CVEs Surge By 25% in 2022 to Another Record High

The number of new vulnerabilities reported by the US federal government in 2022 increased by a quarter on a yearly basis to strike 25,096, a new all-time higher, according to data compiled by Skybox Security.

The security vendor analyzed the Nationwide Vulnerability Databases (NVD) to compile its Vulnerability and Threat Tendencies Report 2023.

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

The results signify that 2022 was the sixth year in a row that the quantity of recently found vulnerabilities strike an all-time significant. Skybox Security claimed the latest raise was the most important due to the fact 2017, with the amount of CVEs revealed about the previous 10 years standing at more than 192,000.

Read through much more on vulnerabilities: Google: History 12 months for Zero Days in 2021.

Some 80% of CVEs documented in 2022 ended up both medium or superior severity, with 16% considered critical.

Though the share of critical bugs dropped from 20% last year, Skybox Security argued that severity does not equal risk, with destructive actors frequently exploiting much less critical vulnerabilities for distant code execution (RCE), privilege escalation and far more.

Risk assessments should therefore be continually run to prioritize patching, based not just on the severity of a CVE but also its exploitability, exposure, asset significance and business enterprise affect, the report observed.

“The composing is on the wall. Common reactive strategies to cybersecurity – waiting until eventually  vulnerabilities are described and then scrambling to scan and patch just about every instance – are a lot more outmoded by the day,” warned Skybox CEO, Mordecai Rosen.

“There are considerably as well a lot of vulnerabilities, it requires much too extensive to come across them and near them, and numerous are unpatchable in any scenario. Understaffed cybersecurity organizations just can’t continue to keep up.”

Perhaps unsurprisingly, the top rated CVE focused by new malware final yr was the Log4j bug, CVE-2021-44228, which was really published at the conclusion of December 2021. 2nd and third spot went to Atlassian Confluence RCE vulnerability, CVE-2022-26134, and the “Follina” RCE flaw in the Microsoft Windows Assist Diagnostic Device (MSDT), CVE-2022-30190.

Of recently identified malware systems in 2022 exploiting regarded vulnerabilities, the backdoor category was the most prolific, according to the report.