces Framework. Attackers can run their own code on Red Hat JBoss RichFaces Framework from anywhere, without logging in. | At work |
3 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2023-41993At home |
Apple devices. Attackers can run their own code on Apple devices. | At home |
CVE-2023-41992At home |
Apple devices. Someone who already has a foothold can use Apple devices to take full control of the machine. | At home |
CVE-2023-41991At home |
Apple devices. Attackers can get past a security protection in Apple devices. | At home |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2023-41179At work |
Trend Micro Apex One and Worry-Free Business Security. Attackers can run their own code on Trend Micro Apex One and Worry-Free Business Security. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2023-28434At work |
MinIO. Someone who already has a foothold can use MinIO to take full control of the machine. | At work |
4 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2022-22265At home |
Samsung Mobile Devices. Attackers can run their own code on Samsung Mobile Devices. | At home |
CVE-2021-3129† Used in ransomwareAt work |
Laravel Ignition. Attackers can run their own code on Laravel Ignition from anywhere, without logging in. | At work |
CVE-2017-6884† Used in ransomwareAt home |
Zyxel EMG2926 Routers. Attackers can run commands on Zyxel EMG2926 Routers. | At home |
CVE-2014-8361At home |
Realtek SDK. Attackers can run their own code on Realtek SDK. | At home |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2023-26369At home |
Adobe Acrobat and Reader. Opening a booby-trapped file can let an attacker run their own code through Adobe Acrobat and Reader. | At home |
3 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2023-4863At home |
Chrome and other Chromium browsers. A booby-trapped web page can corrupt memory in Chrome and other Chromium browsers, which attackers use to take it over. | At home |
CVE-2023-35674At home |
Android Framework. Someone who already has a foothold can use Android Framework to take full control of the machine. | At home |
CVE-2023-20269† Used in ransomwareAt work |
Cisco Adaptive Security Appliance and Firepower Threat Defense. Attackers can get into Cisco Adaptive Security Appliance and Firepower Threat Defense without a valid password. | At work |
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2023-36802At work |
Microsoft Streaming Service Proxy. Someone who already has a foothold can use Microsoft Streaming Service Proxy to take full control of the machine. | At work |
CVE-2023-36761At home |
Microsoft Word. Attackers can read information from Microsoft Word that should be private. | At home |
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2023-41064At home |
Apple iOS, iPadOS, and macOS. Opening a booby-trapped file can let an attacker run their own code through Apple iOS, iPadOS, and macOS. | At home |
CVE-2023-41061At home |
Apple iOS, iPadOS, and watchOS. Attackers can run their own code on Apple iOS, iPadOS, and watchOS. | At home |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2023-33246At work |
Apache RocketMQ. Attackers can run commands on Apache RocketMQ. | At work |
Companies
The flaws were in 14 companies’ products; the most were in Apple’s (5).
| Company | Flaws | Ransomware |
|---|---|---|
| Apple | 5 | – |
| Microsoft | 2 | – |
| Adobe | 1 | – |
| Android | 1 | – |
| Apache | 1 | – |
| Cisco | 1 | 1 |
| 1 | – | |
| Laravel | 1 | 1 |
| MinIO | 1 | – |
| Realtek | 1 | – |
| Red Hat | 1 | – |
| Samsung | 1 | – |
| Trend Micro | 1 | – |
| Zyxel | 1 | 1 |
Other months
Every month since CISA started the list; September 2023 is outlined.
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2026 | 17 | 28 | 26 | 31 | 21 | 23 | 26 | 31 | 43 | 36 | 282 | ||
| 2025 | 14 | 27 | 32 | 15 | 24 | 20 | 20 | 15 | 16 | 31 | 11 | 20 | 245 |
| 2024 | 21 | 9 | 10 | 10 | 14 | 9 | 14 | 19 | 25 | 17 | 22 | 16 | 186 |
| 2023 | 5 | 14 | 18 | 17 | 19 | 24 | 16 | 8 | 19 | 18 | 18 | 11 | 187 |
| 2022 | 40 | 32 | 226 | 45 | 83 | 48 | 3 | 23 | 24 | 12 | 10 | 9 | 555 |
| 2021 | 291 | 20 | 311 |
References
- ^ Cybersecurity and Infrastructure Security Agency. “Known Exploited Vulnerabilities Catalog”. Version 2026.10.30, updated 30 Oct 2026. CISA adds a flaw when it has reliable evidence of it being used in attacks; the date is when it was added, not when the attacks began.
- ^ HARD. Plain-English summaries written from CISA’s and NVD’s text, on each flaw’s page.
See also Exploited flaws, Companies, and Search for any app or company.