Flaws added in July 2024
From Exploited flaws, HARD’s guide to the flaws being used in attacks
This article lists the flaws CISA added in July 2024. For the newest, see Exploited flaws.
In July 2024, CISA added 14 flaws to its list of vulnerabilities being used in attacks, 3 of them in things people have at home; 2 have been used by ransomware gangs. Most came from Microsoft (3), VMware (2) and ServiceNow (2).[1]
Most let an attacker take over the product, running their own code or taking full control.
List of flaws
Every flaw CISA added in July 2024, newest first, in plain English, each with an article of its own.[2] marks the ones used in ransomware.
Show
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2024-37085† Used in ransomwareAt work |
VMware ESXi. Attackers can get into VMware ESXi without a valid password. | At work |
3 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2024-5217At work |
ServiceNow Utah, Vancouver, and Washington DC Now Platform. Attackers can run their own code on ServiceNow Utah, Vancouver, and Washington DC Now Platform from anywhere, without logging in. | At work |
CVE-2024-4879At work |
ServiceNow Utah, Vancouver, and Washington DC Now Platform. Attackers can run their own code on ServiceNow Utah, Vancouver, and Washington DC Now Platform from anywhere, without logging in. | At work |
CVE-2023-45249At work |
Acronis Cyber Infrastructure (ACI). Attackers can run commands on Acronis Cyber Infrastructure (ACI) from anywhere, without logging in. | At work |
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2024-39891At work |
Twilio Authy. Attackers can read information from Twilio Authy that should be private from anywhere, without logging in. | At work |
CVE-2012-4792At home |
Microsoft Internet Explorer. Attackers can run their own code on Microsoft Internet Explorer. | At home |
3 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2024-34102At work |
Adobe Commerce and Magento Open Source. Attackers can run their own code on Adobe Commerce and Magento Open Source. | At work |
CVE-2024-28995At work |
SolarWinds Serv-U. Attackers can read files on SolarWinds Serv-U that should be out of reach. | At work |
CVE-2022-22948At work |
VMware vCenter Server. Attackers can read information from VMware vCenter Server that should be private. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2024-36401At work |
OSGeo GeoServer. Attackers can run their own code on OSGeo GeoServer from anywhere, without logging in. | At work |
3 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2024-38112At home |
Microsoft Windows. Attackers can make something fake look genuine in Microsoft Windows. | At home |
CVE-2024-38080At home |
Microsoft Windows. Someone who already has a foothold can use Microsoft Windows to take full control of the machine. | At home |
CVE-2024-23692† Used in ransomwareAt work |
Rejetto HTTP File Server. Attackers can run commands on Rejetto HTTP File Server from anywhere, without logging in. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2024-20399At work |
Cisco NX-OS. Someone who already has a way in can use Cisco NX-OS to run their own code. | At work |
Companies
The flaws were in ten companies’ products; the most were in Microsoft’s (3).
| Company | Flaws | Ransomware |
|---|---|---|
| Microsoft | 3 | – |
| ServiceNow | 2 | – |
| VMware | 2 | 1 |
| Acronis | 1 | – |
| Adobe | 1 | – |
| Cisco | 1 | – |
| OSGeo | 1 | – |
| Rejetto | 1 | 1 |
| SolarWinds | 1 | – |
| Twilio | 1 | – |
Other months
Every month since CISA started the list; July 2024 is outlined.
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2026 | 17 | 28 | 26 | 31 | 21 | 23 | 26 | 31 | 43 | 36 | 282 | ||
| 2025 | 14 | 27 | 32 | 15 | 24 | 20 | 20 | 15 | 16 | 31 | 11 | 20 | 245 |
| 2024 | 21 | 9 | 10 | 10 | 14 | 9 | 14 | 19 | 25 | 17 | 22 | 16 | 186 |
| 2023 | 5 | 14 | 18 | 17 | 19 | 24 | 16 | 8 | 19 | 18 | 18 | 11 | 187 |
| 2022 | 40 | 32 | 226 | 45 | 83 | 48 | 3 | 23 | 24 | 12 | 10 | 9 | 555 |
| 2021 | 291 | 20 | 311 |
References
- ^ Cybersecurity and Infrastructure Security Agency. “Known Exploited Vulnerabilities Catalog”. Version 2026.10.30, updated 30 Oct 2026. CISA adds a flaw when it has reliable evidence of it being used in attacks; the date is when it was added, not when the attacks began.
- ^ HARD. Plain-English summaries written from CISA’s and NVD’s text, on each flaw’s page.
See also Exploited flaws, Companies, and Search for any app or company.