Detailed Analysis of Recent Trends in Known Exploited Vulnerabilities

Malware Analysis
1

Author: Donghyun Ko, Seungho Lee | S2W TALON

Photo by luis gomes on Pexels

Executive Summary

  • As of September 10, 2025, there are 1,414 publicly disclosed vulnerabilities that have actual exploit cases (Known Exploited Vulnerability, hereinafter KEV), which represents 0.004% of the total 312,011 reported vulnerabilities.
    - When examining the trend of vulnerabilities registered in the KEV since November 2021, excluding the initial registration period, the number of vulnerabilities registered averages roughly 5–30 per month at all times.
  • The most common target vector among vulnerabilities registered in the KEV is network-related vulnerabilities, accounting for 69.5% of all KEV vulnerabilities.
  • Microsoft was identified as the most frequently exploited target product among vulnerabilities registered in the KEV.
    - Analysis of year-by-year changes in target products shows that from 2021 through 2025 Microsoft-related vulnerabilities were registered most frequently, and recently exploitation of VPN-related vulnerabilities — such as those affecting Citrix, Cisco, and Ivanti — has been on the rise.
  • The CWE(Common Weakness Enumeration) type most frequently exploited among vulnerabilities registered in KEV is CWE-20 (Improper Input Validation), i.e., vulnerabilities that arise from incorrect validation of user input.
  • The average CVSS score for vulnerabilities registered in the KEV is 8.21, which is approximately 1.20 points higher than the average CVSS score of 7.01 for vulnerabilities registered from 2021 through 2024.
  • Between November 2024 and September 2025, approximately 1,140 of the vulnerabilities registered in the KEV were mentioned on DDW and Telegram, accounting for about 80.8% of all KEV-registered vulnerabilities.
    - Of these, a total of 160 vulnerabilities — approximately 14.1% of the whole — were mentioned on DDW and Telegram prior to their KEV registration; these mentions were mainly found in posts where vulnerability-related information, such as PoC(Proof of Concept) code sharing and exploit sales, is actively traded and circulated.
    - These pre-mentioned vulnerabilities have, on average, about 5.1 times the number of mentions compared with subsequently mentioned vulnerabilities, indicating they are considered subjects of concentrated interest by threat actors.
  • Most of the vulnerabilities that experienced many exploit attempts over the past year are old vulnerabilities (about 67.5%), so care is needed to update and maintain legacy systems that have not received the latest patches.

1. Statistics of exploited vulnerabilities

As of September 10, 2025, the number of vulnerabilities registered in CISA’s(Cybersecurity and Infrastructure Security Agency) KEV is 1,414.

  • KEV refers to vulnerabilities in software, hardware, or systems that have been confirmed to have been used by threat actors in real attacks, and it serves as guidance to strengthen the security of U.S. federal agencies.
  • The U.S. CISA continuously updates the KEV catalog and supports prioritizing the application of patches and mitigation measures for vulnerabilities that are actively being exploited.
  • Although vulnerabilities registered in the KEV represent a very small portion — about 0.004% of the 312,011 reported vulnerabilities — they are confirmed to have been exploited in the wild, making them extremely high-risk; if such vulnerabilities are used in attacks they can cause severe damage to organizations, so they must be managed as the highest-priority items in security response.

Since November 2021, CISA has been managing the KEV according to 3 standardized catalog policies.

  • The 3 KEV registration criteria designated by CISA are as follows.
    - The exploited vulnerability must have an assigned standard CVE identifier.
    - There must be public evidence that a threat actor exploited the vulnerability; a simple vulnerability report or a PoC (proof of concept) alone is not sufficient for inclusion in the KEV.
    - A clear mitigation for the exploited vulnerability — such as a vendor patch, alternative configuration, or other mitigation measures — must be provided.

For vulnerabilities that satisfy all 3 conditions, CISA reviews the proposed vulnerability’s impact and the evidence of exploitation and then adds it to the catalog.

Figure 1. Progress Graph of KEV by Registration Date

When examining the trend of exploited vulnerabilities by registration date in the KEV, the period with the highest number of registrations was November 2021, when 291 vulnerabilities were added to the KEV catalog.

