CISA: 2021 top 15 routinely exploited vulnerabilities
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
CISA and allies identify 15 CVEs actively exploited in 2021, led by Log4Shell, ProxyLogon, and ProxyShell targeting internet-facing systems.
This joint advisory from CISA, NSA, FBI, and international cybersecurity authorities documents the 15 most routinely exploited vulnerabilities observed in 2021, along with additional frequently targeted CVEs. The advisory emphasizes that malicious actors aggressively targeted newly disclosed critical vulnerabilities against broad target sets worldwide, with proof-of-concept code released within two weeks of disclosure in most cases, enabling rapid weaponization by a broader range of attackers.
Key findings show internet-facing systems—particularly email servers and VPN appliances—were primary targets. Log4Shell (CVE-2021-44228) in Apache Log4j became one of the most rapidly exploited vulnerabilities after its December 2021 disclosure, affecting thousands of products globally. Microsoft Exchange vulnerabilities (ProxyLogon: CVE-2021-26855, CVE-2021-26858, CVE-2021-26857, CVE-2021-27065; and ProxyShell: CVE-2021-34523, CVE-2021-34473, CVE-2021-31207) enabled unauthenticated remote code execution and persistent access to mailboxes and credentials. Atlassian Confluence vulnerability CVE-2021-26084 saw mass exploitation attempts after POC release.
The advisory also documents continued exploitation of older vulnerabilities, indicating organizations fail to patch in a timely manner or run unsupported software. Recommendations include rapid patching prioritization, centralized patch management, MFA enforcement, network segmentation, and continuous monitoring via EDR and SIEM tools.
Mentioned in this report
Detection guidance
Exchange IIS Worker Process Spawning Command Shell
Detects the Exchange application pool worker process (w3wp.exe) spawning cmd.exe or PowerShell, a pattern seen after ProxyLogon/ProxyShell exploitation and webshell use. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Exchange IIS Worker Process Spawning Command Shell
id: e1e384d1-c2ef-5c1a-b488-00d988e9ba80
status: experimental
description: Detects w3wp.exe running an Exchange application pool (OWA, ECP, Autodiscover
and others) spawning cmd.exe, PowerShell or similar interpreters. This matches post-exploitation
of ProxyLogon/ProxyShell (CVE-2021-26855, CVE-2021-34473 and related) and webshell
command execution.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059.003
- attack.t1059.001
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \w3wp.exe
ParentCommandLine|contains: MSExchange
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
condition: selection
falsepositives:
- Rare Exchange diagnostic or health scripts launched from an application pool by
administrators
- Third-party Exchange add-ons that shell out from IIS
level: high
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-117a
Confluence Java Process Spawning Windows Shell
Detects the Atlassian Confluence Java process spawning cmd.exe or PowerShell, consistent with OGNL injection RCE (CVE-2021-26084) exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Confluence Java Process Spawning Windows Shell
id: b091786c-09e5-569a-9aa0-f9a02b3a6ab0
status: experimental
description: Detects a Java process running Atlassian Confluence that spawns cmd.exe,
PowerShell or other interpreters. This is typical of OGNL injection RCE exploitation
such as CVE-2021-26084 against internet-facing Confluence servers.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059.003
- attack.t1059.001
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \java.exe
- \tomcat9.exe
- \tomcat8.exe
ParentCommandLine|contains: confluence
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \certutil.exe
- \bitsadmin.exe
condition: selection
falsepositives:
- Confluence plugins or admin maintenance scripts that legitimately invoke cmd.exe
- Backup or upgrade routines launched from the Confluence service
level: high
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-117a
Log4Shell JNDI Lookup String in Web Request
Detects JNDI lookup injection strings (including common obfuscations and URL-encoded forms) in web request URIs or user agents, as used in Log4Shell (CVE-2021-44228) exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Log4Shell JNDI Lookup String in Web Request
id: 29bcc467-6f15-507d-bceb-ef6635436982
status: experimental
description: Detects Log4Shell (CVE-2021-44228) exploitation attempts in web server
logs. It looks for jndi lookup syntax, including nested-lookup obfuscation and URL-encoded
variants, in the URI query, URI stem or User-Agent. A match indicates an attempt,
not a confirmed compromise.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: webserver
detection:
selection_uri:
cs-uri-query|contains:
- '${jndi:'
- ${${lower:j}
- ${${upper:j}
- ${${::-j}
- '%24%7Bjndi'
- '%24%7B%24%7B'
selection_stem:
cs-uri-stem|contains:
- '${jndi:'
- '%24%7Bjndi'
selection_ua:
cs-user-agent|contains:
- '${jndi:'
- ${${lower:j}
- ${${::-j}
- '%24%7Bjndi'
condition: 1 of selection_*
falsepositives:
- Vulnerability scanners and red team exercises sending JNDI test payloads
- Security researchers' honeypot traffic logged on internal web servers
level: high
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-117a
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-117a
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs