NewsCompaniesFlawsGuides
Get the app

Flaws added in September 2024

From Exploited flaws, HARD’s guide to the flaws being used in attacks
This article lists the flaws CISA added in September 2024. For the newest, see Exploited flaws.

In September 2024, CISA added 25 flaws to its list of vulnerabilities being used in attacks, 12 of them in things people have at home; 4 have been used by ransomware gangs. Most came from Microsoft (5), Adobe (4) and DrayTek (3).[1]

Most let an attacker take over the product, running their own code or taking full control. It was the most CISA added in any month of 2024.

List of flaws

Every flaw CISA added in September 2024, newest first, in plain English, each with an article of its own.[2] marks the ones used in ransomware.

3 added

CVEFlawFound
CVE-2023-25280At home D-Link DIR-820 Router. Attackers can run commands on D-Link DIR-820 Router from anywhere, without logging in. At home
CVE-2020-15415At home DrayTek Multiple Vigor Routers. Attackers can run their own code on DrayTek Multiple Vigor Routers. At home
CVE-2019-0344At work SAP Commerce Cloud. Attackers can run their own code on SAP Commerce Cloud. At work

1 added

CVEFlawFound
CVE-2024-7593At work Ivanti Virtual Traffic Manager. Attackers can get into Ivanti Virtual Traffic Manager without a valid password. At work

1 added

CVEFlawFound
CVE-2024-8963At work Ivanti Cloud Services Appliance (CSA). Attackers can run commands on Ivanti Cloud Services Appliance (CSA) from anywhere, without logging in. At work

4 added

CVEFlawFound
CVE-2024-27348At work Apache HugeGraph-Server. Attackers can run their own code on Apache HugeGraph-Server. At work
CVE-2022-21445At work Oracle ADF Faces. Attackers can run their own code on Oracle ADF Faces from anywhere, without logging in. At work
CVE-2020-14644At work Oracle WebLogic Server. Attackers can run their own code on Oracle WebLogic Server from anywhere, without logging in. At work
CVE-2020-0618† Used in ransomwareAt work Microsoft SQL Server. Someone who already has a way in can use Microsoft SQL Server to run their own code. At work

4 added

CVEFlawFound
CVE-2014-0502At home Adobe Flash Player. Attackers can run their own code on Adobe Flash Player. At home
CVE-2014-0497At home Adobe Flash Player. Attackers can run their own code on Adobe Flash Player. At home
CVE-2013-0648At home Adobe Flash Player. Attackers can run their own code on Adobe Flash Player. At home
CVE-2013-0643At home Adobe Flash Player. Attackers can run their own code on Adobe Flash Player. At home

2 added

CVEFlawFound
CVE-2024-6670† Used in ransomwareAt work Progress WhatsUp Gold. Attackers can read or change the database behind Progress WhatsUp Gold from anywhere, without logging in. At work
CVE-2024-43461At home Microsoft Windows. Attackers can make something fake look genuine in Microsoft Windows. At home

1 added

CVEFlawFound
CVE-2024-8190At work Ivanti Cloud Services Appliance. Someone who already has a way in can use Ivanti Cloud Services Appliance to run their own code. At work

3 added

CVEFlawFound
CVE-2024-38226At home Microsoft Publisher. Attackers can get past a security protection in Microsoft Publisher. At home
CVE-2024-38217At home Microsoft Windows. Attackers can get past a security protection in Microsoft Windows. At home
CVE-2024-38014At home Microsoft Windows. Someone who already has a foothold can use Microsoft Windows to take full control of the machine. At home

3 added

CVEFlawFound
CVE-2024-40766† Used in ransomwareAt work SonicWall SonicOS. Attackers can reach parts of SonicWall SonicOS that should be locked to them. At work
CVE-2017-1000253† Used in ransomwareAt work Linux Kernel. Someone who already has a foothold can use Linux Kernel to take full control of the machine. At work
CVE-2016-3714At work ImageMagick. Opening a booby-trapped file can let an attacker run their own code through ImageMagick. At work

3 added

CVEFlawFound
CVE-2024-7262At work Kingsoft WPS Office. Attackers can read files on Kingsoft WPS Office that should be out of reach. At work
CVE-2021-20124At home DrayTek VigorConnect. Attackers can read files on DrayTek VigorConnect that should be out of reach from anywhere, without logging in. At home
CVE-2021-20123At home DrayTek VigorConnect. Attackers can read files on DrayTek VigorConnect that should be out of reach from anywhere, without logging in. At home

Companies

The flaws were in 13 companies’ products; the most were in Microsoft’s (5).

CompanyFlawsRansomware
Microsoft51
Adobe4–
DrayTek3–
Ivanti3–
Oracle2–
Apache1–
D-Link1–
ImageMagick1–
Kingsoft1–
Linux11
Progress11
SAP1–
SonicWall11

Other months

Every month since CISA started the list; September 2024 is outlined.

Flaws added to CISA’s list each month
YearJanFebMarAprMayJunJulAugSepOctNovDecTotal
2026 17282631212326314336 282
2025 142732152420201516311120 245
2024 2191010149141925172216 186
2023 5141817192416819181811 187
2022 40322264583483232412109 555
2021 29120 311
2026282 flaws
Jan17Feb28Mar26Apr31May21Jun23Jul26Aug31Sep43Oct36NovDec
2025245 flaws
Jan14Feb27Mar32Apr15May24Jun20Jul20Aug15Sep16Oct31Nov11Dec20
2024186 flaws
Jan21Feb9Mar10Apr10May14Jun9Jul14Aug19Sep25Oct17Nov22Dec16
2023187 flaws
Jan5Feb14Mar18Apr17May19Jun24Jul16Aug8Sep19Oct18Nov18Dec11
2022555 flaws
Jan40Feb32Mar226Apr45May83Jun48Jul3Aug23Sep24Oct12Nov10Dec9
2021311 flaws
JanFebMarAprMayJunJulAugSepOctNov291Dec20

References

  1. ^ Cybersecurity and Infrastructure Security Agency. “Known Exploited Vulnerabilities Catalog”. Version 2026.10.30, updated 30 Oct 2026. CISA adds a flaw when it has reliable evidence of it being used in attacks; the date is when it was added, not when the attacks began.
  2. ^ HARD. Plain-English summaries written from CISA’s and NVD’s text, on each flaw’s page.

See also Exploited flaws, Companies, and Search for any app or company.