  • This is analyzed to have occurred because, when the KEV catalog was first managed, previously exploited vulnerabilities were registered all at once.
  • From mid‑2022, as previously exploited vulnerabilities were reviewed and registered, the trend in vulnerability registrations showed high volatility; from August 2022 onward, the trend gradually stabilized.

Newly added KEVs are included only after verification of exploitation evidence and review of vendor advisories and exploit observations, so the number of registered vulnerabilities remains relatively consistent, and it typically takes several days to a few weeks from exploitation to KEV registration.

  • Excluding the initial registration period, the remainder of the timeline shows an average of approximately 5–30 vulnerabilities registered per month.

Even if the number of vulnerabilities registered in KEV remained steady from August 2022 through September 2025, trends in target products and the CWE types of registered vulnerabilities continued to change.

This report analyzes KEV-registered vulnerabilities by target vector, CWE type, CVSS severity, and target product to identify the vulnerability preferences of threat actors and trends in attacks that exploit those vulnerabilities.

1.1 KEV by Target Vector

Vulnerabilities registered as CVEs are classified into 4 attack vectors according to how threat actors access or penetrate a system.

  • Most CVE-registered vulnerabilities fall under the Network attack vector — those that allow threat actors to access and exploit systems remotely — and from 2021 through 2024 Network-vector vulnerabilities accounted for approximately 71.6% of the total.

The KEV-registered vulnerabilities by target vector are as follows.

Figure 2. Target Vector by KEV

Analysis of KEV-registered vulnerabilities by target vector shows that the Network vector is the largest, accounting for approximately 69.5% of all KEV entries.

  • The Network vector refers to vulnerabilities in network‑connected systems that enable threat actors to attempt attacks remotely without actual dinstance constraints.
  • Network‑vector vulnerabilities often lead to a range of attacks — remote code execution, denial of service, authentication bypass, and others — and are the most frequently exploited type in real‑world threat scenarios.

Among all registered vulnerabilities, those with a Local vector account for approximately 25.4%, while among KEV-registered exploited vulnerabilities the proportion is somewhat higher at about 27.9%.

  • It indicates that vulnerabilities threat actors can exploit in local environments for privilege escalation or to further compromise systems after gaining internal access are highly useful in real-world attack chains.
  • They are particularly often abused to establish persistence or to escalate privileges following internal compromise.

1.2 KEV by CWE Types

CWE stands for Common Weakness Enumeration, a classification system for software vulnerabilities that is managed by MITRE.

  • From 2021 through 2024, the CWE types most frequently reported among vulnerabilities registered in CVE were CWE-79 Cross Site Scripting (XSS), CWE-787(Out of Bounds Write), and CWE-89 SQL Injection, respectively.
  • Separate from vulnerabilities registered in CVE, the vulnerabilities registered in KEV from 2021 through September 2025 reflect the attack types favored by threat actors and therefore differ somewhat from the overall CVE results.

Vulnerabilities registered in KEV by CWE type are as follows.

Figure 3. CWE Type by KEV

The most frequent CWE type among vulnerabilities registered in KEV is CWE-20, accounting for approximately 7.9% of all KEV entries.

  • CWE-20 is a vulnerability type that occurs when external input is not properly validated before being processed.
  • Threat actors can inject unintended values or malicious payloads to cause systems to behave unexpectedly, potentially causing serious damage to web applications, network services, and local software.

The CWE type with the second highest number of exploitation cases is CWE-78(OS Command Injection), accounting for approximately 6.6% of all KEV entries, totaling 93 vulnerabilities.

  • CWE-78 is a vulnerability type that occurs when an application passes external input to an operating system command without proper filtering.
  • Threat actors exploit this to execute arbitrary commands and take control of systems, and it often leads to remote code execution(RCE), making it frequently used in security incidents.

The CWE type with the third highest number of exploitation cases is CWE-787), accounting for approximately 6.5% of all KEV entries, with a total of 91 vulnerabilities.

  • CWE-787 is a vulnerability type that occurs when data is written outside allocated memory bounds.
  • Threat actors can use maliciously crafted input to overwrite arbitrary memory regions, causing program crashes and denial of service, and potentially enabling advanced attacks such as arbitrary code execution or rootkit installation.

