Category hub: Vulnerabilities and exploitation

In one sentence: A weakness is exploited in the wild when attackers are actually using it against real organisations, so it matters far more than one that is only theoretical.

What it is

Thousands of software flaws are published each year. Most are never used in an attack. A flaw is exploited in the wild when there is evidence that real attackers have used it against real targets.

CISA keeps the best known public list. It calls the Known Exploited Vulnerabilities (KEV) catalog the authoritative source of vulnerabilities exploited in the wild. CISA says a flaw is added when it has a CVE ID, there is reliable evidence of active exploitation and there is a clear remediation action, such as a vendor update.

How it works

1. A flaw is found and given a CVE number.
2. A fix, if there is one, is published.
3. Attackers study the fix and write attack code, or use the flaw as a zero-day before any fix exists.
4. Scanning begins and the flaw is used against exposed systems.
5. Researchers, vendors or governments see the attacks and say so. Apache, for example, said CVE-2021-41773 was known to be exploited.
6. The flaw is added to lists such as the KEV catalog.

The CVSS score does not tell you this. It rates how bad a flaw could be, not whether anyone is using it. CISA also says a public proof-of-concept does not by itself mean a flaw has been or will be exploited.

Who it affects and how badly

• Sole trader to 10 staff. Your router, VPN, laptop and website plugins can all have exploited flaws. Updates matter more than tools.
• 10 to 250 staff. Firewalls, VPN gateways, file transfer tools and web servers are typical targets. One unpatched device can lead to ransomware or data theft.
• 250 plus and regulated firms. Banks, insurers, healthcare, councils and telecoms may need to show auditors, insurers and regulators a process for fixing actively exploited flaws.

An older CISA directive (BOD 22-01, since revoked and superseded) cited a study of data back to 2019 finding fewer than 4 per cent of known vulnerabilities have been used in the wild, which is why focusing on the exploited ones makes sense.

Real examples

• CVE-2021-41773, Apache HTTP Server. Apache said the flaw was known to be exploited in the wild soon after publication in October 2021. Rapid7 reported that with a CGI module enabled it allowed remote code execution, and found roughly 65,000 potentially vulnerable servers exposed.
• Heartbleed, CVE-2014-0160. CISA’s US-CERT warned of this OpenSSL flaw in April 2014. Public CVE data sites record it as listed in CISA’s KEV catalog, which shows old flaws stay on the list while unpatched systems remain.

How to detect it

• Compare your asset list and software versions against the KEV catalog regularly.
• Subscribe to vendor security notices for the products you use.
• Treat a vendor note saying exploitation has been observed as an emergency.

How to fix or prevent it

1. Keep an accurate list of the software and devices you run, especially internet-facing ones.
2. Apply the vendor’s update. CISA’s required action is to apply updates per vendor instructions.
3. If there is no update, use the vendor’s mitigation, or stop using the product.
4. Fix exploited flaws before higher-scoring flaws that are not being used.
5. Assess the whole estate at least monthly, as the NCSC advises.
6. Reduce what is exposed: close ports and put admin pages behind a VPN.
7. After patching, check for signs the flaw was used before the fix.
8. Record a decision and owner for anything you cannot fix at once.

Related terms

• CISA KEV
• CVE
• CVSS
• Zero-day
• Vulnerability scanning
• Port 80 (HTTP)

FAQ

What does exploited in the wild mean?
There is reliable evidence that attackers are using the flaw against real targets.

Is a high CVSS score the same as actively exploited?
No. CVSS rates severity. CISA’s catalog tracks flaws with evidence of exploitation.

Where can I check?
CISA’s Known Exploited Vulnerabilities catalog is the public list. Use it as an input to your own prioritising.

Sources

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog/reducing-significant-risk-known-exploited-vulnerabilities
• https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities-revoked
• https://www.rapid7.com/blog/post/2021/10/06/apache-http-server-cve-2021-41773-exploited-in-the-wild/
• https://www.ncsc.gov.uk/collection/vulnerability-management/guidance/carry-out-assessments

How Wolfcore helps

A Wolfcore penetration test finds this the way an attacker would, by hand, not with a scanner. Start with the free web vulnerability scan.