Flaws added in October 2023
From Exploited flaws, HARD’s guide to the flaws being used in attacks
This article lists the flaws CISA added in October 2023. For the newest, see Exploited flaws.
In October 2023, CISA added 18 flaws to its list of vulnerabilities being used in attacks, 6 of them in things people have at home; 5 have been used by ransomware gangs. Most came from Cisco (3), Microsoft (3) and F5 (2).[1]
Most let an attacker take over the product, running their own code or taking full control.
List of flaws
Every flaw CISA added in October 2023, newest first, in plain English, each with an article of its own.[2] marks the ones used in ransomware.
Show
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2023-46748At work |
F5 BIG-IP Configuration Utility. Someone who already has a way in can use F5 BIG-IP Configuration Utility to run their own code. | At work |
CVE-2023-46747† Used in ransomwareAt work |
F5 BIG-IP Configuration Utility. Attackers can run commands on F5 BIG-IP Configuration Utility from anywhere, without logging in. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2023-5631At work |
Roundcube Webmail. Attackers can run code in the browser of someone using Roundcube Webmail and act as them. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2023-20273At work |
Cisco IOS XE Web UI. Someone who already has a way in can use Cisco IOS XE Web UI to run their own code. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2023-4966† Used in ransomwareAt work |
Citrix NetScaler ADC and NetScaler Gateway. Attackers can corrupt memory in Citrix NetScaler ADC and NetScaler Gateway, which they use to take it over. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2023-20198At work |
Cisco IOS XE Web UI. Attackers can use Cisco IOS XE Web UI to take full control of the machine from anywhere, without logging in. | At work |
5 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2023-44487At work |
IETF HTTP/2. Attackers can crash IETF HTTP/2 or stop it working. | At work |
CVE-2023-41763At work |
Microsoft Skype for Business. Someone who already has a foothold can use Microsoft Skype for Business to take full control of the machine. | At work |
CVE-2023-36563At home |
Microsoft WordPad. Attackers can read information from Microsoft WordPad that should be private. | At home |
CVE-2023-21608At home |
Adobe Acrobat and Reader. Opening a booby-trapped file can let an attacker run their own code through Adobe Acrobat and Reader. | At home |
CVE-2023-20109At work |
Cisco IOS and IOS XE. Attackers can run their own code on Cisco IOS and IOS XE. | At work |
3 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2023-42824At home |
Apple iOS and iPadOS. Someone who already has a foothold can use Apple iOS and iPadOS to take full control of the machine. | At home |
CVE-2023-40044† Used in ransomwareAt work |
Progress WS_FTP Server. Attackers can run their own code on Progress WS_FTP Server from anywhere, without logging in. | At work |
CVE-2023-22515† Used in ransomwareAt work |
Atlassian Confluence Data Center and Server. Attackers can reach parts of Atlassian Confluence Data Center and Server that should be locked to them. | At work |
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2023-42793† Used in ransomwareAt work |
JetBrains TeamCity. Attackers can run their own code on JetBrains TeamCity. | At work |
CVE-2023-28229At home |
Microsoft Windows CNG Key Isolation Service. Someone who already has a foothold can use Microsoft Windows CNG Key Isolation Service to take full control of the machine. | At home |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2023-4211At home |
Arm Mali GPU Kernel Driver. Attackers can corrupt memory in Arm Mali GPU Kernel Driver, which they use to take it over. | At home |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2023-5217At home |
Chrome and other Chromium browsers. A booby-trapped web page can corrupt memory in Chrome and other Chromium browsers, which attackers use to take it over. | At home |
Companies
The flaws were in 13 companies’ products; the most were in Cisco’s (3).
| Company | Flaws | Ransomware |
|---|---|---|
| Cisco | 3 | – |
| Microsoft | 3 | – |
| F5 | 2 | 1 |
| Adobe | 1 | – |
| Apple | 1 | – |
| Arm | 1 | – |
| Atlassian | 1 | 1 |
| Citrix | 1 | 1 |
| 1 | – | |
| IETF | 1 | – |
| JetBrains | 1 | 1 |
| Progress | 1 | 1 |
| Roundcube | 1 | – |
Other months
Every month since CISA started the list; October 2023 is outlined.
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2026 | 17 | 28 | 26 | 31 | 21 | 23 | 26 | 31 | 43 | 36 | 282 | ||
| 2025 | 14 | 27 | 32 | 15 | 24 | 20 | 20 | 15 | 16 | 31 | 11 | 20 | 245 |
| 2024 | 21 | 9 | 10 | 10 | 14 | 9 | 14 | 19 | 25 | 17 | 22 | 16 | 186 |
| 2023 | 5 | 14 | 18 | 17 | 19 | 24 | 16 | 8 | 19 | 18 | 18 | 11 | 187 |
| 2022 | 40 | 32 | 226 | 45 | 83 | 48 | 3 | 23 | 24 | 12 | 10 | 9 | 555 |
| 2021 | 291 | 20 | 311 |
References
- ^ Cybersecurity and Infrastructure Security Agency. “Known Exploited Vulnerabilities Catalog”. Version 2026.10.30, updated 30 Oct 2026. CISA adds a flaw when it has reliable evidence of it being used in attacks; the date is when it was added, not when the attacks began.
- ^ HARD. Plain-English summaries written from CISA’s and NVD’s text, on each flaw’s page.
See also Exploited flaws, Companies, and Search for any app or company.