Separate from the distribution of CWE types among vulnerabilities registered in CVE, the vulnerabilities actually used in exploitation tend to be those that are relatively easy to exploit and highly impactful when exploited, such as CWE-20, CWE-78, and CWE-787.

  • This indicates that threat actors prefer vulnerabilities that have a high likelihood of success and can effectively propagate damage when conducting attacks.
  • They tend to concentrate on vulnerability types that offer greater payoff when actually exploited, rather than on vulnerabilities that merely exist in large numbers.

1.3 KEV by CVSS Score

CVSS scores refer to a global standard system designed to assess the severity of vulnerabilities and assign standardized scores.

  • CVSS scores quantify the severity of a vulnerability. They range from 0.0 to 10.0 and are assigned based on evaluation criteria such as attack vector, attack complexity, and the impact when the vulnerability is exploited. Scores closer to 10.0 indicate greater severity.

In addition, FIRST (Forum of Incident Response and Security Teams) classifies CVSS scores into severity levels of Low, Medium, High, and Critical.

The distribution of CVSS scores among vulnerabilities registered in KEV is as follows.

Figure 4. CVSS Score Distribution by KEV

The average CVSS score for vulnerabilities registered in KEV is 8.21, approximately 1.2 points higher than the 7.01 average for vulnerabilities registered from 2021 through 2024.

  • This indicates that threat actors prefer vulnerabilities with low attack complexity and high impact when exploited.

When KEV-registered vulnerabilities are classified by severity, approximately 83.7% fall into the High or Critical categories.

  • This indicates that most vulnerabilities included in KEV are high risk and capable of causing significant harm if exploited, and that KEV represents a collection of high severity vulnerabilities reflecting real cases in which threat actors exploited them, leading to security incidents.
  • From a cybersecurity perspective, vulnerabilities included in KEV have higher patching priority than general vulnerabilities and require immediate remediation. This demonstrates that KEV based vulnerability management can serve as a practical, actionable standard.

1.4 KEV by Target Product

The top target products being exploited for vulnerabilities registered in the KEV are as follows.

Figure 5. Target Product by KEV

Analysis of exploited vulnerabilities by target product shows that Microsoft products were the most targeted, with 340 vulnerabilities exploited, accounting for approximately 29.7% of all exploited vulnerabilities.

  • Vulnerabilities targeting Microsoft products are primarily concentrated in widely used software such as operating systems (Windows), Office suites, browsers, and server software.
  • It indicates that threat actors prefer vulnerabilities in products with large user bases, because exploiting those vulnerabilities can compromise more systems or have greater impact, and that they tend to favor vulnerabilities that are more effective in terms of attack efficiency.

The second most targeted product was Apple, with a total of 84 vulnerabilities exploited.

  • Vulnerabilities targeting Apple mainly affect major platforms such as macOS, iOS and Safari. Although their overall adoption is lower than Windows, the high use of premium devices by individual users and corporate executives makes them especially valuable for targeted attacks.
  • In particular, zero day iOS vulnerabilities are frequently used in spyware and surveillance oriented attacks.

Vulnerabilities in Cisco products were the third most targeted, with 78 exploited in total.

  • Network infrastructure devices, such as routers, switches and firewalls, are the primary targets. If a threat actor secures a vulnerability at a network entry point, they can expand access to the entire internal network, which is why these product groups are preferred by threat actors.
  • Due to their deployment in corporate and government infrastructures, such devices are frequently used by threat actors for initial intrusion and for establishing long term footholds.

This demonstrates that threat actors typically exploit vulnerabilities in products with large user bases or high utility, favoring targets that maximize attack success rates and impact rather than targets defined only by a large number of vulnerabilities.

1.4.1 Trends in Target Products of KEV

  • The annual changes in target products for vulnerabilities registered in KEV are as follows.
Figure 6. Annual Heat Map of Changes in Top Target Products

Microsoft

  • This is because Microsoft’s attack targets include not only client software such as Windows OS and Office, but also core server products like SharePoint, Exchange Server, and Active Directory (AD). Having such a wide range of products from clients to servers provides threat actors with a diverse attack surface. In other words, the extensive attack surface is analyzed as the main reason for the high frequency of attacks.

