NSA, FBI warning: Beware these 20 software flaws most used by hackers

Image: Getty/Deagreez

The National Security Agency (NSA), Cybersecurity and Infrastructure Security Agency (CISA) and Federal Bureau of Investigation (FBI) have listed the top 20 software flaws that China-funded hackers have been using to compromise networks since 2020. 

The advisory emphasizes that China-backed hackers actively target not just the networks of the US government and its allies but also software and hardware companies in the supply chain to steal intellectual property and gain access to sensitive networks. These hackers are an active threat to the IT and telecoms sector, the defense industrial base, and critical infrastructure owners and operators. 

“NSA, CISA, and FBI continue to assess [People’s Republic of China] PRC state-sponsored cyber activities as being one of the largest and most dynamic threats to U.S. government and civilian networks,” they note. 

Also: White House warns: Do these 8 things now to boost your security ahead of potential Russian cyberattacks

CISA this week disclosed that several state-backed hacking groups were active on defense industrial base enterprise networks after gaining access through their Microsoft Exchange Server infrastructure from around mid-January 2021. Exchange Server is now under attack by newly discovered flaws similar to last year’s ProxyShell.

Among the top 20 flaws used by China-backed hackers are four Microsoft Exchange Server flaws: CVE-2021-26855, a remote code execution bug, as well CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065. These are all part of the the Exchange Server ProxyLogon pre-authentication vulnerabilities disclosed in 2021.   

Microsoft in July warned these bugs were being used in combination with malware tailored for networks using Microsoft’s Internet Information Services (IIS) web server to host Outlook on the web. 

Other commonly used flaws include those in Apache Log4Shell, and flaws in code-hosting site GitLab, F5’s network gear, VPN endpoints, and popular server products from VMware, Cisco, and Citrix. 

All the bugs are publicly known and present a risk for organizations that haven’t applied available firmware and software updates. 

The GitLab and Atlassian Confluence bugs stand out as examples of hackers targeting developer and IT operations tools.   

“These state-sponsored actors continue to use virtual private networks (VPNs) to obfuscate their activities and target web-facing applications to establish initial access,” CISA notes. 

Many of the top 20 vulnerabilities “allow the actors to surreptitiously gain unauthorized access into sensitive networks, after which they seek to establish persistence and move laterally to other internally connected networks,” it added. 

The agencies recommend patching systems, using multi-factor authentication, disabling unused protocols at the network edge, ditching end-of-life devices, adopting a model that trusts no person, device or app, and enabling logging of internet-facing systems.  

The top flaws used since 2020 are listed in the table below.



Vulnerability Type

Apache Log4j


Remote Code Execution

Pulse Connect Secure


Arbitrary File Read

GitLab CE/EE


Remote Code Execution



Remote Code Execution

Microsoft Exchange


Remote Code Execution

F5 Big-IP


Remote Code Execution

VMware vCenter Server


Arbitrary File Upload 

Citrix ADC


Path Traversal

Cisco Hyperflex


Command Line Execution

Buffalo WSR


Relative Path Traversal

Atlassian Confluence Server and Data Center


Remote Code Execution

Hikvision Webserver


Command Injection

Sitecore XP


Remote Code Execution

F5 Big-IP


Remote Code Execution



Authentication Bypass by Spoofing



Remote Code Execution



Remote Code Execution



Remote Code Execution



Remote Code Execution

Apache HTTP Server


Path Traversal

Source: Information Technologies -

Study finds the risks of sharing health care data are low

Facebook users warned: You may have downloaded these password-stealing Android and iOS apps