Flaws added in March 2024
From Exploited flaws, HARD’s guide to the flaws being used in attacks
This article lists the flaws CISA added in March 2024. For the newest, see Exploited flaws.
In March 2024, CISA added 10 flaws to its list of vulnerabilities being used in attacks, 4 of them in things people have at home; 5 have been used by ransomware gangs. Most came from Microsoft (2), Apple (2) and Fortinet (1).[1]
Eight of the ten let an attacker take over the product, running their own code or taking full control.
List of flaws
Every flaw CISA added in March 2024, newest first, in plain English, each with an article of its own.[2] marks the ones used in ransomware.
Show
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2023-24955† Used in ransomwareAt work |
Microsoft SharePoint Server. Someone who already has a way in can use Microsoft SharePoint Server to run their own code. | At work |
3 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2023-48788† Used in ransomwareAt work |
Fortinet FortiClient EMS. Attackers can run commands on Fortinet FortiClient EMS from anywhere, without logging in. | At work |
CVE-2021-44529† Used in ransomwareAt work |
Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA). Attackers can run their own code on Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) from anywhere, without logging in. | At work |
CVE-2019-7256At work |
Nice Linear eMerge E3-Series. Attackers can run their own code on Nice Linear eMerge E3-Series. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2024-27198† Used in ransomwareAt work |
JetBrains TeamCity. Attackers can get into JetBrains TeamCity without a valid password. | At work |
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2024-23296At home |
Apple devices. Attackers can corrupt memory in Apple devices, which they use to take it over. | At home |
CVE-2024-23225At home |
Apple devices. Attackers can corrupt memory in Apple devices, which they use to take it over. | At home |
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2023-21237At home |
Android Pixel. Attackers can read information from Android Pixel that should be private. | At home |
CVE-2021-36380At work |
Sunhillo SureLine. Attackers can run commands on Sunhillo SureLine from anywhere, without logging in. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2024-21338† Used in ransomwareAt home |
Microsoft Windows. Someone who already has a foothold can use Microsoft Windows to take full control of the machine. | At home |
Companies
The flaws were in eight companies’ products; the most were in Apple’s (2).
Other months
Every month since CISA started the list; March 2024 is outlined.
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2026 | 17 | 28 | 26 | 31 | 21 | 23 | 26 | 31 | 43 | 36 | 282 | ||
| 2025 | 14 | 27 | 32 | 15 | 24 | 20 | 20 | 15 | 16 | 31 | 11 | 20 | 245 |
| 2024 | 21 | 9 | 10 | 10 | 14 | 9 | 14 | 19 | 25 | 17 | 22 | 16 | 186 |
| 2023 | 5 | 14 | 18 | 17 | 19 | 24 | 16 | 8 | 19 | 18 | 18 | 11 | 187 |
| 2022 | 40 | 32 | 226 | 45 | 83 | 48 | 3 | 23 | 24 | 12 | 10 | 9 | 555 |
| 2021 | 291 | 20 | 311 |
References
- ^ Cybersecurity and Infrastructure Security Agency. “Known Exploited Vulnerabilities Catalog”. Version 2026.10.30, updated 30 Oct 2026. CISA adds a flaw when it has reliable evidence of it being used in attacks; the date is when it was added, not when the attacks began.
- ^ HARD. Plain-English summaries written from CISA’s and NVD’s text, on each flaw’s page.
See also Exploited flaws, Companies, and Search for any app or company.