Apple & Google

  • Vulnerabilities in Apple and Google products primarily target client endpoints. For Apple, they are mainly found in operating systems such as iOS and macOS, while for Google they are primarily found in Android OS and the Chrome browser. This illustrates threat actors’ strategy of leveraging mobile devices and web browsers, which have large global user bases, as initial intrusion paths.

Cisco, Ivanti, Citrix, Fortinet

  • These products serve as the boundary between a company’s internal network and the external environment, making them prime targets for threat actors.
    - Cisco: Unlike previous data, the high frequency of KEV registrations in 2021 and 2022 is believed to be closely related to the expansion of remote work environments due to the COVID‑19 pandemic. As VPN usage surged, vulnerabilities in Cisco VPN related devices, such as AnyConnect, were heavily exploited. The decrease in frequency in 2023 may be due to threat actors diversifying their targets to other VPN solutions, such as Ivanti and Fortinet, beyond Cisco.
    - Ivanti, Citrix and Fortinet: products from these vendors also handle network perimeter security, such as VPNs and remote access gateways. If vulnerabilities in these products are exploited, threat actors can more easily obtain access to internal networks, increasing the likelihood of a successful initial intrusion.

Adobe

  • Widely deployed software, such as PDF readers, served as primary attack targets, with attacks mainly directed at end users.
  • Recently, KEV confirmed the exploitation of a severe vulnerability in e-commerce platforms such as Adobe Commerce, formerly Magento. Through this exploitation, threat actors were able to take control of web servers and steal sensitive payment information.

Oracle

  • Vulnerabilities in enterprise server software, such as Oracle Database Server and WebLogic Server, are frequently exploited by threat actors. This indicates that attacks primarily aim directly at organizations’ core data.

An examination of the products affected by exploited vulnerabilities showed that clients were targeted more frequently than servers.

The reason is that attacking user accounts and endpoint PCs provides an easier route for initial access than targeting internal infrastructure, which is typically well managed by security teams.

Several users have relatively low security awareness and tend to prioritize convenience, making them vulnerable to compromise through social engineering techniques.

Therefore, to strengthen internal security, it is crucial not only to defend systems but also to raise users’ security awareness and to identify and remediate compromised user accounts, highlighting these actions as key components of an effective defense strategy.

1.5 Trends in Remediation Time

CISA’s KEV reports recommended patch dates based on a vulnerability’s severity and impact.

Generally, it sets a recommended patch window of about 3 weeks, adjusted according to a vulnerability’s impact, severity, CVSS score, and vendor, and shorter recommended patch windows indicate a more severe vulnerability.

Figure 7. Recommended Patch Dates in KEV

From the fourth quarter of 2021, when KEV was first launched, through the first quarter of 2022, recommended patch windows were relatively long, ranging from 2 weeks up to six months.

  • From that point through September 2023, recommended patch deadlines were gradually shortened to roughly three weeks to one month for most vulnerabilities. Since September 2023, most vulnerabilities have had much shorter recommended patch deadlines of one to three weeks.
  • This trend is attributed to the recent increase in newly disclosed vulnerabilities and their growing complexity, together with threat actors rapidly obtaining PoCs shortly after disclosure, which shortens the time from disclosure to exploitation and to attack campaigns.
    - In fact, for the CVE-2021–44228 Log4Shell vulnerability, PoC code was rapidly distributed worldwide immediately after disclosure, and automated scanning and attack attempts using it surged explosively within days of disclosure.
    - Recently, cases have been observed in which AI services for cybercrime are used to automatically generate and develop exploit scripts based on PoC code.
    - On September 29, 2023, CISA announced that, to address this trend and to improve efficiency in prioritizing and classifying organizations’ vulnerability management activities, it would shorten the time between a vulnerability’s disclosure and the time companies remediate it.

In general, CISA recommends a three week mitigation window according to the BOD 22‑01 catalog.

  • However, CISA noted that this period may be shortened when severe risks are present, and analysis of vulnerabilities with recommended mitigation windows of one week or less revealed the following common characteristics.

Actual Exploited Vulnerability : Vulnerabilities that are already being abused by ransomware or APT ransomware gangs.

