Five critical vulnerabilities still being exploited (and what they teach your SME)

Thousands of new vulnerabilities are published every year, but the most serious incidents rarely come from a freshly discovered flaw: they come from known flaws that have gone unpatched for months —or years. CISA’s Known Exploited Vulnerabilities (KEV) catalogue keeps a public list that never stops growing, and many of its entries are already several years old.

These five vulnerabilities drove mass data theft and extortion campaigns. None of them requires you to be a “big” target: attackers look for any internet-facing, unpatched system. These are the stories and what they teach.

1. Log4Shell (CVE-2021-44228): the dependency nobody knew they had

In December 2021, a critical vulnerability (CVSS 10) was disclosed in Log4j 2, a logging library used by millions of Java applications worldwide. The flaw let an attacker execute code on the server by sending a specially crafted string to any field that ended up in a log.

The added problem was uncertainty: many organisations discovered then that they used Log4j indirectly, through other tools. The vulnerability entered the KEV catalogue the same day it was published.

• Lesson: you cannot patch what you do not know about. Keep an inventory of your software and its dependencies, even if it is just a spreadsheet.
• What to do: update libraries and frameworks regularly; make dependency patching a scheduled task instead of something you do “when something happens”.

2. MOVEit Transfer (CVE-2023-34362): file sharing as a priority target

MOVEit Transfer is the software many businesses use to exchange files with clients and suppliers. In May 2023, a critical SQL injection (CVSS 9.8) was found: it allowed an unauthenticated attacker to reach its database. The Cl0p extortion group exploited it at scale: thousands of organisations had data stolen, with no need to encrypt anything.

• Lesson: the services you share with third parties (file transfer, portals, APIs) are high-value targets. If they are exposed to the internet, urgent patching is not optional.
• What to do: patch these systems within hours, not weeks; limit which addresses can connect; and ask yourself whether the service needs to be internet-facing or can sit behind a VPN.

3. Citrix Bleed (CVE-2023-4966): MFA does not always save you

In October 2023, a sensitive information disclosure was revealed in Citrix NetScaler ADC and NetScaler Gateway (CVSS 9.4 per Citrix) when used as a VPN. The flaw allowed attackers to steal valid session tokens and, with them, hijack already-authenticated sessions: the user’s MFA stopped being a barrier because the session had “already passed” MFA.

The vulnerability was exploited in ransomware campaigns, and CISA stressed a key point: after patching, you must invalidate all active and persistent sessions, because stolen tokens remain valid.

• Lesson: patching is not always enough. After an incident on an access system (VPN, SSO, admin panels), revoke sessions and tokens.
• What to do: audit access to your entry systems; when in doubt, force all users to log out and re-authenticate.

4. ScreenConnect (CVE-2024-1709): your admin tools are a door too

In February 2024, an authentication bypass (CVSS 10) was published for ConnectWise ScreenConnect, a remote support tool. The flaw allowed attackers to create administrator accounts on vulnerable installations, and it was exploited in ransomware campaigns against businesses managing their remote support with it.

• Lesson: the tools you use to manage your machines (remote support, RMM, virtualisation panels) are worth their weight in gold to an attacker: they control many systems at once.
• What to do: treat them as critical systems: immediate updates, MFA at the provider, restricted access and auditing of support sessions.

5. The XZ Utils backdoor (CVE-2024-3094): when the danger comes from the supply chain

In March 2024, a Microsoft engineer accidentally discovered a backdoor in xz/liblzma 5.6.0 and 5.6.1 (CVSS 10): malicious code inserted into the build process that could interfere with SSH authentication on affected systems. It had reached testing distributions (such as Debian unstable or Fedora rawhide), not stable releases, and disaster was narrowly avoided.

The most disturbing part was the method: a months-long campaign to gain the maintainer’s trust, with pressure and fake accounts, to slip in seemingly innocent changes. It was not a bug: it was sabotage in the supply chain.

• Lesson: you depend on code you did not write. Trust in a project must be paired with controls.
• What to do: use stable versions and official repositories; review what you update and from where; keep a dependency inventory; and update in a controlled way, not chaotically.

Five lessons for your SME

1. Inventory first: you cannot protect —or patch— what you do not know you have. Start by identifying which of your services are visible from the internet.
2. Patch by priority: internet-facing and critical systems first. A reasonable target is resolving critical issues within 72 hours.
3. MFA yes, sessions too: enable MFA wherever you can and revoke sessions whenever you touch access systems.
4. Shrink the surface: do not expose admin panels, remote support or file services to the internet if they can sit behind a VPN or allow-lists.
5. Monitor and have a plan: log access, watch for anomalies (new IPs, bulk downloads) and know who you call when something happens.

If you want to know how your business looks from the outside before an attacker does, start with our free OSINT audit: we analyse your public exposure and deliver a report within 72 hours. And for flaws that can only be seen from the inside, we run penetration tests that are controlled and authorised in writing.

Sources: NVD — CVE-2021-44228, NVD — CVE-2023-34362, NVD — CVE-2023-4966, NVD — CVE-2024-1709, NVD — CVE-2024-3094 and CISA’s KEV catalogue.