  • CVE-2024–55591 is a high severity vulnerability with a CVSS score of 9.8 in the Node.js WebSocket module of FortiOS and FortiProxy. A threat actor can obtain super admin privileges by sending a specially crafted request, and the NightSpire ransomware gang is known to have used it for initial access.
  • CVE-2025–53770 is a remote code execution vulnerability in Microsoft SharePoint with a CVSS score of 9.8. At the time of discovery, sustained exploitation attempts were observed against on premise SharePoint installations worldwide.
    - This vulnerability is known to have been exploited by China based nation state threat actor groups APT27 and APT31, and by another China based ransomware gang Storm 2603, targeting internet connected SharePoint servers to deploy web shells and obtain initial access.

Devices/Services Exposed in Internet: Firewalls, VPNs, email gateways and similar systems, where vulnerabilities can enable immediate and large scale damage

  • CVE-2025–5777 is an information disclosure vulnerability in Citrix NetScaler caused by insufficient memory bounds checking, allowing threat actors to exfiltrate session tokens and credentials from memory.
  • CVE-2024–1709 is an Authentication Bypass Vulnerability in ConnectWise ScreenConnect instances caused by inadequate validation of URLs and insufficient access control, and it is a high severity vulnerability with confirmed real world exploitation by the BlackCat/Alphv ransomware gang and the Kimsuky group.

Preferred Ransomware or APT Group by Vendors: Cisco, Atlassian, Ivanti, Fortinet, Palo Alto; these vendors have had vulnerabilities in their products that were exploited in past attacks by ransomware or APT groups.

  • CVE-2024–3400 is a high severity vulnerability with a CVSS score of 10.0 in Palo Alto Networks PAN OS that allows arbitrary file creation and command injection. When chat logs from the Black Basta ransomware gang were leaked, messages sharing details about this vulnerability were actively posted in the leaked logs.
  • CVE-2023–22515 is a vulnerability that allows a threat actor to create an administrator account on Confluence Data Center or Server instances that are publicly accessible. Analysis indicates that, until a patch was applied, the China based ransomware gang Storm 0062 exploited this vulnerability.

Instant Disclosure of Zero-day or PoC: Vulnerabilities with insufficient time for mitigation

  • CVE-2023–20198 is a vulnerability in Cisco IOS XE software that allows remote, unauthenticated creation of a level 15 system account with administrator privileges. At the time of discovery, no security update had been released, enabling threat actors to exploit it immediately.

2. Correlation between vulnerability references in DDW

The S2W Intelligence Center monitors vulnerabilities mentioned on the Deep and Dark Web (hereafter DDW) and on Telegram, and analyzes recent vulnerability trends and their relationship with DDW and Telegram based on mention volume.

Of the vulnerabilities registered in KEV from November 2024 through September 2025, approximately 1,140 were mentioned on the DDW and Telegram, accounting for about 80.8% of registered vulnerabilities.

  • This indicates that threat actors active on the DDW and on Telegram generally show interest in specific vulnerabilities both before and after exploitation.
  • Notably, sharing or selling information about a vulnerability prior to exploitation can provide important early clues for identifying threat actors or taking preemptive action before a security incident occurs.
Figure 8. Proportion of Vulnerabilities Mentioned on DDW and Telegram Before and After Exploitation

Among the 1,140 KEV vulnerabilities mentioned on the DDW and Telegram from November 2024 through September 2025, 160 vulnerabilities, or about 14.1%, were first mentioned on DDW or Telegram prior to their KEV registration or on the same day as registration.

  • Evidence shows that, prior to exploitation, threat actors on DDW and Telegram were sharing PoC code and selling exploits, indicating active exchanges of information about those vulnerabilities.
  • Particularly, higher risk vulnerabilities are shared more actively on DDW and Telegram.
  • This suggests that mentions on DDW and Telegram can serve as an early warning mechanism for some high risk vulnerabilities, enabling early identification of threat actors and preemptive mitigation.
Figure 9. PoC Code Distributing Message for CVE-2025–24016 Uploaded Before exploitation

Additionally, vulnerabilities mentioned on the DDW and on Telegram after being registered in KEV account for approximately 85.9% of the total, indicating that these vulnerabilities continue to be discussed even after exploitation.

  • These vulnerabilities remain exploitable on systems with delayed or unapplied security patches, and on legacy servers and IT assets. In fact, numerous instances have been observed on the DDW of access credentials or exploit code related to these vulnerabilities being traded.
    - These posts indicate that threat actors active on DDW and Telegram can continue to mount attacks using those vulnerabilities even after they have been exploited.
  • Continued mentions of a vulnerability after KEV registration should be interpreted not as mere information sharing, but as a warning signal indicating the potential for secondary impact against unpatched or otherwise unmitigated environments.
Figure 10. Distribution List of Domains Hosting CVE-2023–6553

Analysis of 5,269 DDW posts and 263,206 Telegram messages mentioning KEV vulnerabilities found that vulnerabilities referenced prior to KEV registration had an average of 14.4 posts, about 5.14 times higher than the 2.8 average for mentions after registration.

  • High mention volumes on the DDW and on Telegram suggest that vulnerabilities with greater visibility attract concentrated attention from threat actors, and are therefore more likely to be discussed prior to exploitation.
Figure 11. Comparison of Vulnerability Mention Volumes Before and After KEV Registration

Among vulnerabilities registered in KEV, the most frequently mentioned was CVE-2025–32433, with 31 posts appearing prior to KEV registration and 24 posts appearing after registration, with a total of 55 posts.

  • The high severity vulnerability CVE-2025–32433, which enables remote code execution via SSH servers, had its PoC code published on the DDW prior to KEV registration, and analysis indicates there were active discussions about exploit development and potential use.
Figure 12. PoC Code Post For CVE 2025 32433 Uploaded 2 Months Before Exploitation

Analysis of posts mentioned on the DDW and Telegram prior to KEV registration revealed the following characteristics.

  • Vulnerabilities whose posts contain attack oriented keywords such as “Exploit”, “PoC”, “for sale”, “price”, and “0day” are approximately four times as likely to be mentioned prior to KEV registration as vulnerabilities without such keywords.
    -     It was analyzed that when posts intended for sale or sharing, excluding simple news posts, are detected, they are highly likely to lead to actual exploitation cases.
  • Vulnerabilities whose PoC code is shared via GitHub links are about 0.46 times as likely to be mentioned prior to KEV registration as vulnerabilities without such links.
    -     It suggests that most GitHub link based vulnerabilities shared on the DDW and on Telegram are simply redistributions of code that was already publicly released after being exploited elsewhere.

Therefore, it is necessary to closely monitor vulnerabilities mentioned on the DDW and on Telegram, detect signs of attack early, and take preemptive action.

3. Analysis of exploitation attempts by old vulnerabilities

“Shadowserver,” a company that collects and analyzes data on security incidents and malicious activities occurring on the Internet, provides information on web-based exploit activity detected through its honeypot sensors.

  • This report analyzes CVEs that were actually used in exploits between August 2024 and August 2025.

The CVEs with the highest number of exploit attempts over the past year, as reported by Shadowserver, are as follows.

Table 1. TOP 10 CVEs with the Highest Number of Exploit Attempts in the Past Year

Among web based vulnerabilities with CVE identifiers over the past year, the CVE with the highest number of exploit attempts was CVE-2017–17215, with a total of 787,657 exploit attempts observed.

  • CVE-2017–17215 is a remote code execution vulnerability (Remote Code Execution, RCE) in the Huawei HG532 router, specifically in the SOAP protocol service that operates on port 37215.
  • This vulnerability can be exploited remotely over the network and is particularly severe because it can be used to compromise IoT devices and propagate large scale botnets.

Among the CVEs with the highest number of exploit attempts over the past year, 8 enable arbitrary command execution if exploited, and 2 enable denial of service attacks.

These vulnerabilities can be exploited without authentication or user interaction, and they have low attack complexity, making automated attacks easy to carry out.

It is assessed that these vulnerabilities were used for botnet or ransomware distribution and in campaigns by ransomware gangs, which led to the large number of exploit attempts.

Figure 13. Proportion of Vulnerabilities Registered within 2 Years Before exploitation, Based on Shadowserver

Analysis of vulnerabilities with exploit attempts observed over the past year shows that approximately 67.5% of CVEs were registered more than 2 years before the exploit date, indicating that most attempts targeted older vulnerabilities.

  • As noted earlier, old exploit code continues to be circulated on DDW and Telegram even after vulnerability exploitation, and because PoC code and exploit code remain available, they are easily accessible to threat actors.
  • Even with old vulnerabilities, many assets operated by companies, organizations, or individuals remain unpatched, so threat actors often locate unpatched assets and carry out attacks.
  • For zero-day vulnerabilities or recently disclosed vulnerabilities, the cost to purchase exploit code is high, whereas old vulnerabilities are already known and have proven attack methods, so they offer a higher success rate relative to cost.

Therefore, even publicly disclosed vulnerabilities should be managed for their applicability to relevant assets, and the latest security patches must be applied at all times.

Below are example cases of security incidents caused by the exploitation of old vulnerabilities.

  • In 2025, it was reported that Russian government-sponsored ransomware gangs Static Tundra and Salt Typhoon exploited the CVE-2018–0171 vulnerability in unpatched Cisco equipment.
    - The CVE-2018–0171 vulnerability in Cisco IOS and IOS XE allows a remote threat actor to execute arbitrary commands without authentication, and it was disclosed that the vulnerability was used to gain initial access.
  • In 2025, it was disclosed that Korean financial company A was compromised through the CVE-2017–10271 vulnerability in an unpatched WebLogic Server.
    - The CVE-2017–10271 vulnerability is a deserialization vulnerability in WebLogic Server that allows a remote threat actor to execute arbitrary commands, and it is presumed to have been used to gain initial access.
  • Of the 1,414 vulnerabilities registered in KEV as of September 2025, 630 had disclosure dates at least two years prior to their KEV registration, accounting for about 44.6%, which indicates these vulnerabilities continue to be actively exploited even after disclosure and patching.
Figure 14. Proportion of Vulnerabilities Registered More Than 2 Years Before Exploitation

This demonstrates that threat actors can easily reuse even relatively old vulnerabilities through publicly available exploit code and automated attack tools.

  • Many organizations still have legacy systems and legacy environments that receive low patching priority, making them primary targets for attacks. Furthermore, the exploitation of old vulnerabilities indicates not only past shortcomings in vulnerability management but also that these vulnerabilities can become targets alongside recently disclosed zero-day vulnerabilities.

Therefore, because exploitation of vulnerabilities is continuously observed regardless of disclosure date, this indicates the need to monitor vulnerabilities in legacy systems and apply current security patches.

Conclusion

  • Threat actors active on DDW and Telegram have been observed discussing or sharing information about specific vulnerabilities before those vulnerabilities are registered in the KEV catalog. Therefore, continuous monitoring is necessary to identify new threat intelligence early and to leverage it as a proactive alerting mechanism.
  • Even vulnerabilities disclosed long ago are often exploited on assets neglected in security management, so unused assets should be promptly identified and remediated to minimize the attack surface.
  • Since many attacks target individual users rather than servers, it is important to provide all employees with regular security training and phishing simulation exercises to ensure each employee maintains security awareness.
  • Threat actors gain access by exploiting VPNs and remote access services that connect from outside to the internal network, together with leaked employee credentials; once inside, they can take control of servers and exfiltrate data through privilege escalation vulnerabilities.
    - It is recommended to identify assets related to VPNs and remote access services and enforce access controls so that they can only be accessed from trusted networks.
    - It is recommended to periodically check for leaked employee accounts and to mandate the use of strong password policies along with two factor authentication (2FA/MFA) to mitigate the risk of account compromise.

Detailed Analysis of Recent Trends in Known Exploited Vulnerabilities was originally published in S2W BLOG on Medium, where people are continuing the conversation by highlighting and responding to this story.

Introduction to Malware Binary Triage (IMBT) Course

Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor.

Enroll Now and Save 10%: Coupon Code MWNEWS10

Note: Affiliate link – your enrollment helps support this platform at no extra cost to you.

Article Link: https://medium.com/s2wblog/detailed-analysis-of-recent-trends-in-known-exploited-vulnerabilities-c81678a47f39?source=rss----30a8766b5c42---4